Real-time detection method for security event abnormity

Abstract

The invention discloses a real-time detection method for security event abnormity. The periodicity of a multi-channel security event counting sequence on a plurality of time dimensions (such as years,months, weeks and days) can be quickly and effectively extracted and quantized into periodic items (namely, contributions of the time dimensions to security event counting values). A high-precision and real-time prediction model can be constructed for a multi-channel and long-period safety event counting sequence in a low training cost manner; due to the fact that the multi-time-dimension periodic items are introduced into the prediction model to serve as additional input, the time step length for training the recurrent neural network prediction model can be greatly shortened, the network complexity is reduced, the training cost and the over-fitting possibility are reduced, and meanwhile the prediction precision is improved. A prediction model is combined with a probabilistic anomaly judgment method based on deviation distribution estimation, so that a more scientific and accurate anomaly judgment mechanism is realized compared with a judgment mode based on an absolute threshold value, relative change, simple prediction and the like at present.

Description

technical field [0001] The invention relates to the technical field of server (cluster) abnormal / attacked monitoring and detection, in particular to a real-time detection method for abnormal security events. Background technique [0002] Server system security monitoring and network security monitoring are the basis for realizing the security protection of the production environment, and are the most important part of the operation and maintenance work. Server / network security monitoring has always been highly valued by IT companies, but long-term practice shows that malicious attacks and security anomalies often occur irregularly, and the effects of attacks / anomalies (mainly referring to the state changes of the target system) are unpredictable , making it very difficult to detect them in security monitoring. [0003] At present, there are a lot of anomaly / attack (hereinafter collectively referred to as anomaly) determination technologies used in the field of server system...

AI Technical Summary

Problems solved by technology

At present, although there are a variety of models and tools that can be used to build predictive models of security event count sequences (which are time series in nature), such as autoregressive models, periodic decomposition models, and recurrent neural networks, etc., most existing so