Host abnormality detection method and system

Abstract

The present invention discloses a host abnormality detection method and system. The method comprises: constructing a list of sensitive hosts and collecting host running resource characteristics of the sensitive hosts; using the PCA algorithm to extract main characteristics of the host running resource characteristics; using the DBSCAN algorithm to carry out cluster analysis on the main characteristics to determine whether there is an abnormality point; and finally, using the sliding window algorithm to collect statistics of the number of abnormality points in the window and determining whether the sensitive host is an abnormal host according to the number of abnormality points. According to the method disclosed by the present invention, the known and unknown host abnormal behaviors within a duration can be effectively detected, the detection efficiency is significantly improved, the resource utilization rate is reduced, and the real time detection is improved; and in addition, without training, the method is efficient and simple, the system overhead is small, and host abnormality can be detected in real time.

Description

technical field [0001] The invention relates to the security field of a networked host system, in particular to a host anomaly detection method and system. Background technique [0002] With the rapid development of network technology, computer network has become a major industry related to the national economy and people's livelihood. For example, my country's Internet applications have gradually shifted from information content acquisition and leisure entertainment to high-risk types related to personal information and personal property safety such as e-commerce, social networking, and online finance. Therefore, the network security of various types of devices in various scenarios has become more and more important and prominent. [0003] With the rapid development of computer technology, there are more and more attacks on host behavior. According to the statistics of ICSA (International Computer Security Association), there are dozens of new viruses threatening computers...

AI Technical Summary

Problems solved by technology

However, the real-time performance and accuracy of these two methods for host intrusion detection are low, and they cannot detect the intrusion of unknown hosts.