Intelligent network intrusion detection method based on behavior analysis

Abstract

The application discloses a network intrusion intelligent detection method based on behavior analysis, relates to the technical field of network security detection, and comprises the following steps: collecting behavior logs, traffic metadata and system call records from a target network multi-data source, generating a unified behavior event stream containing time stamps, subject identifiers and the like through mode conversion and field alignment; extracting a subject identifier, modeling a continuous behavior sequence for each subject and constructing a behavior state transition chain; performing multi-dimensional scanning to identify abnormal jumps, periodic mutations and resident outliers, and generating preliminary abnormal markers; backtracking to extract context attributes, inputting an environment risk evaluator to calculate a risk coefficient in combination with asset topology and a business whitelist; and outputting a comprehensive alarm list containing subject identifiers, abnormal types and threat confidence after fusion. The method captures behavior dynamic evolution through a state transition chain, covers deep abnormalities through multi-dimensional scanning, and improves detection accuracy and concealed threat perception ability.

Description

Technical Field

[0001] This invention belongs to the field of network security detection technology, specifically a network intrusion intelligent detection method based on behavior analysis. Background Technology

[0002] Existing network intrusion detection technologies mostly rely on feature matching, traffic threshold determination, and single log analysis to achieve intrusion identification. They mainly complete anomaly determination by matching preset attack features, setting network traffic indicator thresholds, or analyzing isolated system operation logs. The data source is limited to network traffic or single type of system logs, and data processing is mainly based on discrete feature extraction, without conducting time-series continuous modeling of network entity behavior.

[0003] Traditional detection methods can only identify known attack types and lack the ability to identify unknown attacks and covert abnormal behaviors. Their discrete feature extraction methods cannot capture the temporal transition patterns of network entity behavior, making it difficult to accurately detect covert intrusion characteristics such as abnormal state transitions, periodic abrupt changes in behavior, and abnormal state dwell times. Existing detection processes do not correlate anomaly markers with the actual network operating environment and lack contextual risk verification steps that combine network asset topology and business whitelists. This results in poor adaptability of anomaly markers to the actual network environment, easily generating invalid alarms and failing to output threat assessment results with accurate confidence levels.

[0004] This invention addresses the problems of the inability to model the temporal characteristics of network entity behavior and the lack of multi-dimensional identification of abnormal behavior. It constructs a network entity behavior state transition chain and completes multi-dimensional abnormal pattern scanning. To address the issues of the lack of environmental correlation verification for anomaly tags and insufficient alarm accuracy, it traces back the context attributes based on anomaly tags, combines network asset topology and business whitelists to complete environmental risk assessment, and integrates anomaly tags and risk coefficients to complete comprehensive threat alarm output. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art; Therefore, this invention proposes a network intrusion intelligent detection method based on behavior analysis, including: Network entity behavior logs, network traffic metadata, and system call records are collected from multiple data sources in the target network to form a heterogeneous raw behavior dataset; Perform pattern transformation and field alignment on the heterogeneous original behavior dataset to generate a unified format behavior event stream containing timestamps, subject identifiers, behavior types, and context attributes; Extract the subject identifier from the unified format behavior event stream, perform continuous behavior sequence modeling on each subject identifier, and construct a behavior state transition chain that reflects the action switching of network entities over time. A multi-dimensional pattern scan is performed on the behavioral state transition chain to identify abnormal state transitions, periodic abrupt changes, and statistical outliers in state dwell time, generating a preliminary set of behavioral anomaly markers. Based on the initial set of behavioral anomaly markers, backtrack to the corresponding unified format behavioral event stream and extract the set of context attributes related to the initial set of behavioral anomaly markers; The context attribute set is input into the environmental risk assessor, and the environmental risk coefficient is calculated and generated by combining the preset network asset topology relationship and business whitelist rules. By integrating the preliminary set of abnormal behavior markers with the environmental risk coefficient, the behavioral threat determination network outputs a comprehensive threat alert list that includes the subject identifier, anomaly type, and threat confidence level.

[0006] Furthermore, the step of performing continuous behavior sequence modeling for each subject identifier and constructing a behavior state transition chain includes: According to the timestamp order, the behavioral events belonging to the same subject identifier in the unified format behavioral event stream are sorted to form the behavioral event timeline of the subject identifier; Each behavioral event in the behavioral event timeline is mapped to an abstract behavioral state with semantic description, forming a sequence of behavioral states; Analyze the relationships between adjacent behavioral states in the behavioral state sequence, and construct a directed graph with behavioral states as nodes and the relationships between state transitions as directed edges based on the frequency and logical relationships between states. This graph serves as a behavioral state transition chain that reflects the behavioral patterns of the subject.

[0007] Furthermore, a multi-dimensional pattern scan is performed on the behavioral state transition chain to identify abnormal state transitions within the chain, including: Within a preset time window, the historical transition probabilities of transitioning from a specific source state to a specific target state in the behavioral state transition chain are statistically analyzed to form a state transition probability baseline. The behavior state transition chain is monitored in real time. When a state transition occurs, the source state and target state of this transition are obtained. Query the state transition probability baseline to obtain the historical transition probability corresponding to this transition; This transition is treated as an independent event. It is determined whether the statistical probability of its occurrence is lower than the corresponding historical transition probability threshold in the state transition probability baseline. If so, this state transition is marked as an abnormal jump.

[0008] Furthermore, the aforementioned set of context attributes is input into the environmental risk assessor, and combined with pre-defined network asset topology relationships and business whitelist rules, an environmental risk coefficient is calculated and generated, including: The set of context attributes includes source and destination addresses, protocol type, payload feature summary, and number of concurrent sessions; The source and destination addresses in the context attribute set are compared with the preset network asset topology to determine the network area involved in the behavior, and a risk value is assigned to the area based on the sensitivity level of the network area. The protocol type and payload feature summary in the context attribute set are matched with the business whitelist rules to determine whether the current behavior conforms to the known normal business pattern, and a compliance risk value is assigned based on the matching result. Extract the number of concurrent sessions from the context attribute set, and calculate the load anomaly degree by combining it with the behavior type through the session load model; A weighted fusion strategy is adopted to normalize and comprehensively calculate the regional risk value, the compliance risk value, and the load anomaly degree, and output a quantitative environmental risk coefficient.

[0009] Furthermore, by integrating the preliminary set of abnormal behavior markers with the environmental risk coefficients, the behavioral threat determination network outputs a comprehensive threat alert list containing entity identifier, anomaly type, and threat confidence level, including: Each tag in the initial set of behavioral anomaly tags is expanded into a feature vector, which contains an anomaly type code, an anomaly severity value, and an associated timestamp. Each expanded feature vector of a marker is concatenated with the corresponding environmental risk coefficient to form an enhanced feature vector; The enhanced feature vectors are sequentially input into multiple fully connected layers of the behavioral threat determination network for nonlinear transformation and feature abstraction; By using the output layer of the behavioral threat determination network, the abstracted features are mapped to specific threat type probability distributions and threat confidence levels; The category corresponding to the maximum value of the probability distribution of the threat type is taken as the final anomaly type. Combined with the calculated threat confidence and the original subject identifier, it constitutes an entry in the comprehensive threat alert list.

[0010] Furthermore, it also includes: Perform alarm aggregation and causal correlation analysis on the items in the comprehensive threat alarm list to identify alarm groups belonging to the same intrusion activity and form an intrusion activity candidate set. Multi-stage attack script matching is performed on the intrusion activity candidate set. Based on the predefined multi-stage attack script library, the attack stage label with the highest matching degree and the corresponding attack intent inference are assigned to each candidate set. Based on the attack phase labels and intent inferences, an executable intrusion handling plan is generated, which includes response suggestions and a summary of the evidence chain. The process of performing alert aggregation and causal correlation analysis on the entries in the comprehensive threat alert list includes: Using a preset time window and network logical domain as boundaries, the alarm entries in the comprehensive threat alarm list are clustered, and alarm entries with similar time, related subject identifiers, or the same target assets are aggregated into an alarm group; For each alarm group, analyze the chronological order of alarm entries within the group and the logical dependencies between the behaviors described by the alarm entries; Based on the temporal sequence and logical dependencies, an association graph describing the potential causal chains within the alarm group is constructed. If the correlation graph presents a clear evolution path that conforms to the logic of the intrusion steps, then the alarm group is identified as a candidate set of intrusion activities.

[0011] Furthermore, the temporal order of alarm entries within the analysis group, and the logical dependencies between the behaviors described by the alarm entries, include: Extract the timestamp from each alarm entry, and arrange all alarm entries in ascending order of timestamps to form a timeline sequence; Analyze the behavior of the subject identifier in the preceding and following alarm entries in the timeline sequence to determine whether the subsequent behavior is a necessary condition for the result or state of the previous behavior. Analyze the network resources involved in the alarm entries to determine whether the target resources accessed by subsequent alarm entries are resources that were operated on or probed by previous alarm entries; By combining the timeline sequence, the results of the judgment of necessary conditions for behavior, and the resource access relationship, it can be inferred whether there is a temporal necessity and logical dependency among the alarm items.

[0012] Furthermore, the multi-stage attack script matching process for the candidate set of intrusion activities includes: The alarm type sequence, behavior time interval characteristics, and resource access patterns contained in the intrusion activity candidate set are abstracted into a standardized attack feature sequence. The standardized attack feature sequence is compared item by item with each attack script in the predefined multi-stage attack script library; The matching score between the standardized attack feature sequence and each attack script is calculated using either a dynamic time warping algorithm or a sequence matching algorithm. The attack script with the highest matching score is selected as the best matching script, and the multi-stage attack stage labels and tactical intent descriptions defined by the best matching script are used as attack stage labels and intent inferences for the candidate set of intrusion activities.

[0013] Furthermore, the alarm type sequence, behavioral time interval characteristics, and resource access patterns contained in the intrusion activity candidate set are abstracted into a standardized attack feature sequence, including: From the association graph of the intrusion activity candidate set, alarm types sorted by time are extracted to form the original alarm type sequence; Based on a predefined mapping table from alarm types to general attack actions, each alarm type in the original alarm type sequence is converted into the corresponding general attack action code; Based on the common correlation strength of adjacent common attack action codes in attack logic, assign a logical coherence weight to each transition point in the sequence; The standardized attack feature sequence is composed of the converted general attack action encoding sequence and its corresponding logical coherence weights.

[0014] Furthermore, the generation of an executable intrusion handling scheme including response suggestions and a summary of the chain of evidence includes: Based on the attack stage labels and intent inferences, a pre-set response strategy knowledge base is queried to obtain a set of recommended actions corresponding to the attack stage labels and intent inferences. The alarm entries in the candidate set of intrusion activities are used as key evidence nodes and linked together according to their time sequence and logical relationship to form an evidence chain describing the entire intrusion process. Key time points, executing entities, affected assets, and operational behaviors are extracted from the chain of evidence and condensed into a summary of the chain of evidence. The recommended set of actions is integrated with the evidence chain summary and formatted as an executable intrusion handling plan that includes operation steps, execution targets, and expected results.

[0015] Compared with the prior art, the beneficial effects of the present invention are: For each entity identifier, continuous behavior sequence modeling is performed to construct a behavior state transition chain that reflects the action switching of network entities over time. The behavior state transition chain is scanned in multiple dimensions to identify abnormal state jumps, periodic abrupt changes, and statistical outliers in state dwell time. A preliminary set of behavior anomaly markers is generated, which can fully capture the temporal change characteristics of network entity behavior, distinguish between normal and abnormal behavior time trajectories, accurately lock in hidden behavior anomaly features, avoid anomaly omissions caused by discrete feature analysis, refine the identification dimensions of behavior anomalies, and fully cover various anomalies in behavior jumps, periodic changes, and state dwell time.

[0016] Based on the initial set of abnormal behavior markers, the system traces back to the corresponding unified format behavior event stream, extracts the set of contextual attributes related to the initial abnormal behavior markers, and inputs the set of contextual attributes into an environmental risk assessor that integrates pre-set network asset topology relationships and business whitelist rules. An environmental risk coefficient is calculated and generated. The initial set of abnormal behavior markers and the environmental risk coefficient are then integrated, and a comprehensive threat alarm list containing subject identifiers, anomaly types, and threat confidence levels is output through behavioral threat determination. This system can correlate abnormal behavior characteristics with the actual network asset layout and business operation rules, eliminating invalid anomaly markers that do not match the network environment and business rules, reducing redundant alarm information, making threat determination more aligned with actual network operation scenarios, refining the content dimensions of alarm information, and making threat identification results more consistent with actual network intrusion scenarios. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the steps of the intelligent network intrusion detection method based on behavior analysis described in this invention. Figure 2 A flowchart for modeling continuous behavior sequences and constructing behavior state transition chains; Figure 3 Flowchart for calculating environmental risk coefficient; Figure 4 A graph showing the temporal density and threat confidence of alert groups; Figure 5 Radar chart for environmental risk assessment. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] See Figure 1The system collects network entity behavior logs, network traffic metadata, and system call records from multiple data sources within the target network. These data sources include, but are not limited to, firewalls, intrusion detection systems, endpoint agents, server audit logs, and network traffic probes, thus forming a heterogeneous raw behavior dataset. The heterogeneous raw behavior dataset undergoes mode transformation and field alignment. This process involves parsing the log formats from different data sources, extracting common key fields, normalizing time information to a unified timestamp format, mapping entity identifiers such as IP addresses, usernames, and hostnames to unique identifiers, normalizing behavior descriptions to a preset behavior type enumeration, and preserving the original context attributes. Finally, a unified format behavior event stream containing timestamps, entity identifiers, behavior types, and context attributes is generated. Next, entity identifiers are extracted from the unified format behavior event stream. Continuous behavior sequence modeling is performed on each entity identifier. This modeling process analyzes the ordered behavior events of the entity over a period of time, constructing a behavior state transition chain reflecting the network entity's action switching over time. A multi-dimensional pattern scan is performed on the behavioral state transition chain, including state transition probability, behavioral periodicity, and state dwell time. This identifies anomalous state transitions, periodic abrupt changes, and statistical outliers in state dwell time, generating a preliminary set of behavioral anomaly markers. Based on this preliminary set of markers, the corresponding unified-format behavioral event stream is traced back to extract a set of contextual attributes related to the preliminary markers. These attributes include information such as the network address, port, protocol, and payload characteristics associated with the event. This set of contextual attributes is input into an environmental risk assessor, which has pre-set network asset topology diagrams and business whitelist rules. Through comparison and calculation, a quantified environmental risk coefficient is generated. The preliminary set of behavioral anomaly markers and the environmental risk coefficient are then fused and processed by a pre-trained behavioral threat determination network. This network integrates behavioral anomaly features and environmental risk features to output a comprehensive threat alert list containing entity identifier, anomaly type, and threat confidence level.

[0020] See Figure 2 In one embodiment of the present invention, a subject identifier is extracted from a uniformly formatted behavior event stream. The subject identifier can be an IP address, username, or device MAC address. For each independent subject identifier, the system filters out all behavior event entries belonging to that subject identifier. In specific implementations, behavior event entries include a timestamp, subject identifier, behavior type, and context attributes. Based on the value of the timestamp field, the system sorts all filtered behavior event entries in ascending order, forming a behavior event timeline strictly arranged by time. The behavior event timeline accurately records the activity trajectory of the subject identifier over a period of time.

[0021] In some embodiments, each behavioral event in the behavioral event timeline is mapped to an abstract behavioral state, with the mapping process based on predefined state mapping rules. The behavioral type and key contextual attributes of a behavioral event jointly determine the mapping result. For example, an event with a behavioral type of "network connection attempt" and a target port of "445" in the contextual attributes might be mapped to the "SMB service probe" behavioral state. An event with a behavioral type of "file creation" and a file path containing a sensitive directory in the contextual attributes might be mapped to the "suspicious file placement" behavioral state. After the mapping process is complete, the original behavioral event timeline is transformed into a sequence of behavioral states composed of discrete semantic states.

[0022] In its implementation, the system analyzes the relationships between adjacent behavioral states in a sequence of behavioral states. The analysis process counts the frequency of direct jumps from behavioral state A to behavioral state B within the sequence and calculates its frequency of occurrence across all state transitions in the entire sequence. Simultaneously, the system references a pre-built behavioral logic knowledge base to determine whether the transition from behavioral state A to behavioral state B is logically sound. Based on the frequency and logical relationships between state transitions, the system constructs a directed graph structure. In this directed graph, each node represents a unique behavioral state that has appeared in the sequence. Each directed edge represents a transition relationship from one behavioral state node to another. The direction of the directed edge points from the earlier source behavioral state to the later target behavioral state. The weight of the directed edge can be set as a frequency value or a transition probability based on the transition frequency. This directed graph can be understood as a behavioral state transition chain reflecting the subject's behavioral patterns, characterizing common patterns and possible paths of the subject's behavioral behavior.

[0023] In some embodiments, the construction of the behavioral state transition chain can further incorporate a time interval factor. When statistically analyzing the frequency of state transitions, the time interval between each transition is also recorded. It can be understood that by calculating the behavioral state... In the time window Internal transfer to behavioral state conditional probability This allows for a more detailed characterization of time-dependent behavioral patterns. Conditional probability. The calculation can be expressed as a formula:

[0024] in: This indicates the behavioral state in historical observations. In the time window Internal transfer to behavioral state The number of times. This indicates the behavioral state in historical observations. In the time window The total number of transfers that occurred within the body.

[0025] In one embodiment of the present invention, the system presets a historical learning time window, the length of which can be the past 30 days or the past week. Within the historical learning time window, the system statistically analyzes all state transition pairs that have occurred in the behavioral state transition chain. A state transition pair refers to an event in which a state directly transitions from a specific source state to a specific target state. For each state transition pair in the behavioral state transition chain, the system calculates the number of times this pair occurred within the historical learning time window and divides it by the total number of state transition events in the behavioral state transition chain to obtain the historical transition probability of each pair. All historical transition probabilities calculated within the historical learning time window together constitute the state transition probability baseline. The state transition probability baseline records the expected probability distribution of each transition path in the behavioral state transition chain within a normal historical period, and the probability distribution is stored in the form of a matrix or a mapping table.

[0026] In some embodiments, the system enters a real-time monitoring phase, monitoring the dynamic changes of the behavioral state transition chain in real time. When a new state transition occurs in the behavioral state transition chain, the monitoring module captures the source state and target state of this transition. The system immediately queries the stored state transition probability baseline, searching for the historical transition probability value indexed by the source state and target state of this transition. If no corresponding record exists in the state transition probability baseline, it indicates that this transition has never occurred within the historical learning time window, and the historical transition probability value is considered zero. It can be understood that the retrieved historical transition probability value reflects the expected probability of this transition occurring under historical normal patterns.

[0027] In implementation, the system treats the current state transition as an independent random event. The system presets a probability threshold, a pre-defined value representing an extremely low probability event. The system determines whether the historical transition probability corresponding to the current state transition event is lower than the probability threshold. The judgment logic is: if the retrieved historical transition probability value is lower than the probability threshold, the current state transition is determined to be a low-probability event, extremely rare in historical normal patterns. In implementation, the probability threshold can be set based on statistical confidence, for example, 0.01 or 0.05, representing the significance level for rejecting the null hypothesis. Once the historical transition probability of the current state transition is determined to be lower than the probability threshold, the system generates an anomaly marker for this state transition. The anomaly marker includes the source state, target state, and occurrence timestamp, and is marked as an anomalous jump. This anomalous jump marker is understood to be part of the subsequent generation of the initial set of behavioral anomaly markers.

[0028] In some embodiments, the probability threshold can be dynamically adjusted. The system records the historical transition probability value distribution of all state transition events within the monitoring period. Optionally, the system calculates the median and interquartile range of the historical transition probability value sequence and dynamically sets the probability threshold. A formula for dynamically setting the probability threshold can be expressed as:

[0029] in: This represents the probability threshold obtained through dynamic calculation. It represents the first quartile of the historical transition probability value sequence. The interquartile range, or third quartile, represents the sequence of historical transition probability values. With the first quartile The difference. It is a constant factor used to control the degree to which the threshold deviates from the normal range.

[0030] See Figure 3 In one embodiment of the invention, the context attribute set includes source IP address, destination IP address, protocol type, payload feature summary, and number of concurrent sessions. These attributes are extracted from the original uniform format behavior event stream associated with the initial behavior anomaly marker. The environmental risk assessor receives the context attribute set, and the assessment process first processes network topology information. The environmental risk assessor has built-in preset network asset topology relationships, which define network area divisions, network asset IP address attribution, and network area sensitivity levels using structured data. The source IP address and destination IP address in the context attribute set are compared with the preset network asset topology relationships to determine the specific network area involved in the behavior. Network areas include the Internet, external DMZ, internal office area, and core production area. Based on the preset sensitivity level of the network area traversed or reached by the behavior, the environmental risk assessor assigns a regional risk value to this behavior. The regional risk value is a numerical value; for example, the regional risk value for accessing the core production area is higher than the regional risk value for accessing the external DMZ.

[0031] In some embodiments, the environmental risk assessor performs a business compliance assessment. The environmental risk assessor loads pre-defined business whitelist rules, which define allowed protocol types, port combinations, and payload characteristic patterns. It matches the protocol types and payload characteristic summaries in the context attribute set against each of the pre-defined business whitelist rules to determine whether the current behavioral characteristics conform to any known normal business pattern. Matching results are categorized as complete match, partial match, and no match. The environmental risk assessor assigns a compliance risk value based on the matching result, with a lower compliance risk value for a complete match and a higher compliance risk value for a no match. It can be understood that the payload characteristic summary is an identifier obtained by hashing or extracting key fields from the network payload, used for quickly matching known business patterns.

[0032] In practical implementation, the environmental risk assessor calculates the load anomaly degree. It extracts the number of concurrent sessions from the context attribute set, representing the number of sessions initiating the same or similar behaviors by the same actor within the same time window. Combined with the behavior type, a session load model is used for calculation. This model defines a baseline for the normal number of concurrent sessions for different behavior types. The actual number of concurrent sessions is compared with the baseline defined by the session load model to calculate the load anomaly degree, which reflects the degree to which the session concurrency level deviates from the normal baseline. It can be understood that the session load model can obtain the typical concurrency and its fluctuation range for different behavior types per unit time through historical statistical learning.

[0033] The environmental risk assessor employs a weighted fusion strategy to comprehensively calculate regional risk values, compliance risk values, and load anomaly. The weighted fusion strategy pre-assigns weight coefficients to these three values. In implementation, the regional risk values, compliance risk values, and load anomaly are first normalized, mapping the original values ​​with different dimensions to a unified numerical range. Then, the normalized regional risk values, normalized compliance risk values, and normalized load anomaly are linearly weighted and summed according to their respective weight coefficients, outputting a quantified environmental risk coefficient. The weighted fusion calculation can be expressed as the formula:

[0034] in: This represents the calculated environmental risk coefficient. This represents the normalized regional risk value. This represents the normalized compliance risk value. This represents the normalized load anomaly degree. , , These are the weighting coefficients assigned to the regional risk value, compliance risk value, and load anomaly degree, respectively, and satisfy the following conditions: .

[0035] When generating the comprehensive threat alert list, the system processes a preliminary set of behavioral anomaly markers. Each marker in the preliminary set of behavioral anomaly markers is expanded into a feature vector, which includes an anomaly type code, an anomaly severity value, and an associated timestamp. The anomaly type code is a preset enumerated value, corresponding to different types of anomaly jumps, periodic mutations, or outliers in dwell time. The anomaly severity value is a quantification of the anomaly's significance, such as the negative logarithm of the state transition probability. The expanded feature vector of each marker is concatenated with the environmental risk coefficient calculated by formula (3), which corresponds to the same context and subject, to form a higher-dimensional enhanced feature vector. The enhanced feature vector simultaneously includes behavioral anomaly features and environmental risk features.

[0036] In some embodiments, the enhanced feature vector is input to the behavioral threat determination network. The behavioral threat determination network is a neural network containing multiple fully connected layers. The enhanced feature vector sequentially passes through these fully connected layers, which perform non-linear transformations and layer-by-layer abstraction on the input features to extract deep, comprehensive threat-related features. The output layer of the behavioral threat determination network maps the abstracted high-level features to a specific threat type probability distribution and a threat confidence score between 0 and 1. The threat type probability distribution is a vector, where each element represents the probability that the input belongs to a specific threat type. Optionally, the output layer can use the Softmax function to generate the threat type probability distribution and the Sigmoid function to output the threat confidence score.

[0037] In practice, the threat type probability distribution output by the behavioral threat assessment network is processed. The threat category corresponding to the maximum probability in the threat type probability distribution vector is taken as the final anomaly type. The final anomaly type, the threat confidence level calculated by the behavioral threat assessment network, and the originally associated subject identifier are combined to form an entry in the comprehensive threat alert list. The entry format is {subject identifier, anomaly type, threat confidence level}. The comprehensive threat alert list can be understood as a list containing multiple such entries, and its output signifies the completion of the transformation from raw behavioral data to specific, assessable threats.

[0038] In one embodiment of the present invention, the system acquires a comprehensive threat alarm list and performs alarm aggregation and causal correlation analysis on the alarm entries in the comprehensive threat alarm list. A preset time window and network logical domain are used as aggregation boundaries. The time window is, for example, 5 minutes or 1 hour, and the network logical domain can be a subnet segment, VLAN, or security domain. Within the preset time window and network logical domain, the system scans the comprehensive threat alarm list and clusters alarm entries with similar timestamps, related subject identifiers, or the same target asset into an alarm group. The criterion for similar timestamps is that the time difference is less than a preset threshold. The relatedness of subject identifiers can be based on IP addresses belonging to the same subnet, usernames belonging to the same department, or hostnames having the same prefix. The same target asset means that the destination IP address, hostname, or resource identifier involved in the alarm entry is exactly the same. Referring to Table 1, an exemplary alarm entry clustering result is shown.

[0039] Table 1: Example Table of Alarm Item Clustering

[0040] In some embodiments, for each alarm group, the system analyzes the temporal order and logical dependencies of alarm entries within the group. The timestamp field of each alarm entry in the alarm group is extracted, and all alarm entries are arranged in ascending order of timestamps to form a timeline sequence for the alarm group. The behavior of the subject identifiers in the preceding and following alarm entries in the timeline sequence is analyzed to determine whether the subsequent behavior is a necessary condition for the result or state of the preceding behavior. For example, the "remote command execution" behavior may depend on the result of the preceding "authentication credential theft" or "successful vulnerability exploitation" behavior. The network resources involved in the alarm entries are analyzed to determine whether the target resources accessed by the subsequent alarm entries are resources operated on or probed by the preceding alarm entries. For example, the database IP address accessed by the subsequent "database query" behavior may appear in the result list of the preceding "port scan" behavior. Combining the timeline sequence, the results of the behavior necessity judgment, and the resource access relationships, the system infers whether there is a temporal necessity and logical dependency between alarm entries.

[0041] In practical implementation, based on the chronological order and logical dependencies obtained from the analysis, the system constructs a correlation graph describing the potential causal chains within the alarm group. The correlation graph is a directed graph where nodes represent alarm entries, and directed edges point from cause alarms to result alarms. The attributes of the edges describe the type of dependency relationship. If the constructed correlation graph presents a clear evolutionary path that conforms to the logic of known intrusion steps, such as a typical attack chain of "scanning -> vulnerability exploitation -> privilege escalation -> data collection," then this alarm group is identified as a candidate set of intrusion activities. The candidate set of intrusion activities encapsulates a set of alarm entries considered to belong to the same intrusion activity and having causal relationships, along with their associated relationships.

[0042] The system performs multi-stage attack script matching on intrusion activity candidate sets. Based on a predefined multi-stage attack script library, it assigns the highest-matching attack stage label and corresponding attack intent prediction to each candidate set. The attack stage label may originate from the tactical stages of the ATT&CK framework, while the attack intent prediction describes the attacker's objective. In practice, the system generates an executable intrusion handling plan based on the attack stage label and intent prediction. The system queries a pre-built response policy knowledge base, which stores standardized response actions for different attack stages and intents. Using the attack stage label and intent prediction as an index, the system retrieves and obtains the corresponding recommended action set from the pre-built response policy knowledge base. The recommended action set may include specific operations such as "isolate infected hosts," "block malicious IPs," "reset user credentials," and "apply security patches." It is understood that the pre-built response policy knowledge base needs to be predefined and maintained by security experts.

[0043] Alert entries from the candidate intrusion activity set are used as key evidence nodes. Based on the chronological order and logical relationships determined in the correlation graph, these alert entries are linked together to form an evidence chain describing the entire process from the initial intrusion to subsequent actions. Key and representative information is extracted from the evidence chain, including key time points, the executing entity, affected assets, and operational behaviors. This information is condensed into a concise text description, i.e., the evidence chain summary. The evidence chain summary facilitates security analysts' rapid understanding of the attack process. In some embodiments, the recommended set of remedial actions is integrated with the evidence chain summary and output in a formatted manner. The formatted output follows a predetermined template, which defines the structure of the executable intrusion remediation plan. The generated executable intrusion remediation plan includes operational steps, execution targets, and expected results. Operational steps are the actions in the recommended set of remedial actions arranged in execution order. Execution targets are the specific targets of the remedial actions, such as IP addresses, hostnames, and usernames. Expected results describe the desired security state after executing the steps. The integration process ensures that the evidence chain summary provides context and basis for the remedial actions, while the remedial action steps directly address the stage and intent of the attack. An executable intrusion response plan is an operational guide that is ultimately delivered to security operations personnel for execution.

[0044] To quantify the degree of alarm aggregation, the concept of an aggregation metric can be introduced. A formula for measuring the temporal density of entries within an alarm group can be expressed as:

[0045] in: This indicates the timing density of the alarm group, with a value range of [0,1]. This represents the maximum value of all alarm timestamps within the alarm group. This represents the minimum value of all alarm timestamps within the alarm group. It is the preset length of the aggregation time window used to determine "similar time".

[0046] See Figure 4 This is a chart showing the temporal density and threat confidence of alarm groups, illustrating the performance of five alarm clusters in terms of temporal density and average threat confidence. This data is used to assess the correlation and risk level of intrusion activities within these alarm groups. Groups A and E stand out. Although Group A's temporal density is slightly lower than Group E, its average threat confidence is the highest, indicating that its alarms are not only concentrated in time but also have extremely high individual threat levels, making it a priority for in-depth analysis of key intrusion activities. Groups C and D have both indicators at a moderate level, requiring further evaluation of their environmental risk coefficients in conjunction with contextual attributes to determine whether escalation is necessary. Group B's average threat confidence is significantly lower than other groups; even though its temporal density is at a moderate level, it can be preliminarily identified as a low-priority alarm and can be considered a secondary analysis target.

[0047] In one embodiment of the present invention, the system processes a candidate set of intrusion activities and extracts key information from the association graph of the candidate set. The association graph records the causal and temporal relationships between alarm entries. The system first extracts alarm types arranged in chronological order from the association graph to form an original alarm type sequence. The original alarm type sequence is an ordered list, where each element is a specific alarm type corresponding to a node in the association graph.

[0048] The system uses a predefined mapping table between alarm types and general attack actions to convert each specific alarm type in the original alarm type sequence into its corresponding general attack action code. This predefined mapping table is a set of conversion rules that maps specific alarm types to higher-level, standardized attack action descriptions. For example, a "port scan alarm" might be mapped to the general attack action code "reconnaissance," a "successful brute-force attack alarm" might be mapped to the general attack action code "initial access," and an "abnormal file creation alarm" might be mapped to the general attack action code "execution." This mapping process ensures that similar alarms from different sources or with similar names are normalized to the same semantic action.

[0049] In some embodiments, the system assigns a logical coherence weight to each transition point in the general attack action encoding sequence based on the common correlation strength between adjacent general attack action codes in attack logic. A transition point refers to the position in the sequence where the sequence switches from one general attack action code to the next. The logical coherence weight reflects the frequency or logical plausibility of executing the next attack action immediately after the previous one is completed. The weight assignment is based on a pre-defined attack action association knowledge base, which defines the logical relationship strength values ​​between different attack action pairs. For example, the coherence weight of transitioning from a "reconnaissance" action to an "initial access" action may be high, while the weight of directly transitioning back from an "execution" action to a "reconnaissance" action may be low. The transformed general attack action encoding sequence and its corresponding logical coherence weight sequence together constitute a standardized attack feature sequence. The standardized attack feature sequence abstracts the original, specific alarm sequence into an attack action semantic sequence and includes transition logic strength information.

[0050] In practice, the system matches standardized attack feature sequences against a predefined multi-stage attack script library. This library stores scripts for multiple known attack patterns, each script consisting of a generic attack action encoding sequence and the expected relationships between actions. The system compares the standardized attack feature sequences against each script in the predefined multi-stage attack script library item by item. The comparison includes the matching degree of the generic attack action encoding in the sequence and the consistency between the logical coherence weight of the transition points and the expected coherence of the script.

[0051] The system employs either a dynamic time warping algorithm or a sequence matching algorithm to calculate the matching score between standardized attack feature sequences and each attack script. The dynamic time warping algorithm can handle non-linear scaling of two sequences along the time axis. The sequence matching algorithm can be based on edit distance or the longest common subsequence. The matching score comprehensively considers the similarity of action sequences and the consistency of logical coherence. One formula for calculating the matching score can be expressed as:

[0052] in: This represents the calculated matching score. Represents the action-encoded sequence in a standardized attack feature sequence. With attack script The length of the longest common subsequence of the action-coded sequences in the dataset. Represents a sequence The length. Represents a sequence The length of the formula. The first part measures the structural similarity of action sequences. Represents a sequence The length. Represents a sequence The Middle The logical coherence weight of each transition point. Indicating an attack script In, with sequence No. The expected logical coherence value corresponding to each transition point. It is a similarity function, calculated and The similarity. The second part of the formula measures the fit of the transformation logic. It is a harmonic parameter used to balance the weight of action sequence similarity and logical coherence in the total score. This can be understood as the matching score. The higher the value, the more similar the standardized attack signature sequence is to the attack script.

[0053] The attack script with the highest matching score is selected as the best matching script. The multi-stage attack phase labels and tactical intent descriptions defined in the best matching script are used as attack phase labels and intent inferences for the intrusion activity candidate set. Attack phase labels may include "initial intrusion," "privilege escalation," "lateral movement," and "objective achieved." Tactical intent inferences may be described as "stealing database credentials," "deploying ransomware," or "establishing a persistent backdoor." In some embodiments, if the matching scores of all attack scripts are below an acceptable minimum threshold, a default "unknown attack mode" label can be assigned to the intrusion activity candidate set. It is understood that the multi-stage attack script matching process enables the system to understand the overall attack context behind scattered alerts, thereby providing crucial context for generating accurate intrusion response plans.

[0054] See Figure 5 This is an environmental risk assessment radar chart, showing the comparison between current risk values ​​and historical averages across six core risk dimensions to quantify the real-time risk status of the network environment. The current regional risk value is significantly higher than historical values, indicating that the behavior occurred in a high-sensitivity network area, raising the risk level. The current compliance risk value is significantly higher than historical values, indicating a low match between the behavior pattern and the business whitelist, posing a risk of unauthorized operations. The current asset importance is significantly higher than historical values, indicating that the behavior involves high-value core assets, and damage to these assets would have a significant impact. The current network sensitivity is significantly higher than historical values, indicating that the behavior occurred at the boundary of a high-sensitivity network, expanding the exposure surface. The current threat intelligence match is higher than historical values, indicating a high degree of match between the behavior characteristics and known threat intelligence, with a clear attack intent. Currently, the risk values ​​in all dimensions are higher than historical averages, especially the asset importance, network sensitivity, and regional risk values, which significantly exceed the limits, indicating that the current network environment is in a high-risk state, and the attack target is clearly aimed at core assets.

[0055] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A network intrusion intelligent detection method based on behavior analysis, characterized in that, The method includes: Network entity behavior logs, network traffic metadata, and system call records are collected from multiple data sources in the target network to form a heterogeneous raw behavior dataset; Perform pattern transformation and field alignment on the heterogeneous original behavior dataset to generate a unified format behavior event stream containing timestamps, subject identifiers, behavior types, and context attributes; Extract the subject identifier from the unified format behavior event stream, perform continuous behavior sequence modeling on each subject identifier, and construct a behavior state transition chain that reflects the action switching of network entities over time. A multi-dimensional pattern scan is performed on the behavioral state transition chain to identify abnormal state transitions, periodic abrupt changes, and statistical outliers in state dwell time, generating a preliminary set of behavioral anomaly markers. Based on the initial set of behavioral anomaly markers, backtrack to the corresponding unified format behavioral event stream and extract the set of context attributes related to the initial set of behavioral anomaly markers; The context attribute set is input into the environmental risk assessor, and the environmental risk coefficient is calculated and generated by combining the preset network asset topology relationship and business whitelist rules. By integrating the preliminary set of abnormal behavior markers with the environmental risk coefficient, the behavioral threat determination network outputs a comprehensive threat alert list that includes the subject identifier, anomaly type, and threat confidence level.

2. The intelligent network intrusion detection method based on behavior analysis according to claim 1, characterized in that, The step of performing continuous behavior sequence modeling for each subject identifier and constructing a behavior state transition chain includes: According to the timestamp order, the behavioral events belonging to the same subject identifier in the unified format behavioral event stream are sorted to form the behavioral event timeline of the subject identifier; Each behavioral event in the behavioral event timeline is mapped to an abstract behavioral state with semantic description, forming a sequence of behavioral states; Analyze the relationships between adjacent behavioral states in the behavioral state sequence, and construct a directed graph with behavioral states as nodes and the relationships between state transitions as directed edges based on the frequency and logical relationships between states. This graph serves as a behavioral state transition chain that reflects the behavioral patterns of the subject.

3. The intelligent network intrusion detection method based on behavior analysis according to claim 2, characterized in that, Perform multi-dimensional pattern scanning on the behavioral state transition chain to identify abnormal state transitions within the chain, including: Within a preset time window, the historical transition probabilities of transitioning from a specific source state to a specific target state in the behavioral state transition chain are statistically analyzed to form a state transition probability baseline. The behavior state transition chain is monitored in real time. When a state transition occurs, the source state and target state of this transition are obtained. Query the state transition probability baseline to obtain the historical transition probability corresponding to this transition; This transition is treated as an independent event. It is determined whether the statistical probability of its occurrence is lower than the corresponding historical transition probability threshold in the state transition probability baseline. If so, this state transition is marked as an abnormal jump.

4. The intelligent network intrusion detection method based on behavior analysis according to claim 3, characterized in that, The aforementioned set of context attributes is input into the environmental risk assessor, and combined with preset network asset topology relationships and business whitelist rules, an environmental risk coefficient is calculated and generated, including: The set of context attributes includes source and destination addresses, protocol type, payload feature summary, and number of concurrent sessions; The source and destination addresses in the context attribute set are compared with the preset network asset topology to determine the network area involved in the behavior, and a risk value is assigned to the area based on the sensitivity level of the network area. The protocol type and payload feature summary in the context attribute set are matched with the business whitelist rules to determine whether the current behavior conforms to the known normal business pattern, and a compliance risk value is assigned based on the matching result. Extract the number of concurrent sessions from the context attribute set, and calculate the load anomaly degree by combining it with the behavior type through the session load model; A weighted fusion strategy is adopted to normalize and comprehensively calculate the regional risk value, the compliance risk value, and the load anomaly degree, and output a quantitative environmental risk coefficient.

5. The intelligent network intrusion detection method based on behavior analysis according to claim 4, characterized in that, By integrating the preliminary set of abnormal behavior markers with the environmental risk coefficients, the behavioral threat determination network outputs a comprehensive threat alert list containing entity identifier, anomaly type, and threat confidence level, including: Each tag in the initial set of behavioral anomaly tags is expanded into a feature vector, which contains an anomaly type code, an anomaly severity value, and an associated timestamp. Each expanded feature vector of a marker is concatenated with the corresponding environmental risk coefficient to form an enhanced feature vector; The enhanced feature vectors are sequentially input into multiple fully connected layers of the behavioral threat determination network for nonlinear transformation and feature abstraction; By using the output layer of the behavioral threat determination network, the abstracted features are mapped to specific threat type probability distributions and threat confidence levels; The category corresponding to the maximum value of the probability distribution of the threat type is taken as the final anomaly type. Combined with the calculated threat confidence and the original subject identifier, it constitutes an entry in the comprehensive threat alert list.

6. The intelligent network intrusion detection method based on behavior analysis according to claim 5, characterized in that, Also includes: Perform alarm aggregation and causal correlation analysis on the items in the comprehensive threat alarm list to identify alarm groups belonging to the same intrusion activity and form an intrusion activity candidate set. Multi-stage attack script matching is performed on the intrusion activity candidate set. Based on the predefined multi-stage attack script library, the attack stage label with the highest matching degree and the corresponding attack intent inference are assigned to each candidate set. Based on the attack phase labels and intent inferences, an executable intrusion handling plan is generated, which includes response suggestions and a summary of the evidence chain. The process of performing alert aggregation and causal correlation analysis on the entries in the comprehensive threat alert list includes: Using a preset time window and network logical domain as boundaries, the alarm entries in the comprehensive threat alarm list are clustered, and alarm entries with similar time, related subject identifiers, or the same target assets are aggregated into an alarm group; For each alarm group, analyze the chronological order of alarm entries within the group and the logical dependencies between the behaviors described by the alarm entries; Based on the temporal sequence and logical dependencies, an association graph describing the potential causal chains within the alarm group is constructed. If the correlation graph presents a clear evolution path that conforms to the logic of the intrusion steps, then the alarm group is identified as a candidate set of intrusion activities.

7. The intelligent network intrusion detection method based on behavior analysis according to claim 6, characterized in that, The temporal order of alarm entries within the analysis group, and the logical dependencies between the behaviors described by the alarm entries, include: Extract the timestamp from each alarm entry, and arrange all alarm entries in ascending order of timestamps to form a timeline sequence; Analyze the behavior of the subject identifier in the preceding and following alarm entries in the timeline sequence to determine whether the subsequent behavior is a necessary condition for the result or state of the previous behavior. Analyze the network resources involved in the alarm entries to determine whether the target resources accessed by subsequent alarm entries are resources that were operated on or probed by previous alarm entries; By combining the timeline sequence, the results of the judgment of necessary conditions for behavior, and the resource access relationship, it can be inferred whether there is a temporal necessity and logical dependency among the alarm items.

8. The intelligent network intrusion detection method based on behavior analysis according to claim 7, characterized in that, The multi-stage attack script matching process for the candidate set of intrusion activities includes: The alarm type sequence, behavior time interval characteristics, and resource access patterns contained in the intrusion activity candidate set are abstracted into a standardized attack feature sequence. The standardized attack feature sequence is compared item by item with each attack script in the predefined multi-stage attack script library; The matching score between the standardized attack feature sequence and each attack script is calculated using either a dynamic time warping algorithm or a sequence matching algorithm. The attack script with the highest matching score is selected as the best matching script, and the multi-stage attack stage labels and tactical intent descriptions defined by the best matching script are used as attack stage labels and intent inferences for the candidate set of intrusion activities.

9. The intelligent network intrusion detection method based on behavior analysis according to claim 8, characterized in that, The alarm type sequence, behavioral time interval characteristics, and resource access patterns contained in the intrusion activity candidate set are abstracted into a standardized attack feature sequence, including: From the association graph of the candidate intrusion activity set, alarm types sorted by time are extracted to form the original alarm type sequence; Based on a predefined mapping table from alarm types to general attack actions, each alarm type in the original alarm type sequence is converted into the corresponding general attack action code; Based on the common correlation strength of adjacent common attack action codes in attack logic, assign a logical coherence weight to each transition point in the sequence; The standardized attack feature sequence is composed of the converted general attack action encoding sequence and its corresponding logical coherence weights.

10. The intelligent network intrusion detection method based on behavior analysis according to claim 9, characterized in that, The generation of an executable intrusion handling plan, including response suggestions and a summary of the chain of evidence, includes: Based on the attack stage labels and intent inferences, a pre-set response strategy knowledge base is queried to obtain a set of recommended actions corresponding to the attack stage labels and intent inferences. The alarm entries in the candidate set of intrusion activities are used as key evidence nodes and linked together according to their time sequence and logical relationship to form an evidence chain describing the entire intrusion process. Key time points, executing entities, affected assets, and operational behaviors are extracted from the chain of evidence and condensed into a summary of the chain of evidence. The recommended set of actions is integrated with the evidence chain summary and formatted as an executable intrusion handling plan that includes operation steps, execution targets, and expected results.

Images