Collaborative analysis-based lost host detection system and method
Through the collaborative analysis of the lost host detection system, combined with the graph neural network and K-mean clustering method in the network space, and combined with face recognition and physical abnormal behavior recognition in the physical space, joint analysis and tracking of the lost host events are realized, and the current solution is to solve the problem of the current situation. There are problems with low detection accuracy and reliability in the technology, which improves the ability to respond quickly and pursue responsibility.
Patent Information
- Application Number
- CN202411338315.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-25
- Publication Date
- 2024-12-17
AI Technical Summary
The prior art is difficult to effectively detect and trace the abnormal behavior of the lost host, resulting in low detection accuracy and reliability, affecting the reliability and authority of the judgment results.
The collaborative analysis of the loss host detection system is used, combined with the graph neural network and K-mean clustering method to detect it in the network space, and the detection is carried out in the physical space through face recognition and physical abnormal behavior recognition, so as to realize the joint analysis of the behavior of the network and physical space. and tracing.
It improves the reliability of host failure detection, can quickly respond and reduce the impact and losses caused by malicious attacks, and provides more complete and credible behavioral analysis results and accountability investigation.
Smart Images
Figure CN119155093A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security anomaly detection, and in particular to a collaborative analysis compromised host detection system and method. Background Art
[0002] After a network attacker has somehow invaded and gained control of a host, he or she can use viruses such as zombies, Trojans, and worms to use the host as a springboard to launch further infiltration and attacks, causing other hosts to be controlled or even directly paralyzed, thereby expanding the scope of damage or causing a stronger attack effect. The entire process of this attack is called a host compromise.
[0003] The behavior of compromised hosts is becoming more and more covert, making detection more and more difficult and the accuracy of identification is not high. Compromised host detection mainly detects and analyzes information such as the host's network traffic and operation logs to discover the host's compromise, thereby providing support for the subsequent timely removal of security risks and ensuring the safety of the host. At present, there is a lack of effective tracing methods for abnormal behavior of compromised hosts, which makes it impossible to conduct effective analysis, thus affecting the reliability and authority of the judgment results. Summary of the invention
[0004] In order to solve the above problems, the present invention proposes a collaborative analysis compromised host detection system and method, which aims to establish a mutual verification and joint analysis mechanism between network and physical space behaviors to achieve multi-dimensional evidence. The reliability of host compromise detection can be improved to a certain extent, thereby achieving rapid response and reducing the impact and losses caused by malicious attacks.
[0005] The technical solution adopted by the present invention is as follows:
[0006] A collaborative analysis compromised host detection system, comprising:
[0007] A network space detection module is configured to obtain network space behavior information of the target host, and perform compromised host detection based on a graph neural network and a K-means clustering method to determine the host compromise behavior; the network space behavior information includes network traffic information and network log information;
[0008] A physical space detection module is configured to obtain the physical space behavior information of the target person and perform abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods;
[0009] The collaborative analysis module is configured to mutually verify and jointly analyze the results of compromised host detection and abnormal behavior detection, thereby realizing the joint analysis and joint tracing of compromised host events in cyberspace and physical space.
[0010] Furthermore, in the network space detection module, network traffic information is obtained and compromised host detection is performed based on a graph neural network, including:
[0011] Establish a graph representation of a host connection graph that maintains network traffic records and their interactive relationships, and establish a graph neural network model based on the graph representation to detect abnormal network traffic information related to the host;
[0012] Based on the connection path of the attacked host, the graph structure is used to determine whether the network traffic is connected to the same source host or destination host, and to distinguish and associate the upstream or downstream characteristics of the network traffic;
[0013] The host's malicious traffic is detected based on the constructed graph neural network model to determine whether the host has been attacked.
[0014] Furthermore, in the network space detection module, network log information is obtained and compromised host detection is performed based on the K-means clustering method, including:
[0015] Search network log information and count the number of illegal data accesses and users with illegal operations within a preset time period, and count abnormal behaviors of the host to be detected; the network log information includes security warning information, user operation log information and data access log information, and the abnormal behaviors include virus infection behavior and abnormal operation behavior;
[0016] The host behavior data is clustered using the K-means clustering method, and hosts with similar behavior states are classified into one category. Before clustering, the z-score standardization method is used to standardize the statistical log data.
[0017] Furthermore, in the cyberspace detection module, a risk score is calculated for the host based on the clustering results of the abnormal behaviors and the traffic detection results based on the graph neural network. When the risk score exceeds a set threshold, it is determined to be a compromised host.
[0018] Furthermore, in the physical space detection module, the acquisition of the physical space behavior information of the target person and the abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods include:
[0019] Matching the personnel information database through feature extraction algorithms to identify target personnel and their historical locations; the feature extraction algorithms include but are not limited to convolutional neural networks, oriented gradient histograms, scale-invariant feature transforms, accelerated robust features, and local binary patterns;
[0020] The personnel entering and exiting the target scene are analyzed through the behavior pattern recognition algorithm, and combined with the network behavior anomalies fed back by the cyberspace detection module, abnormal behaviors are automatically detected and identified; if any violation is found, a real-time warning or sound and light alarm mechanism is activated; the behavior pattern recognition algorithm includes but is not limited to convolutional neural networks, three-dimensional convolutional neural networks, recurrent neural networks and their variants, hidden Markov models and optical flow methods.
[0021] A collaborative analysis method for detecting compromised hosts, comprising:
[0022] Cyberspace detection: Obtain the cyberspace behavior information of the target host, and perform compromised host detection based on graph neural network and K-means clustering method to determine the host compromise behavior; the cyberspace behavior information includes network traffic information and network log information;
[0023] Physical space detection: Obtain the physical space behavior information of the target person, and perform abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods;
[0024] Collaborative analysis: The compromised host detection and abnormal behavior detection results are mutually verified and jointly analyzed, thereby achieving joint analysis and joint tracing of compromised host events in cyberspace and physical space.
[0025] Furthermore, in the network space detection, network traffic information is obtained and compromised host detection is performed based on a graph neural network, including:
[0026] Establish a graph representation of a host connection graph that maintains network traffic records and their interactive relationships, and establish a graph neural network model based on the graph representation to detect abnormal network traffic information related to the host;
[0027] Based on the connection path of the attacked host, the graph structure is used to determine whether the network traffic is connected to the same source host or destination host, and to distinguish and associate the upstream or downstream characteristics of the network traffic;
[0028] The host's malicious traffic is detected based on the constructed graph neural network model to determine whether the host has been attacked.
[0029] Furthermore, in the network space detection, network log information is obtained and compromised host detection is performed based on the K-means clustering method, including:
[0030] Search network log information and count the number of illegal data accesses and users with illegal operations within a preset time period, and count abnormal behaviors of the host to be detected; the network log information includes security warning information, user operation log information and data access log information, and the abnormal behaviors include virus infection behavior and abnormal operation behavior;
[0031] The host behavior data is clustered using the K-means clustering method, and hosts with similar behavior states are classified into one category. Before clustering, the z-score standardization method is used to standardize the statistical log data.
[0032] Furthermore, in the network space detection, a risk score is calculated for the host based on the clustering results of the abnormal behaviors and the traffic detection results based on the graph neural network. When the risk score exceeds the set threshold, it is determined to be a compromised host.
[0033] Furthermore, in the physical space detection, the physical space behavior information of the target person is obtained, and abnormal behavior detection is performed based on face recognition and physical abnormal behavior recognition methods, including:
[0034] Matching the personnel information database through feature extraction algorithms to identify target personnel and their historical locations; the feature extraction algorithms include but are not limited to convolutional neural networks, oriented gradient histograms, scale-invariant feature transforms, accelerated robust features, and local binary patterns;
[0035] The target scene of personnel entering and exiting is analyzed through the behavior pattern recognition algorithm, and the abnormal network behavior feedback from the network space detection is combined to automatically detect and identify abnormal behavior; if an abnormal violation is found, a real-time warning or sound and light alarm mechanism is activated; the behavior pattern recognition algorithm includes but is not limited to convolutional neural networks, three-dimensional convolutional neural networks, recurrent neural networks and their variants, hidden Markov models and optical flow methods.
[0036] The beneficial effects of the present invention are:
[0037] 1. The present invention uses the network behavior of the host as the analysis foothold in cyberspace, and uses a combination of graph neural network and K-means clustering method to detect the network traffic and log information of the host, quickly locate the host's compromised behavior, and trace the host's compromised behavior. In the physical space, by obtaining relevant videos and pictures of relevant personnel entering and exiting key locations and operating the corresponding host as traceability evidence support, the accuracy and non-repudiation of determining the compromised host are improved.
[0038] 2. The present invention can provide more complete and reliable behavior analysis results and responsibility tracing by real-time monitoring of host network behavior and personnel physical behavior, and mutual verification and joint analysis of cyberspace behavior and physical space behavior. The present invention can improve the reliability of host compromise detection to a certain extent, and can provide support for network decision makers and operators to evaluate the cost and effectiveness of potential attacks, detect and prevent the continuation of network threat activities, so that network operators can take relevant measures against potential network threats, and implement specific mitigation or correction plans to achieve rapid response to reduce the impact and losses caused by malicious attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] Figure 1 This is a diagram showing the modules of a collaborative analysis compromised host detection system of the present invention;
[0040] Figure 2 A flowchart of a network space detection process according to an embodiment of the present invention;
[0041] Figure 3 A flow chart of a physical space detection process according to an embodiment of the present invention;
[0042] Figure 4 The present invention is a flowchart of a collaborative analysis process according to an embodiment of the present invention.
[0043] Figure 5 This is an example diagram of host traffic node interaction according to an embodiment of the present invention. DETAILED DESCRIPTION
[0044] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific implementation methods of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the embodiments described are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.
[0045] Example 1
[0046] like Figure 1 As shown, this embodiment provides a collaborative analysis compromised host detection system, including a cyberspace detection module, a physical space detection module and a collaborative analysis module, wherein the cyberspace detection module is configured to obtain the cyberspace behavior information of the target host, and perform compromised host detection based on a graph neural network and a K-means clustering method to determine the host compromise behavior, the cyberspace behavior information includes network traffic information and network log information; the physical space detection module is configured to obtain the physical space behavior information of the target person, and perform abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods; the collaborative analysis module is configured to mutually verify and jointly analyze the compromised host detection and abnormal behavior detection results, thereby realizing the joint analysis and joint tracing of the compromised host event in the cyberspace and physical space.
[0047] In this embodiment, the cyberspace detection module uses a combination of graph neural networks and statistical methods to detect compromised hosts based on information such as network traffic data and host data.
[0048] Preferably, for network traffic, it is necessary to capture not only the characteristics of a single flow but also the relationship between different flows. This embodiment designs a graphical representation of a host connection graph that maintains traffic records and their interactive relationships, and establishes a host connection graph neural network model for detecting abnormal network traffic information related to the host. Host-based attacks can be manifested as a large number of attacks connecting different hosts to the same destination host, and a large number of attacks connecting from the same host to different ports of the same target host. The graph structure can be used to determine whether the traffic is connected to the same source / destination host, and can distinguish and associate the upstream or downstream characteristics of the traffic. The malicious traffic of the host is detected based on the constructed graph neural network model to determine whether a host has been attacked.
[0049] More preferably, if Figure 2 As shown, cyberspace detection can be achieved by following the steps below:
[0050] 1) Data preprocessing process:
[0051] First, a piece of original traffic pcap data is divided into multiple traffic data according to the same five-tuple features; then the data packets with the same content and empty data stream files are removed and cleaned; each cleaned data packet is uniformly intercepted according to 256 bytes, and if it is less than 256 bytes, FF is padded; finally, the maximum and minimum method is used to normalize the data to construct data readable by the graph neural network.
[0052] 2) Host connection diagram establishment:
[0053] Given a set of traffic F, construct a host connection graph G F , where each node represents a different host (including sending traffic or receiving traffic). In addition, each flow is also represented as a node in the graph. Therefore, given a flow data f∈F, its source host is S and its destination host is D, two undirected edges are created: one is from the source host node to the flow node (S→f), and the other is from the flow node to the destination host node (f→D), and the IP is regarded as the identifier of the host.
[0054] 3) Host malicious traffic detection based on graph neural network:
[0055] ① Initialize the initial characteristics of the nodes in the host connection graph
[0056] If the nodes in the host connection graph are represented as flows, the preprocessed data is used as the initial features of the nodes, and the features are represented as X i =[x0,x1,…x k]. If a node in the host connection graph is represented as a host, all elements in the initial feature vector are set to 1, and the length of the feature vector is consistent with the traffic node.
[0057] ②Message passing
[0058] The calculation method of the result after message transmission in the host connection diagram is:
[0059]
[0060] In the above formula, represents the hidden state of node i after the t-th aggregation of information, represents the neighbors of node i, The table is the number of neighbors of node i, is the vector obtained after aggregating neighbor information. type is an aggregation function, with σ sf and σ fd Two forms of representation, σ sf The edge connecting the source host and the flow, σ fd The edge used to connect the destination host to the flow.
[0061] ③Node hidden state update
[0062] The hidden state update of a node is to concatenate the feature vector after aggregating neighbor information with its own feature vector, and then map it through another function δ to obtain the updated hidden state. The calculation method for the node hidden state update is as follows:
[0063]
[0064] In the above formula, δ type is the update function, with δ h and δ f Two forms of representation, δ h Used to update the hidden state of the host, δ f Used to update the hidden state of flow.
[0065] ④ Malicious node detection
[0066] After multiple hidden state updates, the hidden state of the node is mapped through the function r(·) and the final prediction result is output.
[0067]
[0068] Among them, the function r(.) is a classification function, the input is the final hidden state of each flow, and the output is the predicted class of the flow. The functions used in the process of hidden state update and final classification are shown in Table 1.
[0069] Table 1 - Usability of graph neural network functions
[0070]
[0071] Preferably, for terminal log information, the number of illegal data accesses and users with illegal operations during the statistical time period are calculated by searching security alarm information, user operation log running information and data access log information, and abnormal behaviors including but not limited to virus infection behaviors, abnormal operation behaviors, etc., of the host to be detected are counted, and the host behavior data are clustered using the K-means clustering method, and hosts with similar behavior states are classified into one category. Before clustering, the z-score normalization method is used to standardize the statistical log data.
[0072] More preferably, if Figure 2 As shown, physical space detection can be achieved by following the steps below:
[0073] 1) z-score normalization
[0074] The calculation formula of the z-score standardization method is:
[0075]
[0076] Among them, x mean represents the mean of the data, x std represents the data standard deviation, and n represents the number of hosts in the LAN.
[0077] 2) Host abnormal behavior detection based on K-means clustering
[0078] ① Input host data, and collect statistics including but not limited to "user login and operation behavior", "host operation status and network communication behavior", "host network access", "resource occupation", "business application protocol behavior", "data access and transmission behavior", "whether there is virus or Trojan file infection" by searching security alarm information, user operation log operation information and data access log information;
[0079] ② Use the k-means clustering method to perform cluster calculations on the input host abnormal behaviors.
[0080] ③ Output the cluster center of each type of host abnormal behavior, and make a general description of this type of host abnormal behavior based on the index value of the cluster center. Finally, the host to be detected will be detected for abnormal behaviors including but not limited to virus / Trojan infection behavior, abnormal operation behavior, etc.
[0081] Preferably, in the network space detection module, a danger score is calculated for the host based on the clustering results of the abnormal behaviors and the traffic detection results based on the graph neural network model; when the danger score exceeds a certain threshold, it is determined to be a compromised host.
[0082] More preferably, the calculation process of the risk score is:
[0083] dangerscore=k1×score1+k2×score2+…+kn×scoren
[0084] k1+...+kn=1,k1≥0.5
[0085] score1=A*abnormal ratio=A*L / N
[0086] scorei(x)=5×(1-e -0.2x ), i=2,3,…,n.
[0087] Among them, score1 is the malicious traffic score, scorei is the abnormal behavior score, including but not limited to virus / Trojan infection behavior, abnormal operation behavior, i=2,3,…,n. x is the number of malicious events, abnormal ratio is the abnormal ratio, N is the total number of network traffic data input into the graph neural network model, L is the number of abnormal network traffic data detected by the model, and A is the malicious traffic score coefficient, which can be adjusted according to the abnormal ratio coefficient corresponding to 100 points. For example, when the abnormal ratio is set to 50% and the malicious traffic score is 100, A is 200. dangerscore is the host compromise risk score, and the threshold is adjustable. For example, the threshold is set to 60, that is, when the danger score exceeds 60 points, it is judged as a compromised host.
[0088] In this embodiment, the physical space detection module integrates face recognition and physical behavior recognition technology to capture and deeply analyze the video stream and face image data in the monitoring area in real time.
[0089] Preferably, the physical space detection module accurately matches the personnel information database through feature extraction algorithms to quickly identify the target personnel and their historical locations. The feature extraction algorithms include but are not limited to convolutional neural networks, oriented gradient histograms, scale-invariant feature transforms, accelerated robust features, and local binary patterns.
[0090] Preferably, if Figure 3As shown in the figure, the physical space detection module uses the behavior pattern recognition algorithm to conduct a detailed analysis of scenes such as personnel entering and exiting key locations and operating hosts, and automatically detects and identifies abnormal behaviors, such as entering and exiting unauthorized areas, illegally holding objects, entering and exiting during non-working hours, and combining network behavior anomalies feedback from the network space detection module. Once an abnormal violation is found, a real-time warning or sound and light alarm mechanism is immediately activated. The behavior pattern recognition algorithm includes but is not limited to convolutional neural networks, three-dimensional convolutional neural networks, recurrent neural networks and their variants, hidden Markov models, and optical flow methods.
[0091] In this embodiment, if Figure 4 As shown, the collaborative analysis module collaborates with the cyberspace detection module and the physical space detection module to achieve joint analysis and joint tracing of compromised host events in cyberspace and physical space.
[0092] like Figure 5 The figure shows an example diagram of traffic node interaction of a host with an IP address of 192.168.1.6. Preferably, when a host loss event occurs, firstly, according to clues such as the time of the event, the address of the event, etc., the data information related to the host loss is found from the network traffic and terminal data. Specifically, it includes analyzing abnormal network traffic and abnormal behaviors such as "user login and operation behavior", "host operation status and network communication behavior", "host network access", "resource occupation", "business application protocol behavior", "data access and transmission behavior", "whether there is virus or Trojan file infection", etc., extracting the operation behavior data associated with the event, and tracing the operation behavior according to the time sequence. At the same time, the video surveillance pictures of the personnel at the corresponding time are obtained through the physical space detection module, and the physical space behavior of the illegal personnel is supplemented, which is mutually verified with the abnormal behavior in the network space, forming an evidence chain for event tracing, and providing a basis for the management personnel to trace the source of the lost host event.
[0093] More preferably, when the cyberspace detection module needs to focus on a certain logged-in user, the physical space detection module can focus on monitoring the target user's entry and exit, behavioral actions, etc., and issue timely alarms when abnormal behavior is detected, thereby realizing the linkage and mutual verification of cyberspace and physical space.
[0094] Example 2
[0095] This embodiment provides a collaborative analysis method for detecting a compromised host, including:
[0096] Cyberspace detection: Obtain the cyberspace behavior information of the target host, and perform compromised host detection based on graph neural network and K-means clustering methods to determine the host compromise behavior; cyberspace behavior information includes network traffic information and network log information;
[0097] Physical space detection: Obtain the physical space behavior information of the target person, and perform abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods;
[0098] Collaborative analysis: The compromised host detection and abnormal behavior detection results are mutually verified and jointly analyzed, thereby achieving joint analysis and joint tracing of compromised host events in cyberspace and physical space.
[0099] In this embodiment, the network behavior of the host is used as the analysis foothold in cyberspace, and the network traffic and log information of the host are detected by combining the graph neural network and K-means clustering method to quickly locate the host's compromised behavior and track the host's compromised behavior. In the physical space, relevant videos and pictures of relevant personnel entering and exiting key locations and operating the corresponding host are obtained as traceability evidence to improve the accuracy and non-repudiation of determining the compromised host. By real-time monitoring of host behavior and personnel physical behavior, the cyberspace behavior and physical space behavior are mutually verified and jointly analyzed, which can provide more complete and reliable behavior analysis results and responsibility tracing.
[0100] Preferably, in the network space detection, network traffic information is obtained and compromised host detection is performed based on a graph neural network, including:
[0101] Establish a graph representation of a host connection graph that maintains network traffic records and their interactive relationships, and establish a graph neural network model based on the graph representation to detect abnormal network traffic information related to the host;
[0102] Based on the connection path of the attacked host, the graph structure is used to determine whether the network traffic is connected to the same source host or destination host, and to distinguish and associate the upstream or downstream characteristics of the network traffic;
[0103] The host's malicious traffic is detected based on the constructed graph neural network model to determine whether the host has been attacked.
[0104] Preferably, in the network space detection, network log information is obtained and compromised host detection is performed based on the K-means clustering method, including:
[0105] Search network log information and count the number of illegal data accesses and users with illegal operations within a preset time period, and count abnormal behaviors of the host to be detected; network log information includes security alarm information, user operation log information and data access log information, and abnormal behaviors include virus infection behavior and abnormal operation behavior;
[0106] The host behavior data is clustered using the K-means clustering method, and hosts with similar behavior states are classified into one category. Before clustering, the z-score standardization method is used to standardize the statistical log data.
[0107] Preferably, in the network space detection, the danger score of the host is calculated based on the clustering results of the abnormal behavior and the traffic detection results based on the graph neural network. When the danger score exceeds the set threshold, it is determined to be a compromised host.
[0108] Preferably, in the physical space detection, the physical space behavior information of the target person is obtained, and abnormal behavior detection is performed based on face recognition and physical abnormal behavior recognition methods, including:
[0109] Matching personnel information database through feature extraction algorithm to identify target personnel and their historical location; feature extraction algorithm includes but is not limited to convolutional neural network, oriented gradient histogram, scale-invariant feature transform, accelerated robust feature and local binary pattern;
[0110] The behavior pattern recognition algorithm is used to analyze the entry and exit of personnel into the target scene, and combined with the network behavior anomalies fed back by the cyberspace detection, abnormal behavior is automatically detected and identified; if any violation is found, a real-time warning or sound and light alarm mechanism is activated; the behavior pattern recognition algorithm includes but is not limited to convolutional neural networks, three-dimensional convolutional neural networks, recurrent neural networks and their variants, hidden Markov models, and optical flow methods.
[0111] Example 3
[0112] This embodiment is based on embodiment 1:
[0113] This embodiment provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for detecting a compromised host by collaborative analysis of Embodiment 2 is implemented. The computer program may be in source code form, object code form, executable file, or some intermediate form.
[0114] Example 4
[0115] This embodiment is based on embodiment 1:
[0116] The present embodiment provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the collaborative analysis method for detecting a compromised host of Embodiment 2. The computer program may be in source code form, object code form, an executable file, or some intermediate form, etc. The storage medium includes: any entity or device capable of carrying computer program code, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content contained in the storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the storage medium does not include electric carrier signals and telecommunication signals.
[0117] It should be noted that, for the above method embodiments, for the sake of simplicity of description, they are expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.
Claims
1. A collaborative analysis compromised host detection system, characterized in that: include: The cyberspace detection module is configured to obtain the cyberspace behavior information of the target host, and perform compromised host detection based on the graph neural network and K-means clustering method to determine the host compromise behavior; The cyberspace behavior information includes network traffic information and network log information; A physical space detection module is configured to obtain the physical space behavior information of the target person and perform abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods; The collaborative analysis module is configured to mutually verify and jointly analyze the results of compromised host detection and abnormal behavior detection, thereby realizing the joint analysis and joint tracing of compromised host events in cyberspace and physical space.
2. A collaborative analysis compromised host detection system according to claim 1, characterized in that: In the network space detection module, network traffic information is obtained and compromised host detection is performed based on the graph neural network, including: Establish a graph representation of a host connection graph that maintains network traffic records and their interactive relationships, and establish a graph neural network model based on the graph representation to detect abnormal network traffic information related to the host; Based on the connection path of the attacked host, the graph structure is used to determine whether the network traffic is connected to the same source host or destination host, and to distinguish and associate the upstream or downstream characteristics of the network traffic; The host's malicious traffic is detected based on the constructed graph neural network model to determine whether the host has been attacked.
3. The collaborative analysis compromised host detection system according to claim 1, characterized in that: In the network space detection module, network log information is obtained and compromised host detection is performed based on the K-means clustering method, including: Search network log information and count the number of illegal data accesses and users with illegal operations within a preset time period, and count abnormal behaviors of the host to be detected; the network log information includes security warning information, user operation log information and data access log information, and the abnormal behaviors include virus infection behavior and abnormal operation behavior; The host behavior data is clustered using the K-means clustering method, and hosts with similar behavior states are classified into one category. Before clustering, the z-score standardization method is used to standardize the statistical log data.
4. The collaborative analysis compromised host detection system according to claim 1, characterized in that: In the network space detection module, the risk score of the host is calculated based on the clustering results of the abnormal behaviors and the traffic detection results based on the graph neural network. When the risk score exceeds the set threshold, it is determined to be a compromised host.
5. The collaborative analysis compromised host detection system according to claim 1, characterized in that: In the physical space detection module, the physical space behavior information of the target person is obtained, and abnormal behavior detection is performed based on face recognition and physical abnormal behavior recognition methods, including: Matching the personnel information database through feature extraction algorithms to identify target personnel and their historical locations; the feature extraction algorithms include but are not limited to convolutional neural networks, oriented gradient histograms, scale-invariant feature transforms, accelerated robust features, and local binary patterns; The target scene of personnel entering and exiting is analyzed through the behavior pattern recognition algorithm, and combined with the network behavior anomalies fed back by the cyberspace detection module, abnormal behaviors are automatically detected and identified; if any violation is found, a real-time warning or sound and light alarm mechanism is activated; the behavior pattern recognition algorithm includes but is not limited to convolutional neural networks, three-dimensional convolutional neural networks, recurrent neural networks and their variants, hidden Markov models and optical flow methods.
6. A collaborative analysis method for detecting compromised hosts, characterized in that: include: Cyberspace detection: Obtain the cyberspace behavior information of the target host, and perform compromised host detection based on graph neural network and K-means clustering methods to determine the host compromise behavior; The cyberspace behavior information includes network traffic information and network log information; Physical space detection: Obtain the physical space behavior information of the target person, and perform abnormal behavior detection based on face recognition and physical abnormal behavior recognition methods; Collaborative analysis: The compromised host detection and abnormal behavior detection results are mutually verified and jointly analyzed, thereby achieving joint analysis and joint tracing of compromised host events in cyberspace and physical space.
7. The method for detecting compromised hosts by collaborative analysis according to claim 6, characterized in that: In the network space detection, network traffic information is obtained and compromised host detection is performed based on a graph neural network, including: Establish a graph representation of a host connection graph that maintains network traffic records and their interactive relationships, and establish a graph neural network model based on the graph representation to detect abnormal network traffic information related to the host; Based on the connection path of the attacked host, the graph structure is used to determine whether the network traffic is connected to the same source host or destination host, and to distinguish and associate the upstream or downstream characteristics of the network traffic; The host's malicious traffic is detected based on the constructed graph neural network model to determine whether the host has been attacked.
8. The method for detecting compromised hosts by collaborative analysis according to claim 6, characterized in that: In the network space detection, network log information is obtained and compromised host detection is performed based on the K-means clustering method, including: Search network log information and count the number of illegal data accesses and users with illegal operations within a preset time period, and count abnormal behaviors of the host to be detected; the network log information includes security warning information, user operation log information and data access log information, and the abnormal behaviors include virus infection behavior and abnormal operation behavior; The host behavior data is clustered using the K-means clustering method, and hosts with similar behavior states are classified into one category. Before clustering, the z-score standardization method is used to standardize the statistical log data.
9. The method for detecting compromised hosts by collaborative analysis according to claim 6, characterized in that: In the network space detection, the risk score of the host is calculated based on the clustering results of the abnormal behaviors and the traffic detection results based on the graph neural network. When the risk score exceeds the set threshold, it is determined to be a compromised host.
10. The method for detecting compromised hosts by collaborative analysis according to claim 6, characterized in that: In the physical space detection, the physical space behavior information of the target person is obtained, and abnormal behavior detection is performed based on face recognition and physical abnormal behavior recognition methods, including: Matching the personnel information database through feature extraction algorithms to identify target personnel and their historical locations; the feature extraction algorithms include but are not limited to convolutional neural networks, oriented gradient histograms, scale-invariant feature transforms, accelerated robust features, and local binary patterns; The target scene of personnel entering and exiting is analyzed through the behavior pattern recognition algorithm, and the abnormal network behavior feedback from the network space detection is combined to automatically detect and identify abnormal behavior; if an abnormal violation is found, a real-time warning or sound and light alarm mechanism is activated; the behavior pattern recognition algorithm includes but is not limited to convolutional neural networks, three-dimensional convolutional neural networks, recurrent neural networks and their variants, hidden Markov models and optical flow methods.