基于改进孤立森林算法的Linux日志异常检测方法  

Linux log anomaly detection method based on improved isolated forest algorithm

作　　者：赵海涛 李红烨 ZHAO Haitao;LI Hongye(The First Military Representative Office of the Naval Equipment Shanghai Bureau in Shanghai,Shanghai 201913;China Ship Research Academy,Beijing 100101,China)

机构地区：[1]海装上海局驻上海第一军事代表室,上海201913 [2]中国舰船研究院,北京100101

出　　处：《指挥控制与仿真》2024年第5期114-118,共5页Command Control & Simulation

摘　　要：为高效、正确地识别Linux日志中的异常行为,提出一种基于改进孤立森林算法的Linux日志异常检测方法。该方法在孤立森林算法的基础上引入注意力机制,在处理日志数据时能够动态地调整关注的特征和样本点,并根据样本的异常程度动态调整关注的程度。实验结果表明,该方法相较于传统方法,在精确率、性能等方面均有显著提升。In order to efficiently and correctly identify abnormal behaviors in Linux logs,this paper proposes a Linux log anomaly detection method based on the improved isolated forest algorithm.The method introduces an attention mechanism on the basis of the isolated forest algorithm,which can dynamically adjust the attention features and sample points when processing log data,and dynamically adjust the degree of attention according to the degree of abnormality of the samples.Experimental results show that the method achieves high efficiency in the Linux log anomaly detection task compared with traditional methods,and can effectively discover potential security threats and abnormal behaviors.

关 键 词：异常检测 Linux日志数据 孤立森林 注意力机制 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]