CN113747487B - Method and system for detecting abnormal drift of flow of wireless base station based on Riemann manifold - Google Patents
Method and system for detecting abnormal drift of flow of wireless base station based on Riemann manifold Download PDFInfo
- Publication number
- CN113747487B CN113747487B CN202110837130.0A CN202110837130A CN113747487B CN 113747487 B CN113747487 B CN 113747487B CN 202110837130 A CN202110837130 A CN 202110837130A CN 113747487 B CN113747487 B CN 113747487B
- Authority
- CN
- China
- Prior art keywords
- window
- covariance matrix
- sub
- riemann
- base station
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 47
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 25
- 239000011159 matrix material Substances 0.000 claims abstract description 135
- 238000001514 detection method Methods 0.000 claims abstract description 26
- 238000003070 Statistical process control Methods 0.000 claims abstract description 17
- 238000004364 calculation method Methods 0.000 claims description 8
- 238000004590 computer program Methods 0.000 claims description 4
- 230000008859 change Effects 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- PXFBZOLANLWPMH-UHFFFAOYSA-N 16-Epiaffinine Natural products C1C(C2=CC=CC=C2N2)=C2C(=O)CC2C(=CC)CN(C)C1C2CO PXFBZOLANLWPMH-UHFFFAOYSA-N 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 238000004422 calculation algorithm Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- VCNTUJWBXWAWEJ-UHFFFAOYSA-J aluminum;sodium;dicarbonate Chemical compound [Na+].[Al+3].[O-]C([O-])=O.[O-]C([O-])=O VCNTUJWBXWAWEJ-UHFFFAOYSA-J 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 229910001647 dawsonite Inorganic materials 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 239000006185 dispersion Substances 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000003909 pattern recognition Methods 0.000 description 1
- 238000004886 process control Methods 0.000 description 1
- 238000011897 real-time detection Methods 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/142—Network analysis or design using statistical or mathematical methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Algebra (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Analysis (AREA)
- Mathematical Optimization (AREA)
- Mathematical Physics (AREA)
- Probability & Statistics with Applications (AREA)
- Pure & Applied Mathematics (AREA)
- Position Fixing By Use Of Radio Waves (AREA)
Abstract
The disclosure provides a method and a system for detecting abnormal drift of flow of a wireless base station based on Riemann manifold, wherein the scheme comprises the following steps: acquiring network traffic of a wireless base station and reconstructing phase space of the network traffic; dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively; respectively calculating element mean values and sample covariance matrixes of matrixes formed by the sub-windows; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part; calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix; and obtaining a control interval of the element mean value and the Riemann distance through statistical process control, and judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is positioned in the control interval or not to realize abnormal drift detection of the flow of the wireless base station.
Description
Technical Field
The disclosure belongs to the technical field of wireless base station anomaly detection, and particularly relates to a wireless base station flow anomaly drift detection method and system based on Riemann manifold.
Background
The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art.
Currently, the internet based on 5G technology is rapidly evolving: on the one hand, the internet presents a series of challenges to us in the process of rapid development; on the other hand, new technologies and demands are constantly emerging to change this our lifestyle. The internet is affecting an increasing number of people, almost all network related activities are tied to network traffic, which is an important carrier to record and reflect the user's activities in the network. Through statistical analysis of network traffic, we can indirectly grasp the behavior of users in the network.
The inventor finds that under the actual situation, when the user uses the network resources improperly and the user is attacked by malicious attacks of others, the traffic situation is too large to the normal traffic, so that the network performance is reduced, and the phenomenon is called traffic abnormality; from the data analysis point of view, the statistical characteristics of the base station traffic change, so that the phenomenon of concept drift appears. In actual operation, the collected indexes such as flow are monitored manually, and abnormal drift of the base station is judged based on personal subjective experience. The method relies on subjective experience, and problems such as untimely finding, high labor cost and the like exist. Therefore, how to realize accurate real-time detection of the abnormal drift of the base station flow is a technical problem which needs to be solved currently.
Disclosure of Invention
In order to solve the problems, the disclosure provides a method and a system for detecting abnormal drift of flow of a wireless base station based on a Riemann manifold, wherein the method is based on a multi-scale sliding window, a description method using a covariance matrix as network flow is introduced, the Riemann manifold and statistical process control are combined to realize drift detection of the network flow, and detection precision and detection efficiency are effectively improved.
According to a first aspect of the embodiments of the present disclosure, there is provided a method for detecting abnormal drift of traffic of a wireless base station based on a Riemann manifold, including:
acquiring network traffic of a wireless base station and reconstructing phase space of the network traffic;
dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively;
respectively calculating element mean values and sample covariance matrixes of matrixes formed by the sub-windows; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part;
calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix;
and obtaining a control interval of the element mean value and the Riemann distance through statistical process control, judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is positioned in the control interval, and realizing abnormal drift detection of the flow of the wireless base station.
Further, the phase space reconstruction specifically includes converting the network traffic of the single channel into a matrix representation of the network traffic of the multiple channels through a phase space reconstruction model.
Further, the multi-scale sliding window method specifically comprises the following steps: dividing the reconstructed network traffic into a representative reference window and a sliding window by utilizing a first scale window, and dividing the reference window and the sliding window into sub-windows with the same size respectively by utilizing a second scale window.
Further, the obtaining the element mean value and the control interval of the Riemann distance through statistical process control specifically includes: and analyzing the element mean value and the Riemann distance of a matrix formed by each sub-window of the reference window part through statistical process control to obtain the upper control limit and the lower control limit of the distance from the sample covariance matrix generated by each sub-window in the reference window to the reference covariance matrix, and the upper control limit and the lower control limit of the matrix element mean value in each corresponding sub-window.
According to a second aspect of the embodiments of the present disclosure, there is provided a wireless base station traffic anomaly drift detection system based on a Riemann manifold, including:
a data acquisition unit for acquiring the network traffic of the wireless base station and performing phase space reconstruction on the network traffic;
the window dividing unit is used for dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively;
a reference covariance matrix calculation unit for calculating the element mean value and the sample covariance matrix of the matrix formed by each sub-window; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part;
a Riemann distance calculation unit for calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix;
the detection unit is used for obtaining a control interval of the element mean value and the Riemann distance through statistical process control, judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is positioned in the control interval or not, and realizing abnormal drift detection of the flow of the wireless base station.
According to a third aspect of the embodiments of the present disclosure, there is provided an electronic device, including a memory, a processor, and a computer program stored to run on the memory, where the processor implements the method for detecting abnormal drift of traffic of a wireless base station based on a Riemann manifold when the processor executes the program.
According to a fourth aspect of embodiments of the present disclosure, there is provided a non-transitory computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the method of detecting abnormal drift of wireless base station traffic based on a Riemann manifold.
Compared with the prior art, the beneficial effects of the present disclosure are:
(1) The scheme of the disclosure provides a wireless base station flow abnormal drift detection method based on a Riemann manifold, which is based on a multi-scale sliding window, introduces a description method using a covariance matrix as network flow, combines the Riemann manifold with statistical process control to realize drift detection of the network flow, and improves detection precision and efficiency;
(2) The scheme of the disclosure adopts a multi-scale sliding window method, which not only can obtain a representative basic sample through a large-scale window, but also can more accurately detect concept drift by utilizing a multi-scale small window;
(3) The proposal of the present disclosure introduces a covariance matrix as a representation of network traffic, and since the covariance matrix itself has symmetric, semi-positive characteristics, the matrix belongs to the component of the Riemann manifold. Thus, we can operate on the covariance matrix with operations in the Riemann geometry. Therefore, the problems of noise interference, structural redundancy and the like in the network traffic are solved, and the network traffic is converted into normal distribution, so that the network traffic is convenient to learn.
Additional aspects of the disclosure will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the disclosure.
Drawings
The accompanying drawings, which are included to provide a further understanding of the disclosure, illustrate and explain the exemplary embodiments of the disclosure and together with the description serve to explain the disclosure, and do not constitute an undue limitation on the disclosure.
Fig. 1 is a flowchart of a method for detecting abnormal drift of traffic of a wireless base station based on a Riemann manifold according to an embodiment of the present disclosure;
fig. 2 is a schematic diagram of a multi-scale sliding window model according to a first embodiment of the disclosure.
Detailed Description
The disclosure is further described below with reference to the drawings and examples.
It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present disclosure. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments in accordance with the present disclosure. As used herein, the singular is also intended to include the plural unless the context clearly indicates otherwise, and furthermore, it is to be understood that the terms "comprises" and/or "comprising" when used in this specification are taken to specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof.
Embodiments of the present disclosure and features of embodiments may be combined with each other without conflict.
Embodiment one:
an object of the present embodiment is to provide a method for detecting abnormal drift of traffic of a wireless base station based on a Riemann manifold.
A wireless base station traffic anomaly drift detection method based on Riemann manifold comprises the following steps:
acquiring network traffic of a wireless base station and reconstructing phase space of the network traffic;
dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively;
respectively calculating element mean values and sample covariance matrixes of matrixes formed by the sub-windows; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part;
calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix;
and obtaining a control interval of the element mean value and the Riemann distance through statistical process control, and judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is positioned in the control interval or not to realize abnormal drift detection of the flow of the wireless base station.
In particular, for easy understanding, the following detailed description of the embodiments of the present disclosure will be given with reference to the accompanying drawings:
as shown in fig. 1, the scheme of the present disclosure mainly includes four parts: the first part carries out phase space reconstruction on the collected network traffic, divides the network traffic into a reference window and a sliding window, divides the reference window and the sliding window into small windows with the same length, and obtains the element mean value of each small window forming a matrix; the second part is used for solving a sample covariance matrix according to the matrixes in the small windows in the reference window and the sliding window respectively; and the third part finds a reference covariance matrix on the Riemann manifold composed of the sample covariance matrices generated by the reference window, and obtains the distances from the sample covariance matrix composed of all the small windows to the reference covariance matrix. The fourth part, combine the Riemann distance and matrix element mean value obtained with statistical process control separately, judge the conceptual drift, its detailed step includes:
step 1: dividing windows after re-representing the network traffic, and calculating window element mean values;
the factors that affect the trend change of the sequence in a finite time sequence generated by a nonlinear power system are numerous, and each component of the system evolves to interact with other components. Therefore, the track of the system originally in the high-dimensional space can be extracted and recovered from the time sequence of a certain component, so that a phase space equivalent to the original system is reconstructed, and the implicit rule of the phase space is recovered. In other words, by reconstructing this method in phase space, the structure of the time series can be described more precisely.
Packard et al propose two methods of phase space reconstruction: derivative reconstruction methods and coordinate delay reconstruction methods, of which the delay coordinate reconstruction method is more commonly used. According to the Takes' theorem of embedding, an appropriate embedding dimension m can be found, and when the dimension m of the delay coordinate is not less than 2d+1 (d is the original time sequence dimension), an m-dimensional phase space can be reconstructed.
The network traffic adopted by the user is the number of network traffic used by the user at a certain moment, so that the actually obtained network traffic is often single-channel, and the spatial structure of the original system needs to be constructed through phase space reconstruction. One-dimensional network traffic X (t) = (X) we will take 1 ,x 2 ,...,x N ) N is the length of the network traffic, and the phase space reconstruction is performed, so that the system after m-dimensional phase space reconstruction can be represented by a matrix X:
where τ is the delay time and m is the phase space embedding dimension. Such a one-dimensional network traffic X (t) may be represented by an M X (N- τ) matrix X.
The sliding window method is a very efficient way of handling data streams and is therefore very useful for dynamically monitoring conceptual drift. For one-dimensional time series, a common processing manner of the sliding window method is to divide a long time series into a plurality of short time series, and for a multi-channel series, the sliding window method can be adopted to divide the long time series into a plurality of series, and then covariance matrixes of all sub-series are respectively obtained, which is called a sample covariance matrix. So that the time series of the multiple channels can be represented by the sequence of covariance matrices.
Here we use a multi-scale sliding window approach to process the phase-space reconstructed matrix X. We employ two windows to detect network traffic concept drift, we use a reference window to summarize past normal concept data old information, and a sliding window to collect up-to-date information of the concept drift data to be detected. We divide the matrix X into a reference window of length b and a sliding window of length c. The two large windows are then divided into n sub-windows of width T, then the divided matrix isAnd->We find the corresponding matrix X from the divided sub-windows i Element mean value m of (2) i . The concrete model form is shown in fig. 2.
(2) Calculating a covariance matrix, solving a reference matrix, and calculating a Riemann distance;
riemann manifold M is a topological space of local European space and is a differential manifold with continuous Riemann metrics. Each point on manifold M has a small neighborhood that is differentially homoembryo with a small neighborhood on euro space. In recent years, covariance matrices have been widely used as entities of the Riemann space in fields of pattern recognition, machine learning, image classification, and the like, and have excellent effects. In probability theory and statistics, the covariance matrix is a matrix used to measure the overall error of two variables, each element being the covariance between the individual vector elements. The covariance matrix can thus simultaneously represent the correlation between different dimensions and the variance in each dimension.
For multi-channel signals we need to useThe sample covariance matrix is used to estimate the spatial covariance matrix of the sequence. For this, we divide the matrix obtained by each sub-windowFor calculating the corresponding sample covariance matrix, i.e.>
The covariance matrix is a symmetric semi-positive definite matrix, which can be seen as a point on the Riemann manifold, so we can operate on it. In the Euclidean space, we need to calculate the distance between points by directly using the modulo operation of the vector, but the manifold is not vector space, so the method of calculating the distance in the Euclidean space is not suitable for manifold, and the distance between two points on the Riemann manifold is generally calculated by using the Riemann metric. Riemann manifolds are micro-manifold with Riemann metrics. The Riemann metric is an inner product family over all tangent spaces. It is this metric that can enable us to define geometric concepts of length, angle, etc.
Riemann manifold is the space spanned by a symmetric positive definite matrix, where we setRepresenting a Riemann manifold that is stretched by a real-valued k x k symmetric positive definite matrix. />It can be seen as the interior of a convex cone in k (k+1)/2-dimensional euclidean space, which is a nonlinear dawsonite manifold. Then for any two symmetric positive definite matrices a, B, the more common Riemann metric between them is the affine invariant Riemann metric, which most commonly uses the geodesic distance between two points measured in Riemann manifold, is widely used for analysis of symmetric positive definite matrices. Given two symmetrical positive definite matrices +.>The calculation can be performed by the following formula:
an important step in the proposed algorithm is to calculate the reference covariance matrix, where we calculate the distance from each covariance matrix to the reference covariance matrix according to the Riemann distance minimum principle, and the reference covariance matrix is the average covariance matrix. The calculation method is as follows:
for a set of m symmetric positive definite matricesIts mean value can be obtained by solving the following objective function: />Here δ is a Riemann metric on the Riemann manifold, and the Riemann average can be calculated in four ways.
Using affine invariant Riemann metrics, the Riemann mean can be found by means of iterative updating:
wherein log (·) and exp (·) are the matrix logarithm and the matrix index, respectively.
When we calculate the sample covariance matrix generated by each sub-window in each reference window, we use their Riemann mean P as our reference covariance matrix. Here we exemplify an affine invariant Riemann metric whose formula for the Riemann mean P is:
wherein P is t For the reference matrix of the previous iteration, P i Is the current covariance matrix.
Then, the covariance P of each sample in the reference window and the sliding window is obtained through a formula i Riemann distance S to reference matrix P i 。
Step 3: counting process control;
statistical process control refers to a tool for controlling a process by using a mathematical statistics method and analyzing and controlling the process by using the fluctuating statistical regularity. When the data distribution is stable, the sub window shows normal fluctuation, and when the data distribution is unstable, abnormal fluctuation is generated, so that concept drift is generated.
In general, the upper control limit UCL of the statistical process control chart takes the value of mu+3σ, the CL takes the value of mu, and the lower control limit LCL takes the value of mu-3σ. For conceptual drift detection, ucl=μ+2.4σ and lul=μ -2.4σ are generally taken empirically. Two important parameters are: mu is a position parameter and an average value, and represents the central position and expected value of distribution and reflects the overall comprehensive capacity; σ is a scale parameter, and represents the degree of dispersion and standard deviation of the distribution, and reflects the degree of deviation of the actual value from the expected value, and the larger the value, the more dispersed the data.
We read from left to right the sample covariance matrix P generated by each sub-window i Obtaining covariance matrix P of each sample in the data stream model according to the above formula i A sequence of distances to a corresponding reference covariance matrix P, denoted S i ＝{S 1 ,S 2 ,…,S n All S herein i Each representing the distance of the sample covariance matrix generated by each sub-window from the reference covariance matrix. Since the covariance matrix can only detect correlation between different dimensions and variance variation in each dimension, it is not possible to completely detect whether a conceptual drift has occurred. For this we detect the change in the conceptual drift by detecting the mean of the sub-windows generated from the reference window, the mean of the sub-windows being denoted m i ＝{m 1 ,m 2 ,…,m n All m herein i All representing the matrix X in each sub-window i The mean value of the elements.
Here we use the sample covariance matrix P generated in all sub-windows of length T in the length b reference window i The mean and standard deviation of the distances to the reference covariance matrix P are expressed as:
note that: here we will reference window generated sub-window numberWe express it as a, i.e. +.>The same applies hereinafter.
Matrix X in each sub-window in the reference window i The mean and standard deviation of the mean of the elements are expressed as:
here we implement the detection of the conceptual drift by means of a mean-variance addition function. Firstly, a result based on a multi-scale sliding window method is combined with a statistical process control system, and the distance from a sample covariance matrix generated in each sub-window in a dynamic data stream to a reference covariance matrix and the average value of matrix elements generated in each sub-window are analyzed. Obtaining each of the reference windows separatelySample covariance matrix P generated by small window i Upper control limit UCL to reference covariance matrix P S And a lower control limit LCL S Control upper limit UCL corresponding to matrix element mean value in small window M And a lower control limit LCL M . We obtain the covariance matrix P of each sample in the reference window by a mean-variance additional function i Final to reference covariance matrix P Is a distance of (3).
Similarly, we calculate the distance from each sliding sub-window sample covariance matrix to the reference covariance matrix P and the average value of matrix elements in the sliding sub-window according to the sub-window data in each sliding window, and obtain the distance from the final covariance matrix to the reference covariance matrix through the average value-variance additional function, and even if a certain noise exists, the distance from the covariance matrix generated by most sub-windows in the sliding window to the reference covariance matrix must be also in UCL S With LCL S And wave nearby. If the distance of the sliding sub-window is outside this range, a conceptual drift occurs.
Embodiment two:
an object of the present embodiment is to provide a wireless base station traffic anomaly drift detection system based on a Riemann manifold.
A wireless base station traffic anomaly drift detection system based on a Riemann manifold, comprising:
a data acquisition unit for acquiring the network traffic of the wireless base station and performing phase space reconstruction on the network traffic;
the window dividing unit is used for dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively;
a reference covariance matrix calculation unit for calculating the element mean value and the sample covariance matrix of the matrix formed by each sub-window; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part;
a Riemann distance calculation unit for calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix;
the detection unit is used for obtaining a control interval of the element mean value and the Riemann distance through statistical process control, and abnormal drift detection of the wireless base station flow is realized through judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is positioned in the control interval. In further embodiments, there is also provided:
an electronic device comprising a memory and a processor and computer instructions stored on the memory and running on the processor, which when executed by the processor, perform the method of embodiment one. For brevity, the description is omitted here.
It should be understood that in this embodiment, the processor may be a central processing unit CPU, and the processor may also be other general purpose processors, digital signal processors DSP, application specific integrated circuits ASIC, off-the-shelf programmable gate array FPGA or other programmable logic device, discrete gate or transistor logic devices, discrete hardware components, or the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
The memory may include read only memory and random access memory and provide instructions and data to the processor, and a portion of the memory may also include non-volatile random access memory. For example, the memory may also store information of the device type.
A computer readable storage medium storing computer instructions which, when executed by a processor, perform the method of embodiment one.
The method in the first embodiment may be directly implemented as a hardware processor executing or implemented by a combination of hardware and software modules in the processor. The software modules may be located in a random access memory, flash memory, read only memory, programmable read only memory, or electrically erasable programmable memory, registers, etc. as well known in the art. The storage medium is located in a memory, and the processor reads the information in the memory and, in combination with its hardware, performs the steps of the above method. To avoid repetition, a detailed description is not provided herein.
Those of ordinary skill in the art will appreciate that the elements of the various examples described in connection with the present embodiments, i.e., the algorithm steps, can be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The wireless base station flow abnormal drift detection method and system based on the Riemann manifold can be realized, and has wide application prospect.
The foregoing description of the preferred embodiments of the present disclosure is provided only and not intended to limit the disclosure so that various modifications and changes may be made to the present disclosure by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure should be included in the protection scope of the present disclosure.
While the specific embodiments of the present disclosure have been described above with reference to the drawings, it should be understood that the present disclosure is not limited to the embodiments, and that various modifications and changes can be made by one skilled in the art without inventive effort on the basis of the technical solutions of the present disclosure while remaining within the scope of the present disclosure.
Claims (6)
1. A method for detecting abnormal drift of traffic of a wireless base station based on a Riemann manifold, comprising:
acquiring network traffic of a wireless base station, and carrying out phase space reconstruction on the network traffic, namely converting the network traffic of a single channel into a multi-channel network traffic matrix representation through a phase space reconstruction model;
dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively;
respectively calculating element mean values and sample covariance matrixes of matrixes formed by the sub-windows; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part;
calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix;
obtaining a control interval of the element mean value and the Riemann distance through statistical process control, wherein the control interval comprises the following specific steps: analyzing element mean values and Riemann distances of matrixes formed by the sub-windows of the reference window part through statistical process control to obtain upper control limit and lower control limit of distances from a sample covariance matrix generated by the sub-windows in the reference window to a reference covariance matrix, and upper control limit and lower control limit of matrix element mean values in the corresponding sub-windows; judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is in the control interval or not, and realizing abnormal drift detection of the flow of the wireless base station.
2. The method for detecting abnormal drift of traffic of a wireless base station based on a Riemann manifold as set forth in claim 1, wherein the multi-scale sliding window method specifically comprises: dividing the reconstructed network traffic into a representative reference window and a sliding window by utilizing a first scale window, and dividing the reference window and the sliding window into sub-windows with the same size respectively by utilizing a second scale window.
3. The method for detecting abnormal drift of flow rate of wireless base station based on Riemann manifold as set forth in claim 1, wherein if the distance from the sub-window sample covariance matrix of the sliding window portion to the reference covariance matrix is located in the control interval, no conceptual offset occurs, otherwise, the conceptual offset occurs.
4. A wireless base station traffic anomaly drift detection system based on a Riemann manifold, comprising:
the data acquisition unit is used for acquiring the network traffic of the wireless base station and carrying out phase space reconstruction on the network traffic, specifically, converting the network traffic of a single channel into a multi-channel network traffic matrix representation through a phase space reconstruction model;
the window dividing unit is used for dividing the reconstructed network flow into a reference window and a sliding window by adopting a multi-scale sliding window method, and dividing the reference window and the sliding window into a plurality of sub-windows respectively;
a reference covariance matrix calculation unit for calculating the element mean value and the sample covariance matrix of the matrix formed by each sub-window; obtaining a reference covariance matrix by calculating a Riemann mean value of a sub-window sample covariance matrix divided by a reference window part;
a Riemann distance calculation unit for calculating the Riemann distance from each sub-window sample covariance matrix of the reference window part to the reference covariance matrix;
the detection unit is used for obtaining a control interval of the element mean value and the Riemann distance through statistical process control, and specifically comprises the following steps: analyzing element mean values and Riemann distances of matrixes formed by the sub-windows of the reference window part through statistical process control to obtain upper control limit and lower control limit of distances from a sample covariance matrix generated by the sub-windows in the reference window to a reference covariance matrix, and upper control limit and lower control limit of matrix element mean values in the corresponding sub-windows; judging whether the distance from the sub-window sample covariance matrix of the sliding window part to the reference covariance matrix is in the control interval or not, and realizing abnormal drift detection of the flow of the wireless base station.
5. An electronic device comprising a memory, a processor and a computer program stored for execution on the memory, wherein the processor, when executing the program, implements a method for detecting abnormal drift in traffic of a wireless base station based on a Riemann manifold as claimed in any one of claims 1 to 3.
6. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor implements a method of detecting a wireless base station traffic anomaly drift based on a riman manifold as claimed in any one of claims 1 to 3.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110837130.0A CN113747487B (en) | 2021-07-23 | 2021-07-23 | Method and system for detecting abnormal drift of flow of wireless base station based on Riemann manifold |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110837130.0A CN113747487B (en) | 2021-07-23 | 2021-07-23 | Method and system for detecting abnormal drift of flow of wireless base station based on Riemann manifold |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113747487A CN113747487A (en) | 2021-12-03 |
| CN113747487B true CN113747487B (en) | 2024-04-02 |
Family
ID=78729016
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110837130.0A Active CN113747487B (en) | 2021-07-23 | 2021-07-23 | Method and system for detecting abnormal drift of flow of wireless base station based on Riemann manifold |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113747487B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110191137A (en) * | 2019-06-12 | 2019-08-30 | 北京理工大学 | A kind of network system quantization safety evaluation method and device |
| CN110880984A (en) * | 2019-10-18 | 2020-03-13 | 平安科技（深圳）有限公司 | Model-based flow anomaly monitoring method, device, equipment and storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10410133B2 (en) * | 2017-03-22 | 2019-09-10 | At&T Intellectual Property I, L.P. | Methods, devices and systems for managing network video traffic |
-
2021
- 2021-07-23 CN CN202110837130.0A patent/CN113747487B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110191137A (en) * | 2019-06-12 | 2019-08-30 | 北京理工大学 | A kind of network system quantization safety evaluation method and device |
| CN110880984A (en) * | 2019-10-18 | 2020-03-13 | 平安科技（深圳）有限公司 | Model-based flow anomaly monitoring method, device, equipment and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 基于黎曼流形的MIMO雷达目标检测方法;周美含;姜宏;孙帅;;吉林大学学报(信息科学版)(第03期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113747487A (en) | 2021-12-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Juvonen et al. | Online anomaly detection using dimensionality reduction techniques for HTTP log analysis | |
| Sadreazami et al. | Distributed-graph-based statistical approach for intrusion detection in cyber-physical systems | |
| KR102223419B1 (en) | Fast grouping of time series | |
| WO2021027697A1 (en) | Traffic abnormality detection method, and model training method and apparatus | |
| CN109257383B (en) | BGP anomaly detection method and system | |
| Zhu et al. | Boosting out-of-distribution detection with typical features | |
| CN108921424B (en) | Power data anomaly detection method, device, equipment and readable storage medium | |
| WO2014132612A1 (en) | System analysis device and system analysis method | |
| CN105518654B (en) | To tool processing data offer multi-variables analysis based on K nearest neighbor method and system | |
| CN114861788A (en) | Load abnormity detection method and system based on DBSCAN clustering | |
| JP6183449B2 (en) | System analysis apparatus and system analysis method | |
| Thill et al. | Time series anomaly detection with discrete wavelet transforms and maximum likelihood estimation | |
| Hajek et al. | Information limits for recovering a hidden community | |
| Castro et al. | Adaptive sensing for estimation of structured sparse signals | |
| CN115185761A (en) | Abnormality detection method and apparatus | |
| CN111767538A (en) | Industrial control intrusion detection system feature selection method based on related information entropy | |
| Liu et al. | DSpar: An embarrassingly simple strategy for efficient GNN training and inference via degree-based sparsification | |
| Schoeneman et al. | Entropy-isomap: Manifold learning for high-dimensional dynamic processes | |
| KR101307337B1 (en) | System and method for Triangle Counting Sampling by using Map-Reduce | |
| Setitra et al. | Feature modeling and dimensionality reduction to improve ML-based DDOS detection systems in SDN environment | |
| CN113747487B (en) | Method and system for detecting abnormal drift of flow of wireless base station based on Riemann manifold | |
| Kasarapu et al. | Resource-and workload-aware malware detection through distributed computing in iot networks | |
| EP4227855A1 (en) | Graph explainable artificial intelligence correlation | |
| CN108154162A (en) | A kind of clustering method and device | |
| Kovács et al. | Optimistic search: Change point estimation for large-scale data via adaptive logarithmic queries |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |