Incremental learning-based traffic exception detection method and device, and storage medium

Abstract

The invention discloses an incremental learning-based traffic exception detection method and device, and a storage medium. The method comprises the steps of acquiring traffic data of a user terminal;detecting exception of the traffic data by using a pre-created traffic detection classifier in an exception detection device; and when abnormal data is detected, obtaining training sample data based on the abnormal data, and performing online training on the traffic detection classifier by using the training sample data. The generalization capability of the classifier is improved by diversifying the training samples.

Description

technical field [0001] The invention relates to a network traffic abnormality detection technology, in particular to an abnormal traffic detection method, device and storage medium based on incremental learning. Background technique [0002] Abnormal network traffic refers to the situation where network traffic deviates from its normal track, such as: operation behaviors that occupy resources, aggressive behaviors, etc., especially the abnormalities generated by attack behaviors will threaten the security of the entire network. The purpose of traffic anomaly detection is to discover these anomalies in time and make quick responses. [0003] Current traffic anomaly detection methods include detection methods based on statistical analysis and detection methods based on machine learning. [0004] Based on the method of statistical analysis, data flow sampling can be analyzed according to time series, statistical analysis can be carried out from multiple dimensions such as data...

AI Technical Summary

Problems solved by technology

[0007] 1. The real-time performance is poor. Whether it is based on the selection of statistical analysis threshold or the construction of machine learning-based models, it is necessary to analyze the offline data first, and then deploy the production environment online, and the traffic data is hourly. It is constantly changing every moment. Such a model or threshold is obviously prone to misjudgment or even failure. Even if it is updated regularly, there must be a time lag

[0008] 2. The model is built based on a large number of positive and negative examples. Due to the scarcity of negative examples, the generalization ability of the model is poor

Images