Network anomaly analysis apparatus, method, and non-transitory computer readable storage medium thereof

A network anomaly analysis method, being adapted for an electronic computing apparatus, the electronic computing apparatus storing a plurality of network status data, each of the network status data comprising a plurality of network feature values, the network anomaly analysis method comprising:

• dimension-reducing each of the network status data into a principal component datum by analyzing the network feature values comprised in the network status data according to a dimension-reduce algorithm;
• selecting a first subset of the principal component data as a plurality of training data;
• deriving a classification model by classifying the training data into a plurality of first normal data and a plurality of first abnormal data according to a classification algorithm;
• deriving a clustering model by clustering the first abnormal data into a plurality of first abnormal groups according to a clustering algorithm;
• selecting a second subset of the principal component data as a plurality of testing data;
• deriving an accuracy rate by testing the classification model and the clustering model by the testing data;
• determining that the accuracy rate fails to reach a first threshold;
• selecting a third subset of the principal component data as a plurality of validation data after determining that the accuracy rate fails to reach the first threshold;
• updating the classification model by classifying the validation data into a plurality of second normal data and a plurality of second abnormal data according to the classification algorithm;
• updating the clustering model by clustering the second abnormal data into a plurality of second abnormal groups according to the clustering algorithm;
• and
• outputting the updated classification model and the updated clustering model.

A non-transitory computer readable storage medium, having a computer program stored therein, the computer program executing a network anomaly analysis method after being into an electronic computing apparatus, the electronic computing apparatus storing a plurality of network status data, each of the network status data comprising a plurality of network feature values, and the network anomaly analysis method comprising:

• dimension-reducing each of the network status data into a principal component datum by analyzing the network feature values comprised in the network status data according to a dimension-reduce algorithm;
• selecting a first subset of the principal component datum as a plurality of training data;
• deriving a classification model by classifying the training data into a plurality of first normal data and a plurality of first abnormal data according to a classification algorithm;
• deriving a clustering model by clustering the first abnormal data into a plurality of first abnormal groups according to a clustering algorithm;
• selecting a second subset of the principal component data as a plurality of testing data;
• deriving an accuracy rate by testing the classification model and the clustering model by the testing data;
• determining that the accuracy rate fails to reach a threshold;
• selecting a third subset of the principal component data as a plurality of validation data after determining that the accuracy rate fails to reach the threshold;
• updating the classification model by classifying the validation data into a plurality of second normal data and a plurality of second abnormal data according to the classification algorithm;
• updating the clustering model by clustering the second abnormal data into a plurality of second abnormal groups according to the clustering algorithm;
• and
• outputting the updated classification model and the updated clustering model.