CN112968968A - Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering - Google Patents
Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering Download PDFInfo
- Publication number
- CN112968968A CN112968968A CN202110220844.7A CN202110220844A CN112968968A CN 112968968 A CN112968968 A CN 112968968A CN 202110220844 A CN202110220844 A CN 202110220844A CN 112968968 A CN112968968 A CN 112968968A
- Authority
- CN
- China
- Prior art keywords
- original
- clustering
- feature vector
- internet
- flow
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/088—Non-supervised learning, e.g. competitive learning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Artificial Intelligence (AREA)
- General Health & Medical Sciences (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Evolutionary Computation (AREA)
- General Physics & Mathematics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Mathematical Physics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Molecular Biology (AREA)
- Probability & Statistics with Applications (AREA)
- Evolutionary Biology (AREA)
- Software Systems (AREA)
- Medical Informatics (AREA)
- Power Engineering (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Image Analysis (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention provides an Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering, wherein the method comprises the following steps: extracting an original characteristic vector of original flow; calculating the original feature vector through a VAE algorithm to obtain a three-dimensional feature vector after dimension reduction; and clustering and calculating the three-dimensional characteristic vectors through a K-means algorithm, and determining clustering boundaries of different Internet of things devices so as to perform flow fingerprint identification processing according to the clustering boundaries. Therefore, the traffic fingerprint identification method of the unsupervised Internet of things equipment is realized, and the method is used for realizing the accurate identification of the Internet of things equipment fingerprint under the condition of no label data.
Description
Technical Field
The invention relates to the technical field of network traffic analysis, in particular to a method and a device for identifying traffic fingerprints of Internet of things equipment based on unsupervised clustering.
Background
At present, the number of internet of things devices in the internet is in a high-speed growth stage. With the rapid growth of the internet of things market, the security management problem of the internet of things gradually becomes a new and significant challenge in network management. The primary task for solving the safety problem of the Internet of things is how to accurately identify the Internet of things equipment in the network.
The current methods for identifying devices in the internet of things are mainly divided into two types, one is similar to the method for fingerprinting the operating system, and device information is identified by some specific identifiers in network traffic (for example, a user-agent field in an http request). However, since the variety of the internet of things devices is much larger than that of the operating system, and many devices lack a specific identifier that can be extracted, this method is not very effective in the identification of the internet of things devices. Another method is to learn the network characteristics of the existing internet of things devices by using a supervised machine learning algorithm, so as to construct a classifier of the internet of things devices. However, this method can only be applied to known internet of things devices, and requires a large number of labeled training samples, which requires much labor and economic cost.
Disclosure of Invention
The present invention is directed to solving, at least to some extent, one of the technical problems in the related art.
Therefore, a first object of the present invention is to provide an unsupervised clustering-based internet of things device traffic fingerprint identification method, so as to implement accurate identification of an internet of things device fingerprint without tag data.
The invention also provides an Internet of things equipment flow fingerprint identification device based on unsupervised clustering.
A third object of the invention is to propose a computer device.
A fourth object of the invention is to propose a non-transitory computer-readable storage medium.
A fifth object of the invention is to propose a computer program product.
In order to achieve the above object, an embodiment of a first aspect of the present invention provides an internet of things device traffic fingerprint identification method based on unsupervised clustering, including: extracting an original characteristic vector of original flow; calculating the original feature vector through a VAE algorithm to obtain a three-dimensional feature vector after dimension reduction; and clustering and calculating the three-dimensional characteristic vectors through a K-means algorithm, and determining clustering boundaries of different Internet of things devices so as to perform flow fingerprint identification processing according to the clustering boundaries.
In order to achieve the above object, an embodiment of a second aspect of the present invention provides an internet of things device traffic fingerprint identification apparatus based on unsupervised clustering, including: the extraction module is used for extracting an original characteristic vector of original flow; the acquisition module is used for extracting an original characteristic vector of original flow; and the determining module is used for clustering and calculating the three-dimensional characteristic vectors through a K-means algorithm, and determining clustering boundaries of different Internet of things devices so as to perform flow fingerprint identification processing according to the clustering boundaries.
In order to achieve the above object, a third aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor executes the computer program to implement the unsupervised clustering-based internet of things device traffic fingerprint identification method according to the first aspect of the present invention.
In order to achieve the above object, a fourth aspect of the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the method for traffic fingerprinting of the internet of things device based on unsupervised clustering as described in the first aspect of the present invention.
In order to achieve the above object, an embodiment of a fifth aspect of the present invention provides a computer program product, where when executed by an instruction processor of the computer program product, the method for traffic fingerprinting of an internet of things device based on unsupervised clustering according to an embodiment of the first aspect is implemented.
The embodiment of the invention at least has the following technical effects:
the invention designs an unsupervised Internet of things device traffic fingerprint identification method based on VAE (variational automatic encoder) and K-means (K-means clustering), which can realize accurate identification of Internet of things device fingerprints under the condition of no label data.
Additional aspects and advantages of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.
Drawings
The foregoing and/or additional aspects and advantages of the present invention will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:
fig. 1 is a schematic flow chart of an internet of things device traffic fingerprint identification method based on unsupervised clustering according to an embodiment of the present invention;
FIG. 2 is a representation of feature selection provided by an embodiment of the present invention;
FIG. 3 is a block diagram of an overall algorithm according to an embodiment of the present invention;
fig. 4 is a schematic diagram of a feature clustering result according to an embodiment of the present invention;
FIG. 5 is a graph illustrating an accuracy result according to an embodiment of the present invention; and
fig. 6 is a structural block diagram of an internet of things device traffic fingerprint identification device based on unsupervised clustering according to an embodiment of the present invention.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are illustrative and intended to be illustrative of the invention and are not to be construed as limiting the invention.
The method and the device for identifying the traffic fingerprint of the internet of things equipment based on unsupervised clustering according to the embodiment of the invention are described below with reference to the accompanying drawings.
Fig. 1 is a schematic flow chart of an internet of things device traffic fingerprint identification method based on unsupervised clustering according to an embodiment of the present invention.
To solve the problem, an embodiment of the present invention provides an internet of things device traffic fingerprint identification method based on unsupervised clustering, and as shown in fig. 1, the internet of things device traffic fingerprint identification method based on unsupervised clustering includes the following steps:
In this embodiment, a feature extraction module may be designed to extract an original feature vector of an original flow, where, as shown in fig. 2, the original feature vector includes time and space dimension features, and 72 dimensions of features are selected in both the time and space dimensions to constitute an original feature vector. The characteristics of the time dimension include both periodic and bursty dimensions. The spatial features include flow statistics features, bigram bag features, protocol features, and load features.
In one embodiment of the invention, the original traffic is divided into different flows, according to different mac addresses. We intercept the flow of each flow over a period of time as the original input. In actual use, the statistical range of time for each stream is one hour. The feature extraction module processes each raw stream data into a 72-dimensional raw feature vector.
And 102, calculating the original feature vector through a VAE algorithm to obtain a three-dimensional feature vector after dimension reduction.
In this embodiment, the VAE module corresponding to the VAE algorithm may be used to reduce the 72-dimensional original feature vector into a three-dimensional space, so as to reduce the sparsity of the space. The VAE module comprises three parts of encoding, decoding and loss function design. In the encoding part, we define the original feature vector as x, the output of the hidden layer as z, and we use the encoder neural network to learn an effective characterization method to map the original feature vector to the hidden layer. This mapping is defined as qφ(z | x). The decoder is alsoIs a neural network structure, and the decoder is used for restoring the characterization z of the hidden layer to the one with the same dimension as the original characteristic vector
Therefore, we define the mapping relationship of the decoder as
We define the loss function as
Phi denotes the weight of the encoder network, theta denotes the weight of the decoder network,
which is indicative of the error of the reconstruction,
indicating the KL divergence between the encoder and decoder.
And 103, clustering the three-dimensional characteristic vectors through a K-means algorithm, and determining clustering boundaries of different Internet of things devices so as to perform flow fingerprint identification processing according to the clustering boundaries.
In this embodiment, the VAE module clusters different internet of things devices from the original feature vector into a three-dimensional space. In order to determine the classification of different internet of things devices in a three-dimensional space, clustering learning is performed on the different devices in the three-dimensional space by using a K-means algorithm, and clustering boundaries of the different internet of things devices are determined. As shown in fig. 3, in the embodiment of the present invention, an unsupervised algorithm is provided to cluster the devices of the internet of things, and this method does not need to obtain a large amount of tag data in advance. And the designed unsupervised algorithm solves two main problems of feature selection and model selection.
In one embodiment of the present invention, the performance of the algorithm is evaluated in a network environment with more than 20 kinds of devices, and the evaluation result of feature clustering is shown in fig. 4. Points with different gray values and colors in the graph represent different devices, and it can be seen from the graph that the devices of the same type are clustered in similar areas, and it can be seen that the VAE model well clusters different devices in a three-dimensional space.
The result of the recognition accuracy of the device is shown in fig. 5, the curve realized in the figure is the accuracy result curve of the algorithm provided by the invention, and the result of the curve shows that the accuracy of the algorithm of the invention can reach 86.7% under the condition of using all data, which is slightly higher than an optimal classification algorithm.
In summary, according to the traffic fingerprint identification method of the internet of things equipment based on unsupervised clustering, the original feature vector of original traffic is extracted, the original feature vector is calculated through the VAE algorithm, the three-dimensional feature vector after dimensionality reduction is obtained, and further, the three-dimensional feature vector is subjected to clustering calculation through the K-means algorithm, and the clustering boundaries of different internet of things equipment are determined, so that traffic fingerprint identification processing is performed according to the clustering boundaries. Therefore, the traffic fingerprint identification method of the unsupervised Internet of things equipment based on VAE (variational automatic encoder) and K-means (K-means clustering) realizes accurate identification of the Internet of things equipment fingerprint under the condition of no label data.
In order to implement the embodiment, the invention further provides an internet of things equipment flow fingerprint identification device based on unsupervised clustering.
Fig. 6 is a schematic structural diagram of an internet of things device traffic fingerprint identification device based on unsupervised clustering according to an embodiment of the present invention.
As shown in fig. 6, the traffic fingerprint identification device of the internet of things device based on unsupervised clustering includes: an extraction module 610, an acquisition module 620, and a determination module 630.
The extracting module 610 is configured to extract an original feature vector of an original flow;
an obtaining module 620, configured to extract an original feature vector of an original flow;
the determining module 630 is configured to perform clustering calculation on the three-dimensional feature vectors through a K-means algorithm, and determine clustering boundaries of different internet of things devices, so as to perform traffic fingerprint identification processing according to the clustering boundaries.
It should be noted that the foregoing explanation of the embodiment of the method for identifying traffic fingerprint of internet of things based on unsupervised clustering is also applicable to the apparatus for identifying traffic fingerprint of internet of things based on unsupervised clustering in this embodiment, and is not repeated here.
In order to implement the foregoing embodiment, the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the method for traffic fingerprinting of the internet of things device based on unsupervised clustering as described in the foregoing embodiment is implemented.
In order to implement the foregoing embodiments, the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the unsupervised clustering based internet of things device traffic fingerprint identification method as described in the foregoing embodiments.
In order to implement the foregoing embodiments, the present invention further provides a computer program product, which when executed by an instruction processor in the computer program product, implements the method for traffic fingerprinting of the internet of things device based on unsupervised clustering as described in the foregoing embodiments.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing steps of a custom logic function or process, and alternate implementations are included within the scope of the preferred embodiment of the present invention in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the present invention.
The logic and/or steps represented in the flowcharts or otherwise described herein, e.g., an ordered listing of executable instructions that can be considered to implement logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.
In addition, functional units in the embodiments of the present invention may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.
The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc. Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention, and that variations, modifications, substitutions and alterations can be made to the above embodiments by those of ordinary skill in the art within the scope of the present invention.
Claims (10)
1. An Internet of things equipment flow fingerprint identification method based on unsupervised clustering is characterized by comprising the following steps:
extracting an original characteristic vector of original flow;
calculating the original feature vector through a VAE algorithm to obtain a three-dimensional feature vector after dimension reduction;
and clustering and calculating the three-dimensional characteristic vectors through a K-means algorithm, and determining clustering boundaries of different Internet of things devices so as to perform flow fingerprint identification processing according to the clustering boundaries.
2. The method of claim 1, wherein extracting the raw feature vector of the raw traffic comprises:
dividing the original flow into a plurality of reference flows according to the mac address;
extracting the features of each reference flow according to preset statistical duration to obtain an original sub-feature vector;
and acquiring the original characteristic vector according to the original sub-characteristic vectors of all the reference flows.
3. The method of claim 1 or 2,
the raw feature vector is a time dimension feature and a space dimension feature, wherein,
the time dimension characteristics comprise a periodic characteristic and a burst characteristic,
the spatial dimension characteristics comprise flow statistic characteristics, binary word group bag characteristics, protocol characteristics and load characteristics.
4. The method according to claim 1, wherein the VAE algorithm comprises an encoding layer, a hiding layer, and a decoding layer, and before the obtaining the three-dimensional feature vector after the dimensionality reduction through the VAE algorithm to the original feature vector calculation, comprises:
mapping the original characteristic vector of the sample to a hidden layer according to a preset mapping relation through the coding layer;
restoring, by the decoding layer, the characterization of the hidden layer to a target feature vector having the same dimensions as the sample original feature vector;
and calculating loss values of the target characteristic vector and the sample original characteristic vector according to a preset loss function until the loss values are smaller than a preset threshold value.
5. The method of claim 1, wherein the predetermined loss function is:
wherein z is the target feature vector, z is the original feature vector, φ represents a weight of an encoder network, θ represents a weight of a decoder network,
which is indicative of the error of the reconstruction,
indicating the KL divergence between the encoder and decoder.
6. The utility model provides a thing networking equipment flow fingerprint identification device based on unsupervised clustering which characterized in that includes:
the extraction module is used for extracting an original characteristic vector of original flow;
the acquisition module is used for extracting an original characteristic vector of original flow;
and the determining module is used for clustering and calculating the three-dimensional characteristic vectors through a K-means algorithm, and determining clustering boundaries of different Internet of things devices so as to perform flow fingerprint identification processing according to the clustering boundaries.
7. The apparatus of claim 6, wherein the extraction module is specifically configured to:
dividing the original flow into a plurality of reference flows according to the mac address;
extracting the features of each reference flow according to preset statistical duration to obtain an original sub-feature vector;
and acquiring the original characteristic vector according to the original sub-characteristic vectors of all the reference flows.
8. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method of any one of claims 1-5 when executing the computer program.
9. A non-transitory computer-readable storage medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the method of any one of claims 1-5.
10. A computer program product, characterized in that instructions in the computer program product, when executed by a processor, implement the method according to any of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110220844.7A CN112968968B (en) | 2021-02-26 | 2021-02-26 | Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110220844.7A CN112968968B (en) | 2021-02-26 | 2021-02-26 | Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112968968A true CN112968968A (en) | 2021-06-15 |
| CN112968968B CN112968968B (en) | 2022-08-19 |
Family
ID=76275797
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110220844.7A Active CN112968968B (en) | 2021-02-26 | 2021-02-26 | Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112968968B (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102685016A (en) * | 2012-06-06 | 2012-09-19 | 济南大学 | Internet flow distinguishing method |
| CN207993065U (en) * | 2017-01-04 | 2018-10-19 | 意法半导体股份有限公司 | Configurable accelerator frame apparatus and the system for depth convolutional neural networks |
| CN108881196A (en) * | 2018-06-07 | 2018-11-23 | 中国民航大学 | The semi-supervised intrusion detection method of model is generated based on depth |
| CN111144470A (en) * | 2019-12-20 | 2020-05-12 | 中国科学院信息工程研究所 | Unknown network flow identification method and system based on deep self-encoder |
| CN111526144A (en) * | 2020-04-21 | 2020-08-11 | 福州大学 | Abnormal flow detection method and system based on DVAE-Catboost |
-
2021
- 2021-02-26 CN CN202110220844.7A patent/CN112968968B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102685016A (en) * | 2012-06-06 | 2012-09-19 | 济南大学 | Internet flow distinguishing method |
| CN207993065U (en) * | 2017-01-04 | 2018-10-19 | 意法半导体股份有限公司 | Configurable accelerator frame apparatus and the system for depth convolutional neural networks |
| CN108881196A (en) * | 2018-06-07 | 2018-11-23 | 中国民航大学 | The semi-supervised intrusion detection method of model is generated based on depth |
| CN111144470A (en) * | 2019-12-20 | 2020-05-12 | 中国科学院信息工程研究所 | Unknown network flow identification method and system based on deep self-encoder |
| CN111526144A (en) * | 2020-04-21 | 2020-08-11 | 福州大学 | Abnormal flow detection method and system based on DVAE-Catboost |
Non-Patent Citations (1)
| Title |
|---|
| 杨宏宇: "基于无监督多源数据特征解析的网络威胁态势评估", 《通信学报》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112968968B (en) | 2022-08-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109873779B (en) | LSTM-based hierarchical wireless signal modulation type identification method | |
| CN110008082B (en) | Abnormal task intelligent monitoring method, device, equipment and storage medium | |
| CN110287936B (en) | Image detection method, device, equipment and storage medium | |
| CN115034286B (en) | Abnormal user identification method and device based on self-adaptive loss function | |
| KR102433598B1 (en) | A System and Method for Deriving Data Boundary | |
| CN110751191A (en) | Image classification method and system | |
| CN110969526A (en) | Overlapping community processing method and device and electronic equipment | |
| CN111539910B (en) | Rust area detection method and terminal equipment | |
| CN114332500A (en) | Image processing model training method and device, computer equipment and storage medium | |
| CN112613617A (en) | Uncertainty estimation method and device based on regression model | |
| CN111024147A (en) | Component mounting detection method and device based on CNNs, electronic equipment and storage medium | |
| CN116150186B (en) | Communication Internet of things management method and system based on big data | |
| CN112968968B (en) | Internet of things equipment flow fingerprint identification method and device based on unsupervised clustering | |
| CN111199228B (en) | License plate positioning method and device | |
| CN115705279A (en) | Intelligent fault early warning method and device based on index data | |
| CN112785595B (en) | Target attribute detection, neural network training and intelligent driving method and device | |
| US20220198824A1 (en) | Method for extracting a signature of a fingerprint and device implementing said method | |
| CN115984671A (en) | Model online updating method and device, electronic equipment and readable storage medium | |
| CN116188445A (en) | Product surface defect detection and positioning method and device and terminal equipment | |
| CN114218487B (en) | Video recommendation method, system, device and storage medium | |
| CN112699908B (en) | Method for labeling picture, electronic terminal, computer readable storage medium and equipment | |
| CN114168781A (en) | Pathological image retrieval method and device | |
| KR100581673B1 (en) | Data Classification Method | |
| CN113518058A (en) | Abnormal login behavior detection method and device, storage medium and computer equipment | |
| CN111597934A (en) | System and method for processing training data for statistical applications |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |