Behavior chain analysis and abnormal association detection method

Abstract

The invention provides a behavior chain analysis and abnormal association detection method, which comprises the following steps: collecting program operation behavior data, and constructing a behavior chain graph model, each node representing one operation, and each edge representing the sequence or relationship between the operations; calculating the correlation degree of each node by using the modeling information, and comparing the calculated node correlation degree with a baseline model of a normal behavior chain to judge whether abnormity exists or not; extracting features from the detected abnormal behavior chain, including degrees of abnormal nodes and weights of abnormal edges, and training a malicious behavior detection model by using the extracted features as input data; and the malicious behavior detection model learns the relationship between the extracted features and malicious behaviors, and identifies and classifies the input new behavior chain to judge whether the behavior chain is abnormal or malicious. According to the method, the false positive rate and the false negative rate can be effectively reduced, the processing speed is high, and the problems caused by program malicious behaviors in related technologies are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for behavior chain analysis and abnormal association detection. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent. Malware has become a major threat in modern network environments. They not only cause trouble to individual users, but also pose serious security risks to enterprises and government agencies. Malware can be spread in a variety of ways, such as email attachments, download links, and social engineering methods, so defense measures must be constantly updated to cope with emerging threats.

[0003] Malicious programs usually enter the system in a covert way. Once they infect the target, they can perform various harmful operations. For example, data theft may lead to the leakage of users' personal information or corporate secrets, and system damage may cause system crashes or data loss. In addition, some malicious programs can remotely control infected computers to conduct further attacks or manipulation. These behaviors not only affect the normal operation of the system, but also may lead to information tampering and further security issues. Summary of the invention

[0004] The present invention proposes a behavior chain analysis and anomaly association detection method. By combining behavior chain modeling, multi-level anomaly detection and complex mathematical models, the problems of low anomaly detection efficiency, poor adaptability to complex environments, insufficient real-time dynamic monitoring, low feature extraction and data processing efficiency, and difficulty in malicious behavior identification in related technologies are solved. Through in-depth modeling and dynamic monitoring of the behavior chain, the accuracy of anomaly detection can be improved, the system's adaptability to complex and dynamic environments can be enhanced, and the ability to identify malicious program behaviors can be improved.

[0005] A method for behavior chain analysis and abnormal association detection comprises the following steps:

[0006] Step 1: Behavior chain modeling: collect program operation behavior data, and build a graph model of the behavior chain based on the operation behavior data. The graph model represents the behavior chain in a graph structure, where each node represents an operation, and each edge represents the order or relationship between operations. The behavior chain is modeled using graph theory technology.

[0007] Step 2: Abnormal association detection: Use the modeling information in step 1 to calculate the association degree of each node, and compare the calculated node association degree with the baseline model of the normal behavior chain to determine whether there is an abnormality;

[0008] Step 3: Malicious behavior identification: Extract features from the detected abnormal behavior chain, including the degree of abnormal nodes and the weight of abnormal edges, and use the extracted features as input data to train the malicious behavior detection model; the malicious behavior detection model learns the relationship between the extracted features and malicious behavior, identifies and classifies the input new behavior chain to determine whether it is abnormal or malicious.

[0009] Furthermore, it also includes:

[0010] Step 4: Multi-dimensional feature fusion: In the feature extraction process, multi-dimensional features are combined to provide more information to identify abnormal or malicious behaviors. The extracted features are used to train the mixed Gaussian model for malicious behavior detection. The extracted features include the time interval between operations, the operation frequency, and the context information of the operations. The principal component analysis (PCA) method is used to improve the expression ability of the features. The covariance matrix in the principal component analysis is calculated as:

[0011]

[0012] Among them, x i is the i-th sample, is the sample mean, and N is the total number of samples.

[0013] Furthermore, in step one, constructing a graphical model of a behavior chain based on the operation behavior data specifically includes: the operation behavior data records the operation sequence and its context information, and graphically represents the collected program operation behavior data according to the operation sequence and relationship.

[0014] Furthermore, in step one, constructing a graphical model of a behavior chain based on the operation behavior data specifically includes: the operation behavior data records the operation sequence and its context information, and graphically represents the collected program operation behavior data according to the operation sequence and relationship.

[0015] Furthermore, the nodes and edges of the graph model are defined as follows:

[0016] Node set V = {v1, v2, ..., v n}, where each node v i Represents an operation;

[0017] The edge set E = {e ij |e ij Connect node v i and v j}, where each edge e ij Express the order or dependency between operations;

[0018] Weight function where w(e ij )=f(Tij , F ij ) weight, indicating the strength of the relationship between operations.

[0019] Furthermore, the use of graph theory technology to model the behavior chain in step 1 is an in-depth processing of the graph model, defining the nodes, edges and their weights of the graph, and representing the strength relationship, time interval or frequency between operations by defining the weights of nodes and edges. Specifically, it includes:

[0020] Node weight is calculated by the following function:

[0021]

[0022] in, is node v i The weight of is node v i The frequency of the corresponding operation, is node v i The importance of the corresponding operation, is node v i The complexity of context information, α, β and γ are weight coefficients, satisfying α+β+γ=1;

[0023] The edge weight formula is used to construct the weight of the edge in the graph model, reflecting the relationship between nodes under normal circumstances. The weight is calculated based on the time interval and operation frequency. The edge weight is calculated by the following function:

[0024] w ij =f(T ij , F ij )

[0025] Among them, w ij It is edge ij The weight, T ij is the time interval between operations, F ij is the frequency of operation, f is the weight function, i represents the index of a node, and j represents the index of another node.

[0026] Furthermore, step 2 specifically includes:

[0027] The calculated node association degree is compared with the baseline model of the normal behavior chain to determine whether there is an abnormality. The node association degree A(v i ) is calculated as:

[0028]

[0029] where w ij is node v i With node v j The weight of the edge between them reflects the strength of the association between nodes;

[0030] The edge weight anomaly detection formula is:

[0031] If the outlier value of edge weight Δw ij Exceeding the abnormal threshold θ anomaly , then it means that edge e ij There is an abnormal relationship or order;

[0032] Among them, ω observed (e ij ) is the actual observed edge weight, ω expected (e ij ) is the expected edge weight in the baseline model, σ ij is the standard deviation of edge weights; the edge weight anomaly detection formula is used to identify anomalies in edge weights during real-time detection, compare the difference between actual weights and expected weights, and combine the standard deviation to determine whether there is an anomaly;

[0033] The anomaly score is calculated as:

[0034] Among them, μ A and σ A are the mean and standard deviation of node association, respectively;

[0035] If |S(v i )| is within the set normal range (such as [-2,2]), the node association is considered normal; if |S(v i )|Out of this range (such as S(v i )>2 or S(v i )<-2), the node is judged to be abnormal, indicating abnormal operation or malicious behavior.

[0036] Furthermore, step three specifically includes:

[0037] Use a mixed Gaussian model to model abnormal behavior chains and calculate the probability density function of each abnormal behavior chain:

[0038]

[0039] Among them, π k is the mixing weight, is the Gaussian distribution function μ k and∑ k are the mean and covariance matrix of the Gaussian distribution respectively; the probability density function P(x) of the mixed Gaussian model is used to model the characteristics of the behavior chain, and abnormal behavior is identified by calculating the probability density of the feature vector.

[0040] Furthermore, the normal range of the baseline model is defined as follows:

[0041] Node degree range D normal (v i )∈[D min , D max ];

[0042] Among them, D min and D max are the minimum and maximum thresholds of node degree respectively; D normal (v i ): represents node v i The normal range of the degree of node v i The degree of node v i The number of connected edges; during the detection process, the system will i Calculate its current degree. If the node’s degree D(v i ) exceeds the preset normal range [D min , D max ], the node will be marked as abnormal;

[0043] Edge weight range W normal (e ij )∈[W min , W max ];

[0044] Among them, W normal (e ij ) represents node v i and v j The edge between ij The normal range of weights; W min and W max are the minimum and maximum thresholds of edge weights respectively; the system calculates the actual weight W(e ij ) and compare it with the preset normal range [W min , W max ] for comparison; if the weight of an edge exceeds this range, it means that the edge may have an abnormal association.

[0045] The present invention has the following advantages:

[0046] 1. Improved anomaly detection methods, using behavior chain modeling and multi-level anomaly detection mechanisms to improve detection efficiency.

[0047] 2. Through precise mathematical models and comprehensive feature analysis, the false positive and false negative rates in detection are reduced and the accuracy is improved.

[0048] 3. The introduction of complex network analysis and multi-dimensional feature fusion technology enhances the adaptability of the detection system in complex environments.

[0049] 4. Through real-time monitoring and dynamic adjustment mechanisms, ensure that the system can promptly detect and respond to abnormal changes in the behavior chain.

[0050] 5. The advanced feature extraction technology and optimized data processing methods are adopted to solve the limitations of feature extraction and data processing.

[0051] 6. Through complex mathematical models and multiple machine learning methods, the ability and accuracy of identifying malicious behavior are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The present invention is a flowchart of a method for behavior chain analysis and abnormal association detection. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] like Figure 1 As shown, the embodiment of the present invention provides a method for behavior chain analysis and abnormal association detection, including the following steps:

[0055] (1) Behavior chain modeling:

[0056] First, collect program operation behavior data and record the operation sequence and its context information.

[0057] Next, consider these operation behaviors as nodes in a chain, and construct a graph model of the behavior chain. Constructing a graph model of the behavior chain means graphically representing the collected program operation behavior data according to the operation sequence and relationship. The "graph model" here is a preliminary representation method, which regards each operation in the behavior chain as a node in the graph, and the sequence or relationship between the operations is represented as the edge in the graph. This process is equivalent to establishing a basic graph structure for representing the behavior chain. Each node represents an operation, and each edge represents the sequence or relationship between operations.

[0058] The nodes and edges of the graph model are defined as follows:

[0059] Node set V = {v1, v2, ..., v n}, where each node v i Represents an operation;

[0060] The edge set E = {eij |e ij Connect node v i and v j}, where each edge e ij Express the order or dependency between operations;

[0061] Weight function where w(e ij )=f(T ij , F ij ) weight, indicating the strength of the relationship between operations.

[0062] Then, use graph theory technology to model the behavior chain. After building the graph model, the next step is a more in-depth modeling process. This step uses graph theory technology to further analyze and define the specific properties of the nodes, edges and their weights in the graph. "Modeling" here refers to the quantitative description of the nodes and edges in the graph model according to a specific algorithm or technology, such as defining the weights of nodes and edges to represent the strength of the relationship between operations, time intervals or frequencies, and other information. This step is a refined processing of the graph model, so that the graph model is not only a simple structural representation, but also can play a role in subsequent analysis. Building a graph model is the premise of modeling, and modeling is an in-depth processing of the graph model to define the nodes, edges and their weights of the graph.

[0063] Node weight is calculated by the following function:

[0064]

[0065] in, is node v i The weight of is node v i The frequency of the corresponding operation, is node v i The importance of the corresponding operation, is node v i The complexity of context information, α, β and γ are weight coefficients, satisfying α+β+γ=1.

[0066] The edge weight formula is used to construct the weight of the edge in the graph model, reflecting the relationship between nodes under normal circumstances. The weight is calculated based on the time interval and operation frequency. The edge weight is calculated by the following function:

[0067] w ij =f(T ij , F ij )

[0068] Among them, w ij It is edge ij The weight, T ij is the time interval between operations, Fij is the frequency of the operation, f is the weight function, i represents the index of a node, such as the i-th operation; j represents the index of another node, such as the j-th operation.

[0069] (2) Abnormal association detection: Build a baseline model based on normal behavior chain data to define the patterns and characteristics of normal behavior chains.

[0070] The normal ranges for the baseline model are defined as follows:

[0071] Node degree range D normal (v i )∈[D min , D max ];

[0072] Among them, D min and D max are the minimum and maximum thresholds of node degree respectively; D normal (v i ) represents node v i The normal range of the degree of node v i The degree of node v i The number of connected edges; during the detection process, the system will i Calculate its current degree. If the node’s degree D(v i ) exceeds the preset normal range [D min , D max ], the node will be marked as abnormal;

[0073] Edge weight range W normal (e ij )∈[W min , W max ]

[0074] Among them, W normal (e ij ) represents node v i and v j The edge between ij The normal range of weights; W min and W max are the minimum and maximum thresholds of edge weights respectively; the system calculates the actual weight W(e ij ) and compare it with the preset normal range [W min , W max ] for comparison; if the weight of an edge exceeds this range, it means that the edge may have an abnormal association.

[0075] On this basis, the dynamic changes of the behavior chain are monitored in real time, and the abnormal correlation pattern in the detection behavior chain is calculated by the following formula:

[0076] The calculated node association degree is compared with the baseline model of the normal behavior chain to determine whether there is an anomaly. The node association degree is calculated as:

[0077]

[0078] where w ij is node v i With node v j The weight of the edge between them reflects the strength of the association between nodes;

[0079] The edge weight anomaly detection is:

[0080] If the outlier value of edge weight Δw ij If it exceeds the threshold, it means that edge e ij There is an abnormal relationship or order.

[0081] Among them, w observed (e ij ) is the actual observed edge weight, w expected (e ij ) is the expected edge weight in the baseline model, σ ij is the standard deviation of edge weights. The edge weight anomaly detection formula is used to identify anomalies in edge weights during real-time detection. It compares the difference between the actual weights and the expected weights and combines the standard deviation to determine whether there is an anomaly.

[0082] The anomaly score is calculated as:

[0083] Among them, μ A and σ A are the mean and standard deviation of node association, respectively.

[0084] If |S(v i )| is within the set normal range (such as [-2,2]), the node association is considered normal; if |S(v i )|Out of this range (such as S(v i )>2 or S(v i )<-2), the node is judged to be abnormal, indicating abnormal operation or malicious behavior.

[0085] (3) Malicious behavior identification: Extract features from the detected abnormal behavior chains, including the degree of abnormal nodes and the weight of abnormal edges, and use these features as input data to train the malicious behavior detection model. The model will learn the relationship between these features and malicious behavior, so that it can identify and classify whether new behavior chains are abnormal or malicious. Use the following comprehensive model (comprehensive model refers to combining multiple models or algorithms to improve the accuracy and robustness of detection) to train the malicious behavior detection model and classify abnormal behavior chains.

[0086] Specifically, a mixed Gaussian model is used to model the abnormal behavior chain, and the probability density function of each abnormal behavior chain is calculated:

[0087]

[0088] Among them, π k is the mixing weight, is the Gaussian distribution function μ k and∑ k are the mean and covariance matrix of the Gaussian distribution, respectively. The probability density function P(x) of the mixed Gaussian model is used to model the characteristics of the behavior chain, and abnormal behavior is identified by calculating the probability density of the feature vector. Specifically, the behavior chain features with low probability density in the model indicate the degree to which they deviate from the normal behavior pattern, which helps to identify malicious behavior. In this way, the comprehensive model can effectively detect and classify malicious behavior in newly emerging behavior chains.

[0089] (4) Multi-dimensional feature fusion: In the feature extraction process, by combining multi-dimensional features, the characteristics of the behavior chain can be more accurately described, providing more information to identify abnormal or malicious behavior. The extracted features are used to train the mixed Gaussian model for malicious behavior detection. By analyzing these features, the model can identify the difference between normal and abnormal behaviors. This includes the time interval between operations, the frequency of operations, and the context information of the operations. The principal component analysis (PCA) method is used to improve the expressiveness of the features. The covariance matrix in the principal component analysis is calculated as:

[0090]

[0091] Among them, x i is the i-th sample, is the sample mean, and N is the total number of samples. The processed data will have lower dimensions and will be easier for the model to handle.

[0092] The following is an example to illustrate:

[0093] 1. Behavior chain modeling

[0094] 1.1 Data Collection: Operation behavior data is collected from a real system log containing 10,000 user operations. The operation record includes timestamp, operation type and operation result.

[0095] 1.2 Graph model construction: Convert the operation data into a behavior chain graph model. Each operation is a node, and the edges between nodes represent the relationship between operations.

[0096] 2. Abnormal correlation detection

[0097] 2.1 Baseline model construction: 5000 normal behavior chain data are used to build a baseline model, and the mean and standard deviation of the node association and edge weight in the normal operation chain are statistically analyzed.

[0098] 2.2 Anomaly Detection: Real-time monitoring of behavior chain changes. Calculate node association A(v i ) and the anomaly detection index Δw of edge weight ij :

[0099]

[0100]

[0101] Abnormal score S(v i ) is calculated as:

[0102] Among them, μ A and σ A are the mean and standard deviation of node association, respectively.

[0103] 3. Malicious behavior identification

[0104] 3.1 Feature extraction: Extract features from abnormal behavior chains, use mixed Gaussian model to build models, and calculate the probability density function of each behavior chain:

[0105]

[0106] Among them, π k is the mixing weight, is the Gaussian distribution function μ k and∑ k are the mean and covariance matrix of the Gaussian distribution.

[0107] 4. Multi-dimensional feature fusion

[0108] 4.1 Feature fusion: Principal component analysis (PCA) is used for feature extraction. The covariance matrix in principal component analysis is calculated as:

[0109]

[0110] Among them, xi is the i-th sample, is the sample mean, and N is the total number of samples.

[0111] 4.2 Experimental data and verification:

[0112] The experimental data table is as follows:

[0113] Table 1: Normal behavior chain data statistics

[0114]

[0115] Table 2: Anomaly detection performance comparison

[0116]

[0117] Table 3: Anomaly detection experimental results

[0118]

[0119] Table 4: Malicious behavior identification capabilities

[0120]

[0121] According to the results of experimental data, the following conclusions can be drawn:

[0122] 1. Improved detection accuracy: The false positive rate (5%) and false negative rate (7%) of the method of the present invention are significantly better than the 15% and 20% of the traditional method. The detection accuracy and the ability to identify new malicious behaviors have also been significantly improved.

[0123] 2. Improved real-time performance: The average processing time of the method of the present invention is shortened to 15 seconds, which is 50% faster than the 30 seconds of the traditional method. Both the detection delay and memory usage are significantly improved.

[0124] 3. Enhanced malicious behavior identification capabilities: The recognition accuracy rates for malicious behaviors such as network attacks, data leaks, privilege abuse, and system tampering reached 87%, 82%, 88%, and 84%, respectively, which are significantly better than traditional methods.

[0125] The experimental results show that the present invention has the following innovations:

[0126] 1. Construction of the behavior chain graph model: Existing technologies usually use single events or static features to detect malicious behaviors, which tends to ignore the correlation and dynamic characteristics between operational behaviors. The present invention innovatively regards program operation behaviors as a chain, uses graph theory technology to model the behavior chain, and reveals potential complex behavior patterns through the association between nodes and edges. This method can not only capture the dynamic evolution of operational behaviors, but also more accurately identify potential malicious behaviors by analyzing the interaction between different nodes in the chain, greatly improving the accuracy and comprehensiveness of detection.

[0127] 2. Multi-dimensional feature analysis: Most existing SQL attack detection methods are based on single-dimensional features, such as IP address or request string, which cannot fully determine the authenticity of the alarm, resulting in a high false alarm rate. The present invention comprehensively evaluates the authenticity of SQL injection attack alarms by comprehensively analyzing multi-dimensional features including source IP address, request string, request size, request frequency, target URL, number of request parameters, etc. Through the joint analysis of multi-dimensional features, the present invention can effectively eliminate false alarms of SQL attacks and improve the accuracy of alarm processing.

[0128] 3. False alarm elimination based on historical alarm patterns: The existing technology often relies on fixed rules or thresholds for false alarm elimination, lacks consideration of historical alarm patterns, and easily leads to misjudgment. The present invention introduces historical alarm pattern analysis, identifies common false alarm patterns by comparing the similarity between the current alarm and historical data, and automatically eliminates possible false alarm behaviors. This method reduces false alarms while improving the system's ability to accurately respond to SQL injection attacks and reducing the workload of security personnel.

[0129] 4. Application of principal component analysis (PCA) in alarm feature selection: In traditional false alarm detection methods, feature selection is usually completed through expert experience or simple statistical methods, which easily leads to excessive dimensions or feature redundancy, affecting detection efficiency. The present invention innovatively introduces principal component analysis (PCA) technology to automatically reduce the dimension of alarm features and select the most representative features for analysis. This innovation not only reduces the complexity of data processing, but also significantly improves the efficiency and accuracy of the false alarm elimination process.

[0130] 5. Multi-level alarm correlation analysis: Existing alarm analysis technologies usually stay at a single level of analysis, and it is difficult to identify the correlation between alarms at different levels. The present invention proposes a multi-level alarm correlation analysis method, which identifies potential alarm correlations by analyzing multiple levels of features such as network context, request latency, and connection stability, and eliminates false alarms based on this. This method has significant advantages in solving the problem of SQL attack false alarms in complex scenarios.

[0131] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for behavior chain analysis and abnormal association detection, characterized in that: The following steps are involved: Step 1: Behavior chain modeling: collect program operation behavior data, and build a graph model of the behavior chain based on the operation behavior data. The graph model represents the behavior chain in a graph structure, where each node represents an operation, and each edge represents the order or relationship between operations. The behavior chain is modeled using graph theory technology. Step 2: Abnormal association detection: Use the modeling information in step 1 to calculate the association degree of each node, and compare the calculated node association degree with the baseline model of the normal behavior chain to determine whether there is an abnormality; Step 3: Malicious behavior identification: Extract features from the detected abnormal behavior chain, including the degree of abnormal nodes and the weight of abnormal edges, and use the extracted features as input data to train the malicious behavior detection model; the malicious behavior detection model learns the relationship between the extracted features and malicious behavior, identifies and classifies the input new behavior chain to determine whether it is abnormal or malicious.

2. The method for behavior chain analysis and abnormal association detection as claimed in claim 1, characterized in that: Also includes: Step 4: Multi-dimensional feature fusion: In the feature extraction process, multi-dimensional features are combined to provide more information to identify abnormal or malicious behaviors. The extracted features are used to train the mixed Gaussian model for malicious behavior detection. The extracted features include the time interval between operations, the operation frequency, and the context information of the operations. The principal component analysis (PCA) method is used to improve the expression ability of the features. The covariance matrix in the principal component analysis is calculated as: Among them, x i is the i-th sample, is the sample mean, and N is the total number of samples.

3. The method for behavior chain analysis and abnormal association detection as claimed in claim 1, characterized in that: The step 1 of constructing a graphical model of a behavior chain according to the operation behavior data specifically includes: the operation behavior data records the operation sequence and its context information, and graphically represents the collected program operation behavior data according to the operation sequence and relationship.

4. The method according to claim 3, characterized in that The nodes and edges of the graph model are defined as follows: Node set V = {v1, v2, ..., v n }, where each node v i Represents an operation; The edge set E = {e ij |e ij Connect node v i and v j }, where each edge e ij Express the order or dependency between operations; Weight function where w(e ij )=f(T ij , F ij ) weight, indicating the strength of the relationship between operations.

5. The method for behavior chain analysis and abnormal association detection as claimed in claim 4, characterized in that: In step 1, modeling the behavior chain using graph theory technology is an in-depth processing of the graph model. It defines the nodes, edges and their weights of the graph. By defining the weights of nodes and edges, the strength relationship, time interval or frequency between operations are expressed. Specifically, it includes: Node weight is calculated by the following function: in, is node v i The weight of is node v i The frequency of the corresponding operation, is node v i The importance of the corresponding operation, is node v i The complexity of context information, α, β and γ are weight coefficients, satisfying α+β+γ=1; The edge weight formula is used to construct the weight of the edge in the graph model, reflecting the relationship between nodes under normal circumstances. The weight is calculated based on the time interval and operation frequency. The edge weight is calculated by the following function: w ij =f(T ij ,F ij ) Among them, w ij It is edge ij The weight, T ij is the time interval between operations, F ij is the frequency of operation, f is the weight function, i represents the index of a node, and j represents the index of another node.

6. The method for behavior chain analysis and abnormal association detection as claimed in claim 1, characterized in that: Step 2 specifically includes: The calculated node association degree is compared with the baseline model of the normal behavior chain to determine whether there is an abnormality. The node association degree A(v i ) is calculated as: where w ij is node v i With node v j The weight of the edge between them reflects the strength of the association between nodes; The edge weight anomaly detection formula is: If the outlier value of edge weight Δw ij Exceeding the abnormal threshold θ anomaly , then it means that edge e ij There is an abnormal relationship or order; Among them, w observed (e ij ) is the actual observed edge weight, w expected (e ij ) is the expected edge weight in the baseline model, σ ij is the standard deviation of edge weights; the edge weight anomaly detection formula is used to identify anomalies in edge weights during real-time detection, compare the difference between actual weights and expected weights, and combine the standard deviation to determine whether there is an anomaly; The anomaly score is calculated as: Among them, μ A and σ A are the mean and standard deviation of node association, respectively; If |S(v i )| is within the set normal range (such as [-2,2]), the node association is considered normal; if |S(v i )|Out of this range (such as S(v i )>2 or S(v i )<-2), the node is judged to be abnormal, indicating abnormal operation or malicious behavior.

7. The method for behavior chain analysis and abnormal association detection as claimed in claim 1, characterized in that: Step three specifically includes: Use a mixed Gaussian model to model abnormal behavior chains and calculate the probability density function of each abnormal behavior chain: Among them, π k is the mixing weight, is the Gaussian distribution function μ k and Σ k are the mean and covariance matrix of the Gaussian distribution respectively; the probability density function P(x) of the mixed Gaussian model is used to model the characteristics of the behavior chain, and abnormal behavior is identified by calculating the probability density of the feature vector.

8. The method according to claim 1, characterized in that The normal ranges for the baseline model are defined as follows: Node degree range D normal (v i )∈[D min , D max ]; Among them, D min and D max are the minimum and maximum thresholds of node degree respectively; D normal (v i ): represents node v i The normal range of the degree of node v i The degree of node v i The number of connected edges; during the detection process, the system will i Calculate its current degree. If the node’s degree D(v i ) exceeds the preset normal range [D min , D max ], the node will be marked as abnormal; Edge weight range W normal (e ij )∈[W min , W max ]; Among them, W normal (e ij ) represents node v i and v j The edge between ij The normal range of weights; W min and W max are the minimum and maximum thresholds of edge weights respectively; the system calculates the actual weight W(e ij ) and compare it with the preset normal range [W min , W max ] for comparison; if the weight of an edge exceeds this range, it means that the edge may have an abnormal association.

Images