CN111126468A - Feature dimension reduction method and device and anomaly detection method and device in cloud computing environment - Google Patents

Feature dimension reduction method and device and anomaly detection method and device in cloud computing environment Download PDF

Info

Publication number
CN111126468A
CN111126468A CN201911301125.7A CN201911301125A CN111126468A CN 111126468 A CN111126468 A CN 111126468A CN 201911301125 A CN201911301125 A CN 201911301125A CN 111126468 A CN111126468 A CN 111126468A
Authority
CN
China
Prior art keywords
layer
network
encoder
cae
depth
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201911301125.7A
Other languages
Chinese (zh)
Other versions
CN111126468B (en
Inventor
杜学绘
王文娟
陈性元
杨智
秦若熙
曹利峰
单棣斌
孙奕
任志宇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Information Engineering University of PLA Strategic Support Force
Original Assignee
Information Engineering University of PLA Strategic Support Force
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Information Engineering University of PLA Strategic Support Force filed Critical Information Engineering University of PLA Strategic Support Force
Priority to CN201911301125.7A priority Critical patent/CN111126468B/en
Publication of CN111126468A publication Critical patent/CN111126468A/en
Application granted granted Critical
Publication of CN111126468B publication Critical patent/CN111126468B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/213—Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Image Analysis (AREA)

Abstract

The application provides a feature dimension reduction method, an anomaly detection method and an anomaly detection device in a cloud computing environment, wherein the feature dimension reduction method in the cloud computing environment comprises the following steps: acquiring network data in a cloud computing environment, and extracting network features from the network data; and inputting the network characteristics into a depth shrinkage self-encoder trained in advance to obtain the characteristics output by the depth shrinkage self-encoder, wherein the dimensionality of the characteristics output by the depth shrinkage self-encoder is lower than that of the network characteristics. In the application, the security detection capability of the cloud computing environment can be improved through the method.

Description

Feature dimension reduction method and device and anomaly detection method and device in cloud computing environment
Technical Field
The application relates to the technical field of cloud computing, in particular to a feature dimension reduction method, an abnormality detection method and an abnormality detection device in a cloud computing environment.
Background
Although the open sharing characteristic of the cloud computing environment brings convenience to users, the cloud computing environment is more easily attacked by network malicious behaviors, and the health sustainable development of cloud computing is seriously affected, so that the security detection capability of the cloud computing environment is improved, and the establishment of the cloud computing environment capable of monitoring and tracing becomes one of the primary problems to be faced in promoting the development of cloud computing landfills.
However, how to improve the security detection capability of the cloud computing environment becomes a problem.
Disclosure of Invention
In order to solve the above technical problems, embodiments of the present application provide a feature dimension reduction method, an anomaly detection method, and an anomaly detection device in a cloud computing environment, so as to achieve the purpose of improving the security detection capability of the cloud computing environment, and the technical scheme is as follows:
a feature dimension reduction method in a cloud computing environment comprises the following steps:
acquiring network data under a cloud computing environment, and extracting network features from the network data;
inputting the network features into a depth contraction self-encoder trained in advance to obtain features output by the depth contraction self-encoder, wherein the dimensionality of the features output by the depth contraction self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
Preferably, the training process of the depth-shrinkage self-encoder includes:
inputting sample characteristics in first training sample data into an input layer in a k-th layer CAE network in the depth shrinkage self-encoder, and training the k-th layer CAE network in the depth shrinkage self-encoder until errors between decoding results obtained by an output layer in the k-th layer CAE network and the sample characteristics in the first training sample data received by the input layer in the k-th layer CAE network are within a set range;
wherein, the value range of k is 1-n, k is an integer, n is the number of layers of the CAE network included in the deep scalable self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 th-layer CAE network;
an input layer in the k-th CAE network outputs the sample characteristics in the first training sample data to a hidden layer in the k-th CAE network, the hidden layer in the k-th CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, and outputs the features after dimension reduction to an output layer in the k-th CAE network, and the output layer in the k-th CAE network decodes the features after dimension reduction to obtain a decoding result;
judging whether k is smaller than n;
if not, under the condition that unused training sample data exists in the unlabeled training data set, selecting one unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step of inputting the sample characteristics in the first training sample data into an input layer in a k-th CAE network in the deep-contraction self-encoder;
ending training of the depth-systolic auto-encoder if unused training sample data does not exist in the unlabeled training dataset;
if yes, taking an output result of a hidden layer in the trained k-th CAE network as a sample feature in the first training sample data, updating k to k +1, and executing the step of inputting the sample feature in the first training sample data into an input layer in the k-th CAE network in the deep-contraction self-encoder.
Preferably, the training of the k-th layer CAE network in the depth-shrinkage self-encoder includes:
using a pair-target learning function
Figure BDA0002321815700000031
A minimization mode, training a k-th layer CAE network in the depth contraction self-encoder, wherein JCAEThe value of the objective learning function is expressed,
Figure BDA0002321815700000032
representing a summation function, X(i)Representing the ith training sample data, Z, in said unlabeled training data set(i)Representing a decoding result obtained by an output layer in a k-th layer CAE network in the depth-punctured self-encoder corresponding to the ith training sample data,
Figure BDA0002321815700000033
representing the reconstruction error, Jf(X(i)) A Jacobian matrix representing the ith training sample data,
Figure BDA0002321815700000034
representing the F-norm of the jacobian matrix, λ represents a penalty parameter,
Figure BDA0002321815700000035
a contraction penalty item is represented, n represents the number of training sample data in the unlabeled training data set, i is not largeAn integer in n.
Preferably, the training process of the depth-shrinkage self-encoder further includes:
selecting one unused training sample data from the labeled training data set;
extracting features from the unused training sample data as labeled training features;
inputting the training features with labels into the depth-shrinkage self-encoder to obtain features output by the depth-shrinkage self-encoder;
inputting the features output by the depth shrinkage self-encoder into a classifier to obtain the class output by the classifier, wherein the class is used as the class of the features output by the depth shrinkage self-encoder;
computing cross entropy of the classes of features output by the depth-systolic self-encoder and the classes of the labeled training features;
taking the cross entropy as a loss function result;
and respectively transmitting the loss function result to each layer of CAE network in the depth shrinkage self-encoder according to the sequence from the input layer in the (k + 1) th layer of CAE network in the depth shrinkage self-encoder to the hidden layer in the k-th layer of CAE network and from the hidden layer in each layer of CAE network to the input layer, updating the parameters of each layer of CAE network in the depth shrinkage self-encoder, and returning to the step of selecting unused training sample data from the training data set with the label until the cross entropy is converged.
An anomaly detection method in a cloud computing environment comprises the following steps:
acquiring network data under a cloud computing environment, and extracting network features from the network data;
inputting the network features into a depth contraction self-encoder trained in advance to obtain features output by the depth contraction self-encoder, wherein the dimensionality of the features output by the depth contraction self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network;
inputting the features output by the depth shrinkage self-encoder into a pre-trained SVM classifier to obtain the class output by the SVM classifier.
Preferably, the training process of the SVM classifier includes:
obtaining features of the depth-shrunk self-encoder output;
and training the SVM classifier by using the acquired features and the marks corresponding to the acquired features.
A feature dimension reduction apparatus in a cloud computing environment, comprising:
the system comprises a first extraction module, a second extraction module and a third extraction module, wherein the first extraction module is used for acquiring network data in a cloud computing environment and extracting network features from the network data;
the first dimension reduction module is used for inputting the network features into a depth shrinkage self-encoder trained in advance to obtain the features output by the depth shrinkage self-encoder, and the dimension of the features output by the depth shrinkage self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
Preferably, the apparatus further comprises: a depth-systolic self-coder training module to:
inputting sample characteristics in first training sample data into an input layer in a k-th layer CAE network in the depth shrinkage self-encoder, and training the k-th layer CAE network in the depth shrinkage self-encoder until errors between decoding results obtained by an output layer in the k-th layer CAE network and the sample characteristics in the first training sample data received by the input layer in the k-th layer CAE network are within a set range;
wherein, the value range of k is 1-n, k is an integer, n is the number of layers of the CAE network included in the deep scalable self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 th-layer CAE network;
an input layer in the k-th CAE network outputs the sample characteristics in the first training sample data to a hidden layer in the k-th CAE network, the hidden layer in the k-th CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, and outputs the features after dimension reduction to an output layer in the k-th CAE network, and the output layer in the k-th CAE network decodes the features after dimension reduction to obtain a decoding result;
judging whether k is smaller than n;
if not, under the condition that unused training sample data exists in the unlabeled training data set, selecting one unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step of inputting the sample characteristics in the first training sample data into an input layer in a k-th CAE network in the deep-contraction self-encoder;
ending training of the depth-systolic auto-encoder if unused training sample data does not exist in the unlabeled training dataset;
if yes, taking an output result of a hidden layer in the trained k-th CAE network as a sample feature in the first training sample data, updating k to k +1, and executing the step of inputting the sample feature in the first training sample data into an input layer in the k-th CAE network in the deep-contraction self-encoder.
Preferably, the depth-systolic self-coder training module is specifically configured to:
using a pair-target learning function
Figure BDA0002321815700000051
A minimization mode, training a k-th layer CAE network in the depth contraction self-encoder, wherein JCAEThe value of the objective learning function is expressed,
Figure BDA0002321815700000061
representing a summation function, X(i)Representing the ith training sample data, Z, in said unlabeled training data set(i)Representing a decoding result obtained by an output layer in a k-th layer CAE network in the depth-punctured self-encoder corresponding to the ith training sample data,
Figure BDA0002321815700000062
representing the reconstruction error, Jf(X(i)) A Jacobian matrix representing the ith training sample data,
Figure BDA0002321815700000063
representing the F-norm of the jacobian matrix, λ represents a penalty parameter,
Figure BDA0002321815700000064
and representing a contraction penalty item, wherein n represents the number of training sample data in the unlabeled training data set, and i is an integer not greater than n.
An abnormality detection apparatus in a cloud environment, comprising:
the second extraction module is used for acquiring network data in a cloud computing environment and extracting network features from the network data;
the second dimension reduction module is used for inputting the network features into a depth shrinkage self-encoder trained in advance to obtain the features output by the depth shrinkage self-encoder, and the dimension of the features output by the depth shrinkage self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network;
and the first classification module is used for inputting the features output by the depth shrinkage self-encoder into a pre-trained SVM classifier to obtain the class output by the SVM classifier.
Compared with the prior art, the beneficial effect of this application is:
in the application, the deep shrinkage self-coding network comprising the multilayer CAE network is used for feature extraction, deeper, more excellent and more robust features can be extracted from the network data in the cloud computing environment, and favorable conditions are provided for the identification of abnormal data in the later period, so that the safety detection capability of the cloud computing environment is improved.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for a person skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a flowchart of an embodiment 1 of a feature dimension reduction method in a cloud computing environment according to the present application;
FIG. 2 is a flow chart of training of a depth-punctured self-encoder provided herein;
FIG. 3 is a schematic diagram of a network structure of a depth-punctured self-encoder provided in the present application;
FIG. 4 is a flow chart of training of another depth-punctured self-encoder provided herein;
FIG. 5 is a flow chart of training of yet another depth-punctured self-encoder provided for the present application;
FIG. 6 is a flow chart of an anomaly detection method in a cloud computing environment provided by the present application;
fig. 7 is a schematic logical structure diagram of a feature dimension reduction apparatus in a cloud computing environment according to the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The embodiment of the application discloses a feature dimension reduction method in a cloud computing environment, which comprises the following steps: acquiring network data under a cloud computing environment, and extracting network features from the network data; inputting the network characteristics into a depth shrinkage self-encoder trained in advance to obtain characteristics output by the depth shrinkage self-encoder, wherein the dimensionality of the characteristics output by the depth shrinkage self-encoder is lower than that of the network characteristics; the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network. In the application, the security detection capability of the cloud computing environment can be improved.
Next, describing a feature dimension reduction method in a cloud computing environment disclosed in an embodiment of the present application, as shown in fig. 1, a flowchart of an embodiment 1 of the feature dimension reduction method in the cloud computing environment provided by the present application may include the following steps:
and step S11, acquiring network data in the cloud computing environment, and extracting network features from the network data.
And step S12, inputting the network characteristics into a depth-shrinkage self-encoder trained in advance to obtain the characteristics output by the depth-shrinkage self-encoder, wherein the dimension of the characteristics output by the depth-shrinkage self-encoder is lower than that of the network characteristics.
Since there may be a large number of useless redundant features in the network features extracted from the network data, it is necessary to perform dimension reduction on the network features extracted from the network data to screen out useful features. The depth-shrinking self-encoder can be realized by the following structure:
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
In this embodiment, the hidden layer is used to perform dimension reduction on the features output by the input layer.
It should be noted that each layer of CAE network includes an output layer in addition to an input layer and a hidden layer, but when performing dimension reduction on network features, the output layer may not participate in calculation, so that the description of the output layer is omitted in this embodiment, and the detailed description of the output layer is described in the following training process of the depth-shrinkage self-encoder.
It can be understood that, an input layer in a first-layer CAE network of the depth-shrinking auto-encoder is used as an input end of the depth-shrinking auto-encoder, a hidden layer in a last-layer CAE network is used as an output end of the depth-shrinking sub-encoder, and an output of a hidden layer in each layer of CAE network before the last-layer CAE network is used as an input of an input layer in a next-layer CAE network, so that after network features are input into the depth-shrinking auto-encoder, the hidden layer in each layer of CAE network in the depth-shrinking auto-encoder can perform dimension reduction on the features after the dimension reduction of the hidden layer in the previous-layer CAE network, so as to obtain features with lower dimensions.
The feature that guarantees the lower dimensionality of the output of the depth-shrinkage self-encoder is a useful feature and is realized through training of the depth-shrinkage self-encoder.
Referring to fig. 2, a training process of a depth-shrinkage self-encoder provided by the present application is shown, which may include the following steps:
step S21, inputting the sample feature in the first training sample data into an input layer in a k-th CAE network in the depth-shrinkage self-encoder, and training the k-th CAE network in the depth-shrinkage self-encoder until an error between a decoding result obtained by an output layer in the k-th CAE network and the sample feature in the first training sample data received by the input layer in the k-th CAE network is within a set range.
In this embodiment, each layer of CAE network in the depth-shrinking auto-encoder includes: an input layer, a hidden layer and an output layer. As shown in fig. 3, the process from the input layer to the hidden layer may be referred to as encoding, and the process from the hidden layer to the output layer may be referred to as decoding. It is to be understood that the process of encoding may be understood as a dimension reduction process and the process of decoding may be understood as a reconstruction process. The dimension of the features decoded by the output layer is the same as that received by the input layer, and the dimension of the features output by the hidden layer is lower than that received by the input layer. The features decoded by the output layer can be used to compare with the features received by the input layer to verify the validity of the features output by the hidden layer and to adjust the parameters of the depth-punctured self-encoder.
In this embodiment, the sample feature in the first training sample data is input to the input layer in the k-th CAE network in the deep-shrinkage self-encoder, and the k-th CAE network in the deep-shrinkage self-encoder is trained until the error between the decoding result obtained by the output layer in the k-th CAE network and the sample feature in the first training sample data received by the input layer in the k-th CAE network is within a set range, so that the validity of the feature with a lower dimension output by the hidden layer in the k-th CAE network is ensured to be higher.
Wherein, the value range of k is 1-n, k is an integer, n is the number of layers of the CAE network included in the deep scalable self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 th-layer CAE network;
and the input layer in the k-th CAE network outputs the sample characteristics in the first training sample data to the hidden layer in the k-th CAE network, the hidden layer in the k-th CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, the features after dimension reduction are output to the output layer in the k-th CAE network, and the output layer in the k-th CAE network decodes the features after dimension reduction to obtain a decoding result.
And step S22, judging whether k is less than n.
If not, go to step S23; if yes, go to step S26.
And step S23, judging whether the unlabeled training data set has unused training sample data.
If yes, go to step S24; if not, step S25 is executed.
Step S24, selecting an unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step S21;
and step S25, finishing the training of the depth-shrinkage self-encoder.
Step S26, taking the output result of the trained hidden layer in the k-th CAE network as the sample feature in the first training sample data, updating k to k +1, and executing step S21.
Steps S21-S26 enable training of a depth-punctured self-encoder with an unlabeled training data set.
As another alternative embodiment of the present application, the training process of the depth-shrinkage self-encoder in embodiment 1 is detailed, and referring to fig. 4, the training process of the depth-shrinkage self-encoder may include, but is not limited to, the following steps:
step S31, inputting the sample characteristics in the first training sample data into the input layer in the k-th layer CAE network in the depth-shrinkage self-encoder, and utilizing the target learning function
Figure RE-GDA0002433228690000101
And in a minimization mode, training a k-th layer CAE network in the deep shrinkage self-encoder until the error between a decoding result obtained by an output layer in the k-th layer CAE network and the sample feature in the first training sample data received by an input layer in the k-th layer CAE network is within a set range.
Wherein, the J isCAEThe value of the target learning function is represented,
Figure BDA0002321815700000111
representing a summation function, X(i)Representing the ith training sample data, Z, in said unlabeled training data set(i)Representing a decoding result obtained by an output layer in a k-th layer CAE network in the depth-punctured self-encoder corresponding to the ith training sample data,
Figure BDA0002321815700000112
denotes reconstruction error, Jf(X(i)) A Jacobian matrix representing the ith training sample data,
Figure BDA0002321815700000113
representing the Jacobian matrixIs given by F-norm, λ represents a penalty parameter,
Figure BDA0002321815700000114
and representing a contraction penalty item, wherein n represents the number of training sample data in the unlabeled training data set, and i is an integer not greater than n.
Wherein, X(i)May be a d-dimensional vector, respectively, Z(i)Is a d 'dimensional vector, and d' < d.
It can be understood that the smaller the reconstruction error, the better the performance of the CAE network in extracting valid information from the input features, and the smaller the shrinkage penalty, the better the performance of the CAE network in suppressing or discarding useless information. The shrinkage penalty term contained in the target learning function can ensure that excellent robustness can be shown when the input features have certain disturbance, namely, the feature representation has invariance to the small disturbance of the input features.
The value range of k is 1-n, k is an integer, n is the number of layers of a CAE network included in the deep-contraction self-encoder, the first training sample data is an unused training sample data selected from an unlabeled training data set under the condition that k is 1, and the first training sample data is an output result of a hidden layer in a trained k-1 th-layer CAE network under the condition that k is not 1.
And the input layer in the k-th CAE network outputs the sample characteristics in the first training sample data to the hidden layer in the k-th CAE network, the hidden layer in the k-th CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, the features after dimension reduction are output to the output layer in the k-th CAE network, and the output layer in the k-th CAE network decodes the features after dimension reduction to obtain a decoding result.
Step S31 is a specific implementation manner of step S21 in example 1.
And step S32, judging whether k is less than n.
If not, go to step S33; if yes, go to step S36.
And step S33, judging whether the unlabeled training data set has unused training sample data.
If yes, go to step S34; if not, step S35 is executed.
Step S34, selecting an unused training sample data from the unlabeled training data set, updating the first training sample data, and performing the step S31.
The detailed procedures of steps S31-S34 can be found in the related descriptions of steps S21-S24 in embodiment 1, and are not repeated herein.
And step S35, finishing the training of the depth-shrinkage self-encoder.
Step S36, taking the output result of the trained hidden layer in the k-th CAE network as the sample feature in the first training sample data, updating k to k +1, and executing step S31.
Step S36 is the same as step S26 in embodiment 1, and is not repeated here.
As another alternative embodiment of the present application, the training process of the depth-punctured self-encoder in embodiment 1 is extended, and referring to fig. 5, the training process of another depth-punctured self-encoder provided for the present application may include, but is not limited to, the following steps:
step S41, inputting the sample feature in the first training sample data into an input layer in a k-th CAE network in the depth-shrinkage self-encoder, and training the k-th CAE network in the depth-shrinkage self-encoder until an error between a decoding result obtained by an output layer in the k-th CAE network and the sample feature in the first training sample data received by the input layer in the k-th CAE network is within a set range.
In this embodiment, the sample feature in the first training sample data is input to the input layer in the k-th CAE network in the deep-shrinkage self-encoder, and the k-th CAE network in the deep-shrinkage self-encoder is trained until the error between the decoding result obtained by the output layer in the k-th CAE network and the sample feature in the first training sample data received by the input layer in the k-th CAE network is within a set range, so that the validity of the feature with a lower dimension output by the hidden layer in the k-th CAE network is ensured to be higher.
Wherein, the value range of k is 1-n, k is an integer, n is the number of layers of the CAE network included in the deep scalable self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 th-layer CAE network;
and the input layer in the k-th CAE network outputs the sample characteristics in the first training sample data to the hidden layer in the k-th CAE network, the hidden layer in the k-th CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, the features after dimension reduction are output to the output layer in the k-th CAE network, and the output layer in the k-th CAE network decodes the features after dimension reduction to obtain a decoding result.
And step S42, judging whether k is less than n.
If not, go to step S43; if yes, go to step S46.
And step S43, judging whether the unlabeled training data set has unused training sample data.
If yes, go to step S44; if not, step S45 is executed.
Step S44, selecting an unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step S41;
and step S45, finishing the training of the depth-shrinkage self-encoder.
Step S46, taking the output result of the trained hidden layer in the k-th CAE network as the sample feature in the first training sample data, updating k to k +1, and executing step S41.
And step S47, adjusting the parameters of each layer of CAE network in the trained depth-shrinkage self-encoder by using the training data set with the label and a back propagation algorithm until the adjusted parameters of each layer of CAE network in the depth-shrinkage self-encoder reach the set requirements.
The step realizes the adjustment of the parameters of each layer of CAE network in the trained deep-contraction self-encoder.
The method for adjusting the parameters of each layer of CAE network in the trained deep-scaling auto-encoder by using the labeled training data set and the back propagation algorithm until the adjusted parameters of each layer of CAE network in the deep-scaling auto-encoder meet the set requirements may include the following steps:
s471, selecting one unused training sample data from the training data set with the label.
S472, extracting features from the unused training sample data as labeled training features.
S473, inputting the labeled training features into the depth-shrinking self-encoder to obtain features output by the depth-shrinking self-encoder.
S474, calculating the cross entropy of the class of the feature output by the depth contraction self-encoder and the class of the marked training feature.
And S475, taking the cross entropy as a loss function result.
S476, according to the sequence from the input layer in the k +1 th layer CAE network to the hidden layer in the k layer CAE network in the depth shrinkage self-encoder and from the hidden layer in each layer CAE network to the input layer, respectively transferring the loss function result to each layer CAE network in the depth shrinkage self-encoder, updating the parameters of each layer CAE network in the depth shrinkage self-encoder, and returning to the step S471 until the cross entropy is converged.
In another embodiment of the present application, a method for detecting an anomaly in a cloud computing environment is introduced, and referring to fig. 6, the method may include the following steps:
and step S51, acquiring network data in the cloud computing environment, and extracting network features from the network data.
And step S52, inputting the network characteristics into a depth-shrinkage self-encoder trained in advance to obtain the characteristics output by the depth-shrinkage self-encoder, wherein the dimension of the characteristics output by the depth-shrinkage self-encoder is lower than that of the network characteristics.
The depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
And step S53, inputting the features output by the depth shrinkage self-encoder into a pre-trained SVM classifier to obtain the class output by the SVM classifier.
In this embodiment, the training process of the SVM classifier may include:
and S531, acquiring the features output by the deep-contraction self-encoder trained in the steps S21-S26, and marking the acquired features to obtain SVM classification training features.
And S532, training the SVM classifier by using the acquired features and the marks corresponding to the acquired features.
And identifying whether the network data is attack data or not according to the category output by the SVM classifier.
After the class of the network feature is determined, whether the network data is attack data or not can be identified according to a preset mapping relation between the feature class and the attack data.
Next, a feature dimension reduction device in a cloud computing environment provided by the present application is introduced, and the feature dimension reduction device in the cloud computing environment and the feature dimension reduction method in the cloud computing environment described above may be referred to correspondingly.
Referring to fig. 7, the data classification apparatus in a cloud computing environment includes: a first extraction module 11 and a first dimension reduction module 12.
The first extraction module 11 is configured to acquire network data in a cloud computing environment and extract network features from the network data;
a first dimension reduction module 12, configured to input the network feature into a pre-trained depth shrinkage self-encoder to obtain a feature output by the depth shrinkage self-encoder, where a dimension of the feature output by the depth shrinkage self-encoder is lower than a dimension of the network feature;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
In this embodiment, the data classification apparatus in the cloud computing environment may further include:
a depth-systolic self-coder training module to:
inputting sample characteristics in first training sample data into an input layer in a k-th layer CAE network in the depth shrinkage self-encoder, and training the k-th layer CAE network in the depth shrinkage self-encoder until errors between decoding results obtained by an output layer in the k-th layer CAE network and the sample characteristics in the first training sample data received by the input layer in the k-th layer CAE network are within a set range;
wherein, the value range of k is 1-n, k is an integer, n is the number of layers of the CAE network included in the deep scalable self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 th-layer CAE network;
an input layer in the k-th CAE network outputs the sample characteristics in the first training sample data to a hidden layer in the k-th CAE network, the hidden layer in the k-th CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, and outputs the features after dimension reduction to an output layer in the k-th CAE network, and the output layer in the k-th CAE network decodes the features after dimension reduction to obtain a decoding result;
judging whether k is smaller than n;
if not, under the condition that unused training sample data exists in the unlabeled training data set, selecting one unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step of inputting the sample characteristics in the first training sample data into an input layer in a k-th CAE network in the deep-contraction self-encoder;
ending training of the depth-systolic auto-encoder if unused training sample data does not exist in the unlabeled training dataset;
if yes, taking an output result of a hidden layer in the trained k-th CAE network as a sample feature in the first training sample data, updating k to k +1, and executing the step of inputting the sample feature in the first training sample data into an input layer in the k-th CAE network in the deep-contraction self-encoder.
In this embodiment, the depth shrinkage self-encoder training module may be specifically configured to:
using a pair-target learning function
Figure RE-GDA0002433228690000161
A minimization mode, training a k-th layer CAE network in the depth contraction self-encoder, wherein JCAEThe value of the objective learning function is expressed,
Figure RE-GDA0002433228690000162
representing a summation function, X(i)Representing the ith training sample data, Z, in said unlabeled training data set(i)Representing a decoding result obtained by an output layer in a k-th layer CAE network in the depth-punctured self-encoder corresponding to the ith training sample data,
Figure RE-GDA0002433228690000163
representing the reconstruction error, Jf(X(i)) A Jacobian matrix representing the ith training sample data,
Figure RE-GDA0002433228690000171
representing the F-norm of the jacobian matrix, λ represents a penalty parameter,
Figure RE-GDA0002433228690000172
and representing a contraction penalty item, wherein n represents the number of training sample data in the unlabeled training data set, and i is an integer not greater than n. In this embodiment, the depth shrinkage self-encoder training module may be further configured to:
selecting one unused training sample data from the labeled training data set;
extracting features from the unused training sample data as labeled training features;
inputting the training features with labels into the depth-shrinkage self-encoder to obtain features output by the depth-shrinkage self-encoder;
computing cross entropy of the classes of features output by the depth-systolic self-encoder and the classes of the labeled training features;
taking the cross entropy as a loss function result;
and respectively transmitting the loss function result to each layer of CAE network in the depth shrinkage self-encoder according to the sequence from the input layer in the (k + 1) th layer of CAE network in the depth shrinkage self-encoder to the hidden layer in the k-th layer of CAE network and from the hidden layer in each layer of CAE network to the input layer, updating the parameters of each layer of CAE network in the depth shrinkage self-encoder, and returning to the step of selecting unused training sample data from the training data set with the label until the cross entropy is converged.
In another embodiment of the present application, an abnormality detection apparatus in a cloud environment may include:
the second extraction module is used for acquiring network data in a cloud computing environment and extracting network features from the network data;
the second dimension reduction module is used for inputting the network features into a depth shrinkage self-encoder trained in advance to obtain the features output by the depth shrinkage self-encoder, and the dimension of the features output by the depth shrinkage self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network;
and the first classification module is used for inputting the features output by the depth shrinkage self-encoder into a pre-trained SVM classifier to obtain the class output by the SVM classifier.
In this embodiment, the anomaly detection apparatus in the cloud computing environment may further include:
an SVM classifier training module to:
acquiring the features output by the depth shrinkage self-encoder, and marking the acquired features to obtain SVM classification training features;
and training an SVM classifier by using the SVM classification training characteristics.
It should be noted that each embodiment is mainly described in terms of differences from other embodiments, and the same and similar parts between the embodiments may be referred to each other. For the device-like embodiment, since it is basically similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
Finally, it is further noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.
From the above description of the embodiments, it is clear for those skilled in the art that the present application can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the present application may be embodied in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, or the like, and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute the method according to the embodiments or some parts of the embodiments of the present application.
The feature dimension reduction method, the anomaly detection method and the device in the cloud computing environment provided by the application are introduced in detail, specific examples are applied in the description to explain the principle and the implementation mode of the application, and the description of the embodiments is only used for helping to understand the method and the core idea of the application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and the application scope, and in summary, the present specification should not be construed as a limitation to the present application.

Claims (10)

1. A feature dimension reduction method in a cloud computing environment is characterized by comprising the following steps:
acquiring network data under a cloud computing environment, and extracting network features from the network data;
inputting the network characteristics into a depth contraction self-encoder trained in advance to obtain characteristics output by the depth contraction self-encoder, wherein the dimensionality of the characteristics output by the depth contraction self-encoder is lower than that of the network characteristics;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
2. The method of claim 1, wherein the training process of the depth-punctured self-encoder comprises:
inputting sample characteristics in first training sample data into an input layer in a k-th layer CAE network in the depth shrinkage self-encoder, and training the k-th layer CAE network in the depth shrinkage self-encoder until errors between decoding results obtained by an output layer in the k-th layer CAE network and the sample characteristics in the first training sample data received by the input layer in the k-th layer CAE network are within a set range;
wherein, the value range of k is 1-n, k is an integer, n is the number of layers of a CAE network included in the deep-contracting self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 layer CAE network;
an input layer in the k-th-layer CAE network outputs the sample characteristics in the first training sample data to a hidden layer in the k-th-layer CAE network, the hidden layer in the k-th-layer CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, and outputs the features after dimension reduction to an output layer in the k-th-layer CAE network, and the output layer in the k-th-layer CAE network decodes the features after dimension reduction to obtain a decoding result;
judging whether k is smaller than n;
if not, under the condition that unused training sample data exists in the unlabeled training data set, selecting one unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step of inputting the sample characteristics in the first training sample data into an input layer in a k-th CAE network in the deep-contraction self-encoder;
ending training of the depth-systolic auto-encoder if unused training sample data does not exist in the unlabeled training dataset;
if yes, taking an output result of a hidden layer in the trained k-th CAE network as a sample feature in the first training sample data, updating k to k +1, and executing the step of inputting the sample feature in the first training sample data into an input layer in the k-th CAE network in the deep-contraction self-encoder.
3. The method of claim 2, wherein training the k-th layer CAE network in the depth-punctured self-encoder comprises:
using a pair-target learning function
Figure FDA0002321815690000021
A minimization mode, training a k-th layer CAE network in the depth contraction self-encoder, wherein JCAEThe value of the target learning function is represented,
Figure FDA0002321815690000022
representing a summation function, X(i)Representing the ith training sample data, Z, in said unlabeled training data set(i)Representing a decoding result obtained by an output layer in a k-th layer CAE network in the depth-punctured self-encoder corresponding to the ith training sample data,
Figure FDA0002321815690000023
denotes reconstruction error, Jf(X(i)) A Jacobian matrix representing the ith training sample data,
Figure FDA0002321815690000024
representing the F-norm of the jacobian matrix, λ represents a penalty parameter,
Figure FDA0002321815690000025
and representing a contraction penalty item, wherein n represents the number of training sample data in the unlabeled training data set, and i is an integer not greater than n.
4. The method of claim 2, wherein the training process of the depth-punctured self-encoder further comprises:
selecting one unused training sample data from the labeled training data set;
extracting features from the unused training sample data as labeled training features;
inputting the training features with labels into the depth-shrinkage self-encoder to obtain features output by the depth-shrinkage self-encoder;
inputting the features output by the depth shrinkage self-encoder into a classifier to obtain the class output by the classifier, wherein the class is used as the class of the features output by the depth shrinkage self-encoder;
calculating cross entropy of the class of features output by the depth-systolic self-encoder and the class of the labeled training features;
taking the cross entropy as a loss function result;
and respectively transmitting the loss function result to each layer of CAE network in the depth shrinkage self-encoder according to the sequence from the input layer in the (k + 1) th layer of CAE network in the depth shrinkage self-encoder to the hidden layer in the k-th layer of CAE network and from the hidden layer in each layer of CAE network to the input layer, updating the parameters of each layer of CAE network in the depth shrinkage self-encoder, and returning to the step of selecting unused training sample data from the training data set with the label until the cross entropy is converged.
5. An anomaly detection method in a cloud computing environment, comprising:
acquiring network data under a cloud computing environment, and extracting network features from the network data;
inputting the network characteristics into a depth contraction self-encoder trained in advance to obtain characteristics output by the depth contraction self-encoder, wherein the dimensionality of the characteristics output by the depth contraction self-encoder is lower than that of the network characteristics;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network;
inputting the features output by the depth shrinkage self-encoder into a pre-trained SVM classifier to obtain the class output by the SVM classifier.
6. The method of claim 5, wherein the training process of the SVM classifier comprises:
obtaining features of the depth-shrunk self-encoder output;
and training the SVM classifier by using the acquired features and the marks corresponding to the acquired features.
7. A feature dimension reduction device in a cloud computing environment, comprising:
the system comprises a first extraction module, a second extraction module and a third extraction module, wherein the first extraction module is used for acquiring network data in a cloud computing environment and extracting network features from the network data;
the first dimension reduction module is used for inputting the network features into a depth shrinkage self-encoder trained in advance to obtain the features output by the depth shrinkage self-encoder, and the dimension of the features output by the depth shrinkage self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network.
8. The apparatus of claim 7, further comprising: a depth-systolic self-coder training module to:
inputting sample characteristics in first training sample data into an input layer in a k-th layer CAE network in the depth shrinkage self-encoder, and training the k-th layer CAE network in the depth shrinkage self-encoder until errors between decoding results obtained by an output layer in the k-th layer CAE network and the sample characteristics in the first training sample data received by the input layer in the k-th layer CAE network are within a set range;
wherein, the value range of k is 1-n, k is an integer, n is the number of layers of a CAE network included in the deep-contracting self-encoder, and when k is 1, the first training sample data is an unused training sample data selected from an unlabeled training data set, and when k is not 1, the first training sample data is an output result of a hidden layer in a trained k-1 layer CAE network;
an input layer in the k-th-layer CAE network outputs the sample characteristics in the first training sample data to a hidden layer in the k-th-layer CAE network, the hidden layer in the k-th-layer CAE network reduces the dimension of the sample characteristics in the first training sample data to obtain the features after dimension reduction, and outputs the features after dimension reduction to an output layer in the k-th-layer CAE network, and the output layer in the k-th-layer CAE network decodes the features after dimension reduction to obtain a decoding result;
judging whether k is smaller than n;
if not, under the condition that unused training sample data exists in the unlabeled training data set, selecting one unused training sample data from the unlabeled training data set, updating the first training sample data, and executing the step of inputting the sample characteristics in the first training sample data into an input layer in a k-th CAE network in the deep-contraction self-encoder;
ending training of the depth-systolic auto-encoder if unused training sample data does not exist in the unlabeled training dataset;
if yes, taking an output result of a hidden layer in the trained k-th CAE network as a sample feature in the first training sample data, updating k to k +1, and executing the step of inputting the sample feature in the first training sample data into an input layer in the k-th CAE network in the deep-contraction self-encoder.
9. The apparatus of claim 8, wherein the depth-systolic self-encoder training module is specifically configured to:
using a pair-target learning function
Figure FDA0002321815690000051
A minimization mode, training a k-th layer CAE network in the depth contraction self-encoder, wherein JCAEThe value of the target learning function is represented,
Figure FDA0002321815690000052
representing a summation function, X(i)Representing the ith training sample data, Z, in said unlabeled training data set(i)Representing a decoding result obtained by an output layer in a k-th layer CAE network in the depth-punctured self-encoder corresponding to the ith training sample data,
Figure FDA0002321815690000053
denotes reconstruction error, Jf(X(i)) A Jacobian matrix representing the ith training sample data,
Figure FDA0002321815690000054
representing the F-norm of the jacobian matrix, λ represents a penalty parameter,
Figure FDA0002321815690000055
and representing a contraction penalty item, wherein n represents the number of training sample data in the unlabeled training data set, and i is an integer not greater than n.
10. An abnormality detection device in a cloud environment, comprising:
the second extraction module is used for acquiring network data in a cloud computing environment and extracting network features from the network data;
the second dimension reduction module is used for inputting the network features into a depth shrinkage self-encoder trained in advance to obtain the features output by the depth shrinkage self-encoder, and the dimension of the features output by the depth shrinkage self-encoder is lower than that of the network features;
the depth contraction self-encoder comprises a plurality of layers of CAE networks, each layer of CAE network comprises an input layer and a hidden layer, the output of the input layer is used as the input of the hidden layer, the input layer in the first layer of CAE network is used as the input end of the depth contraction self-encoder, the hidden layer in the last layer of CAE network is used as the output end of the depth contraction sub-encoder, and the output of the hidden layer in each layer of CAE network before the last layer of CAE network is used as the input of the input layer in the next layer of CAE network;
and the first classification module is used for inputting the features output by the depth shrinkage self-encoder into a pre-trained SVM classifier to obtain the class output by the SVM classifier.
CN201911301125.7A 2019-12-17 2019-12-17 Feature dimension reduction method, anomaly detection method and device in cloud computing environment Active CN111126468B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201911301125.7A CN111126468B (en) 2019-12-17 2019-12-17 Feature dimension reduction method, anomaly detection method and device in cloud computing environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201911301125.7A CN111126468B (en) 2019-12-17 2019-12-17 Feature dimension reduction method, anomaly detection method and device in cloud computing environment

Publications (2)

Publication Number Publication Date
CN111126468A true CN111126468A (en) 2020-05-08
CN111126468B CN111126468B (en) 2023-10-03

Family

ID=70498392

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201911301125.7A Active CN111126468B (en) 2019-12-17 2019-12-17 Feature dimension reduction method, anomaly detection method and device in cloud computing environment

Country Status (1)

Country Link
CN (1) CN111126468B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112763056A (en) * 2020-12-29 2021-05-07 上海交大智邦科技有限公司 Method and system for online real-time monitoring and evaluation of state of numerical control machine tool system

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107729393A (en) * 2017-09-20 2018-02-23 齐鲁工业大学 File classification method and system based on mixing autocoder deep learning
US20190042952A1 (en) * 2017-08-03 2019-02-07 Beijing University Of Technology Multi-task Semi-Supervised Online Sequential Extreme Learning Method for Emotion Judgment of User

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190042952A1 (en) * 2017-08-03 2019-02-07 Beijing University Of Technology Multi-task Semi-Supervised Online Sequential Extreme Learning Method for Emotion Judgment of User
CN107729393A (en) * 2017-09-20 2018-02-23 齐鲁工业大学 File classification method and system based on mixing autocoder deep learning

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
任伟: "基于稀疏自编码深度神经网络的入侵检测方法", 《移动通信》 *
吴奇等: "基于深度收缩稀疏自编码网络的飞行员疲劳状态识别", 《控制与决策》 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112763056A (en) * 2020-12-29 2021-05-07 上海交大智邦科技有限公司 Method and system for online real-time monitoring and evaluation of state of numerical control machine tool system

Also Published As

Publication number Publication date
CN111126468B (en) 2023-10-03

Similar Documents

Publication Publication Date Title
CN111783875B (en) Abnormal user detection method, device, equipment and medium based on cluster analysis
CN111652290B (en) Method and device for detecting countermeasure sample
WO2020003533A1 (en) Pattern recognition apparatus, pattern recognition method, and computer-readable recording medium
CN109831460B (en) Web attack detection method based on collaborative training
Zhang et al. Why lottery ticket wins? a theoretical perspective of sample complexity on sparse neural networks
CN113628059B (en) Associated user identification method and device based on multi-layer diagram attention network
CN112052451A (en) Webshell detection method and device
Liu et al. Adversaries or allies? Privacy and deep learning in big data era
CN112769974A (en) Domain name detection method, system and storage medium
Dong et al. Multi‐task learning method for classification of multiple power quality disturbances
CN110674370A (en) Domain name identification method and device, storage medium and electronic equipment
CN111126468B (en) Feature dimension reduction method, anomaly detection method and device in cloud computing environment
CN111310185B (en) Android malicious software detection method based on improved stacking algorithm
CN114866246B (en) Computer network security intrusion detection method based on big data
Das et al. Thai automatic signature verification system employing textural features
CN114255381B (en) Training method of image recognition model, image recognition method, device and medium
CN116029394A (en) Self-adaptive text emotion recognition model training method, electronic equipment and storage medium
CN116722992A (en) Fraud website identification method and device based on multi-mode fusion
CN116502705A (en) Knowledge distillation method and computer equipment for dual-purpose data set inside and outside domain
CN115759043A (en) Document-level sensitive information detection model training and prediction method
CN114254130A (en) Relation extraction method of network security emergency response knowledge graph
ALI et al. A Novel Leader Election Algorithm for Honeycomb Mesh Networks
Yazdani et al. RPCA: a novel preprocessing method for PCA
CN113259369A (en) Data set authentication method and system based on machine learning member inference attack
Khare et al. Url classification using non negative matrix factorization

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant