Host Protection State Anomaly Detection Based on Multidimensional Features
Dong Liu, Gang Wang, Fang Lou, MingYong Yia, Chunrui Zhang · 2023
The features extracted from traffic data can characterize the communication behavior and operational status of software. However, the accuracy of detecting abnormal host protection status of internal network terminals using only traffic data is not high. This article proposes a anomaly detection method based on multidimensional feature for host protection state detection. The method consists of two stages. In the first stage, a basic dataset is generated using traffic data, software logs, and login logs. In the second stage, a multilayer clustering method and a small amount of labeled data are applied to identify abnormal terminals. In practical applications, the proposed method can effectively detect abnormal terminals with software not installed and abnormal heartbeat.