Semi-supervised time sequence anomaly detection method and system

Abstract

The invention relates to a semi-supervised time sequence anomaly detection method and system, wherein the method comprises the steps: constructing an auto-encoder model based on a long short-term memory network, wherein the auto-encoder model comprises an encoder, a normal traffic data decoder and an abnormal traffic data decoder, and selecting a normal marked traffic data set and an unmarked traffic data set from a time sequence data set of traffic. Two training sets are used for training the auto-encoder model, a threshold does not need to be predefined in advance, and for unmarked data, whether the data are abnormal or not can be judged by comparing the sizes of reconstruction errors passing through two decoders. According to the method, the difficulty of optimal threshold selection is avoided, anomaly detection can be accurately carried out, a sliding window is adopted to carry out enrichment processing of abnormal traffic data on the unmarked traffic data set, the problem of rare abnormal points is solved, the abnormal data is enriched, and the anomaly detection rate is further improved.

Description

technical field [0001] The invention relates to the technical field of anomaly detection, in particular to a semi-supervised time series anomaly detection method and system. Background technique [0002] With the development of the technology era, the amount of data is growing explosively. Among these data, the proportion of time series data is very large. Among them, the most common type of time-series data is network traffic, which refers to the amount of data sent and received by people who visit online websites. Abnormal network traffic indicates abnormal changes in time-series traffic, and the abnormal data in it may cause serious Consequences, fast and accurate detection is crucial to the efficient operation of complex computer network systems. [0003] At present, there are certain defects in the traditional method, such as the method based on rules, the first step of this method is to obtain the rules, and the second step is to judge whether the behavior is similar ...

AI Technical Summary

Problems solved by technology

Generally, the reconstruction error can be obtained by calculating the reconstructed sample with the original sample, and then comparing the reconstruction error with a predefined threshold to judge whether the sample is an abnormal sample, but the optimal threshold is difficult to choose

Images