Multi-data-stream anomaly detection method based on context

Abstract

The invention provides a multi-data-stream anomaly detection method based on the context. The method comprises the following steps that 1, multiple data streams are obtained, and snapshots are generated; 2, the anomaly of the snapshots of the multiple data streams is quantified; 3, the anomaly of the data streams is quantified; 4, the anomaly of the data streams is recognized. The detection method aims to adopt the node anomaly detection of an isomorphism distributed computation system as the study background and adopt the data streams monitored by computational nodes as the study object, the anomaly detection method comprehensively considers the context information of the multiple data streams and the historical behavior information of a single data stream, and the detection rate is high.

Description

technical field [0001] The invention belongs to anomaly detection technology, in particular to an anomaly detection method that integrates context information of multiple data streams and historical behavior information of a single data stream. Background technique [0002] Data stream anomaly detection is an important direction in data stream mining research. Anomalies refer to data that are out of the ordinary in a data set, that are not due to random bias, but are generated by an entirely different mechanism. Since finding anomalies in data streams has a wide range of applications in the fields of network attack monitoring, credit card fraud, and computing system performance analysis, data stream anomaly detection methods are one of the current research hotspots. The detection and mining of abnormal behaviors on data streams The research has attracted the attention of academia and industry. [0003] In real-world applications such as distributed computing, the data stre...

AI Technical Summary

Problems solved by technology

(Park N H, Lee W S. Statistical grid-based clustering over data streams[J]. ACM SIGMOD Record, 2004, 33(1): 32-37.) The above anomaly detection methods either use the top-p method to quantify the abnormal value The highest p data streams are regarded as anomalies, or the data streams whose abnormal quantization value exceeds a predefined threshold are regarded as anomalies. These methods have problems in practical application: 1) The threshold is difficult to set

However, the LOF algorithm does not consider the difference in the value range of different dimensions, which may lead to the influence of some dimensions being significantly greater than others; in addition, its time complexity is acceptable for offline detection, but not for real-time detection. practical

Images