CN113747441A - Mobile network flow abnormity detection method and system based on feature dimension reduction - Google Patents
Mobile network flow abnormity detection method and system based on feature dimension reduction Download PDFInfo
- Publication number
- CN113747441A CN113747441A CN202110888057.XA CN202110888057A CN113747441A CN 113747441 A CN113747441 A CN 113747441A CN 202110888057 A CN202110888057 A CN 202110888057A CN 113747441 A CN113747441 A CN 113747441A
- Authority
- CN
- China
- Prior art keywords
- flow
- low
- dimensional
- vector
- mobile network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 46
- 239000013598 vector Substances 0.000 claims abstract description 46
- 230000002159 abnormal effect Effects 0.000 claims abstract description 32
- 230000001413 cellular effect Effects 0.000 claims abstract description 30
- 238000012790 confirmation Methods 0.000 claims abstract description 17
- 238000003064 k means clustering Methods 0.000 claims abstract description 11
- 238000009826 distribution Methods 0.000 claims abstract description 9
- 208000025174 PANDAS Diseases 0.000 claims abstract description 7
- 208000021155 Paediatric autoimmune neuropsychiatric disorders associated with streptococcal infection Diseases 0.000 claims abstract description 7
- 235000016496 Panda oleosa Nutrition 0.000 claims abstract description 7
- 230000004931 aggregating effect Effects 0.000 claims abstract description 4
- 238000000034 method Methods 0.000 claims description 13
- 230000005856 abnormality Effects 0.000 claims description 9
- 240000004718 Panda Species 0.000 claims description 6
- 238000000605 extraction Methods 0.000 claims description 3
- 238000005457 optimization Methods 0.000 claims description 3
- 238000012549 training Methods 0.000 claims description 3
- 241000257303 Hymenoptera Species 0.000 claims 1
- 240000000220 Panda oleosa Species 0.000 abstract 1
- 239000000523 sample Substances 0.000 description 10
- 238000010586 diagram Methods 0.000 description 6
- 238000012545 processing Methods 0.000 description 5
- 238000013468 resource allocation Methods 0.000 description 2
- 230000003321 amplification Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013523 data management Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000003745 diagnosis Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000003199 nucleic acid amplification method Methods 0.000 description 1
- 238000011160 research Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Computer Security & Cryptography (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- General Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Computational Linguistics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Biophysics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Biomedical Technology (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Molecular Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computer Hardware Design (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Probability & Statistics with Applications (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention discloses a mobile network flow abnormity detection method and system based on feature dimension reduction, comprising the following steps: dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, and aggregating the cellular flow value of each grid area by using pandas to obtain the cellular flow total value taking hour as a unit; dividing the detection time period into K time slots to form a time sequence vector, and taking the time sequence vector as an original cellular flow vector xj(ii) a Raw cellular traffic vector x for all mesh regions using LSTM autoencoderjExtracting low dimensional flow features cj(ii) a Confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas; and performing anomaly confirmation on the low-dimensional flow characteristics of the suspected anomaly by using K-means clustering to finish mobile network flow anomaly detection based on characteristic dimension reduction.
Description
Technical Field
The invention relates to an anomaly detection method and system, in particular to a mobile network flow anomaly detection method and system based on feature dimension reduction.
Background
Anomaly detection is one of the important tasks in wireless network data analysis and management. Anomalies in a wireless network refer to patterns of departure from normal/expected behavior that can be spurious traffic caused by network congestion, DDoS amplification attacks, port/service scans, and network failures in a wireless network. Anomaly detection is very valuable to service providers. Detecting the occurred user traffic abnormality can provide more hot area related information for network operators, examine the rationality of the existing resource allocation scheme, guide the dynamic allocation and adjustment of network resources, and provide an intelligent fault diagnosis solution.
In the existing abnormity detection research work, the K-means clustering method is widely applied to an abnormity detection task due to the simplicity of the K-means clustering method. The K-means cluster-based anomaly detection method detects anomalies by dividing data into normal traffic clusters and abnormal traffic clusters. However, the anomaly detection method still has some problems, and the anomaly of the high-flow area can be detected by directly detecting the anomaly by using the clustering algorithm, but the anomaly of the low-flow area can be ignored. In addition, an anomaly detection method based on K-means clustering of a flow pattern has the defects of limited number of processing areas, limited duration of data processing and the like in the large-scale long-time sequence detection problem.
Disclosure of Invention
The present invention is directed to overcome the drawbacks of the prior art, and provides a method and a system for detecting abnormal mobile network traffic based on feature dimension reduction, which can detect abnormal mobile network traffic and have the characteristics of large number of processing areas and short data processing time.
In order to achieve the above object, the method for detecting abnormal traffic of a mobile network based on feature dimension reduction according to the present invention comprises the following steps:
dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, wherein M and N are positive integers, and aggregating the cellular flow value of each grid area by using pandas to obtain the total cellular flow value in hour;
dividing the detection time period into K time slots to form a time sequence vector, and taking the time sequence vector as an original cellular flow vector xj；
Raw cellular traffic vector x for all mesh regions using LSTM autoencoderjExtracting low dimensional flow features cj；
Confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas;
and (4) carrying out anomaly confirmation on the low-dimensional flow characteristics of the suspected anomaly by using K-means clustering, and completing the anomaly detection of the mobile network flow based on characteristic dimension reduction.
The detection period is divided into 672 slots.
For any mesh region j, the original cellular traffic vector
xj＝[xj[1],xj[2]L xj[p]L xj[K]]TWherein x isj[p]And (4) representing the total mobile phone traffic value of the grid area j in the p hour.
Inputting 24-dimensional flow vectors in each step of an encoding part of the LSTM self-encoder, inputting 28 steps in total, and setting a hidden layer as a 3 layer; the flow characteristics obtained by encoding are 2-dimensional vectors; gradually inputting the feature vectors into a decoder for 28 steps, and setting a hidden layer of the decoder as a 3 layer to obtain reconstructed data; and training the LSTM self-encoder by taking the mean square error of the flow data input from the encoder and the reconstructed data output from the encoder as an optimization target.
The specific process of carrying out abnormity confirmation on the low-dimensional flow characteristics of the suspected abnormity by using the K-means cluster comprises the following steps:
forming an abnormal cluster by using the low-dimensional flow characteristics of each suspected abnormality;
determining the optimal clustering number by using the wear-on-Weibull D index DBI, measuring the sample distance by using the Euclidean distance, taking the sample distance as a clustering division criterion, marking the sample with the largest clustering centroid and the smallest sample amount in the same cluster as an abnormal low-dimensional flow characteristic, and simultaneously determining the time period of the abnormal low-dimensional flow characteristic in the grid.
A mobile network flow abnormity detection system based on feature dimension reduction comprises:
the classification module is used for dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, wherein M and N are positive integers, and the cell flow value of each grid area is aggregated by using pandas, so that the total cell flow value in hour is taken as a unit;
a dividing module for dividing the detection time period into K time slots to form a time sequence vector, and using the time sequence vector as an original cellular flow vector xj；
An extraction module for raw cellular traffic vectors x for all mesh regions using an LSTM autoencoderjExtracting low dimensional flow features cj；
The preliminary confirmation module is used for confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas;
and the abnormity confirmation module is used for performing abnormity confirmation on the low-dimensional flow characteristics of the suspected abnormity by using K-means clustering to finish the detection of the abnormal flow of the mobile network based on characteristic dimension reduction.
The detection period is divided into 672 slots.
For any mesh region j, the original cellular traffic vector xj＝[xj[1],xj[2]L xj[p]L xj[K]]TWherein x isj[p]And (4) representing the total mobile phone traffic value of the grid area j in the p hour.
The invention has the following beneficial effects:
the invention relates to a mobile network flow abnormity detection method and system based on characteristic dimension reduction, which is used for detecting user abnormity directly aiming at all grids and utilizing an LSTM self-encoder to carry out original honeycomb flow vector x of all grid areasjExtracting low dimensional flow features cjAnd then, abnormality confirmation is carried out on the low-dimensional flow characteristics of suspected abnormality based on K-means clustering, the abnormality detection function of large-scale high-dimensional flow data is realized, a service provider is facilitated to manage and control the network and optimize network resource allocation, and the data processing time is short.
Drawings
FIG. 1 is a schematic diagram of an LSTM auto-encoder;
FIG. 2 is a feature space sample distribution diagram;
FIG. 3a is a graph of cellular flow within an anomaly grid 3667;
FIG. 3b is a graph of cellular flow within exception grid 3983;
FIG. 3c is a graph of cell flow within the exception grid 4181;
FIG. 3d is a graph of cellular traffic within the exception grid 4621;
FIG. 4a is a graph of the results of flow anomaly detection within anomaly grid 3667;
FIG. 4b is a diagram of the results of flow anomaly detection within anomaly grid 3983;
FIG. 4c is a graph of the results of flow anomaly detection within the anomaly grid 4181;
FIG. 4d is a diagram of the results of traffic anomaly detection within anomaly grid 4621.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, not all of the embodiments, and are not intended to limit the scope of the present disclosure. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
There is shown in the drawings a schematic block diagram of a disclosed embodiment in accordance with the invention. The figures are not drawn to scale, wherein certain details are exaggerated and possibly omitted for clarity of presentation. The shapes of various regions, layers and their relative sizes and positional relationships shown in the drawings are merely exemplary, and deviations may occur in practice due to manufacturing tolerances or technical limitations, and a person skilled in the art may additionally design regions/layers having different shapes, sizes, relative positions, according to actual needs.
The invention relates to a mobile network flow abnormity detection method based on feature dimension reduction, which comprises the following steps:
1) dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, wherein M and N are positive integers, and aggregating the cellular flow value of each grid area by using pandas to obtain the total cellular flow value in hour;
dividing the detection time period into K time slots to form a time sequence vector, and taking the time sequence vector as an original cellular flow vector xjThe detection time period is divided into 672 time slots, and for any grid area j, the original cellular flow vector xj＝[xj[1],xj[2]L xj[p]L xj[672]]TWherein x isj[p]And (4) representing the total mobile phone traffic value of the grid area j in the p hour.
2) Raw cellular traffic vector x for all mesh regions using LSTM autoencoderjExtracting low dimensional flow features cj；
Wherein, 24-dimensional flow vectors are input into an encoding part of the LSTM self-encoder in each step, 28 steps are input in total, and a hidden layer is set as a 3-layer; the flow characteristics obtained by encoding are 2-dimensional vectors; gradually inputting the feature vectors into a decoder for 28 steps, and setting a hidden layer of the decoder as a 3 layer to obtain reconstructed data; and training the LSTM self-encoder by taking the mean square error of the flow data input from the encoder and the reconstructed data output from the encoder as an optimization target.
3) Confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas;
4) and (4) carrying out anomaly confirmation on the low-dimensional flow characteristics of the suspected anomaly by using K-means clustering, and completing the anomaly detection of the mobile network flow based on characteristic dimension reduction.
The specific process of carrying out abnormity confirmation on the low-dimensional flow characteristics of the suspected abnormity by using the K-means cluster comprises the following steps:
forming an abnormal cluster by using the low-dimensional flow characteristics of each suspected abnormality;
determining the optimal clustering number by using the wear-on-Weibull D index DBI, measuring the sample distance by using the Euclidean distance, taking the sample distance as a clustering division criterion, marking the sample with the largest clustering centroid and the smallest sample amount in the same cluster as an abnormal low-dimensional flow characteristic, and simultaneously determining the time period of the abnormal low-dimensional flow characteristic in the grid.
The specific process of the step 4) is as follows:
determining an optimal number of cluster clusters using Davison Baud Index (DBI)
Wherein N is the number of clusters,
average distance, m, of all samples within cluster i (j) to the centroidi,jIs the distance between cluster i and cluster j, wherein,
Mifor the number of active traffic samples in cluster i,
for the active traffic samples in cluster i, ai(aj) Is the center of mass of the cluster, | ·| luminance2Is Euclidean norm, when DBI is minimum, the corresponding N is the optimal cluster number; then, mobile network flow data at each moment in one month is selected from all grids with suspicious anomalies as input samples, and the Euclidean distance is used for calculating the distance between two active samples
Wherein, cluster CiMean vector of
The minimum square error describes the compactness of the cluster samples around the mean vector to a certain extent, and the smaller the E value is, the cluster samples are similarThe higher the degree, finally, because the abnormal flow value is very different from the normal flow value, the abnormal flow samples will constitute a single cluster, and the cluster with the least number of samples and the highest level of the number of flow values is considered abnormal.
Fig. 2 shows the distribution of characteristic space samples of 3000 grids obtained after characteristic dimension reduction.
FIGS. 3 a-3 d are graphs of traffic records within a grid in which suspected anomalies are present;
FIGS. 4a to 4d are diagrams illustrating the results of abnormal detection in the grid in which suspected abnormality occurs;
the performance comparison of the three anomaly detection methods in the high and low flow regions is shown in table 1:
TABLE 1
The invention relates to a mobile network flow abnormity detection system based on feature dimension reduction, which comprises:
the classification module is used for dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, wherein M and N are positive integers, and the cell flow value of each grid area is aggregated by using pandas, so that the total cell flow value in hour is taken as a unit;
a dividing module for dividing the detection time period into K time slots to form a time sequence vector, and using the time sequence vector as an original cellular flow vector xj；
An extraction module for raw cellular traffic vectors x for all mesh regions using an LSTM autoencoderjExtracting low dimensional flow features cj；
The preliminary confirmation module is used for confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas;
and the abnormity confirmation module is used for performing abnormity confirmation on the low-dimensional flow characteristics of the suspected abnormity by using K-means clustering to finish the detection of the abnormal flow of the mobile network based on characteristic dimension reduction.
The detection period is divided into 672 slots.
For any mesh region j, the original cellular traffic vector xj＝[xj[1],xj[2]L xj[p]L xj[K]]TWherein x isj[p]And (4) representing the total mobile phone traffic value of the grid area j in the p hour.
Claims (8)
1. A mobile network flow abnormity detection method based on feature dimension reduction is characterized by comprising the following steps:
dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, wherein M and N are positive integers, and aggregating the cellular flow value of each grid area by using pandas to obtain the total cellular flow value in hour;
dividing the detection time period into K time slots to form a time sequence vector, and taking the time sequence vector as an original cellular flow vector xj；
Raw cellular traffic vector x for all mesh regions using LSTM autoencoderjExtracting low dimensional flow features cj；
Confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas;
and (4) carrying out anomaly confirmation on the low-dimensional flow characteristics of the suspected anomaly by using K-means clustering, and completing the anomaly detection of the mobile network flow based on characteristic dimension reduction.
2. The method for detecting abnormal traffic in a mobile network according to claim 1, wherein the detection period is 672 slots.
3. The method according to claim 1, wherein for any grid region j, the original cellular traffic vector x isj＝[xj[1],xj[2]L xj[p]L xj[K]]TWherein x isj[p]And (4) representing the total mobile phone traffic value of the grid area j in the p hour.
4. The method for detecting abnormal traffic in mobile network based on feature dimension reduction according to claim 1, wherein the encoding part of the LSTM self-encoder inputs 24-dimensional traffic vectors at each step, and the input is 28 steps in total, and the hidden layer is set to 3 layers; the flow characteristics obtained by encoding are 2-dimensional vectors; gradually inputting the feature vectors into a decoder for 28 steps, and setting a hidden layer of the decoder as a 3 layer to obtain reconstructed data; and training the LSTM self-encoder by taking the mean square error of the flow data input from the encoder and the reconstructed data output from the encoder as an optimization target.
5. The method for detecting the abnormal mobile network traffic based on the feature dimension reduction according to claim 1, wherein the specific process of performing the abnormal confirmation on the low-dimensional traffic features of the suspected abnormality by using the K-means cluster comprises the following steps:
forming an abnormal cluster by using the low-dimensional flow characteristics of each suspected abnormality;
determining the optimal clustering number by using the wear-on-Weibull D index DBI, measuring the sample distance by using the Euclidean distance, taking the sample distance as a clustering division criterion, marking the sample with the largest clustering centroid and the smallest sample amount in the same cluster as an abnormal low-dimensional flow characteristic, and simultaneously determining the time period of the abnormal low-dimensional flow characteristic in the grid.
6. A mobile network flow abnormity detection system based on feature dimension reduction is characterized by comprising the following steps:
the classification module is used for dividing the urban area into M multiplied by N grid areas according to the distribution of urban base stations, wherein M and N are positive integers, and the cell flow value of each grid area is aggregated by using pandas, so that the total cell flow value in hour is taken as a unit;
a dividing module for dividing the detection time period into K time slots to form a time sequence vector, and using the time sequence vector as an original cellular flow vector xj；
An extraction module for the primitive bees of all grid areas using the LSTM autoencoderLitter flow vector xjExtracting low dimensional flow features cj；
The preliminary confirmation module is used for confirming suspicious abnormal low-dimensional flow characteristics in the low-dimensional flow characteristics corresponding to all grid areas;
and the abnormity confirmation module is used for performing abnormity confirmation on the low-dimensional flow characteristics of the suspected abnormity by using K-means clustering to finish the detection of the abnormal flow of the mobile network based on characteristic dimension reduction.
7. The system for detecting abnormal traffic in mobile network according to claim 5, wherein the detection time period is 672 slots.
8. The system according to claim 5, wherein the original cellular traffic vector x is for any grid region jj＝[xj[1],xj[2]L xj[p]L xj[K]]TWherein x isj[p]And (4) representing the total mobile phone traffic value of the grid area j in the p hour.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110888057.XA CN113747441A (en) | 2021-08-03 | 2021-08-03 | Mobile network flow abnormity detection method and system based on feature dimension reduction |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110888057.XA CN113747441A (en) | 2021-08-03 | 2021-08-03 | Mobile network flow abnormity detection method and system based on feature dimension reduction |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113747441A true CN113747441A (en) | 2021-12-03 |
Family
ID=78729995
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110888057.XA Pending CN113747441A (en) | 2021-08-03 | 2021-08-03 | Mobile network flow abnormity detection method and system based on feature dimension reduction |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113747441A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114745187A (en) * | 2022-04-19 | 2022-07-12 | 中国人民解放军战略支援部队航天工程大学 | Internal network anomaly detection method and system based on POP flow matrix |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190124045A1 (en) * | 2017-10-24 | 2019-04-25 | Nec Laboratories America, Inc. | Density estimation network for unsupervised anomaly detection |
| US20200099597A1 (en) * | 2018-08-20 | 2020-03-26 | Arbor Networks. Inc. | Scalable unsupervised host clustering based on network metadata |
| CN111556440A (en) * | 2020-05-07 | 2020-08-18 | 之江实验室 | Network anomaly detection method based on traffic pattern |
| CN111783442A (en) * | 2019-12-19 | 2020-10-16 | 国网江西省电力有限公司电力科学研究院 | Intrusion detection method, device, server and storage medium |
-
2021
- 2021-08-03 CN CN202110888057.XA patent/CN113747441A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190124045A1 (en) * | 2017-10-24 | 2019-04-25 | Nec Laboratories America, Inc. | Density estimation network for unsupervised anomaly detection |
| US20200099597A1 (en) * | 2018-08-20 | 2020-03-26 | Arbor Networks. Inc. | Scalable unsupervised host clustering based on network metadata |
| CN111783442A (en) * | 2019-12-19 | 2020-10-16 | 国网江西省电力有限公司电力科学研究院 | Intrusion detection method, device, server and storage medium |
| CN111556440A (en) * | 2020-05-07 | 2020-08-18 | 之江实验室 | Network anomaly detection method based on traffic pattern |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114745187A (en) * | 2022-04-19 | 2022-07-12 | 中国人民解放军战略支援部队航天工程大学 | Internal network anomaly detection method and system based on POP flow matrix |
| CN114745187B (en) * | 2022-04-19 | 2022-11-01 | 中国人民解放军战略支援部队航天工程大学 | Internal network anomaly detection method and system based on POP flow matrix |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103902636B (en) | Method and server based on filter clusters method pushed information | |
| CN106708989B (en) | Skyline query method based on space time sequence data stream application | |
| CN108243435B (en) | Parameter optimization method and device in LTE cell scene division | |
| CN109446243B (en) | Method for detecting power generation abnormity of photovoltaic power station based on big data analysis | |
| CN116055413B (en) | Tunnel network anomaly identification method based on cloud edge cooperation | |
| CN108684043B (en) | Abnormal user detection method of deep neural network based on minimum risk | |
| CN105871879A (en) | Automatic network element abnormal behavior detection method and device | |
| CN113747441A (en) | Mobile network flow abnormity detection method and system based on feature dimension reduction | |
| CN111339924A (en) | Polarized SAR image classification method based on superpixel and full convolution network | |
| CN116527362A (en) | Data protection method based on LayerCFL intrusion detection | |
| CN117170979B (en) | Energy consumption data processing method, system, equipment and medium for large-scale equipment | |
| CN105208582B (en) | The method and system of signal optimization based on grid interference in LTE network | |
| CN111405605B (en) | Wireless network interruption detection method based on self-organizing mapping | |
| CN111556440A (en) | Network anomaly detection method based on traffic pattern | |
| CN112422546A (en) | Network anomaly detection method based on variable neighborhood algorithm and fuzzy clustering | |
| CN114465681B (en) | Multi-node cooperation spectrum sensing method and device for electric power Internet of things | |
| CN114430530B (en) | Space division method, apparatus, device, medium, and program product | |
| CN106658533B (en) | Airspace flow characteristic extraction method considering user distribution | |
| WO2023004899A1 (en) | Method and apparatus for detecting abnormal data of satellite and wireless communication convergence network performance | |
| CN109769216B (en) | Method and device for grouping users in complex environment based on mobile phone signals | |
| CN109167642B (en) | Low-overhead real-time spectrogram construction method based on historical decision data learning | |
| CN114025375A (en) | 5G tracking area abnormity detection method and system based on honeycomb distribution identification technology | |
| CN109104741B (en) | Sample grouping method and method for estimating duty ratio of main user by using same | |
| CN111263382B (en) | Method, device and equipment for determining problem source cell causing overlapping coverage | |
| CN109286900B (en) | Wi-Fi sample data optimization method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20211203 |