CN112532643B - Flow anomaly detection method, system, terminal and medium based on deep learning - Google Patents
Flow anomaly detection method, system, terminal and medium based on deep learning Download PDFInfo
- Publication number
- CN112532643B CN112532643B CN202011418799.8A CN202011418799A CN112532643B CN 112532643 B CN112532643 B CN 112532643B CN 202011418799 A CN202011418799 A CN 202011418799A CN 112532643 B CN112532643 B CN 112532643B
- Authority
- CN
- China
- Prior art keywords
- flow
- data
- deep learning
- network
- sequence
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 38
- 238000013135 deep learning Methods 0.000 title claims abstract description 32
- 238000000034 method Methods 0.000 claims abstract description 27
- 238000012549 training Methods 0.000 claims abstract description 27
- 238000013528 artificial neural network Methods 0.000 claims abstract description 12
- 238000005291 chaos (dynamical) Methods 0.000 claims abstract description 11
- 238000004364 calculation method Methods 0.000 claims abstract description 5
- 210000002569 neuron Anatomy 0.000 claims description 30
- 238000012545 processing Methods 0.000 claims description 15
- 238000004590 computer program Methods 0.000 claims description 13
- 230000005856 abnormality Effects 0.000 claims description 10
- 230000008859 change Effects 0.000 claims description 3
- 238000005314 correlation function Methods 0.000 claims description 3
- 238000010606 normalization Methods 0.000 claims description 3
- 238000007781 pre-processing Methods 0.000 claims description 3
- 230000002159 abnormal effect Effects 0.000 abstract description 4
- 230000008569 process Effects 0.000 abstract description 4
- 238000010586 diagram Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 5
- 238000003860 storage Methods 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 238000013461 design Methods 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/06—Physical realisation, i.e. hardware implementation of neural networks, neurons or parts of neurons
- G06N3/061—Physical realisation, i.e. hardware implementation of neural networks, neurons or parts of neurons using biological neurons, e.g. biological neurons connected to an integrated circuit
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Biophysics (AREA)
- Biomedical Technology (AREA)
- Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Evolutionary Computation (AREA)
- General Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Molecular Biology (AREA)
- Mathematical Physics (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- General Health & Medical Sciences (AREA)
- Neurology (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Microelectronics & Electronic Packaging (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a flow anomaly detection method, a system, a terminal and a medium based on deep learning, which relate to the technical field of Internet and solve the problems of low efficiency and poor timeliness of the existing network flow anomaly detection, and the technical scheme is as follows: classifying historical network flow data; normalizing various historical network flow data to obtain a flow time sequence; training all flow time sequences through a deep learning neural network training model to obtain a flow main line, a flow branch line and associated information; predicting to obtain the main flow prediction data of the next moment through a prediction model based on a chaos theory method; calculating according to the associated information to obtain branch flow prediction data at the moment of the corresponding flow branch line; and comparing and analyzing the real-time network flow data with the flow prediction data to obtain an abnormal detection result. The method has low complexity in the calculation process, and the anomaly detection result can be obtained through direct comparison, so that the timeliness is high.
Description
Technical Field
The invention relates to the technical field of Internet, in particular to a flow anomaly detection method, a flow anomaly detection system, a flow anomaly detection terminal and a flow anomaly detection medium based on deep learning.
Background
With the advent of the big data age, the internet application layer was varied and the components of the network were increasingly complex. In order to better implement network management and network security measures, network administrators need to detect massive network traffic types and traffic anomalies. In the last decade, the network traffic classification method plays an important role in optimizing network configuration, reducing network security risks and improving user service quality.
New application types are continuously emerging in the network, so that the diversity and complexity of network traffic are greatly increased, the network traffic is identified and classified by the network traffic classification method, and then the classified network traffic is subjected to network anomaly comparison analysis, so that the network anomaly monitoring system has the advantages of larger data processing capacity, high complexity and certain delay, and is difficult to achieve the effect of efficiently and real-time monitoring the flow anomaly safety.
Therefore, how to study and design a flow anomaly detection method, a system, a terminal and a medium which are efficient and real-time and based on deep learning is a problem which needs to be solved at present.
Disclosure of Invention
The invention aims to solve the problems of low efficiency and poor timeliness of the existing network flow anomaly detection, and provides a flow anomaly detection method, a system, a terminal and a medium based on deep learning.
The technical aim of the invention is realized by the following technical scheme:
in a first aspect, a flow anomaly detection method based on deep learning is provided, including the following steps:
s101: acquiring historical network flow data, and classifying the historical network flow data according to the network flow type;
s102: normalizing various historical network flow data to obtain a corresponding class flow time sequence;
s103: training all flow time sequences through a deep learning neural network training model to obtain a flow main line, a flow branch line and related information of the flow branch line and the flow main line;
s104: predicting the flow time sequence of the flow main line through a prediction model based on a chaos theory method to obtain main flow prediction data of the next moment;
s105: calculating according to the associated information of the same flow main line and the network flow prediction data to obtain branch flow prediction data of the corresponding flow branch line at the next moment;
s106: and acquiring real-time network flow data, and comparing and analyzing the real-time network flow data with flow prediction data to obtain an abnormality detection result.
Further, the deep learning neural network training model comprises an input layer, a first hidden layer, a second hidden layer and an output layer;
the input layer is provided with N neurons, wherein N is the number of classification types of the network flow data;
the first hidden layer is provided with M neurons, wherein M is the sequence number of the traffic time sequence;
the second hidden layer is provided with P multiplied by Q neurons, P is the number of preset main lines, and N=P+Q;
the output layer is provided with three neurons;
each neuron of the input layer is respectively connected with each neuron of the first hidden layer in sequence;
each neuron of the first hidden layer is respectively connected with each neuron of the second hidden layer in sequence;
each neuron of the second hidden layer is respectively connected with each neuron of the output layer in turn.
Further, the main flow line training selection specifically includes:
each value of the flow time sequence of the flow main line is not zero;
and, preferentially selecting the line with the largest number of associated flow branch lines.
Further, the association information includes:
starting point information of the flow branch line and the flow main line;
termination point information associated with the flow branch line and the flow main line;
the correlation function of the flow branch line and the flow main line in the time period from the starting point to the ending point.
Further, the prediction model based on the chaos theory method specifically comprises the following steps:
determining time delay of the flow time sequence by a sequence correlation method, and determining the optimal embedding dimension of the flow time sequence by a saturation correlation dimension method;
establishing a reconstructed phase space according to the optimal embedding dimension, preprocessing a flow time sequence in a spaced point-taking mode, and then putting the flow time sequence into the reconstructed phase space;
calculating the closeness between two sequence points in a reconstructed phase space through Euclidean distance, and selecting a plurality of sequence points with minimum closeness with a predicted report starting point to form a similar near point set;
and predicting the coordinate change of the follow-up sequence points of the predicted report point through the coordinate values of the follow-up sequence points of the similar near point set.
In a second aspect, a flow anomaly detection system based on deep learning is provided, comprising:
the data dividing module is used for acquiring historical network flow data and classifying the historical network flow data according to the network flow type;
the data processing module is used for carrying out normalization processing on various historical network flow data to obtain a flow time sequence of a corresponding class;
the model training module is used for training all flow time sequences through the deep learning neural network training model to obtain a flow main line, a flow branch line and the related information of the flow branch line and the flow main line;
the data prediction module is used for predicting the flow time sequence of the flow main line through a prediction model based on a chaos theory method to obtain main flow prediction data at the next moment;
the data calculation module is used for calculating branch flow prediction data at the next moment of the corresponding flow branch line according to the associated information of the same flow main line and the network flow prediction data;
the abnormality detection module is used for acquiring real-time network flow data, and comparing and analyzing the real-time network flow data with flow prediction data to obtain an abnormality detection result.
In a third aspect, a computer terminal is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the deep learning based flow anomaly detection method according to any one of the first aspects when the processor executes the program.
In a fourth aspect, there is provided a computer readable medium having stored thereon a computer program, wherein execution of the computer program by a processor implements the deep learning based flow anomaly detection method of any one of the first aspects.
Compared with the prior art, the invention has the following beneficial effects:
1. the invention firstly carries out classification processing on the network traffic, then trains the classified network traffic to obtain the traffic main line, the traffic branch line and the associated information of the traffic branch line and the traffic main line which can reflect the distribution condition of the network traffic in a time domain, predicts the main traffic prediction data of the traffic main line at the next moment, and combines the corresponding associated function to calculate the branch traffic prediction data of the traffic branch line, thereby having lower complexity of the calculation process; the obtained real-time network flow data is directly compared to obtain an abnormal detection result, so that the timeliness is high;
2. the method can intuitively obtain the time node with the abnormal condition and the specific abnormal condition, does not need secondary analysis and processing, and has simple data processing process;
3. according to the invention, the network traffic is subjected to classification training of the main line and the branch line through the deep learning neural network training model, the classification effect of the main line and the branch line is good, and the correlation between the main line and the branch line is strong;
4. according to the invention, the network flow data is predicted by the prediction model based on the chaos theory method, and the prediction result is accurate and reliable.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments or the description of the prior art will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart in an embodiment of the invention;
FIG. 2 is a schematic diagram of a deep learning neural network training model in an embodiment of the present invention;
fig. 3 is a system architecture diagram in an embodiment of the invention.
Detailed Description
In order to make the technical problems, technical schemes and beneficial effects to be solved more clear, the invention is further described in detail below with reference to the accompanying drawings and embodiments.
Example 1: the flow anomaly detection method based on deep learning, as shown in fig. 1, comprises the following steps:
s101: acquiring historical network flow data, and classifying the historical network flow data according to the network flow type;
s102: normalizing various historical network flow data to obtain a corresponding class flow time sequence;
s103: training all flow time sequences through a deep learning neural network training model to obtain a flow main line, a flow branch line and related information of the flow branch line and the flow main line;
s104: predicting the flow time sequence of the flow main line through a prediction model based on a chaos theory method to obtain main flow prediction data of the next moment;
s105: calculating according to the associated information of the same flow main line and the network flow prediction data to obtain branch flow prediction data of the corresponding flow branch line at the next moment;
s106: and acquiring real-time network flow data, and comparing and analyzing the real-time network flow data with flow prediction data to obtain an abnormality detection result.
As shown in fig. 2, the deep learning neural network training model includes an input layer, a first hidden layer, a second hidden layer, and an output layer. The input layer is provided with N neurons, wherein N is the number of classification types of the network flow data; the first hidden layer is provided with M neurons, wherein M is the sequence number of the traffic time sequence; the second hidden layer is provided with P multiplied by Q neurons, P is the number of preset main lines, and N=P+Q; the output layer is provided with three neurons. Each neuron of the input layer is respectively connected with each neuron of the first hidden layer in sequence; each neuron of the first hidden layer is respectively connected with each neuron of the second hidden layer in sequence; each neuron of the second hidden layer is respectively connected with each neuron of the output layer in turn.
The flow main line training selection specifically comprises the following steps: each value of the flow time sequence of the flow main line is not zero; and, preferentially selecting the line with the largest number of associated flow branch lines.
The association information includes: starting point information of the flow branch line and the flow main line; termination point information associated with the flow branch line and the flow main line; the correlation function of the flow branch line and the flow main line in the time period from the starting point to the ending point.
The prediction model based on the chaos theory method specifically comprises the following steps: determining time delay of the flow time sequence by a sequence correlation method, and determining the optimal embedding dimension of the flow time sequence by a saturation correlation dimension method; establishing a reconstructed phase space according to the optimal embedding dimension, preprocessing a flow time sequence in a spaced point-taking mode, and then putting the flow time sequence into the reconstructed phase space; calculating the closeness between two sequence points in a reconstructed phase space through Euclidean distance, and selecting a plurality of sequence points with minimum closeness with a predicted report starting point to form a similar near point set; and predicting the coordinate change of the follow-up sequence points of the predicted report point through the coordinate values of the follow-up sequence points of the similar near point set.
Example 2: the flow anomaly detection system based on deep learning, as shown in fig. 3, comprises a data dividing module, a data processing module, a model training module, a data predicting module, a data calculating module and an anomaly detection module. The data dividing module is used for acquiring historical network flow data and classifying the historical network flow data according to the network flow type. And the data processing module is used for carrying out normalization processing on various historical network flow data to obtain a flow time sequence of a corresponding class. The model training module is used for training all flow time sequences through the deep learning neural network training model to obtain a flow main line, a flow branch line and the related information of the flow branch line and the flow main line. And the data prediction module is used for predicting the flow time sequence of the flow main line through a prediction model based on a chaos theory method to obtain the main flow prediction data of the next moment. And the data calculation module is used for calculating and obtaining branch flow prediction data at the next moment of the corresponding flow branch line according to the associated information of the same flow main line and the network flow prediction data. The abnormality detection module is used for acquiring real-time network flow data, and comparing and analyzing the real-time network flow data with flow prediction data to obtain an abnormality detection result.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The foregoing description of the embodiments has been provided for the purpose of illustrating the general principles of the invention, and is not meant to limit the scope of the invention, but to limit the invention to the particular embodiments, and any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the invention are intended to be included within the scope of the invention.
Claims (8)
1. The flow anomaly detection method based on deep learning is characterized by comprising the following steps of:
s101: acquiring historical network flow data, and classifying the historical network flow data according to the network flow type;
s102: normalizing various historical network flow data to obtain a corresponding class flow time sequence;
s103: training all flow time sequences through a deep learning neural network training model to obtain a flow main line, a flow branch line and related information of the flow branch line and the flow main line;
s104: predicting the flow time sequence of the flow main line through a prediction model based on a chaos theory method to obtain main flow prediction data of the next moment;
s105: calculating to obtain branch flow prediction data of the corresponding flow branch line at the next moment according to the associated information of the same flow main line and the main flow prediction data;
s106: and acquiring real-time network flow data, and comparing and analyzing the real-time network flow data with flow prediction data to obtain an abnormality detection result.
2. The flow anomaly detection method based on deep learning of claim 1, wherein the deep learning neural network training model comprises an input layer, a first hidden layer, a second hidden layer and an output layer;
the input layer is provided with N neurons, wherein N is the number of classification types of the network flow data;
the first hidden layer is provided with M neurons, wherein M is the sequence number of the traffic time sequence;
the second hidden layer is provided with P multiplied by Q neurons, P is the number of preset main lines, and N=P+Q;
the output layer is provided with three neurons;
each neuron of the input layer is respectively connected with each neuron of the first hidden layer in sequence;
each neuron of the first hidden layer is respectively connected with each neuron of the second hidden layer in sequence;
each neuron of the second hidden layer is respectively connected with each neuron of the output layer in turn.
3. The flow anomaly detection method based on deep learning as claimed in claim 1, wherein the flow main line training selection specifically includes:
each value of the flow time sequence of the flow main line is not zero;
and selecting the line with the largest number of associated flow branch lines.
4. The deep learning-based flow anomaly detection method of claim 1, wherein the association information comprises:
starting point information of the flow branch line and the flow main line;
termination point information associated with the flow branch line and the flow main line;
the correlation function of the flow branch line and the flow main line in the time period from the starting point to the ending point.
5. The flow anomaly detection method based on deep learning of claim 1, wherein the prediction model based on the chaos theory method specifically comprises:
determining time delay of the flow time sequence by a sequence correlation method, and determining the optimal embedding dimension of the flow time sequence by a saturation correlation dimension method;
establishing a reconstructed phase space according to the optimal embedding dimension, preprocessing a flow time sequence in a spaced point-taking mode, and then putting the flow time sequence into the reconstructed phase space;
calculating the closeness between two sequence points in a reconstructed phase space through Euclidean distance, and selecting a plurality of sequence points with minimum closeness with a predicted report starting point to form a similar near point set;
and predicting the coordinate change of the follow-up sequence points of the predicted report point through the coordinate values of the follow-up sequence points of the similar near point set.
6. A flow abnormality detection system based on deep learning is characterized by comprising:
the data dividing module is used for acquiring historical network flow data and classifying the historical network flow data according to the network flow type;
the data processing module is used for carrying out normalization processing on various historical network flow data to obtain a flow time sequence of a corresponding class;
the model training module is used for training all flow time sequences through the deep learning neural network training model to obtain a flow main line, a flow branch line and the related information of the flow branch line and the flow main line;
the data prediction module is used for predicting the flow time sequence of the flow main line through a prediction model based on a chaos theory method to obtain main flow prediction data at the next moment;
the data calculation module is used for calculating branch flow prediction data at the next moment of the corresponding flow branch line according to the associated information of the same flow main line and the main flow prediction data;
the abnormality detection module is used for acquiring real-time network flow data, and comparing and analyzing the real-time network flow data with flow prediction data to obtain an abnormality detection result.
7. A computer terminal comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the deep learning based flow anomaly detection method of any one of claims 1-5 when the program is executed by the processor.
8. A computer readable medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the deep learning based flow anomaly detection method of any one of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011418799.8A CN112532643B (en) | 2020-12-07 | 2020-12-07 | Flow anomaly detection method, system, terminal and medium based on deep learning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011418799.8A CN112532643B (en) | 2020-12-07 | 2020-12-07 | Flow anomaly detection method, system, terminal and medium based on deep learning |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112532643A CN112532643A (en) | 2021-03-19 |
| CN112532643B true CN112532643B (en) | 2024-02-20 |
Family
ID=74997888
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011418799.8A Active CN112532643B (en) | 2020-12-07 | 2020-12-07 | Flow anomaly detection method, system, terminal and medium based on deep learning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112532643B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113688924B (en) * | 2021-08-31 | 2024-05-31 | 中国平安财产保险股份有限公司 | Abnormal order detection method, device, equipment and medium |
| CN116527329B (en) * | 2023-04-12 | 2023-11-17 | 广东工贸职业技术学院 | Intrusion detection method and system based on machine learning |
| CN117914733B (en) * | 2024-03-15 | 2024-05-28 | 深圳尚米网络技术有限公司 | Flow analysis and prediction method based on big data |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102915511A (en) * | 2012-09-21 | 2013-02-06 | 四川大学 | Safety monitoring method for neural network model of power-loaded chaotic phase space |
| CN106789297A (en) * | 2016-12-29 | 2017-05-31 | 淮海工学院 | Predicting network flow system and its method for predicting based on neutral net |
| CN107070683A (en) * | 2016-12-12 | 2017-08-18 | 国网北京市电力公司 | The method and apparatus of data prediction |
| CN109194539A (en) * | 2018-08-13 | 2019-01-11 | 中国平安人寿保险股份有限公司 | Data management-control method, device, computer equipment and storage medium |
| CN110120935A (en) * | 2018-02-05 | 2019-08-13 | 罗伯特·博世有限公司 | For identifying the abnormal method and apparatus in data flow in a communication network |
| CN110851782A (en) * | 2019-11-12 | 2020-02-28 | 南京邮电大学 | Network flow prediction method based on lightweight spatiotemporal deep learning model |
| CN111428789A (en) * | 2020-03-25 | 2020-07-17 | 广东技术师范大学 | Network traffic anomaly detection method based on deep learning |
| CN111754034A (en) * | 2020-06-15 | 2020-10-09 | 西安工业大学 | Time sequence prediction method based on chaos optimization neural network model |
-
2020
- 2020-12-07 CN CN202011418799.8A patent/CN112532643B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102915511A (en) * | 2012-09-21 | 2013-02-06 | 四川大学 | Safety monitoring method for neural network model of power-loaded chaotic phase space |
| CN107070683A (en) * | 2016-12-12 | 2017-08-18 | 国网北京市电力公司 | The method and apparatus of data prediction |
| CN106789297A (en) * | 2016-12-29 | 2017-05-31 | 淮海工学院 | Predicting network flow system and its method for predicting based on neutral net |
| CN110120935A (en) * | 2018-02-05 | 2019-08-13 | 罗伯特·博世有限公司 | For identifying the abnormal method and apparatus in data flow in a communication network |
| CN109194539A (en) * | 2018-08-13 | 2019-01-11 | 中国平安人寿保险股份有限公司 | Data management-control method, device, computer equipment and storage medium |
| CN110851782A (en) * | 2019-11-12 | 2020-02-28 | 南京邮电大学 | Network flow prediction method based on lightweight spatiotemporal deep learning model |
| CN111428789A (en) * | 2020-03-25 | 2020-07-17 | 广东技术师范大学 | Network traffic anomaly detection method based on deep learning |
| CN111754034A (en) * | 2020-06-15 | 2020-10-09 | 西安工业大学 | Time sequence prediction method based on chaos optimization neural network model |
Non-Patent Citations (2)
| Title |
|---|
| 基于时间序列分析的网络流量异常检测;闫伟;张军;吉林大学学报(理学版);第55卷(第5期);1249-1254 * |
| 基于深度学习的网络异常检测技术研究;尹传龙;信息科技辑(第7期);I139-1 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112532643A (en) | 2021-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112532643B (en) | Flow anomaly detection method, system, terminal and medium based on deep learning | |
| CN111158977A (en) | Abnormal event root cause positioning method and device | |
| CN112152830A (en) | Intelligent fault root cause analysis method and system | |
| CN112148772A (en) | Alarm root cause identification method, device, equipment and storage medium | |
| CN105095048A (en) | Processing method for alarm correlation of monitoring system based on business rules | |
| CN115800272B (en) | Power grid fault analysis method, system, terminal and medium based on topology identification | |
| CN115237717A (en) | Micro-service abnormity detection method and system | |
| CN112785108A (en) | Power grid operation data correlation analysis method and system based on regulation cloud | |
| Hwang et al. | Detection and correction method of erroneous data using quantile pattern and LSTM | |
| CN111796917A (en) | Operator operation scheduling method and device | |
| CN117041029A (en) | Network equipment fault processing method and device, electronic equipment and storage medium | |
| CN112905370A (en) | Topological graph generation method, anomaly detection method, device, equipment and storage medium | |
| CN111898446A (en) | Single-phase earth fault studying and judging method based on multi-algorithm normalization analysis | |
| CN115456092A (en) | Real-time monitoring method for abnormal data of power system | |
| CN115269241A (en) | Method, device and storage medium for carrying out anomaly detection on periodic data | |
| CN116108376A (en) | Monitoring system and method for preventing electricity stealing, electronic equipment and medium | |
| CN116225752A (en) | Fault root cause analysis method and system for micro-service system based on fault mode library | |
| CN115018124A (en) | Data prediction method, system, device and storage medium | |
| CN111222550B (en) | User electricity consumption behavior determining method and device | |
| CN114449569B (en) | User traffic usage processing method, network equipment and service processing system | |
| CN113946717A (en) | Sub-map index feature obtaining method, device, equipment and storage medium | |
| CN114090377A (en) | Data monitoring method and device | |
| CN111144540A (en) | Generation method of anti-electricity-stealing simulation data set | |
| CN110806961A (en) | Intelligent early warning method and system and recommendation system | |
| US20170303014A1 (en) | System for providing functionality based on sensor data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |