虚拟机日志中的异常检测与无关属性干扰无关
Hao Zhang1, Yun Zhou2, Huahu Xu1
1School of Computer Engineering and Science, Shanghai University, Shanghai, China.
PloS one
|January 8, 2025
概括
本研究介绍了LADSVM,这是一种用于检测虚拟机日志中的异常的新方法. LADSVM有效地识别安全风险和系统故障,即使有噪音数据,提高检测准确度.
科学领域:
- 计算机科学 计算机科学
- 网络安全 网络安全
- 机器学习 机器学习
背景情况:
- 虚拟机日志产生大量数据,可能包含显示安全风险或系统故障的异常.
- 识别这些异常对于维护系统完整性至关重要,但现实世界日志数据经常受到噪音和收集挑战的影响.
- 由于日志复杂性和固有的噪音,现有的方法可能会在准确性和效率方面扎.
研究的目的:
- 为虚拟机日志提出和评估一个强大的无监督异常检测方法.
- 为了提高在存在杂和复杂的日志数据的情况下检测异常的准确性和有效性.
- 解决日志解析和特征提取的挑战,以改善异常识别.
主要方法:
- 日志解析用于预处理原始日志数据.
- 一种混合特征提取技术,结合长短期内存 (LSTM) 和自动编码解码器,以减少维度和消除噪音.
- 支持矢量机 (SVM) 用于分类提取的特征和检测异常.
主要成果:
- 拟议的LADSVM方法在检测虚拟机日志中的异常方面表现优于传统方法.
- 这种方法有效地学习了相关的特征,而没有先前的知识,表现出对噪声的增强强性.
- 实验结果证实了该方法在处理顺序模式和杂日志数据方面的能力.
结论:
- LADSVM提供了一种强大而准确的解决方案,用于在虚拟机日志中无监督检测异常,特别是那些具有序列模式和噪声的日志.
- 该方法的噪声稳定性和在没有先前知识的情况下学习特征的能力代表了重大进步.
- 基于日志数据特征的检测方法的仔细选择对于最佳性能至关重要.
更多相关视频
05:57Long-term Video Tracking of Cohoused Aquatic Animals: A Case Study of the Daily Locomotor Activity of the Norway Lobster Nephrops norvegicus
Published on: April 8, 2019
6.8K
09:34A Virtual Machine Platform for Non-Computer Professionals for Using Deep Learning to Classify Biological Sequences of Metagenomic Data
Published on: September 25, 2021
3.9K
相关概念视频
Detection of Gross Error: The Q Test
5.6K
When one or more data points appear far from the rest of the data, there is a need to determine whether they are outliers and whether they should be eliminated from the data set to ensure an accurate representation of the measured value. In many cases, outliers arise from gross errors (or human errors) and do not accurately reflect the underlying phenomenon. In some cases, however, these apparent outliers reflect true phenomenological differences. In these cases, we can use statistical methods...
5.6K
Unusual Results
3.1K
Unusual results are those that have a very low chance of occurring. Unusual results can be identified using probabilities and the range rule of thumb. In problems involving probability, unusual results can be observed in 2 instances – an unusually high number of successes or an unusually low number of successes.
According to the range rule of thumb, any value above or below two standard deviations, 2σ from the mean, μ is considered unusual.
Maximum unusual value =...
According to the range rule of thumb, any value above or below two standard deviations, 2σ from the mean, μ is considered unusual.
Maximum unusual value =...
3.1K
Atomic Absorption Spectroscopy: Interference
651
Interference leads to systematic error in atomic absorption (AA) measurements by enhancing or diminishing the analytical signal or the background. These interferences can be grouped into three main categories: spectral interference, chemical interference, and physical interference.
Spectral interference occurs when signals from other elements or molecules overlap with the analyte signal, falsely elevating or masking the analyte's absorbance. This interference can be corrected using Zeeman,...
Spectral interference occurs when signals from other elements or molecules overlap with the analyte signal, falsely elevating or masking the analyte's absorbance. This interference can be corrected using Zeeman,...
651
Quantifying and Rejecting Outliers: The Grubbs Test
1.5K
Sometimes, a data set can have a recorded numerical observation that greatly deviates from the rest of the data. Assuming that the data is normally distributed, a statistical method called the Grubbs test can be used to determine whether the observation is truly an outlier. To perform a two-tailed Grubbs test, first, calculate the absolute difference between the outlier and the mean. Then, calculate the ratio between this difference and the standard deviation of the sample. This...
1.5K
What Are Outliers?
3.6K
Outliers are observed data points that are far from the least squares line. They have unusual values and need to be examined carefully. Though an outlier may result from erroneous data, at other times, it may hold valuable information about the population under study and should be included in the data. Hence, it is crucial to examine what causes a data point to be an outlier.
The z score is used to find outliers or unusual values. It should be noted that any values beyond -2 and +2 are...
The z score is used to find outliers or unusual values. It should be noted that any values beyond -2 and +2 are...
3.6K
Outliers and Influential Points
4.0K
An outlier is an observation of data that does not fit the rest of the data. It is sometimes called an extreme value. When you graph an outlier, it will appear not to fit the pattern of the graph. Some outliers are due to mistakes (for example, writing down 50 instead of 500), while others may indicate that something unusual is happening. Outliers are present far from the least squares line in the vertical direction. They have large "errors," where the "error" or residual is the...
4.0K
