MH-LSTM anomaly detection method based on session feature similarity

The invention discloses an MH-LSTM anomaly detection method based on session feature similarity. The method comprises the steps: setting a sliding window to collect Web access data of a user, and carrying out the processing of the Web access data through Min-Hash, and extracting sequence features; training a detection model by using a time sequence classification algorithm of LSTM; and finally, detecting and positioning abnormal users in the captured Web session stream data by using the trained detection model. The method not only can effectively adapt to challenges in a streaming data environment, but also can maintain a high detection rate and a high recall rate. 本发明公开基于会话特征相似性的MH-LSTM异常检测方法，通过设立滑动窗口以收集用户的Web访问数据，利用Min-Hash对Web访问数据进行处理提取序列特征；然后利用LSTM的时间序列分类算法进行检测模型的训练；最后利用训练好的检测模型对抓取的Web会话流数据进行异常用户的检测和定位。本发明不仅能够有效适应流数据环境下的挑战，且能够保持较高的检测率和召回率。