Internal threat detection method and device based on user long-term and short-term behavior representation

Abstract

The present application discloses an internal threat detection method and device based on user long-term and short-term behavior representations, wherein the method includes: collecting a variety of heterogeneous user activity log data, extracting raw log data, and converting the heterogeneous user activity log data into data in a preset format; constructing activity representations, and generating a user activity representation sequence in chronological order, generating a short-term behavior representation for each moment by modeling the activity sequence; obtaining user short-term behavior representations and user long-term behavior representations, and modeling user long-term behavior patterns based on user short-term behavior representations and user long-term behavior representations, so as to use the model obtained by modeling to make abnormal predictions of internal dangers. The embodiment of the present application can unify the described log data format and behavior representation method, and apply the comparative learning idea to design learning tasks to guide the model to model the user's long-term behavior and short-term behavior patterns, so as to solve the problems currently faced in the field of internal threat detection.

Description

Technical Field

[0001] The present application relates to the technical field of network security attack detection, and in particular to an internal threat detection method and device based on long-term and short-term user behavior characterization. Background Art

[0002] With the widespread adoption of informatization, information technology systems have become an integral part of the daily operations of organizations. Insider threats are one of the most frequent and costly cybersecurity incidents. Because insiders have access to information technology system resources and possess a deep understanding of the security prevention and control technologies and mechanisms within these systems, malicious insiders can effectively avoid many of the traces left behind by external attacks. Therefore, compared to external attack detection, which relies on distinct attack behavior, insider threat detection based on user logs faces greater concealment and complexity.

[0003] Related technologies can generally be categorized into three types: statistical feature-based, graph-based, and sequence modeling-based. Feature-based methods involve researchers designing a feature engineering scheme to extract user behavioral features, typically statistically significant. This approach uses multiple statistical features to describe user behavior characteristics within an activity or session. Machine learning algorithms are then used to identify anomalies and perform anomaly detection. However, the feature engineering design phase still relies on the designer's domain experience and familiarity with specific information technology systems, making scalability difficult. Furthermore, analysis based on manually designed features can discard much of the valid information in the raw activity data. Graph-based detection methods convert raw logs into corresponding activity graphs based on researcher-designed graph construction rules, combining graph representation and clustering techniques for anomaly detection. Graph-based methods can more directly connect related log data through edges, bringing related logs closer together in the temporal dimension by reducing spatial distances. Sequence modeling methods organize raw log data into activity sequences and construct normal user behavior patterns based on these sequences. They primarily focus on capturing user behavior characteristics in the temporal dimension of log data. These two approaches have significantly improved the effectiveness and usability of insider threat detection, effectively alleviating the information loss caused by purely artificial features. However, most research still relies on expert knowledge and can only detect user behavior at the session level. Furthermore, the utilization of raw activity information needs to be improved. Furthermore, insider threat detection is a typical learning task in imbalanced data scenarios. The aforementioned approaches are limited by the lack of malicious samples and, to avoid representation collapse, are unable to use log data on a large scale. This results in missing out on the vast amount of underlying user activity features and behavior information contained in the data.

[0004] Application Contents

[0005] The present application provides an internal threat detection method and device based on the characterization of long-term and short-term user behavior to solve the problems in related technologies such as the lack of malicious samples, the difficulty in using log data on a large scale to avoid the problem of characterization collapse, and the loss of a large amount of underlying user activity characteristics and user behavior information contained in various heterogeneous log data.

[0006] The first aspect of the present application provides an internal threat detection method based on user long-term and short-term behavior characterizations, comprising the following steps: collecting a variety of heterogeneous user activity log data, extracting original log data based on user activities, and converting the heterogeneous user activity log data in the original log data into data in a preset format; characterizing the activities corresponding to the original log data to construct an activity representation, and generating a user activity representation sequence in chronological order, generating a short-term behavior representation for each moment by modeling the activity sequence; obtaining a user short-term behavior representation and a user long-term behavior representation according to the user activity representation sequence, and modeling the user's long-term behavior pattern based on the user short-term behavior representation and the user long-term behavior representation, so as to use the model obtained by modeling to predict abnormalities of internal risks.

[0007] Optionally, in one embodiment of the present application, the preset format is a triplet<T,I,C> In this format, T represents the time attribute of the activity, I represents the activity type attribute, and C represents the activity context attribute.

[0008] Optionally, in one embodiment of the present application, the conversion of the heterogeneous user activity log data in the original log data into data in a preset format includes: using the log time as the time attribute of the activity data, extracting the attribute values of the discrete type fields in the log and combining them into the activity type attributes in the activity data, and extracting the fact information triples in the heterogeneous text information in the log and combining them into the activity context attributes in the activity data.

[0009] Optionally, in one embodiment of the present application, the activities corresponding to the original log data are characterized to construct a user activity representation, including: using different network structures to represent the time attribute, the activity type attribute and the activity context attribute respectively, converting the time attribute into a bias value of a preset period and using trigonometric function representation, organizing the activity type attribute into a type sequence to mine and characterize the co-occurrence distribution characteristics between different types of attribute values, splicing the fact information triples in the activity context attribute into text and performing text representation, and fusing the three attribute representations into a user activity representation through a fusion network.

[0010] Optionally, in one embodiment of the present application, before obtaining the user short-term behavior representation and the user long-term behavior representation based on the user activity representation sequence, it also includes: when constructing the user long-term behavior representation, extracting a personnel information graph from the organizational personnel structure file and the project file, combining the graph representation technology, and performing representation based on the user identification to obtain the user long-term behavior representation.

[0011] Optionally, in one embodiment of the present application, the model obtained by using modeling to perform abnormal prediction of internal dangers further includes: using a long-term and short-term representation user similarity classifier to assist the anomaly detection classifier in fusing the user's short-term behavior representation and the user's long-term behavior representation and constructing a decision boundary between normal activities and abnormal activities.

[0012] The second aspect of the present application provides an internal threat detection device based on the long-term and short-term behavior representation of users, including: an extraction module for collecting a variety of heterogeneous user activity log data, and extracting original log data based on the user activity log data, and converting the heterogeneous log data in the original log data into data in a preset format; a generation module for representing the activities corresponding to the original log data to construct an activity representation, and generating a user activity representation sequence in chronological order, and generating a short-term behavior representation for each moment by modeling the activity sequence; a detection module for obtaining a user short-term behavior representation and a user long-term behavior representation according to the user activity representation sequence, and modeling the user's long-term behavior pattern based on the user short-term behavior representation and the user long-term behavior representation, so as to use the model obtained by modeling to predict abnormalities of internal risks.

[0013] Optionally, in one embodiment of the present application, it also includes: an auxiliary module, which is used to use the long-term and short-term representation user similarity classifier to assist the anomaly detection classifier in fusing the user's short-term behavior representation and the user's long-term behavior representation and constructing the decision boundary between normal activities and abnormal activities.

[0014] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program and a learning model stored in the memory and executable on the processor, wherein the processor executes the program and model to implement the internal threat detection method based on the long-term and short-term behavior characterization of the user as described in the above embodiment.

[0015] The fourth aspect of the present application provides a computer-readable storage medium on which a computer program and a learning model are stored. The program and model are executed by a processor to implement the internal threat detection method based on the long-term and short-term behavior characterization of users as described in the above embodiments.

[0016] The data format and representation method of the description are unified, and the comparative learning idea is applied to design learning tasks to guide the model to model the long-term and short-term behavior patterns of users, so as to solve the problems currently faced in the field of internal threat detection. Among them, the underlying information of the original log data of user behavior is fully utilized to expand the semantic space of activity representation, and a longer-term association is established between user activities, so as to effectively coordinate analysis to deal with the detection difficulties of internal threat scenarios with high requirements for activity content analysis and long attack cycles. It effectively improves the detection rate of internal threats, reduces the false negative rate, and enhances the real-time monitoring capabilities of the internal threat detection system. In this way, the problems in related technologies such as the lack of malicious samples and the difficulty in using log data on a large scale to avoid the problem of representation collapse are solved, resulting in the loss of a large amount of underlying user activity characteristics and user behavior information contained in various heterogeneous log data.

[0017] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0019] Figure 1 This is a flowchart of an internal threat detection method based on user long-term and short-term behavior characterization according to an embodiment of the present application;

[0020] Figure 2 is a flowchart of activity information extraction according to one embodiment of the present application;

[0021] Figure 3 A flowchart for modeling long-term behavior characterization according to one embodiment of the present application;

[0022] Figure 4 A flowchart for modeling short-term behavior characterization according to one embodiment of the present application;

[0023] Figure 5 A flowchart of anomaly detection according to one embodiment of the present application

[0024] Figure 6 This is an example diagram of an internal threat detection device based on user long-term and short-term behavior characterization according to one embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structure of an electronic device provided in an application embodiment.

[0026] Description of reference numerals:

[0027] 10-Internal threat detection device based on user long-term and short-term behavior characterization; 100-Extraction module, 200-Generation module, 300-Detection module; 701-Memory, 702-Processor, 703-Communication interface. DETAILED DESCRIPTION

[0028] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0029] The following describes, with reference to the accompanying drawings, an insider threat detection method and apparatus based on user long-term and short-term behavior representations according to an embodiment of the present application. To address the challenges in the field of insider threat detection, such as the difficulty in representing heterogeneous log information, establishing long-term associations between activities, and the lack of malicious samples to guide large-scale data utilization, as mentioned in the background art above, the present application provides an insider threat detection method based on user long-term and short-term behavior representations. This method includes a model for representing both long-term and short-term user behaviors, and a multi-task training approach to prevent representation breakdown in data imbalance scenarios. These three main components effectively address the challenges faced by insider threat detection in complex information technology systems. The method unifies the data format and representation method for descriptions, and employs comparative learning to design learning tasks to guide the model in modeling long-term and short-term user behavior patterns, addressing current challenges in the field of insider threat detection. The method leverages the underlying information of raw log data for user behavior, expands the semantic space for activity representations, and establishes longer-term associations between user activities, enabling effective collaborative analysis. This method addresses the challenges of insider threat detection in scenarios where activity content analysis is demanding and attack spans long periods. This method effectively improves the detection rate of insider threats, reduces the false negative rate, and enhances the real-time monitoring capabilities of insider threat detection systems.

[0030] Specifically, Figure 1 A flowchart of an internal threat detection method based on user long-term and short-term behavior characterization provided in an embodiment of the present application.

[0031] like Figure 1 As shown, the internal threat detection method based on user long-term and short-term behavior characterization includes the following steps:

[0032] In step S101 , a plurality of heterogeneous user activity log data are collected, and original log data are extracted according to user activities, and the heterogeneous user activity log data in the original log data are converted into data in a preset format.

[0033] It can be understood that the embodiment of the present application first collects user activity log data of the information technology system, and extracts information from the original log data for the collected various heterogeneous user log data, and converts the heterogeneous log data into a format with a unified semantic description.

[0034] In one embodiment of the present application, the preset format is a triplet<T,I,C> In this format, T represents the time attribute of the activity, I represents the activity type attribute, and C represents the activity context attribute.

[0035] That is, as a possible implementation method, the unified description semantic format of heterogeneous log information can adopt a triple<T,I,C> A formal description of a user activity, where T represents the time attribute of the activity, I represents the activity type attribute, and C represents the activity context attribute.

[0036] Furthermore, in one embodiment of the present application, heterogeneous user activity log data in the original log data is converted into data in a preset format, including: using the log time as the time attribute of the activity data, extracting the attribute values of the discrete type fields in the log and combining them into the activity type attributes in the activity data, and extracting the fact information triples in the heterogeneous text information in the log and combining them into the activity context attributes in the activity data.

[0037] It can be understood that the log time is used as the time attribute of the activity data, the attribute values of the discrete type fields in the log are extracted and combined into the type attributes in the activity data, and the fact information triples in the heterogeneous text information in the log are extracted and combined into the activity context attributes in the activity data.

[0038] In step S102 , the activities corresponding to the original log data are characterized to construct activity representations, and a user activity representation sequence is generated in chronological order. By modeling the activity sequence, a short-term behavior representation at each moment is generated.

[0039] Specifically, the extracted activities are characterized, and the constructed activity representations are organized into a user activity representation sequence in chronological order. The user short-term behavior representation module uses a timing model to perform time series modeling on the activity sequence to establish a representation for the user short-term behavior corresponding to each activity moment.

[0040] Optionally, in one embodiment of the present application, user activities corresponding to the original log data are characterized to construct a user activity representation, including: using different network structures to represent the time attribute, activity type attribute and activity context attribute respectively, converting the time attribute into a bias value of a preset period and using trigonometric function representation, organizing the activity type attribute into a type sequence to mine the co-occurrence distribution characteristics between different types of attribute values and characterize them, splicing the fact information triples in the activity context attribute into text and performing text representation, and fusing the three attribute representations into a user activity representation through a fusion network.

[0041] It can be understood that in the above steps, the activity representation module in the unified description of semantic format data representation uses different network structures to represent the three attributes in the user activity, converts the time attribute into a fixed-period bias value and uses trigonometric function representation, organizes the type attributes into type sequences to mine and represent the co-occurrence distribution characteristics between different types of attribute values, splices the fact information triples in the context attributes into text and performs text representation, and fuses the three attribute representations into user activity representation through a fusion network.

[0042] In step S103, the user's short-term behavior representation and the user's long-term behavior representation are obtained according to the user activity representation sequence, and the user's long-term behavior pattern is modeled based on the user's short-term behavior representation and the user's long-term behavior representation, so as to use the model obtained by modeling to predict abnormalities of internal risks.

[0043] Finally, the user's long-term behavior pattern is modeled. For the user's short-term behavior representation and long-term behavior representation obtained in the above steps, the two types of representations are fused using an anomaly detection classifier, and the user behavior is predicted to be abnormal through the anomaly classifier.

[0044] Optionally, in one embodiment of the present application, before obtaining the user's short-term behavior representation and the user's long-term behavior representation based on the user activity representation sequence, it also includes: when constructing the user's long-term behavior representation, extracting a personnel information graph from the organization's personnel structure file and the project file, combining the graph representation technology, and performing representation based on the user's identification to obtain the user's long-term behavior representation.

[0045] It can be understood that the user long-term behavior representation module in constructing the user long-term behavior representation extracts the personnel information graph from the organizational personnel structure file and the project file, combines the graph representation technology, and obtains the user long-term behavior representation by representing the user identifier (ID).

[0046] In addition, in one embodiment of the present application, the model obtained by modeling is used to predict internal danger anomalies, further including: using a long-term and short-term characterization user similarity classifier to assist the anomaly detection classifier in fusing the user's short-term behavior characterization and the user's long-term behavior characterization and constructing a decision boundary between normal activities and abnormal activities.

[0047] During the actual implementation process, the embodiment of the present application can add a long-term and short-term representation user similarity classifier to assist the anomaly detection classifier in better integrating the user's long-term and short-term behavior representations and constructing the decision boundary between normal activities and abnormal activities, thereby avoiding the problem of representation collapse during deep network training under data imbalance.

[0048] In summary, the detection method of the embodiment of the present application includes:

[0049] Step S1: Collect user activity log data and record different field values according to the characteristics of different types of logs.

[0050] Step S2: With respect to the user log data collected in step S1, the activity information extraction module extracts information from the original log data and converts the heterogeneous log data into a format with a unified semantic description.

[0051] Among them, a triple is used<T,I,C> A formal description of a user activity, where T represents the time attribute of the activity, I represents the activity type attribute, and C represents the activity context attribute.

[0052] Furthermore, the time of the log is used as the time attribute of the activity data, the attribute values of the discrete type fields in the log are extracted and combined into the type attributes in the activity data, and the triple information in the heterogeneous text information in the log is extracted and combined into the activity context attributes in the activity data.

[0053] Step S3: The activity characterization module characterizes the activities extracted in step S2.

[0054] Furthermore, different network structures are used to represent the three attributes of the activity respectively, and then the three attribute representations are fused into the activity representation through a fusion network.

[0055] Step S4: The activity representation constructed in step S3 is organized into a user activity representation sequence in chronological order, and the moment corresponding to each activity represents the short-term behavior of the user at that moment.

[0056] Step S5: The user long-term characterization module extracts the personnel information graph from the organizational personnel structure file and the project file, and combines the graph characterization technology to obtain the user's long-term behavior characterization by characterizing the user's ID.

[0057] Step S6: For the user short-term behavior representation and the user long-term behavior representation obtained in step S4 and step S5, the anomaly detection classifier fuses the two types of representations and performs anomaly prediction through the anomaly classifier.

[0058] Furthermore, in order to avoid the problem of representation collapse during deep network training under data imbalance, a long-term and short-term representation user similarity classifier is added to assist the anomaly detection classifier in better integrating the user's long-term and short-term behavior representations and constructing the decision boundary between normal and abnormal activities.

[0059] Those skilled in the art will appreciate that the embodiments of the present application have the following beneficial effects:

[0060] 1. The embodiments of the present application can provide an effective activity description form and characterization method for different types of heterogeneous log information. Compared with existing characterization methods, it can obtain more comprehensive semantic information and features in log data.

[0061] Second, in the embodiments of this application, insider attacks often span weeks or even months. Establishing longer-term connections between activities is a key capability required of insider threat detection methods. This embodiment of the application models user behavior patterns within time windows of varying lengths, building longer-term connections between activities and enabling collaborative analysis of activities across different time periods.

[0062] 3. In the embodiment of the present application, by setting up comparative prediction tasks and auxiliary task modules, the neural network is assisted to better extract data features, avoiding the representation collapse problem in unbalanced data scenarios, thereby making the method large-scale.

[0063] As can be seen from the above embodiments of the present application, the present application embodiment increases the semantic information of activity representation by uniformly representing heterogeneous log information, characterizing the characteristics of users' long-term and short-term behavior patterns and conducting correlation analysis, thereby enabling the construction of correlation and collaborative analysis between remote activities. The design of training methods and auxiliary modules enables the present invention to utilize raw data on a large scale and more fully explore the underlying characteristics of the data. The present invention can effectively improve the recall rate of the internal threat detection system, reduce the false alarm rate, and has the ability to be deployed in practical applications.

[0064] The following is a specific example to further illustrate the principle of the detection method of the embodiment of the present application.

[0065] Specifically, the embodiment of the present application includes a total of seven parts. Among them, the user log collection part, the activity information extraction part and the information graph construction part are mainly responsible for data preparation work such as raw data collection, data cleaning, formatting and other data preprocessing. The activity characterization part is mainly responsible for characterizing the heterogeneous logs after unified description. The short-term behavior characterization part obtains the characterization of the user's short-term behavior pattern at different times by performing sequence modeling on the activity representation sequence output by the activity characterization part. The long-term behavior characterization part receives the user relationship graph from the information graph construction part and integrates it into the user's long-term behavior pattern modeling. The anomaly detection part will accept the output of the short-term behavior characterization module and the long-term behavior characterization module, and fuse the two representations to make a decision whether the activity is abnormal.

[0066] like Figure 2 The figure shows the workflow of the activity information extraction part. This part obtains the original log data, converts the heterogeneous data into the activity data description form under the unified description framework, and filters out the noisy text information during the information extraction process.

[0067] like Figure 3 The figure shows a workflow diagram for long-term behavior representation modeling. This flowchart includes both information graph construction and long-term behavior representation. First, information related to individuals, such as their IDs, project participation information, project roles, and teams, is obtained from the organization's personnel structure and project documents. Based on the relationships within the documents, this information is connected via undirected edges to construct an undirected graph. Graph representation techniques are used to represent nodes in the information graph. The ID nodes are used as the initialization vector for the corresponding user's long-term behavior representation in the long-term behavior representation encoder. This vector is then updated as the entire network updates, thereby updating the parameters.

[0068] like Figure 4 The figure shows the workflow for modeling short-term behavior representation. This flowchart encompasses the workflows of the activity representation module and the short-term behavior representation module. Activity data extracted from the raw data is first grouped by user and arranged by time to construct a user activity sequence. The activity representation process represents three attributes separately, and finally, the three attribute representations are fused to form the activity representation. Short-term behavior is modeled using a temporal deep network model to model the activity representation sequence, using the hidden vector at each time step as the user's short-term behavior representation at that time step.

[0069] like Figure 5The figure shows the workflow of the anomaly detection component. The anomaly prediction process integrates a user's long-term and short-term behavior representations and outputs an anomaly judgment through an anomaly classifier. The auxiliary task process randomly replaces users with other users' long-term behavior representations with a certain probability. The user's long-term and short-term behavior representations are then integrated. The auxiliary task classifier determines whether the long and short-term behaviors originate from the same user. Through parameter sharing, the backpropagation process of the auxiliary task influences the anomaly prediction task, further guiding behavior modeling and anomaly judgment.

[0070] According to the internal threat detection method based on the characterization of long-term and short-term user behaviors proposed in the embodiment of the present application, a model for characterizing long-term and short-term user behaviors respectively, and a multi-task training form to prevent characterization collapse in data imbalance scenarios. The three main parts can effectively deal with the difficulties faced in the field of internal threat detection in complex information technology systems, unify the data format and characterization method for description, and apply the comparative learning idea to design learning tasks to guide the model to model the long-term and short-term behavior patterns of users, so as to solve the problems faced by the current field of internal threat detection. Among them, the underlying information of the original data of user behavior is fully utilized, the semantic space of activity representation is expanded, and a longer-term association is established between user activities, so as to effectively coordinate analysis to deal with the detection difficulties of internal threat scenarios with high requirements for activity content analysis and long attack spans. It effectively improves the detection rate of internal threats, reduces the false alarm rate, and enhances the real-time monitoring capability of the internal threat detection system. Therefore, it solves the problems in related technologies that are limited by the lack of malicious samples and the difficulty of using log data on a large scale to avoid the problem of characterization collapse, resulting in the loss of a large amount of underlying features and user behavior information contained in the data.

[0071] Next, an internal threat detection device based on user long-term and short-term behavior characterization proposed in an embodiment of the present application will be described with reference to the accompanying drawings.

[0072] Figure 6 4 is a block diagram of an internal threat detection device based on user long-term and short-term behavior characterization according to an embodiment of the present application.

[0073] like Figure 6 As shown, the internal threat detection device 10 based on the long-term and short-term behavior characterization of users includes: an extraction module 100, a generation module 200 and a detection module 300.

[0074] Specifically, the extraction module 100 is used to collect a variety of heterogeneous user activity log data, extract original log data according to user activities, and convert the heterogeneous user activity log data in the original log data into data in a preset format.

[0075] The generation module 200 is used to characterize the activities corresponding to the original log data to construct activity representations, and generate user activity representation sequences in chronological order, and generate short-term behavior representations for each moment by modeling the activity sequence.

[0076] The detection module 300 is used to obtain the user's short-term behavior representation and the user's long-term behavior representation according to the user activity representation sequence, and model the user's long-term behavior pattern based on the user's short-term behavior representation and the user's long-term behavior representation, so as to use the model obtained by modeling to predict internal danger anomalies.

[0077] Optionally, in one embodiment of the present application, the detection device 10 of the embodiment of the present application further includes: an auxiliary module.

[0078] Among them, the auxiliary module is used to use the long-term and short-term representations of the user similarity classifier to assist the anomaly detection classifier in fusing the user's short-term behavior representation and the user's long-term behavior representation and constructing the decision boundary between normal activities and abnormal activities.

[0079] It should be noted that the aforementioned explanation of the embodiment of the internal threat detection method based on the long-term and short-term behavior characterization of users is also applicable to the internal threat detection device based on the long-term and short-term behavior characterization of users in this embodiment, and will not be repeated here.

[0080] According to the embodiment of the present application, the internal threat detection device based on the characterization of long-term and short-term user behaviors, a model for characterizing long-term and short-term user behaviors, and a multi-task training method to prevent characterization collapse in data imbalance scenarios are proposed. These three main parts can effectively address the difficulties faced in the field of internal threat detection in complex information technology systems. The unified description data format and characterization method, and the application of comparative learning ideas to design learning tasks to guide the model to model the long-term and short-term behavior patterns of users, solve the problems currently faced in the field of internal threat detection. Among them, the underlying information of the original data of user behavior is fully utilized to expand the semantic space of activity representation, establish longer-term associations between user activities, and effectively coordinate analysis to address the detection difficulties of internal threat scenarios with high requirements for activity content analysis and long attack spans. It effectively improves the detection rate of internal threats, reduces the false alarm rate, and enhances the real-time monitoring capability of the internal threat detection system. Therefore, it solves the problems in related technologies such as the lack of malicious samples, the difficulty in using log data on a large scale to avoid the problem of characterization collapse, and the loss of a large amount of underlying features and user behavior information contained in the data.

[0081] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0082] Memory 701 , processor 702 , and computer programs and learning models stored in the memory 701 and executable on the processor 702 .

[0083] When the processor 702 executes the program and the model, the internal threat detection method based on the long-term and short-term behavior characterization of the user provided in the above embodiment is implemented.

[0084] Furthermore, the electronic device further includes:

[0085] The communication interface 703 is used for communication between the memory 701 and the processor 702 .

[0086] The memory 701 is used to store computer programs and learning models that can be run on the processor 702.

[0087] The memory 701 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0088] If the memory 701, processor 702, and communication interface 703 are implemented independently, the communication interface 703, memory 701, and processor 702 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0089] Optionally, in a specific implementation, if the memory 701, the processor 702 and the communication interface 703 are integrated on a chip, the memory 701, the processor 702 and the communication interface 703 can communicate with each other through an internal interface.

[0090] Processor 702 may be a central processing unit (CPU), a deep learning processing architecture combining a central processing unit and multiple graphics processing units (GPUs), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0091] This embodiment also provides a computer-readable storage medium on which a computer program and a learning model are stored. When the program and model are executed by a processor, the above-mentioned internal threat detection method based on the long-term and short-term behavior characterization of users is implemented.

[0092] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0093] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0094] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0095] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, such as a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0096] Those skilled in the art will understand that all or part of the steps in the method for implementing the above-mentioned embodiment can be completed by instructing related hardware through programs and models, and the programs and models can be stored in a computer-readable storage medium. When the programs and models are executed, they include one of the steps of the method embodiment or a combination thereof.

Claims

1. A method for detecting internal threats based on the characterization of users' long-term and short-term behaviors, characterized by: The following steps are involved: Collecting a variety of heterogeneous user activity log data, and preprocessing the extracted raw log data so as to convert the heterogeneous user activity log data in the raw log data into data in a preset format; Characterizing the activities corresponding to the original log data to construct activity representations, including: Different network structures are used to represent time attributes, activity type attributes, and activity context attributes. Time attributes are converted into bias values of a preset period and represented using trigonometric functions. Activity type attributes are organized into type sequences to mine and characterize the co-occurrence distribution characteristics between different types of attribute values. Factual information triplets in activity context attributes are concatenated into text and represented. The three attribute representations are fused into an activity representation through a fusion network. Generate a user activity representation sequence in chronological order of user activities, and generate a short-term behavior representation for each moment by modeling the activity sequence; and Acquire a user's short-term behavior representation and a user's long-term behavior representation according to the user activity representation sequence, and model the user's long-term behavior pattern based on the user's short-term behavior representation and the user's long-term behavior representation, so as to use the model obtained by modeling to perform abnormal prediction of internal risks; Before acquiring the user short-term behavior representation and the user long-term behavior representation according to the user activity representation sequence, the method further includes: When constructing the user long-term behavior representation, a personnel information graph is extracted from the organizational personnel structure file and the project file, and the graph representation technology is combined to perform representation based on the user identification to obtain the user long-term behavior representation.

2. The method according to claim 1, characterized in that The preset format is a triple<T,I,C> In this format, T represents the time attribute of the activity, I represents the activity type attribute, and C represents the activity context attribute.

3. The method according to claim 2, characterized in that The converting the heterogeneous user activity log data in the original log data into data in a preset format includes: The log time is used as the time attribute of the activity data, the attribute values of the discrete type fields in the log are extracted and combined into the activity type attributes in the activity data, and the fact information triples in the heterogeneous text information in the log are extracted and combined into the activity context attributes in the activity data.

4. The method according to claim 1, wherein The method of using the model obtained by modeling to predict abnormalities of internal risks further includes: By using the long-term and short-term representation user similarity classifier, the auxiliary anomaly detection classifier fuses the user's short-term behavior representation and the user's long-term behavior representation and constructs the decision boundary between normal activities and abnormal activities.

5. An internal threat detection device based on user long-term and short-term behavior characterization, characterized by: include: An extraction module, configured to collect a variety of heterogeneous user activity log data, extract original log data based on user activities, and convert the heterogeneous user activity log data in the original log data into data in a preset format; A generation module is used to characterize the activities corresponding to the original log data to construct an activity representation, and to generate a user activity representation sequence in chronological order, and to generate a short-term behavior representation at each moment by modeling the activity sequence; as well as a detection module, configured to obtain a user short-term behavior representation and a user long-term behavior representation based on the user activity representation sequence, and model the user long-term behavior pattern based on the user short-term behavior representation and the user long-term behavior representation, so as to use the model obtained to perform anomaly prediction of internal risks; Characterizing the activity corresponding to the original log data to construct an activity characterization includes: Different network structures are used to represent time attributes, activity type attributes, and activity context attributes. Time attributes are converted into bias values of a preset period and represented using trigonometric functions. Activity type attributes are organized into type sequences to mine and characterize the co-occurrence distribution characteristics between different types of attribute values. Factual information triplets in activity context attributes are concatenated into text and represented. The three attribute representations are fused into an activity representation through a fusion network. Before the detection module obtains the user short-term behavior representation and the user long-term behavior representation according to the user activity representation sequence, the detection module further includes: When constructing the user long-term behavior representation, a personnel information graph is extracted from the organizational personnel structure file and the project file, and the graph representation technology is combined to perform representation based on the user identification to obtain the user long-term behavior representation.

6. The device according to claim 5, characterized in that Also includes: The auxiliary module is used to utilize the long-term and short-term representations of the user similarity classifier to assist the anomaly detection classifier in fusing the user's short-term behavior representation and the user's long-term behavior representation and constructing the decision boundary between normal activities and abnormal activities.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program and a learning model stored in the memory and executable on the processor, wherein the processor executes the program and the model to implement the internal threat detection method based on the long-term and short-term behavior characterization of the user as described in any one of claims 1 to 4.

8. A computer-readable storage medium having a computer program and a learning model stored thereon, characterized in that: The program and model are executed by a processor to implement the internal threat detection method based on user long-term and short-term behavior characterization as described in any one of claims 1 to 4.

Images