Multi-modal fusion network abnormal behavior detection system and method thereof

Abstract

The invention relates to the technical field of network security detection systems, in particular to a multi-modal fusion network abnormal behavior detection system and method. The multi-modal feature extraction module is connected with the multi-modal data collection module; the multi-modal fusion module is connected with the multi-modal feature extraction module and used for fusing the feature vectors Vi; the behavior recognition module is connected with the multi-modal fusion module and is used for analyzing the fusion vector F, judging whether the host to be tested has an abnormal behavior or not, and judging the category and confidence of the abnormal behavior; the active learning annotation screening module is used for screening and annotating unannotated data so as to optimize the model performance; multi-modal data collection provides rich original information for feature extraction, deep feature extraction provides high-quality feature representation for multi-modal fusion, a fusion method of an attention mechanism makes full use of the features, and an active learning module continuously optimizes the performance of the whole system.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection systems, and in particular to a multi-modal fusion network abnormal behavior detection system and a method thereof. Background Art

[0002] With the rapid development of information technology and the widespread popularity of network applications, network security issues are becoming increasingly prominent. As an important means of network security protection, network abnormal behavior detection has always been the focus of academic and industrial attention. Traditional network abnormal behavior detection methods mainly rely on a single data source, such as network traffic analysis or log auditing, which to some extent limits the accuracy and comprehensiveness of detection.

[0003] In recent years, with the advancement of machine learning technology, anomaly detection methods based on machine learning have been widely used. These methods can better identify abnormal behaviors that deviate from normal patterns by learning the patterns of normal network behavior. However, these methods still have some significant limitations. First, most of them rely on a single data source and it is difficult to fully capture multiple aspects of network behavior. Second, traditional machine learning methods often require a lot of manual feature engineering, which is not only time-consuming and labor-intensive, but also difficult to adapt to the rapidly changing network environment and new attack methods.

[0004] In addition, existing anomaly detection systems generally face the problems of high false positive rate and high false negative rate. This is mainly because the complexity and diversity of network behavior make the boundary between normal behavior and abnormal behavior often blurred. Especially in the face of complex attacks such as advanced persistent threats (APT), the detection capabilities of traditional methods are particularly insufficient.

[0005] Another common problem is sample imbalance. In actual network environments, abnormal behaviors usually account for only a small proportion, which makes the detection model prone to bias and has poor recognition ability for minority classes (abnormal behaviors). Although some studies have tried to solve this problem through methods such as oversampling or undersampling, the results are often unsatisfactory.

[0006] Finally, most existing anomaly detection systems lack adaptive capabilities. Network environments and attack methods are constantly changing, and static detection models are difficult to adapt to these changes in a timely manner, resulting in a decrease in detection effectiveness over time.

[0007] Faced with these challenges, new methods are urgently needed to comprehensively, accurately, and adaptively detect abnormal network behavior. Summary of the invention

[0008] The present invention aims to solve the above technical problems and proposes a network abnormal behavior detection system and method based on multimodal fusion. The system integrates multi-source heterogeneous data, uses deep learning technology to automatically extract features, adopts attention mechanism to achieve intelligent fusion, and introduces active learning strategy to solve the problem of sample imbalance, thereby achieving more comprehensive, accurate and adaptive network abnormal behavior detection.

[0009] The present invention proposes a multi-modal fusion network abnormal behavior detection system, comprising:

[0010] Multimodal data collection module, used to obtain traffic information, log information, user behavior and network permission information of the host under test;

[0011] The multimodal feature extraction module is connected to the multimodal data collection module and is used to extract features from the flow information, log information, user behavior and network permission information to obtain the corresponding feature vector V i , where i∈{1,2,3,4}, corresponding to four modal data respectively;

[0012] A multimodal fusion module is connected to the multimodal feature extraction module and is used to extract the feature vector V i The fusion is performed to obtain the fusion vector F, where the fusion process is implemented by the following formula: α i is the attention weight of the i-th modal data;

[0013] A behavior recognition module, connected to the multimodal fusion module, is used to analyze the fusion vector F to determine whether the host to be tested has abnormal behavior, the category of the abnormal behavior and its confidence level;

[0014] The active learning annotation and screening module is connected to the multimodal data collection module, the multimodal feature extraction module and the behavior recognition module, and is used to screen and annotate unlabeled data to optimize model performance.

[0015] Preferably, the multimodal feature extraction module includes four feature extractors, each feature extractor corresponds to modal data, and each feature extractor adopts an encoder structure based on deep learning. The feature extraction process can be expressed as: V i =Encoder i (X i ), where X i is the original data of the i-th mode, Encoder i is the corresponding deep learning encoder.

[0016] Preferably, the multimodal fusion module adopts a deep learning model based on a cross-modal attention mechanism, including a feature vector weight calculation unit and a feature fusion unit, wherein the feature vector weight calculation unit obtains the attention weight α by calculating the cosine similarity between feature vectors of different modalities. i , the calculation formula is: Where cos(V i ,V j ) represents the feature vector V i and V j The cosine similarity between .

[0017] Preferably, the behavior recognition module adopts a classifier based on a multi-layer fully connected network and uses a Softmax function to output the detection result, which is defined as follows: Where y represents the predicted category, k∈{0,1} is the confidence interval, and W k and b k are the weight vector and bias term of the kth category respectively, and K is the total number of categories.

[0018] Preferably, the active learning annotation and screening module adopts an anomaly score strategy for data screening, and the calculation formula of the anomaly score AS is: AS = |P-0.5|, where P is the probability of unlabeled data being identified as abnormal behavior. When AS is greater than a preset threshold θ, the data sample is marked as a sample with information content and added to the training set.

[0019] The multimodal fusion network abnormal behavior detection method based on the system includes the following steps:

[0020] S1: Multimodal data collection, obtaining the flow information, log information, user behavior and network permission information of the host under test through the multimodal data collection module;

[0021] S2: Multimodal feature extraction: Use the multimodal feature extraction module to extract features from the multimodal data collected in S1 to obtain the feature vector V i ;

[0022] S3: Multimodal fusion, the feature vector V obtained in S2 i Input the multimodal fusion module and fuse it through the cross-modal attention mechanism to obtain the fusion vector F;

[0023] S4: Behavior recognition: input the fusion vector F obtained in S3 into the behavior recognition module to determine whether the host under test has abnormal behavior, the category of abnormal behavior and its confidence level;

[0024] S5: Active learning annotation and screening, use the active learning annotation and screening module to screen and annotate unlabeled data to optimize model performance.

[0025] Preferably, the multimodal feature extraction step in S2 specifically includes:

[0026] For each modal data X i , i∈{1,2,3,4}, use the corresponding deep learning encoder Encoder to extract features and obtain the feature vector V i =Encoder i (X i );

[0027] Among them, traffic information, log information, user behavior and network permission information correspond to i=1, 2, 3, 4 respectively.

[0028] Preferably, the multimodal fusion step in S3 specifically includes:

[0029] Calculate the cosine similarity between eigenvectors of different modalities: where ∥V i ∥ and ∥V j ∥ respectively represent vector V i and V j The L2 norm of ;

[0030] Calculate the attention weight based on cosine similarity:

[0031] Feature fusion using attention weights:

[0032] Preferably, the behavior identification step in S4 specifically includes:

[0033] Input the fusion vector F into the multi-layer fully connected network;

[0034] Use the Softmax function to calculate the probability of each category:

[0035] Based on the probability value, determine whether the host under test has abnormal behavior, the type of abnormal behavior and its confidence.

[0036] Preferably, the active learning annotation and screening step in S5 specifically includes: extracting features and identifying behaviors of unlabeled data; calculating anomaly scores: AS=|P-0.5|, where P is the probability that unlabeled data is identified as abnormal behaviors; screening data according to the anomaly scores: if AS>θ, the data sample is marked as an informative sample and added to the training set, where θ is a preset threshold; retraining the model with the newly added annotated data to improve model performance; repeating the above process until the model performance reaches expectations or the number of iterations reaches a set value.

[0037] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0038] First, through multimodal data fusion, the present invention realizes a full range of observation of network behavior. The system not only takes into account network traffic information, but also integrates data from multiple dimensions such as system logs, user behavior, and permission information. This multi-angle analysis greatly improves the comprehensiveness and accuracy of abnormal behavior detection. Especially in the face of complex attack scenarios, the advantages of multimodal fusion are more obvious. For example, some advanced persistent threats may be very hidden in a single dimension, but when comprehensively analyzed in multiple dimensions, abnormal characteristics can be exposed.

[0039] Secondly, the feature extraction method based on deep learning significantly improves the system's adaptability and generalization capabilities. Unlike traditional methods that rely on manually designed features, the deep learning model of the present invention can automatically learn effective feature representations from raw data. This not only greatly reduces the manual workload, but more importantly, enables the system to adapt to the ever-changing network environment and new attack methods. The nonlinear modeling capability of the deep learning model also enables the system to capture more complex and hidden abnormal patterns.

[0040] Thirdly, the multimodal fusion method based on the attention mechanism realizes the intelligent trade-off of different data sources. This method can dynamically adjust the importance of each modality data according to the specific situation, so as to achieve the best performance in different types of abnormal behavior detection. For example, when detecting DDoS attacks, the system pays more attention to network traffic characteristics; while when identifying internal threats, user behavior and permission information are given more attention. This flexibility allows the system to remain efficient in the face of various types of network threats.

[0041] In addition, the active learning annotation and screening module introduced in the present invention effectively solves the problem of sample imbalance. By intelligently selecting the most informative samples for annotation and model update, the system not only improves the ability to identify rare abnormal behaviors, but also greatly reduces the cost of data annotation. This feature enables the system to continuously improve itself in practical applications and maintain long-term high efficiency.

[0042] Finally, the synergy between the various modules of the present invention produces a significant synergistic effect. Multimodal data collection provides rich original information for feature extraction, deep feature extraction provides high-quality feature representation for multimodal fusion, the fusion method of the attention mechanism makes full use of these features, and the active learning module continuously optimizes the performance of the entire system. This close synergy enables the system as a whole to show performance improvements far beyond the simple addition of each part.

[0043] In general, this invention effectively solves the problems of insufficient accuracy, poor adaptability, and sample imbalance faced by existing network abnormal behavior detection systems through innovative multimodal fusion methods, deep learning technology, and active learning strategies. The high accuracy, low false alarm rate, and strong adaptive ability demonstrated by the system provide a powerful tool for network security protection, which has important theoretical significance and practical application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is the overall logic block diagram of the system of the present invention.

[0045] Figure 2 It is a logic block diagram of the multimodal data collection module of the present invention.

[0046] Figure 3 It is a logic block diagram of the multimodal feature extraction module of the present invention.

[0047] Figure 4 It is a logical block diagram of the multimodal fusion module of the present invention.

[0048] Figure 5 It is a logic block diagram of the behavior recognition module of the present invention.

[0049] Figure 6 This is a logic block diagram of the active learning annotation screening module of the present invention. DETAILED DESCRIPTION

[0050] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects thereof are described in detail below in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0051] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0052] Example 1

[0053] See also Figure 1-6 The present invention provides a multi-modal fusion network abnormal behavior detection system and method thereof, aiming to solve the problem of insufficient detection accuracy caused by a single data source in the existing network security detection system.

[0054] First, the multimodal fusion network abnormal behavior detection system of the present invention includes a multimodal data collection module 1, a multimodal feature extraction module 2, a multimodal fusion module 3, a behavior recognition module 4 and an active learning annotation screening module 5. This modular design makes the system have good scalability and flexibility, and can adapt to different network environments and security requirements.

[0055] Specifically, the multimodal data collection module 1 is responsible for obtaining the traffic information, log information, user behavior and network permission information of the host to be tested. These four different types of data sources provide the system with a comprehensive network behavior portrait, greatly improving the coverage of abnormal behavior detection. For example, in a typical enterprise network environment, traffic information may include characteristics such as the size, frequency and destination of network packets, log information may record user login time, accessed files and executed commands, user behavior data may include keyboard input mode and mouse movement trajectory, and network permission information may include user access level and resource usage restrictions.

[0056] Secondly, the multimodal feature extraction module 2 is connected to the multimodal data collection module 1 to extract features from the collected four modal data and obtain the corresponding feature vector V i , where i∈{1,2,3,4}. In one embodiment of the present invention, each modal data is equipped with a dedicated feature extractor, and these feature extractors all adopt an encoder structure based on deep learning. The feature extraction process can be expressed as: V i =Encoder i (X i ), where X i is the original data of the i-th mode, Encoder i For example, for traffic information, a convolutional neural network (CNN) can be used as an encoder to extract the spatiotemporal features of network traffic; for log information, a recurrent neural network (RNN) or a long short-term memory network (LSTM) can be used to capture sequence information; for user behavior, an autoencoder can be used to learn a compact representation of the behavior pattern; and for network permission information, a multi-layer perceptron (MLP) can be used to extract high-level features.

[0057] Then, the multimodal fusion module 3 is connected to the multimodal feature extraction module 2 to fuse the feature vectors Vi to obtain the fusion vector F. The fusion process is implemented by the following formula: α iis the attention weight of the i-th modal data. The present invention adopts a deep learning model based on a cross-modal attention mechanism for feature fusion. This method can adaptively adjust the importance of different modal data and improve the flexibility and generalization ability of the model. For example, when detecting DDoS attacks, the system pays more attention to traffic information, so it gives higher weight to traffic features; when detecting internal threats, user behavior and permission information get more attention.

[0058] Next, the behavior recognition module 4 is connected to the multimodal fusion module 3 to analyze the fusion vector F to determine whether the host under test has abnormal behavior, the category of abnormal behavior and its confidence. In one embodiment of the present invention, the behavior recognition module 4 uses a classifier based on a multi-layer fully connected network and uses the Softmax function to output the detection result. The Softmax function is defined as follows: Where y represents the predicted category, k∈{0,1} is the confidence interval, and W k and b k are the weight vector and bias term of the kth category, respectively, and K is the total number of categories. This design can not only determine whether there is abnormal behavior, but also identify specific abnormal types, such as DDoS attacks, data leaks, internal threats, etc., and give corresponding confidence levels, providing security managers with a more detailed and reliable basis for decision-making.

[0059] Finally, the active learning annotation screening module 5 is connected to the multimodal data collection module 1, the multimodal feature extraction module 2 and the behavior recognition module 4, and is used to screen and annotate unlabeled data to optimize model performance. This module uses an anomaly score strategy for data screening, and the calculation formula of the anomaly score AS is: AS = |P-0.5|, where P is the probability that unlabeled data is identified as abnormal behavior. When AS is greater than the preset threshold θ, the data sample is marked as a sample with information content and added to the training set. For example, the present invention can set θ to 0.3, which means that when the model's judgment on a certain sample is very uncertain (probability close to 0.5) or very certain (probability close to 0 or 1), the present invention believes that this sample has a high amount of information and is worthy of manual review and annotation. This strategy can effectively alleviate the problem of sample imbalance, improve the model's recognition ability for minority classes, and also improve the efficiency and quality of data annotation.

[0060] Next, the present invention introduces in detail a multi-modal fusion network abnormal behavior detection method based on the above system. The method comprises the following steps:

[0061] First, multimodal data collection is performed. The flow information, log information, user behavior and network permission information of the host to be tested are obtained through the multimodal data collection module 1. In practical applications, this may involve the deployment of multiple tools such as network sniffers, log collectors, user behavior monitoring software and permission management systems.

[0062] Secondly, multimodal feature extraction is performed. The multimodal feature extraction module 2 is used to extract features from the collected multimodal data to obtain a feature vector V i For each modal data X i , i∈{1,2,3,4}, using the corresponding deep learning encoder Encoder i Perform feature extraction and obtain the feature vector V i =Encoder i (X i ). Here, traffic information, log information, user behavior and network permission information correspond to i=1, 2, 3, 4 respectively. For example, for traffic information, the present invention extracts features such as packet size distribution, protocol type ratio, source destination IP distribution, etc.; for log information, the present invention may focus on command type sequence, file access mode, etc.; for user behavior, the present invention may extract features such as keystroke speed and mouse movement trajectory; for network permissions, the present invention may focus on information such as user permission level and resource access frequency.

[0063] Then, multimodal fusion is performed. The feature vector Vi obtained in the previous step is input into the multimodal fusion module 3, and fused through the cross-modal attention mechanism to obtain the fusion vector F. The specific steps include: first, calculating the cosine similarity between feature vectors of different modalities: where ∥V i ∥ and ∥V j ∥ respectively represent vector V i and V j The L2 norm of ; then the attention weight is calculated based on the cosine similarity: Finally, the attention weights are used for feature fusion: This fusion method can adaptively adjust the importance of different modal data. For example, when detecting network scanning, traffic features may obtain higher weights; while when detecting permission abuse, user behavior and permission information may be more important.

[0064] Next, behavior recognition is performed. The fusion vector F is input into the behavior recognition module 4 to determine whether the host under test has abnormal behavior, the category of abnormal behavior and its confidence. The specific steps include: first, the fusion vector F is input into the multi-layer fully connected network; then the Softmax function is used to calculate the probability of each category: Finally, the probability value is used to determine whether the host under test has abnormal behavior, the type of abnormal behavior, and its confidence. For example, the present invention can set a probability threshold of 0.8. When the probability of a certain abnormal behavior exceeds this threshold, the system will issue an alarm. This design can not only identify whether an abnormality exists, but also give the specific abnormality type and confidence, providing more decision-making basis for security personnel.

[0065] Finally, active learning annotation and screening is performed. The active learning annotation and screening module 5 is used to screen and annotate the unlabeled data to optimize the model performance. The specific steps include: first, feature extraction and behavior recognition of the unlabeled data; then the anomaly score is calculated: AS = |P-0.5|, where P is the probability that the unlabeled data is identified as abnormal behavior; then the data is screened according to the anomaly score: if AS>θ, the data sample is marked as an informative sample and added to the training set, where θ is a preset threshold, which can be set to 0.3, for example; then the model is retrained using the newly added annotated data to improve the model performance; finally, the above process is repeated until the model performance reaches the expected value or the number of iterations reaches the set value. This method can effectively solve the common sample imbalance problem in the field of network security and improve the model's ability to identify rare abnormal behaviors.

[0066] In summary, the multimodal fusion network abnormal behavior detection system and method proposed in the present invention realizes comprehensive and accurate detection of network abnormal behavior through the fusion of multimodal data and deep learning technology. The system can adapt to complex and changeable network environments and provide a powerful tool for network security management.

[0067] In order to verify the effectiveness and superiority of the multi-modal fusion network abnormal behavior detection system and method of the present invention, the present invention selected the widely used UNSW-NB15 dataset for experiment. This dataset contains data on normal network traffic and various modern attack behaviors, which is very suitable for evaluating the system performance of the present invention.

[0068] Embodiment 1: Multimodal fusion network abnormal behavior detection system of the present invention

[0069] In this embodiment, the present invention fully implements the multimodal fusion network abnormal behavior detection system proposed by the present invention. The system uses four modal data: network traffic, system logs, user behavior and permission information. The present invention uses a deep learning model as a feature extractor, adopts a multimodal fusion method based on an attention mechanism, and implements an active learning annotation and screening module.

[0070] Comparative Example 1: Traditional single-mode network anomaly detection system

[0071] For comparison, the present invention implements a traditional anomaly detection system that uses only network traffic data. The system uses a random forest algorithm for feature extraction and classification, and does not use deep learning and multimodal fusion technology.

[0072] Test indicators and methods:

[0073] 1. Accuracy: The number of correctly classified samples divided by the total number of samples.

[0074] 2. Precision: The number of true positive examples divided by the number of samples predicted to be positive examples.

[0075] 3. Recall: The number of true positive examples divided by the number of all actual positive examples.

[0076] 4. F1 score: the harmonic mean of precision and recall.

[0077] 5. False Negative Rate (FNR): The number of missed abnormal samples divided by the number of all actual abnormal samples.

[0078] 6. False Positive Rate (FPR): The number of false positive samples divided by the number of actual normal samples.

[0079] The present invention uses a 5-fold cross validation method to test to ensure the reliability of the results. At the same time, the present invention also tests the performance of the system on different types of attacks to comprehensively evaluate its performance.

[0080] The test results are shown in the following table:

[0081] index Embodiment 1 (present invention) Comparative Example 1 (Traditional Method) Accuracy 97.8％ 92.3％ Accuracy 96.5％ 89.7％ Recall 95.9％ 87.2％ F1 score 96.2％ 88.4％ False negative rate 4.1％ 12.8％ False Positive Rate 1.3％ 5.6％

[0082] For different types of attacks, the system of the present invention performs as follows:

[0083] 1.DDoS attack detection accuracy: 99.1%;

[0084] 2. Information detection attack detection accuracy: 98.3%;

[0085] 3. Remote control attack detection accuracy: 97.5%;

[0086] 4. Data penetration attack detection accuracy: 96.8%.

[0087] It can be seen from the test results that the multi-modal fusion network abnormal behavior detection system of the present invention is significantly superior to the traditional single-modal method in all indicators. Specifically:

[0088] 1. The accuracy rate increased by 5.5 percentage points to 97.8%, which shows that the system of the present invention can more accurately distinguish between normal and abnormal behaviors.

[0089] 2. The precision and recall rates increased by 6.8 and 8.7 percentage points respectively, and the F1 score increased by 7.8 percentage points. This means that the system of the present invention has achieved a better balance by reducing false positives and improving the detection rate when identifying abnormal behaviors.

[0090] 3. The false negative rate was reduced from 12.8% to 4.1%, a decrease of 68%. This significant improvement means that the system of the present invention can capture more abnormal behaviors and greatly reduce security risks.

[0091] 4. The false alarm rate was reduced from 5.6% to 1.3%, a decrease of 76.8%. This improvement greatly reduced the workload of security personnel in dealing with false alarms and improved the practicality of the system.

[0092] 5. The detection results for different types of attacks show that the system of the present invention has a good recognition ability for various types of attacks, especially the detection accuracy of DDoS attacks is as high as 99.1%.

[0093] These excellent results are mainly due to the following innovations:

[0094] First, multimodal data fusion enables the system to analyze network behavior from multiple dimensions, providing more comprehensive information, thereby improving the accuracy and robustness of detection.

[0095] Secondly, feature extraction based on deep learning can automatically learn more effective feature representations and capture more complex and hidden abnormal patterns compared to manual feature engineering of traditional methods.

[0096] Again, the multimodal fusion method based on the attention mechanism can adaptively adjust the importance of data in different modalities, which enables the system to better cope with different types of attacks.

[0097] Finally, the active learning annotation and screening module effectively solves the sample imbalance problem and improves the system's ability to identify rare abnormal behaviors.

[0098] In general, these test results fully demonstrate the superiority of the system of the present invention. It not only significantly surpasses traditional methods in overall performance, but also performs well in dealing with various types of network attacks. This comprehensive and efficient abnormal behavior detection capability is of great significance for improving the level of network security protection and reducing security risks. In today's complex and changing network environment, the present invention provides a powerful tool for network security management.

[0099] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. The multi-modal fusion network abnormal behavior detection system is characterized by: include: Multimodal data collection module, used to obtain traffic information, log information, user behavior and network permission information of the host under test; The multimodal feature extraction module is connected to the multimodal data collection module and is used to extract features from the flow information, log information, user behavior and network permission information to obtain the corresponding feature vector V i , where i∈{1,2,3,4}, corresponding to four modal data respectively; A multimodal fusion module is connected to the multimodal feature extraction module and is used to extract the feature vector V i The fusion is performed to obtain the fusion vector F, where the fusion process is implemented by the following formula: α i is the attention weight of the i-th modal data; A behavior recognition module, connected to the multimodal fusion module, is used to analyze the fusion vector F to determine whether the host to be tested has abnormal behavior, the category of the abnormal behavior and its confidence level; The active learning annotation and screening module is connected to the multimodal data collection module, the multimodal feature extraction module and the behavior recognition module, and is used to screen and annotate unlabeled data to optimize model performance.

2. The multi-modal fusion network abnormal behavior detection system according to claim 1 is characterized in that: The multimodal feature extraction module includes four feature extractors, each of which corresponds to modal data, and each feature extractor adopts an encoder structure based on deep learning. The feature extraction process can be expressed as: V i =Encoder i (X i ), where X i is the original data of the i-th mode, Encoder i is the corresponding deep learning encoder.

3. The multi-modal fusion network abnormal behavior detection system according to claim 1 is characterized in that: The multimodal fusion module adopts a deep learning model based on a cross-modal attention mechanism, including a feature vector weight calculation unit and a feature fusion unit, wherein the feature vector weight calculation unit obtains the attention weight α by calculating the cosine similarity between feature vectors of different modalities. i , the calculation formula is: Where cos(V i ,V j ) represents the feature vector V i and V j The cosine similarity between .

4. The multi-modal fusion network abnormal behavior detection system according to claim 1 is characterized in that: The behavior recognition module uses a classifier based on a multi-layer fully connected network and uses a Softmax function to output the detection results, which is defined as follows: Where y represents the predicted category, k∈{0,1} is the confidence interval, and W k and b k are the weight vector and bias term of the kth category respectively, and K is the total number of categories.

5. The multi-modal fusion network abnormal behavior detection system according to claim 1 is characterized in that: The active learning annotation and screening module adopts anomaly score strategy for data screening. The calculation formula of anomaly score AS is: AS = |P-0.5|, where P is the probability of unlabeled data being identified as abnormal behavior. When AS is greater than the preset threshold θ, the data sample is marked as a sample with information content and added to the training set.

6. A multi-modal fusion network abnormal behavior detection method based on the system according to any one of claims 1 to 5, characterized in that: The following steps are involved: S1: Multimodal data collection, obtaining the flow information, log information, user behavior and network permission information of the host under test through the multimodal data collection module; S2: Multimodal feature extraction: Use the multimodal feature extraction module to extract features from the multimodal data collected in S1 to obtain the feature vector V i ; S3: Multimodal fusion, the feature vector V obtained in S2 i Input the multimodal fusion module and fuse it through the cross-modal attention mechanism to obtain the fusion vector F; S4: Behavior recognition: input the fusion vector F obtained in S3 into the behavior recognition module to determine whether the host under test has abnormal behavior, the category of abnormal behavior and its confidence level; S5: Active learning annotation and screening, use the active learning annotation and screening module to screen and annotate unlabeled data to optimize model performance.

7. The multimodal fusion network abnormal behavior detection method according to claim 6 is characterized in that: The multimodal feature extraction step in S2 specifically includes: For each modal data X i , i∈{1, 2, 3, 4}, using the corresponding deep learning encoder Encoder i Perform feature extraction and obtain the feature vector V i =Encoder i (X i ); Among them, traffic information, log information, user behavior and network permission information correspond to i=1, 2, 3, 4 respectively.

8. The multimodal fusion network abnormal behavior detection method according to claim 6 is characterized in that: The multimodal fusion step in S3 specifically includes: Calculate the cosine similarity between eigenvectors of different modalities: Where ||V i || and ||V j || respectively represent vector V i and V j The L2 norm of ; Calculate the attention weight based on cosine similarity: Feature fusion using attention weights:

9. The multimodal fusion network abnormal behavior detection method according to claim 6 is characterized in that: The behavior recognition step in S4 specifically includes: Input the fusion vector F into the multi-layer fully connected network; Use the Softmax function to calculate the probability of each category: Based on the probability value, determine whether the host under test has abnormal behavior, the type of abnormal behavior and its confidence.

10. The multimodal fusion network abnormal behavior detection method according to claim 6, characterized in that: The active learning annotation and screening step in S5 specifically includes: extracting features and identifying behaviors of unlabeled data; calculating anomaly scores: AS=|P-0.5|, where P is the probability that unlabeled data is identified as abnormal behaviors; screening data according to the anomaly scores: if AS>θ, the data sample is marked as an informative sample and added to the training set, where θ is a preset threshold; retraining the model with the newly added annotated data to improve model performance; repeating the above process until the model performance reaches the expected level or the number of iterations reaches the set value.

Images