Unsupervised anomaly detection method and system based on improved CURE clustering algorithm

Abstract

The invention provides an unsupervised anomaly detection method and a system based on improved CURE clustering algorithm. The detection method comprises the following steps: clustering is carried on training sets and data of abnormal behavior and normal behavior are classified; the classified data are marked; modeling is carried out according to data marked as normal behavior, while modeling algorithm is based on hyperrectangle; data to be detectd are compared with model of normal behavior to judge weather the data to be detected are abnormal data or not. The detection system comprises a data formatting module, a clustering module, a standard class module, a model generating module and a detection module. The detection method is suitable to detect data with relatedness not being strong among dimensions.

Description

Technical field: [0001] The invention relates to an anomaly detection technology, in particular to an unsupervised anomaly detection method based on an improved CURE clustering algorithm and a system based on the method, belonging to the technical field of computer data security. Background technique: [0002] In recent years, with the continuous development of computer technology and the continuous expansion of network scale, intrusions have become more and more serious threats to the security of computer systems and networks. Intrusion is a deliberate attempt to access information without authorization, to alter information, and to render a system unreliable or unusable. As the methods of intrusion become more and more diversified and the means are more and more advanced, traditional static security technologies such as firewalls and data encryption technologies can no longer meet the security requirements of systems and networks. [0003] As an important dynamic security...

AI Technical Summary

Problems solved by technology

However, some of the clustering algorithms used in these unsupervised anomaly detection methods cannot cluster clusters of arbitrary shapes, resulting in an unsatisfactory normal behavior model, which affects the detection effect

Although density-based clustering algorithms and neural network algorithms can cluster clusters of any shape, it takes a lot of time to process training sets containing large-scale data, so that the normal behavior model cannot be updated in time, resulting in Cannot detect intrusions well when network or host conditions change

Images