Intrusion detection method based on cross-domain security management and shared behavior model

Abstract

The invention relates to an intrusion detection method based on cross-domain security management and a shared behavior model. The method comprises the following steps: acquiring multi-dimensional original data according to a preset cross-domain data acquisition rule and multi-domain node deployment; performing compliance, integrity and format matching degree verification on the original data, shielding sensitive information by using a dynamic desensitization technology based on a verification result, converting a heterogeneous data format, filtering missing field abnormal data, and obtaining compliance data; the method comprises the following steps: extracting a multi-dimensional feature set of user cross-domain access, constructing a shared behavior feature vector through weighted calculation, constructing a reference behavior model library in combination with a cross-domain security policy, and screening out intrusion behaviors and feature deviation data through feature comparison and behavior deviation calculation; according to the method, cross-domain security audit logs are fused for correlation analysis, intrusion behavior types and risk levels are judged by means of a Bayesian network model, differential security response strategies are generated and executed, and cross-domain intrusion detection and protection are achieved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an intrusion detection method based on cross-domain security management and shared behavior model. Background Technology

[0002] Currently, intrusion detection in cross-domain security management and shared behavior models still has the following areas for improvement: In today's era of rapid network technology development, cross-domain data sharing and interaction have become core requirements for various business scenarios, widely applied in areas such as government-enterprise collaboration and multi-platform linkage. However, the heterogeneity of cross-domain environments, the complexity of data transmission, and the dynamic changes in inter-domain trust relationships pose serious challenges to network security protection.

[0003] Existing intrusion detection methods have significant limitations: Firstly, most solutions lack specific adaptation to cross-domain scenarios, making it difficult to effectively handle format differences and transmission security verification issues of heterogeneous data from multiple domains, and easily leading to detection omissions or misjudgments due to non-standard data. Secondly, traditional detection models mostly rely on fixed feature libraries, failing to fully integrate the dynamic characteristics of cross-domain shared behaviors, and are unable to accurately construct benchmark behavior models that fit actual scenarios, resulting in insufficient ability to identify unknown intrusion behaviors. Furthermore, existing methods lack systematic design in behavior deviation calculation, intrusion type determination, and risk level correlation analysis, making it difficult to achieve a closed-loop process from anomaly detection to accurate response. This fails to meet the high requirements of cross-domain security management for detection accuracy, timeliness, and differentiated responses. Therefore, there is an urgent need for an intrusion detection solution that adapts to the characteristics of cross-domain environments and balances data processing standardization with intelligent behavior recognition. Summary of the Invention

[0004] To address the aforementioned problems in the existing technology, this invention provides an intrusion detection method based on cross-domain security management and a shared behavior model; The objective of this invention can be achieved through the following technical solutions: S1: Based on preset cross-domain data collection rules and multi-domain node deployment, collect multi-dimensional raw data in a multi-domain heterogeneous environment; S2: Verify the data based on the multidimensional original data, and use dynamic desensitization technology to mask the fields based on the verification results; convert heterogeneous format data, filter out abnormal data with missing fields, and obtain compliant data; S2: Extract user cross-domain access data based on the compliance data to obtain a multi-dimensional feature set; perform weighted calculation on the multi-dimensional feature set to construct a multi-dimensional shared behavior feature vector; construct a benchmark shared behavior model in combination with cross-domain security policies to obtain a benchmark behavior model library; compare the cross-domain behavior features with the benchmark features based on the benchmark behavior model library, calculate the behavior deviation degree and filter intrusion behaviors to obtain intrusion behavior and feature deviation data. S4: Based on the intrusion behavior and feature deviation data, perform correlation analysis by integrating cross-domain security audit logs to obtain correlation features; use a Bayesian network model to determine the correlation features and obtain the intrusion behavior type and risk level; based on the output results of the Bayesian network model, obtain the intrusion behavior type and corresponding risk level, generate differentiated response suggestions, and execute cross-domain security response strategies.

[0005] As a preferred technical solution of the present invention, the data verification is performed by: verifying the access qualifications and data transmission authorization of the corresponding domain nodes according to the preset cross-domain data collection rules, and obtaining the node legality verification result; The integrity of the multidimensional raw data is verified by comparing hash values ​​to investigate the data transmission process and generate a data integrity report. Verify the matching degree between the data field format and the cross-domain security standard, mark fields with abnormal formats, and obtain the format verification list; The validity verification results, data integrity report, and format verification checklist mentioned in the integrated node are used to generate the verification results.

[0006] Specifically, the process of performing masking on the field includes: filtering the data based on the verification result to obtain a masking object; matching the masking object using a dynamic desensitization algorithm; performing masking processing using the matching result to obtain masked data.

[0007] Specifically, the process of converting heterogeneous data includes: identifying the original format and data structure hierarchy of the masked data; establishing field mapping rules between the original format and the standard format through a preset unified data format standard and performing format conversion to obtain formatted data.

[0008] Specifically, the filtering of abnormal data with missing fields includes: extracting fields from the formatted data and filtering the data for abnormalities by using a missing field determination threshold preset for cross-domain business requirements; and performing secondary verification based on the filtering results to obtain compliant data.

[0009] Specifically, obtaining the multi-dimensional feature set includes: extracting the basic features of the compliance data, and supplementing the extraction of transmission features by combining cross-domain data transmission logs; performing deduplication and normalization processing on the basic features and the transmission features to obtain the multi-dimensional feature set.

[0010] Specifically, the process of constructing the multi-dimensional shared behavioral feature vector includes: dynamically assigning feature security weights to the multi-dimensional feature set, and generating a feature-weight mapping table by combining inter-domain trust level and data sensitivity; A weighted feature fusion algorithm is used to perform matrix operations on the feature-weight mapping table to obtain standardized weighted feature scores; the weighted feature scores are arranged in order to construct the shared behavior feature vector matrix; and the vector dimension is compressed through a redundant feature pruning mechanism to obtain a lightweight multi-dimensional shared behavior feature vector.

[0011] Specifically, the acquisition of the benchmark behavior model library includes: performing time slicing processing on the lightweight multi-dimensional shared behavior feature vector based on historical behavior feature time series acquisition technology to construct a historical behavior feature dataset; By combining the cross-domain security policy library and using a scenario-based behavior clustering algorithm, the historical behavior feature dataset is divided into scenarios according to the data interaction type between domains, and a scenario feature subset is generated. Behavioral patterns are extracted from the subset of scene features, and scene behavioral feature clusters are located using density peak clustering algorithm to construct a scene-based benchmark behavioral model; the scene-based benchmark behavioral model is labeled to obtain a benchmark behavioral model library with scene tags.

[0012] Specifically, the comparison of cross-domain behavioral features with baseline features includes: using intelligent behavioral scene recognition technology to analyze the interaction type and data flow of cross-domain behavior, and performing feature matching based on the analysis results and the baseline behavioral model library of the scene label; using feature vector dimension alignment technology to perform dimension matching between the multi-dimensional shared behavioral feature vector of cross-domain behavior and the feature vector of the baseline behavioral model library of the scene label; and using cosine similarity to calculate and introducing inter-domain trust coefficients to correct the similarity results, thereby quantifying the matching degree of the feature vectors.

[0013] Specifically, the calculation of behavioral deviation and screening of intrusion behaviors includes: using a Manhattan distance weighted calculation algorithm based on the quantification results, and correcting the distance results by combining feature security weights to obtain behavioral deviation values; matching the calculated deviation values ​​with the corresponding thresholds through a preset deviation threshold, automatically determining the behavioral risk level and marking behaviors that exceed the thresholds, and generating a feature deviation data report of abnormal features.

[0014] Specifically, obtaining the associated features includes: extracting intrusion behavior and feature deviation data based on the feature deviation data report, locating the abnormal dimension, and generating an abnormal indicator set; Based on audit log matching technology, log records related to intrusion behavior are filtered from cross-domain security audit logs according to three dimensions: timestamp, user ID, and access node. By using time-series correlation and behavioral causal analysis, a correlation logic between abnormal indicators and matching logs is established; By using correlation feature integration technology, the abnormal indicators, correlation logs, and correlation logic are encapsulated into a structured correlation feature package.

[0015] Specifically, obtaining the intrusion behavior type and risk level includes: decomposing the associated feature package into identifiable input parameters, using Bayesian network inference calculation, combining it with a preset intrusion type judgment rule base, and outputting the intrusion behavior type through probabilistic inference; and using risk level mapping technology to obtain the intrusion behavior type and corresponding risk level.

[0016] The beneficial effects of this invention are as follows: Based on multi-dimensional feature sets and dynamic weight assignment, combined with cosine similarity algorithm and Manhattan distance calculation, accurate comparison between cross-domain behavior and benchmark models is achieved, reducing the false positive rate. By using a Bayesian network model to perform probabilistic inference on associated features, the type and risk level of intrusion behavior are accurately determined, providing a reliable basis for security response. Dynamic de-identification technology is employed to mask sensitive information, while multi-layered data verification (legality, integrity, and format matching) ensures secure and compliant cross-domain data transmission.

[0017] The redundant feature pruning mechanism compresses the vector dimension, which reduces security risks in the data processing process while ensuring detection effectiveness. By combining the cross-domain security strategy library and the scenario-based behavior clustering algorithm, a scenario-based benchmark behavior model library is built to adapt to different types of inter-domain data interaction scenarios in multi-domain heterogeneous environments.

[0018] By constructing a full-cycle historical behavior feature dataset based on historical behavior time-series acquisition technology, the benchmark model can dynamically adapt to changes in cross-domain behavior, improving the flexibility of detection. Through format conversion, abnormal data filtering, and lightweight feature vector construction, the efficiency of data processing and feature comparison is improved, enabling rapid identification of intrusion behavior. By integrating cross-domain security audit logs for correlation analysis, differentiated response suggestions are generated, making security response strategies more targeted and reducing losses caused by cross-domain intrusions. Attached Figure Description

[0019] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0020] Figure 1 This is a flowchart illustrating an intrusion detection method based on cross-domain security management and shared behavior model according to the present invention. Figure 2 This is a flowchart of the intrusion detection technology in this invention. Detailed Implementation

[0021] To further illustrate the technical means and effects of the present invention in achieving the intended purpose, the following detailed description of the specific implementation methods, structures, features and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0022] Please see Figure 1-2An intrusion detection method based on cross-domain security management and shared behavior model includes: S1: collecting multi-dimensional raw data in a multi-domain heterogeneous environment based on preset cross-domain data collection rules and multi-domain node deployment; S2: Verify the data based on the multidimensional original data, and use dynamic desensitization technology to mask the fields based on the verification results; convert heterogeneous format data, filter out abnormal data with missing fields, and obtain compliant data; S2: Extract user cross-domain access data based on the compliance data to obtain a multi-dimensional feature set; perform weighted calculation on the multi-dimensional feature set to construct a multi-dimensional shared behavior feature vector; construct a benchmark shared behavior model in combination with cross-domain security policies to obtain a benchmark behavior model library; compare the cross-domain behavior features with the benchmark features based on the benchmark behavior model library, calculate the behavior deviation degree and filter intrusion behaviors to obtain intrusion behavior and feature deviation data. S4: Based on the intrusion behavior and feature deviation data, perform correlation analysis by integrating cross-domain security audit logs to obtain correlation features; use a Bayesian network model to determine the correlation features and obtain the intrusion behavior type and risk level; based on the output results of the Bayesian network model, obtain the intrusion behavior type and corresponding risk level, generate differentiated response suggestions, and execute cross-domain security response strategies.

[0023] As a preferred technical solution of the present invention, the data verification is performed by: verifying the access qualifications and data transmission authorization of the corresponding domain nodes according to the preset cross-domain data collection rules, and obtaining the node legality verification result; The integrity of the multidimensional raw data is verified by comparing hash values ​​to investigate the data transmission process and generate a data integrity report. Verify the matching degree between the data field format and the cross-domain security standard, mark fields with abnormal formats, and obtain the format verification list; The validity verification results, data integrity report, and format verification checklist mentioned in the integrated node are used to generate the verification results.

[0024] In this embodiment, the data verification process adopts a triple verification + result integration model to ensure the compliance and reliability of cross-domain data collection. The pre-defined cross-domain data collection rules are the core foundation for accurate and secure data collection in a multi-domain heterogeneous environment. Their design revolves around three principles: compliance assurance, security priority, and scenario adaptation, covering dimensions such as collection scope, access control, format specifications, collection frequency, quality verification, and privacy protection. During node legitimacy verification, the system automatically verifies the node's access license and data transmission authorization documents by connecting to an inter-domain trust authentication system, rejecting access requests from unqualified nodes. Data integrity verification uses the SHA-256 hash algorithm to calculate and compare the hash values ​​of the original data before and after transmission. If a hash value inconsistency is found, it is determined that the data has been tampered with or lost, triggering a data retransmission mechanism. In the format verification stage, a field format verification rule library is established based on relevant national cybersecurity standards and industry-defined specifications. Targeted verification is performed on different types of fields such as dates, numbers, and characters, marking fields with mismatched formats and providing feedback to the data provider.

[0025] Specifically, the process of performing masking on the field includes: filtering the data based on the verification result to obtain a masking object; matching the masking object using a dynamic desensitization algorithm; performing masking processing using the matching result to obtain masked data.

[0026] In this embodiment, the selection of masking targets is based on the verification results, focusing on sensitive personal information such as ID card numbers, mobile phone numbers, and bank card numbers, as well as key information such as core business parameters and confidential data fields. The dynamic de-identification algorithm adopts a scenario-adaptive matching mechanism, selecting appropriate de-identification strategies for different types of sensitive information: for ID card numbers, the first 6 digits and last 4 digits are retained, and the middle 8 digits are replaced with asterisks; for mobile phone numbers, the first 3 digits and last 4 digits are retained, and the middle 4 digits are replaced with asterisks; for confidential business data, random character replacement or encryption masking is used to ensure that the de-identified data cannot be used to deduce the original information, while not affecting subsequent feature extraction and model analysis.

[0027] Specifically, the process of converting heterogeneous data includes: identifying the original format and data structure hierarchy of the masked data; establishing field mapping rules between the original format and the standard format through a preset unified data format standard and performing format conversion to obtain formatted data.

[0028] In this embodiment, the original format recognition employs a multi-mode parsing algorithm, supporting automatic identification of various heterogeneous data formats. Simultaneously, through syntax analysis and structural parsing, it clarifies the hierarchical relationships and field association logic of the data. The unified data format standard adopts a structured data format, defining specifications such as field names, data types, field lengths, and value ranges. The field mapping rule base supports custom configuration, establishing one-to-one or many-to-one mapping relationships based on the differences between different original formats and standard formats. For example, nested fields in XML format are decomposed into peer fields in the standard format, and unordered fields in CSV format are reordered according to the standard format. Data standardization is completed through format conversion algorithms, ensuring data compatibility in subsequent stages.

[0029] Specifically, the filtering of abnormal data with missing fields includes: extracting fields from the formatted data and filtering the data for abnormalities by using a missing field determination threshold preset for cross-domain business requirements; and performing secondary verification based on the filtering results to obtain compliant data.

[0030] In this embodiment, the threshold for determining missing fields is set based on the core requirements of cross-domain business, and is divided into two categories: critical fields and non-critical fields. Critical fields (such as user ID, access node identifier, business operation type, etc.) are not allowed to be missing; if missing, they are directly judged as abnormal data. Non-critical fields (such as remarks, auxiliary description fields, etc.) are allowed to be partially missing, but if the missing proportion exceeds a preset threshold (e.g., 30%), they are judged as abnormal data. The secondary verification stage uses a combination of manual review and system verification to reconfirm the initially screened abnormal data, eliminating misjudgments of missing fields caused by data transmission delays or temporary system failures, and ultimately retaining compliant data with complete fields that meet the requirements of business analysis.

[0031] Specifically, obtaining the multi-dimensional feature set includes: extracting the basic features of the compliance data, and supplementing the extraction of transmission features by combining cross-domain data transmission logs; performing deduplication and normalization processing on the basic features and the transmission features to obtain the multi-dimensional feature set.

[0032] In this embodiment, basic feature extraction covers the core dimensions of user cross-domain access, including: access time, access frequency, operation duration, access node, operation type, and data access range; transmission features are extracted from cross-domain data transmission logs, including: transmission rate, data traffic size, transmission link, transmission protocol, and packet loss rate. Deduplication is performed using feature value hash comparison to eliminate completely duplicate feature records; normalization is performed using the Min-Max standardization algorithm, mapping feature values ​​of different magnitudes to the [0,1] interval, eliminating dimensional differences between feature dimensions, and ensuring that each feature has equal weight in subsequent weighted calculations, ultimately forming a standardized feature set containing multiple dimensions such as access features and transmission features.

[0033] Specifically, the process of constructing the multi-dimensional shared behavioral feature vector includes: dynamically assigning feature security weights to the multi-dimensional feature set, and generating a feature-weight mapping table by combining inter-domain trust level and data sensitivity; A weighted feature fusion algorithm is used to perform matrix operations on the feature-weight mapping table to obtain standardized weighted feature scores; the weighted feature scores are arranged in order to construct the shared behavior feature vector matrix; and the vector dimension is compressed through a redundant feature pruning mechanism to obtain a lightweight multi-dimensional shared behavior feature vector.

[0034] In this embodiment, the dynamic assignment of feature security weights adopts a combination of the analytic hierarchy process (AHP) and the entropy weight method, taking into account both the subjective evaluation of feature importance by domain experts and the objective distribution characteristics of the data itself. Inter-domain trust levels are synchronized in real time by the cross-domain security management platform and are divided into high, medium, and low levels, each corresponding to a different weight adjustment coefficient. Data sensitivity is categorized based on data type and business attributes; the higher the sensitivity level, the greater the weight of the corresponding feature. The weighted feature fusion algorithm uses matrix multiplication to perform matrix operations on the feature set and the feature-weight mapping table to obtain the standardized weighted score of each feature. Redundant feature pruning uses a combination of variance analysis and correlation analysis to remove features with excessively low variance (low contribution) or high correlation with other features (high redundancy). While ensuring the integrity of feature information, the vector dimension is compressed, improving the efficiency of subsequent model calculations.

[0035] Specifically, the acquisition of the benchmark behavior model library includes: performing time slicing processing on the lightweight multi-dimensional shared behavior feature vector based on historical behavior feature time series acquisition technology to construct a historical behavior feature dataset; By combining the cross-domain security policy library and using a scenario-based behavior clustering algorithm, the historical behavior feature dataset is divided into scenarios according to the data interaction type between domains, and a scenario feature subset is generated. Behavioral patterns are extracted from the subset of scene features, and scene behavioral feature clusters are located using density peak clustering algorithm to construct a scene-based benchmark behavioral model; the scene-based benchmark behavioral model is labeled to obtain a benchmark behavioral model library with scene tags.

[0036] In this embodiment, time slicing processing divides historical behavior feature vectors at fixed time intervals (e.g., 1 hour) to construct a full-cycle historical behavior feature dataset covering different time periods and business cycles. Contextualized behavior clustering algorithms divide scenarios based on inter-domain data interaction types (e.g., data query, file transfer, business approval, system login, etc.), with each scenario corresponding to a subset of scenario features. Density peak clustering algorithms do not require pre-setting the number of clusters; they automatically locate typical behavioral feature clusters within a scenario by calculating the local density and relative distance of feature points. Based on these feature clusters, a contextualized benchmark behavior model reflecting normal behavior patterns in that scenario is constructed. Scenario labels use a combination of scenario type and security level, such as: data query - low security level, file transfer - high security level, facilitating rapid matching of the corresponding benchmark model later.

[0037] Specifically, the comparison of cross-domain behavioral features with baseline features includes: using intelligent behavioral scene recognition technology to analyze the interaction type and data flow of cross-domain behavior, and performing feature matching based on the analysis results and the baseline behavioral model library of the scene label; using feature vector dimension alignment technology to perform dimension matching between the multi-dimensional shared behavioral feature vector of cross-domain behavior and the feature vector of the baseline behavioral model library of the scene label; and using cosine similarity to calculate and introducing inter-domain trust coefficients to correct the similarity results, thereby quantifying the matching degree of the feature vectors.

[0038] In this embodiment, the intelligent behavior scene recognition technology analyzes key information such as the operation type, data flow, and business identifier of cross-domain behaviors to automatically determine the scene type to which the current behavior belongs, and then matches the corresponding scene-based benchmark model from the benchmark behavior model library. The feature vector dimension alignment technology addresses potential dimensional differences between the detected feature vector and the benchmark feature vector by using dimension completion (filling missing dimensions with 0) or dimension pruning (removing redundant dimensions) to ensure that the dimensions of the two are consistent. Cosine similarity calculation is used to quantify the similarity between the detected feature vector and the benchmark feature vector, with a value range of [0,1]. The closer the value is to 1, the higher the matching degree; the cosine similarity calculation formula is: , Sim: Corrected feature vector matching degree (value range: [0,1], Sim close to 1 indicates that the detected behavior is highly consistent with the baseline behavior, Sim close to 0 indicates that the behavior is abnormal). : Feature vector of cross-domain behavior to be detected (dimension: n, where n is the number of features in the multi-dimensional feature set, and the elements are the standardized weighted scores of each feature). ; : Feature vector of the baseline behavior model (dimension: n, elements are the average standardized weighted scores of each feature in the baseline scenario); K d Inter-domain trust coefficient (value range: [0.8, 1.2]), high trust domain (K d =1.0-1.2), low trust region (K) d =0.8-1.0), correcting the matching bias in low-trust domains.

[0039] The inter-domain trust coefficient is dynamically adjusted based on the trust level of the current interaction domain. The higher the trust level, the closer the correction coefficient is to 1, ultimately yielding a corrected and accurate matching value.

[0040] Specifically, the calculation of behavioral deviation and screening of intrusion behaviors includes: using a Manhattan distance weighted calculation algorithm based on the quantification results, and correcting the distance results by combining feature security weights to obtain behavioral deviation values; matching the calculated deviation values ​​with the corresponding thresholds through a preset deviation threshold, automatically determining the behavioral risk level and marking behaviors that exceed the thresholds, and generating a feature deviation data report of abnormal features.

[0041] In this embodiment, the Manhattan distance weighted calculation algorithm introduces feature safety weights when calculating the distance between the detected behavior and the baseline behavior. This makes the deviation of important features have a greater impact on the overall deviation, thus improving the accuracy of the deviation calculation. The Manhattan distance weighted calculation formula is as follows: , D: Behavior deviation (value range: [0, n], the larger the D, the greater the deviation between the detected behavior and the baseline behavior, and the more likely it is to be an intrusion behavior); W i : Safety weight of the i-th feature (same as Formula 1, to ensure that deviations from important features have a greater impact on the result); X i : Feature vector of the behavior to be detected The i-th element; Y i : Benchmark behavior feature vector The i-th element; n: the dimension of the feature vector (i.e., the number of features in the multi-dimensional feature set).

[0042] The preset deviation thresholds are divided into three levels: low, medium, and high, corresponding to different risk levels: deviations below the low threshold indicate normal behavior; deviations between the low and medium thresholds indicate low-risk anomalies; deviations between the medium and high thresholds indicate medium-risk anomalies; and deviations above the high threshold indicate high-risk anomalies. The feature deviation data report records detailed information such as the occurrence time of the abnormal behavior, the users involved, the access nodes, the dimensions of the abnormal features, the deviation value, and the risk level, providing a basis for subsequent correlation analysis.

[0043] Specifically, obtaining the associated features includes: extracting intrusion behavior and feature deviation data based on the feature deviation data report, locating the abnormal dimension, and generating an abnormal indicator set; Based on audit log matching technology, log records related to intrusion behavior are filtered from cross-domain security audit logs according to three dimensions: timestamp, user ID, and access node. By using time-series correlation and behavioral causal analysis, a correlation logic between abnormal indicators and matching logs is established; By using correlation feature integration technology, the abnormal indicators, correlation logs, and correlation logic are encapsulated into a structured correlation feature package.

[0044] In this embodiment, the anomaly indicator set focuses on the core dimensions leading to abnormal behavior, such as abnormal access frequency, abnormal transmission traffic, and abnormal access nodes. Each anomaly indicator includes information such as indicator name, abnormal value, normal range, and deviation ratio. Audit log matching technology performs precise matching based on three dimensions: timestamp (within a 10-minute range), user ID, and access node, filtering out log records related to intrusion behavior, including operation logs, transmission logs, and security logs. Temporal correlation analysis establishes the chronological order of anomaly indicators and matching logs, while behavioral causal analysis clarifies the causal relationship between them (e.g., abnormal transmission traffic caused by a specific file transmission operation). The structured association feature package uses a standardized data format, integrating anomaly indicators, associated logs, and association logic into a unified feature package, facilitating parsing and judgment by the Bayesian network model.

[0045] Specifically, obtaining the intrusion behavior type and risk level includes: decomposing the associated feature package into identifiable input parameters, using Bayesian network inference calculation, combining it with a preset intrusion type judgment rule base, and outputting the intrusion behavior type through probabilistic inference; and using risk level mapping technology to obtain the intrusion behavior type and corresponding risk level.

[0046] In this embodiment, the Bayesian network model is pre-trained based on a large amount of intrusion behavior sample data to establish a probabilistic mapping relationship between intrusion features and intrusion types; the Bayesian network model calculation formula is as follows: , : In the associated feature vector Below, the posterior probability of the behavior belonging to the k-th type of intrusion (value range: [0,1], with the highest probability C) is given. k (That is, the type of intrusion determined). : Associated feature vector (dimension: p, where p is the number of associated features, such as anomaly indicators, log features, etc.); P(C k ): The prior probability of the k-th type of intrusion (obtained through statistics of historical intrusion behaviors, such as the historical probability of data theft). Under the k-th type of intrusion, an associated feature vector appears. The likelihood probability (obtained by fitting the training samples of the Bayesian network); m: the total number of intrusion types (such as illegal intrusion, data theft, malicious attack, unauthorized access, etc., defined by the preset intrusion type judgment rule base).

[0047] After decomposing the associated feature package, the model can identify the input parameters, including anomaly indicator parameters, log feature parameters, and correlation logic parameters. The intrusion type determination rule base includes common cross-domain intrusion types, such as illegal intrusion, data theft, malicious attacks, and unauthorized access, with each intrusion type corresponding to specific feature determination rules. Bayesian network inference computation, through the probability mapping relationship between the input parameters and the model, combined with the determination rule base, outputs the probability value for each intrusion type, selecting the type with the highest probability value as the final intrusion behavior type. The risk level mapping technology establishes a mapping relationship between intrusion type and risk level (low, medium, high) based on factors such as intrusion behavior type, scope of impact, and severity, automatically matching the corresponding risk level. Based on the determination of intrusion behavior type and risk level, differentiated response suggestions are generated and cross-domain security response strategies are implemented: For low-risk intrusion behaviors (such as minor unauthorized access or anomalies caused by accidental operation), alarm notification and logging strategies are implemented, sending alarm information to administrators and recording detailed behavior information for subsequent verification; for medium-risk intrusion behaviors (such as suspected data probing or non-core data theft), access restriction and data isolation strategies are implemented, temporarily freezing some operation permissions of relevant users and isolating the abnormal data links involved to prevent risk spread; for high-risk intrusion behaviors (such as malicious attacks, core data theft, and unauthorized control), emergency blocking and source tracing strategies are implemented, immediately cutting off abnormal connections, freezing relevant user accounts, activating security devices to intercept attacks, and conducting source tracing analysis based on audit logs and related characteristics to locate the attack source and propagation path. After the response is executed, the processing results and behavioral data are fed back to the benchmark behavioral model library. Through the model iteration update mechanism, the benchmark model parameters are optimized to improve the accuracy and adaptability of subsequent intrusion detection.

[0048] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. An intrusion detection method based on cross-domain security management and shared behavior model, characterized in that, include: S1: Based on preset cross-domain data collection rules and multi-domain node deployment, collect multi-dimensional raw data in a multi-domain heterogeneous environment; S2: Verify the data based on the multidimensional original data, and use dynamic desensitization technology to mask the fields based on the verification results; convert heterogeneous format data, filter out abnormal data with missing fields, and obtain compliant data; S2: Extract user cross-domain access data based on the compliance data to obtain a multi-dimensional feature set; perform weighted calculation on the multi-dimensional feature set to construct a multi-dimensional shared behavior feature vector; construct a benchmark shared behavior model in combination with cross-domain security policies to obtain a benchmark behavior model library; compare the cross-domain behavior features with the benchmark features based on the benchmark behavior model library, calculate the behavior deviation degree and filter intrusion behaviors to obtain intrusion behavior and feature deviation data. S4: Based on the intrusion behavior and feature deviation data, perform correlation analysis by integrating cross-domain security audit logs to obtain correlation features; A Bayesian network model is used to determine the associated features and obtain the type and risk level of the intrusion behavior; Based on the output of the Bayesian network model, the intrusion behavior type and corresponding risk level are obtained, differentiated response suggestions are generated, and cross-domain security response strategies are executed.

2. The method according to claim 1, characterized in that, The data verification process involves: verifying the access qualifications and data transmission authorization of the corresponding domain nodes according to preset cross-domain data collection rules, and obtaining the node legality verification results. The integrity of the multidimensional raw data is verified by comparing hash values ​​to investigate the data transmission process and generate a data integrity report. Verify the matching degree between the data field format and the cross-domain security standard, mark fields with abnormal formats, and obtain the format verification list; The validity verification results, data integrity report, and format verification checklist mentioned in the integrated node are used to generate the verification results.

3. The method according to claim 1, characterized in that, The process of performing masking on the field includes: filtering the data based on the verification result to obtain a masking object; matching the masking object using a dynamic desensitization algorithm; performing masking processing using the matching result to obtain masked data.

4. The method according to claim 1, characterized in that, The process of converting heterogeneous data includes: identifying the original format and data structure hierarchy of the masked data; establishing field mapping rules between the original format and the standard format through a preset unified data format standard and performing format conversion to obtain formatted data.

5. The method according to claim 1, characterized in that, The process of filtering out abnormal data with missing fields includes: extracting fields from the formatted data and filtering the data for abnormalities by using a missing field determination threshold preset for cross-domain business requirements; and performing secondary verification based on the filtering results to obtain compliant data.

6. The method according to claim 1, characterized in that, The process of obtaining the multi-dimensional feature set includes: extracting the basic features of the compliance data, and supplementing the extraction of transmission features by combining cross-domain data transmission logs; and performing deduplication and normalization processing on the basic features and the transmission features to obtain the multi-dimensional feature set.

7. The method according to claim 1, characterized in that, The specific process of constructing the multi-dimensional shared behavioral feature vector includes: dynamically assigning feature security weights to the multi-dimensional feature set, and generating a feature-weight mapping table by combining inter-domain trust level and data sensitivity; A weighted feature fusion algorithm is used to perform matrix operations on the feature-weight mapping table to obtain standardized weighted feature scores; the weighted feature scores are arranged in order to construct the shared behavior feature vector matrix; and the vector dimension is compressed through a redundant feature pruning mechanism to obtain a lightweight multi-dimensional shared behavior feature vector.

8. The method according to claim 1, characterized in that, The acquisition of the benchmark behavior model library includes: performing time slicing processing on the lightweight multi-dimensional shared behavior feature vector based on historical behavior feature time series acquisition technology to construct a historical behavior feature dataset; By combining the cross-domain security policy library and using a scenario-based behavior clustering algorithm, the historical behavior feature dataset is divided into scenarios according to the data interaction type between domains, and a scenario feature subset is generated. Behavioral patterns are extracted from the subset of scene features, and scene behavioral feature clusters are located using density peak clustering algorithm to construct a scene-based benchmark behavioral model; the scene-based benchmark behavioral model is labeled to obtain a benchmark behavioral model library with scene tags.

9. The method according to claim 1, characterized in that, The comparison of cross-domain behavioral features with baseline features includes: using intelligent behavioral scene recognition technology to analyze the interaction type and data flow of cross-domain behavior, and performing feature matching based on the analysis results and the baseline behavioral model library of the scene label; using feature vector dimension alignment technology to perform dimension matching between the multi-dimensional shared behavioral feature vector of cross-domain behavior and the feature vector of the baseline behavioral model library of the scene label; and using cosine similarity to calculate and introducing inter-domain trust coefficients to correct the similarity results, thereby quantifying the matching degree of the feature vectors.

10. The method according to claim 1, characterized in that, The calculation of behavioral deviation and screening of intrusion behaviors includes: using a Manhattan distance weighted calculation algorithm based on the quantification results, and correcting the distance results by combining feature security weights to obtain behavioral deviation values; matching the calculated deviation values ​​with the corresponding thresholds through a preset deviation threshold, automatically determining the behavioral risk level and marking behaviors that exceed the thresholds, and generating a feature deviation data report of abnormal features.

11. The method according to claim 1, characterized in that, The acquisition of associated features includes: extracting intrusion behavior and feature deviation data based on the feature deviation data report, locating abnormal dimensions, and generating an abnormal indicator set; Based on audit log matching technology, log records related to intrusion behavior are filtered from cross-domain security audit logs according to three dimensions: timestamp, user ID, and access node. By using time-series correlation and behavioral causal analysis, a correlation logic between abnormal indicators and matching logs is established; By using correlation feature integration technology, the abnormal indicators, correlation logs, and correlation logic are encapsulated into a structured correlation feature package.

12. The method according to claim 1, characterized in that, The process of obtaining the intrusion behavior type and risk level includes: decomposing the associated feature package into identifiable input parameters, using Bayesian network inference calculation, combining it with a preset intrusion type judgment rule base, and outputting the intrusion behavior type through probabilistic inference; and using risk level mapping technology to obtain the intrusion behavior type and corresponding risk level.

Images