CN109271855B - Method for extracting characteristics of industrial control signals - Google Patents

Method for extracting characteristics of industrial control signals Download PDF

Info

Publication number
CN109271855B
CN109271855B CN201810902497.4A CN201810902497A CN109271855B CN 109271855 B CN109271855 B CN 109271855B CN 201810902497 A CN201810902497 A CN 201810902497A CN 109271855 B CN109271855 B CN 109271855B
Authority
CN
China
Prior art keywords
physical signal
industrial control
control signals
signal samples
correlation coefficient
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201810902497.4A
Other languages
Chinese (zh)
Other versions
CN109271855A (en
Inventor
戚建淮
赖武光
郑伟范
刘建辉
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Y&D Electronics Information Co Ltd
Original Assignee
Shenzhen Y&D Electronics Information Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Y&D Electronics Information Co Ltd filed Critical Shenzhen Y&D Electronics Information Co Ltd
Priority to CN201810902497.4A priority Critical patent/CN109271855B/en
Publication of CN109271855A publication Critical patent/CN109271855A/en
Application granted granted Critical
Publication of CN109271855B publication Critical patent/CN109271855B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2218/00Aspects of pattern recognition specially adapted for signal processing
    • G06F2218/08Feature extraction
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2218/00Aspects of pattern recognition specially adapted for signal processing
    • G06F2218/12Classification; Matching

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Theoretical Computer Science (AREA)
  • Artificial Intelligence (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Investigating Or Analysing Biological Materials (AREA)
  • Other Investigation Or Analysis Of Materials By Electrical Means (AREA)

Abstract

A method for extracting characteristics of industrial control signals comprises the following steps: s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample; s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples; s3, obtaining a correlation coefficient curve based on the variance map; and S4, obtaining the characteristic threshold values of the physical signal samples of different classes based on the correlation coefficient curve. By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.

Description

Method for extracting characteristics of industrial control signals
Technical Field
The invention relates to the field of signal detection, in particular to a method for extracting characteristics of industrial control signals.
Background
With the increasing requirements on industrial control safety, the existing industrial control safety detection is realized on the network protocol detection level, and no matter what degree of protection is constructed on the network protocol level, the invasion of various network attack means cannot be avoided. The physical signal layer of the industrial control equipment is undoubtedly the most fundamental detection basis, and the detection means established on the signal layer is a more reliable detection method. However, the corresponding functions of different types of industrial control signals are different, and their characteristics are different. In order to quickly identify the type of the received industrial control signal and judge whether the industrial control signal belongs to a normal signal, a fault signal or other invasive virus signals, enough signal characteristic knowledge needs to be learned, and enough samples are required to be collected to extract the characteristics of different types of signals. Therefore, a method for extracting the characteristics of the industrial control signals, which is simple in operation, high in identification efficiency and wide in application range, is needed.
Disclosure of Invention
The technical problem to be solved by the present invention is to provide a method for extracting characteristics of an industrial control signal, aiming at the above-mentioned defects in the prior art.
The technical scheme adopted by the invention for solving the technical problems is as follows: a method for extracting characteristics of industrial control signals is constructed, and comprises the following steps:
s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample;
s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples;
s3, obtaining a correlation coefficient curve based on the variance map;
and S4, obtaining the characteristic threshold values of the physical signal samples of different classes based on the correlation coefficient curve.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S1 further includes:
s11, acquiring a classification instruction signal of the industrial control equipment;
s12, exciting the classification command signal and recording the physical signal of the label corresponding to the classification command signal;
and S13, carrying out normalization processing on the physical signal to obtain the physical signal sample.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S11 further includes:
s111, selecting industrial control equipment to be detected and selecting an instruction classification scheme of the industrial control equipment to be detected;
and S112, classifying the industrial control signals of the industrial control equipment in a labeling mode based on the instruction classification scheme to obtain classification instruction signals.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S2 further includes:
s21, selecting at least two groups of physical signal samples which are the same in quantity and cover the value range variation range from the physical signal samples;
s22, obtaining variance points based on the physical signal samples according to the following formula, and making a variance map based on the variance points:
Figure GDA0003024992390000021
wherein sigma2Representing the variance of the characteristic bytes corresponding to different kinds of physical signal samples, N representing the number of samples of the acquired physical signal samples, xiRepresents the magnitude of the amplitude of the physical signal samples and μ represents the mean of the amplitudes of the physical signal samples.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S3 further includes:
s31, obtaining the waveform of the physical signal sample where the characteristic byte is located based on the variogram;
s32, calculating the waveform mean value of each category to be used as a reference signal of the characteristic byte of the category;
and S33, obtaining a correlation coefficient curve based on the waveform ranges of the reference signal and the physical signal sample.
In the method for extracting characteristics of an industrial control signal according to the present invention, the step S33 further includes calculating a correlation coefficient value of the correlation coefficient curve based on the following formula:
Figure GDA0003024992390000031
where ρ isXYRepresenting the value of the correlation coefficient, Cov (X, Y) representing the covariance of the random variables X and Y, D (X) and D (Y) representing the variance of the random variables X and Y, respectively, μxDenotes the mean value, μ, of the random variable XyRepresents a mean value of a random variable Y, wherein the random variable X represents the reference signal and the random variable Y represents a physical signal sample point within a waveform range of the physical signal sample.
Another technical solution to solve the technical problem of the present invention is to configure a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the method for extracting characteristics of an industrial control signal.
By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Drawings
The invention will be further described with reference to the accompanying drawings and examples, in which:
fig. 1 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention;
fig. 2 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention;
FIG. 3 is a schematic diagram of a sort command signal of the present invention;
FIG. 4 is a schematic diagram of the feature byte extraction of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
The invention relates to a method for extracting characteristics of industrial control signals, which comprises the following steps: s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample; s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples; s3, obtaining a correlation coefficient curve based on the variance map; and S4, obtaining the characteristic threshold values of the physical signal samples of different classes based on the correlation coefficient curve. By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Fig. 1 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention. In step S1, the industrial control signal is acquired and pre-processed to obtain a physical signal sample. In a preferred embodiment of the present invention, the instruction signal of the industrial control device may be obtained first, and then the instruction signal is classified in a labeling manner, so as to obtain a classification instruction signal. The physical signal samples may then be obtained by executing a classification command signal and then recording. In a further preferred embodiment of the invention, the normalization process may be performed on the physical signal samples.
In step S2, at least two groups of physical signal samples are selected from the physical signal samples to be used as feature byte variograms of different classes of physical signal samples. In a preferred embodiment of the present invention, at least two groups of physical signal samples with the same number and covering the value range variation range are selected from the physical signal samples, and then variance points are obtained based on the physical signal samples. Of course, in other preferred embodiments of the present invention, a person skilled in the art can make various signal selections according to actual needs, and can use any method known in the art to make a variogram.
In step S3, a correlation coefficient curve is obtained based on the variance map. In a preferred embodiment of the present invention, the waveform of the physical signal sample in which the characteristic byte is located is obtained based on the variance map. Further, the waveform mean of each class is calculated as a reference signal for the feature byte of the class. Then, a correlation coefficient curve is obtained based on the waveform ranges of the reference signal and the physical signal samples. In the invention, the analysis shows that the variance value of the curve segment where the characteristic byte is located is large, and the size is about 0.5, and the waveform range of the classification data of the characteristic can be obtained according to the characteristic. And observing how many classes the characteristic byte contains, and then calculating the mean value of the corresponding dimension of each class as a reference signal of the class. After the reference signal is obtained, the correlation coefficient is calculated by the points of the reference signal and the characteristic range corresponding to the normalized signal, and finally, a correlation coefficient curve under the reference signal is obtained.
In step S4, feature thresholds for different classes of physical signal samples are obtained based on the correlation coefficient curve. In the preferred embodiment of the present invention, if the feature byte contains a plurality of categories, a plurality of correlation coefficient curves are obtained, and the threshold for identifying classification data belonging to different categories can be determined by observing the distribution trend of the curves.
By implementing the method for extracting the characteristics of the industrial control signals, the characteristics of the industrial control signals can be extracted through concise operation, and the method has high efficiency of identifying the characteristics of the industrial control signals and wide application range.
Fig. 2 is a flowchart of a feature extraction method of an industrial control signal according to a first embodiment of the present invention. In step S1, a classification command signal of the industrial control device is acquired. In a preferred embodiment of the present invention, the industrial control device to be detected is selected, the instruction classification scheme of the industrial control device to be detected is selected, and then the industrial control signals of the industrial control device are classified by labeling based on the instruction classification scheme to obtain the classification instruction signals. Fig. 3 shows the sort instruction signal of the present invention.
In step S2, the sorting command signal is excited and the physical signal of the label corresponding to the sorting command signal is recorded. In a preferred embodiment of the present invention, the sorting command signal may be excited and the physical signal of the label tag corresponding to the sorting command signal may be based on trigger-stop recording. In a further preferred embodiment of the invention, the instruction function of the sorting instruction signal can be verified by replaying the sorting instruction signal. The physical signal with the classification label can be obtained by exciting the classification command signals of all functional classifications. Those skilled in the art will appreciate that any trigger-abort condition setting known in the signaling art may be used with the present invention. The skilled person can make relevant selections according to actual needs. The present invention is not limited by the specific trigger-abort conditions.
In step S3, the physical signal is normalized to obtain the physical signal sample. The waveform of the physical signal can be generally processed by adopting the normalization of positive and negative upper and lower limit values of a voltage value.
At step S4, at least two sets of physical signal samples with the same number and covering the range of value range variation are selected from the physical signal samples.
In step S5, a variance point is obtained according to a set formula based on the physical signal sample, and a variance map is constructed based on the variance point. In other preferred embodiments of the present invention, one skilled in the art can use any method known in the art to make a variogram according to actual needs.
In a preferred embodiment of the present invention, each variance point σ on the variance map can be calculated by the following formula2
Figure GDA0003024992390000051
Wherein sigma2Representing the variance of the characteristic bytes corresponding to different classes of classification command signals, N representing the number of samples of the collected classification command signals, xiRepresents the magnitude of the sample point amplitude and μ represents the mean of the sample point amplitudes.
In step S6, a waveform of the physical signal sample in which the feature byte is located is obtained based on the variance map. As known to those skilled in the art, the waveform of the physical signal sample may also be represented by the sequence number of the physical signal sample where the characteristic byte is located. In the preferred embodiment of the present invention, it is found by analysis that the variance value of the curve segment where the characteristic byte is located is large, and the size is about 0.5, and from this characteristic, the waveform range of the classification data of the characteristic can be obtained. Observe how many categories the signature byte contains.
In step S7, the waveform mean value of each class is calculated as a reference signal for the feature byte of the class. Figure 4 shows the characteristic bytes of the invention. In the invention, it can be observed how many classes the characteristic byte contains, and then calculate the mean value on the corresponding dimension of each class as the reference signal of the class. In other embodiments of the present invention, other reference signals may be used.
In step S8, a correlation coefficient curve is obtained based on the waveform ranges of the reference signal and the physical signal sample.
In a further preferred embodiment of the invention, the visual formula of the correlation coefficient algorithm is:
Figure GDA0003024992390000061
where ρ isXYRepresenting the value of the correlation coefficient, Cov (X, Y) representing the covariance of the random variables X and Y, d (X) and d (Y) representing the variance of the random variables X and Y, respectively, with X being the number of rows of the feature points on the abscissa and Y being the correlation coefficient on the ordinate.
In the invention, after the reference signal is obtained, the correlation coefficient is calculated by the reference signal and the point of the characteristic range corresponding to the normalized signal, and finally, the correlation coefficient curve under the reference signal is obtained. If the characteristic byte contains a plurality of categories, a plurality of correlation coefficient curves are obtained, and the threshold value for identifying physical signal samples belonging to different categories can be determined by observing the distribution trend of the curves.
In a further preferred embodiment of the present invention, the threshold is used to detect the receipt of a test sample (i.e., a test industrial control signal). For example, the correlation values of the test sample with various reference signals can be compared to a threshold value, which can be used as a feature to distinguish signal classes to see if it belongs to the corresponding class.
The method is based on the algorithm of calculating the variance and the correlation through statistics, firstly determines the interval range of the characteristic bytes, then calculates the correlation to obtain the threshold for identifying various signals, has simple operation, high identification efficiency and wide application range, and greatly develops the signal characteristic extraction technology.
The description of the invention also describes the implementation of particular functions and their interrelationships by means of method steps. The boundaries and sequence of these method steps have been specifically defined herein for the convenience of the description. The boundaries and sequence of these functions and relationships may be redefined so that they function properly. These redefinitions of boundaries and order are intended to fall within the spirit and scope of the claimed invention.
The present invention may also be implemented by a computer program product, comprising all the features enabling the implementation of the methods of the invention, when loaded in a computer system. The computer program in this document refers to: any expression, in any programming language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: a) conversion to other languages, codes or symbols; b) reproduced in a different format.
While the invention has been described with reference to specific embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from its scope. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed, but that the invention will include all embodiments falling within the scope of the appended claims.

Claims (6)

1. A method for extracting features of industrial control signals is characterized by comprising the following steps:
s1, acquiring and preprocessing the industrial control signal to obtain a physical signal sample;
s2, selecting at least two groups of physical signal samples from the physical signal samples to be used as feature byte variograms of different types of physical signal samples;
s3, obtaining a correlation coefficient curve based on the variance map;
s4, obtaining characteristic thresholds of different types of physical signal samples based on the correlation coefficient curve;
the step S3 further includes:
s31, obtaining the waveform of the physical signal sample where the characteristic byte is located based on the variogram;
s32, calculating the waveform mean value of each category to be used as a reference signal of the characteristic byte of the category;
s33, obtaining a correlation coefficient curve based on the waveform ranges of the reference signal and the physical signal sample;
the step S2 further includes selecting at least two groups of physical signal samples that are equal in number and cover the range of value range from the physical signal samples, then obtaining variance points based on the physical signal samples, and making the variance map based on the variance points.
2. The method for extracting features of industrial control signals according to claim 1, wherein the step S1 further includes:
s11, acquiring a classification instruction signal of the industrial control equipment;
s12, exciting the classification command signal and recording the physical signal of the label corresponding to the classification command signal;
and S13, carrying out normalization processing on the physical signal to obtain the physical signal sample.
3. The method for extracting features of industrial control signals according to claim 2, wherein the step S11 further includes:
s111, selecting industrial control equipment to be detected and selecting an instruction classification scheme of the industrial control equipment to be detected;
and S112, classifying the industrial control signals of the industrial control equipment in a labeling mode based on the instruction classification scheme to obtain classification instruction signals.
4. The method for extracting features of industrial control signals according to claim 1, wherein in the step S2,
the variance point is obtained according to the following formula:
Figure FDA0003024992380000021
wherein sigma2Representing the variance of the characteristic bytes corresponding to different kinds of physical signal samples, N representing the number of samples of the acquired physical signal samples, xiRepresents the magnitude of the amplitude of the physical signal samples and μ represents the mean of the amplitudes of the physical signal samples.
5. The method for extracting features of industrial control signals according to claim 1, wherein the step S33 further includes calculating the correlation coefficient value of the correlation coefficient curve based on the following formula:
Figure FDA0003024992380000022
where ρ isXYRepresenting the value of the correlation coefficient, Cov (X, Y) representing the covariance of the random variables X and Y, D (X) and D (Y) representing the variance of the random variables X and Y, respectively, μxDenotes the mean value, μ, of the random variable XyRepresents a mean value of a random variable Y, wherein the random variable X represents the reference signal and the random variable Y represents a physical signal sample point within a waveform range of the physical signal sample.
6. A computer-readable storage medium, on which a computer program is stored, wherein the program, when executed by a processor, implements a method for feature extraction of an industrial control signal according to any one of claims 1 to 5.
CN201810902497.4A 2018-08-09 2018-08-09 Method for extracting characteristics of industrial control signals Active CN109271855B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201810902497.4A CN109271855B (en) 2018-08-09 2018-08-09 Method for extracting characteristics of industrial control signals

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201810902497.4A CN109271855B (en) 2018-08-09 2018-08-09 Method for extracting characteristics of industrial control signals

Publications (2)

Publication Number Publication Date
CN109271855A CN109271855A (en) 2019-01-25
CN109271855B true CN109271855B (en) 2021-07-09

Family

ID=65153484

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201810902497.4A Active CN109271855B (en) 2018-08-09 2018-08-09 Method for extracting characteristics of industrial control signals

Country Status (1)

Country Link
CN (1) CN109271855B (en)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8019702B1 (en) * 2007-12-07 2011-09-13 Google Inc. Supervised learning with multi-scale time intervals using a statistical classification model to classify unlabeled events
CN102780700A (en) * 2012-07-27 2012-11-14 天津市亚安科技股份有限公司 Method and device for realizing baud rate and protocol self-adaption in video monitoring field
CN106209843A (en) * 2016-07-12 2016-12-07 工业和信息化部电子工业标准化研究院 A kind of data flow anomaly towards Modbus agreement analyzes method
CN107181724A (en) * 2016-03-11 2017-09-19 华为技术有限公司 A kind of recognition methods for cooperateing with stream, system and the server using this method
CN107689847A (en) * 2017-09-30 2018-02-13 电子科技大学 Mark auxiliary radio communication system signal method of sending and receiving
CN107809310A (en) * 2017-11-15 2018-03-16 深圳大学 Information detecting method, device and receiving device based on packet variance
CN108108712A (en) * 2017-12-29 2018-06-01 哈尔滨工业大学 A kind of Emitter Fingerprint feature extracting method based on variance dimension

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130304739A1 (en) * 2012-05-10 2013-11-14 Samsung Electronics Co., Ltd. Computing system with domain independence orientation mechanism and method of operation thereof

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8019702B1 (en) * 2007-12-07 2011-09-13 Google Inc. Supervised learning with multi-scale time intervals using a statistical classification model to classify unlabeled events
CN102780700A (en) * 2012-07-27 2012-11-14 天津市亚安科技股份有限公司 Method and device for realizing baud rate and protocol self-adaption in video monitoring field
CN107181724A (en) * 2016-03-11 2017-09-19 华为技术有限公司 A kind of recognition methods for cooperateing with stream, system and the server using this method
CN106209843A (en) * 2016-07-12 2016-12-07 工业和信息化部电子工业标准化研究院 A kind of data flow anomaly towards Modbus agreement analyzes method
CN107689847A (en) * 2017-09-30 2018-02-13 电子科技大学 Mark auxiliary radio communication system signal method of sending and receiving
CN107809310A (en) * 2017-11-15 2018-03-16 深圳大学 Information detecting method, device and receiving device based on packet variance
CN108108712A (en) * 2017-12-29 2018-06-01 哈尔滨工业大学 A kind of Emitter Fingerprint feature extracting method based on variance dimension

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
Features extraction and analysis for classifying causable patterns in control charts;Khaled Assaleh et al.;《Computers & Industrial Engineering》;20050831;第49卷(第1期);全文 *
雷达辐射源特征提取和个体识别;杨凡;《中国优秀硕士学位论文全文数据库 信息科技辑》;20180615(第06期);全文 *

Also Published As

Publication number Publication date
CN109271855A (en) 2019-01-25

Similar Documents

Publication Publication Date Title
CN107276805B (en) Sample prediction method and device based on intrusion detection model and electronic equipment
CN108030494B (en) Electrocardiosignal error flag training sample recognition methods based on cross validation
CN101984450B (en) Malicious code detection method and system
CN108957251B (en) Cable joint partial discharge mode identification method
CN110795732A (en) SVM-based dynamic and static combination detection method for malicious codes of Android mobile network terminal
CN113435546B (en) Migratable image recognition method and system based on differentiation confidence level
CN109992969B (en) Malicious file detection method and device and detection platform
CN107688742B (en) Large-scale rapid mobile application APP detection and analysis method
CN112733146B (en) Penetration testing method, device and equipment based on machine learning and storage medium
EP3905084A1 (en) Method and device for detecting malware
CN108508297B (en) Fault arc detection method based on mutation coefficient and SVM
CN111753290A (en) Software type detection method and related equipment
CN108900538B (en) Industrial control signal detection method and device
CN115396204A (en) Industrial control network flow abnormity detection method and device based on sequence prediction
CN114024761B (en) Network threat data detection method and device, storage medium and electronic equipment
CN109271855B (en) Method for extracting characteristics of industrial control signals
CN111950606A (en) Disconnecting link state identification method, device, equipment and storage medium
CN116707992A (en) Malicious traffic avoidance detection method based on generation countermeasure network
CN110718270B (en) Method, device, equipment and storage medium for detecting type of gene sequencing result
CN114970694B (en) Network security situation assessment method and model training method thereof
CN112163217B (en) Malware variant identification method, device, equipment and computer storage medium
KR102247179B1 (en) Xai-based normal learning data generation method and device for unsupervised learning of abnormal behavior detection model
CN113468555A (en) Method, system and device for identifying client access behavior
CN112528893A (en) Abnormal state identification method and device and computer readable storage medium
CN108062473B (en) Training set pruning and malicious program identification method and device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant