Abstract: Aiming at the increasing number and complexity of new network attacks in the Internet of Things environment,the traditional anomaly detection algorithm has high false alarm rate,low detection rate and large amount of data,which cause calculation difficulties,this paper proposes an anomaly detection algorithm based on the combination of subspace clustering(SSC) and BP neural network.Firstly,different subspaces are obtained by CLIQUE algorithm,which is the most commonly used subspace clustering algorithm;secondly,BP neural network anomaly detection is carried out on the data in different subspaces,and the prediction error value is calculated.By comparing with the pre-set accuracy,the threshold value is constantly updated for correction,so as to improve the ability of identifying network attacks.The NSL-KDD public data set and the network attack data set in the Internet of Things environment are used in the simulation experiment.The NSL-KDD public data set is divided into four kinds of single attack subsets and a mixed attack subsets.Compared with K-means,DBSCAN,SSC-EA and K-KNN anomaly detection models.In the mixed attack subset,the detection rate of SSC-BP neural network model is 6% higher than that of traditional K-means model,and the false detection rate is reduced by 0.2%;SSC-BP neural network model can detect the most attacked network with the lowest false detection rate in four single attack subsets.In the Internet of Things environment,SSC-BP neural network model is superior to other models.

Key words: Anomaly detection, BP neural network, New network attack, Subspace clustering