Research On Unsupervised Anomaly Detection Algorithm Based On Depth Generated Model

Anomalies exist in various application areas,such as disease patterns in healthcare systems,fraud in credit card consumption,data breaches in databases,network intrusion,and ICS anomalies.Anomalies often carry more information and are more important than normal.For example,abnormal device operation means that the system may have malfunctioned or been maliciously attacked.Therefore,it is of great practical significance to detect system anomalies quickly and accurately to ensure the security of information infrastructure.In view of the current unsupervised anomaly detection algorithm for different types of high-dimensional data detection problem of poor effect,after delving into unsupervised anomaly detection methods and depth generation model,this article puts forward the unsupervised anomaly detection algorithm based on depth generation model is used to handle different types of data,improving the accuracy of anomaly detection.The main methods and innovations adopted in this paper are as follows:(1)An unsupervised anomaly detection model that does not require too much prior knowledge is proposed.Sequence coverage algorithm is used to calculate the similarity between the data,a multi-layer clustering algorithm is used to establish a normal data model.The model was tested on four ICS datasets,and the average detection rate was96.7% and the false positive rate was 0.7%,which could effectively improve the detection rate and reduce the false alarm rate.(2)In view of the current unsupervised methods,the temporal and spatial correlation and other dependencies between multiple variables in the system are rarely used to detect anomalies,the one-dimensional convolutional neural network(1D?CNN)combined with GRU,to construct a sensor/controller parameters in the industrial control system of prediction network model.The model is verified on SWAT dataset,and the experimental results show that the abnormal detection of industrial control system can be achieved well,with an average precision of 0.99,a recall rate of 0.85,and a F1 score of 0.91.(3)The above anomaly detection algorithm based on the generation model uses the reconstruction loss of samples to identify anomalies.There are two problems in this recognition method: first,the strong generalization ability of the generated model leads to the small loss of partial abnormal reconstruction;Second,background information will interfere with the calculation of outliers.This paper proposes a method of MHMA(Multihead Memory Autoencoder)anomaly detection.The last layer of the decoder is divided into multiple branches by using variational autoencoder as the generating model,so as to learn and generate a diversified sample distribution.And the generalization ability of the model is kept within a reasonable range by combining with the generation of antagonistic network.Finally,the likelihood ratio method is used to remove the interference of background information in the process of calculating outliers.The experimental results show that compared with the mainstream model,MHMA not only improves the effect of anomaly detection,but also has better universality.