MH-LSTM anomaly detection method based on session feature similarity

Abstract

The invention discloses an MH-LSTM anomaly detection method based on session feature similarity. The method comprises the steps: setting a sliding window to collect Web access data of a user, and carrying out the processing of the Web access data through Min-Hash, and extracting sequence features; training a detection model by using a time sequence classification algorithm of LSTM; and finally, detecting and positioning abnormal users in the captured Web session stream data by using the trained detection model. The method not only can effectively adapt to challenges in a streaming data environment, but also can maintain a high detection rate and a high recall rate.

Description

technical field [0001] The invention relates to the field of anomaly detection of WEB stream data, in particular to an MH-LSTM anomaly detection method based on session feature similarity. Background technique [0002] Along with people's increasing dependence on Web applications, while Web services bring convenience to people, their security issues have become a common threat to all human beings. How to resist various attacks on the Web has become one of the biggest challenges in the global field. Generally speaking, the initial symptoms of security problems are abnormal information, and abnormal information can be found as early as possible through abnormal detection to help stop losses in time. How to detect and locate anomalies in a timely manner from Web streaming data is a current research hotspot. [0003] Generally speaking, the current anomaly detection research at home and abroad mainly includes the following three aspects: (1) Anomaly detection algorithms based o...

AI Technical Summary

Problems solved by technology

[0003] Generally speaking, the current research on anomaly detection at home and abroad mainly includes the following three aspects: (1) Anomaly detection algorithms based on statistical analysis, when faced with large data sets with complex data distribution, due to the difficulty in delineating the outline of the data distribution, Its detection ability is obviously reduced, and the setting of the detection threshold has always been a major factor affecting the detection performance; (2) The rule-based anomaly detection algorithm can well guarantee the accuracy of anomaly detection, but how to update the rules in time is the key There is a problem with the method; (3) Anomaly detection algorithms based on data mining usually require a large amount of labeled data for model training, but in actual situations, labeled data in various fields are often difficult to obtain and belong to the field of unsupervised learning. The accuracy of the model is weaker than other methods

Images