Abnormal behavior detection method and system based on behavior and attention mechanism

Abstract

The present application provides an abnormal behavior detection method, system and computer medium based on behavior and attention mechanism, which obtains user behavior, extracts behavior sequence features and behavior statistical features; fuses behavior sequence features and behavior statistical features to obtain behavior fusion features; inputs behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; inputs the user behavior to be detected into the abnormal behavior detection model to obtain abnormal behavior detection results. The present application uses a technical means combining user historical behavior with an attention mechanism to realize the recognition of different user behavior patterns, and ultimately realizes a detection model with higher precision and accuracy to reduce the threats and losses caused by abnormal behavior of internal users to some organizations or enterprises.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and specifically, relates to an abnormal behavior detection method and system based on behavior and attention mechanism. Background Art

[0002] Internal threats are cyber attacks by internal employees of an organization or enterprise that use their granted access rights and familiarity with internal systems to steal sensitive data and damage internal systems. The adverse consequences cause the enterprise or organization to suffer financial losses and negative reputational impacts. Because internal threat attackers usually do not carry out malicious activities from the beginning, they usually carry out normal activities with certain behavioral habits most of the time, and then for some reasons they carry out internal threat attacks, and these attack behaviors are often significantly different from their normal behavioral habits. Therefore, existing internal threat detection research draws on the anomaly detection method to model the normal behavior patterns of users to detect internal threats. However, the existing mainstream internal threat detection methods generally cannot simultaneously achieve fine-grained detection and modeling analysis of different user behavior patterns, resulting in problems such as low detection precision or insufficient accuracy.

[0003] At present, internal threats from personnel cause enterprises or organizations to suffer financial losses and negative impacts on reputation. Therefore, the mainstream method of internal threat detection is based on the analysis of personnel's user behavior. Research on internal threat detection based on user behavior can be roughly divided into two categories: internal threat detection based on machine learning and internal threat detection based on deep learning. However, due to the lack of fine-grained detection and the inability to effectively capture the behavior patterns of individual users, the precision and accuracy of detection are insufficient. Summary of the invention

[0004] The present invention proposes an abnormal behavior detection method and system based on behavior and attention mechanism, aiming to solve the problem that when detecting internal threats through abnormal behavior, it is currently impossible to simultaneously achieve fine-grained behavior detection and modeling analysis of different user behaviors.

[0005] According to a first aspect of an embodiment of the present application, a method for detecting abnormal behavior based on behavior and attention mechanism is provided, which specifically includes the following steps:

[0006] Obtain user behavior and extract behavior sequence features and behavior statistical features;

[0007] Fusing behavior sequence features and behavior statistical features to obtain behavior fusion features;

[0008] The behavior fusion features are input into the LSTM network of the attention mechanism for training to obtain the abnormal behavior detection model;

[0009] The user behavior to be detected is input into the abnormal behavior detection model to obtain the abnormal behavior detection result.

[0010] In some embodiments of the present application, the behavior sequence features and the behavior statistical features are fused to obtain the behavior fusion features, which specifically include:

[0011] The different behaviors of users are digitally numbered, and a behavior number sequence arranged based on time is obtained according to the user behaviors, namely, the behavior sequence feature;

[0012] Lengthen or shorten multiple behavior sequence features to obtain multiple behavior sequence features with standard length values;

[0013] Corresponding to the user's behavior number sequence, count the number of user behaviors corresponding to each behavior number to obtain the corresponding behavior statistical sequence, i.e., the behavior statistical feature;

[0014] Each statistical value n of the behavior statistical feature is replaced by 1 / e^(-n) to obtain a new behavior statistical feature;

[0015] Each behavior of the behavior sequence feature is numbered and concatenated with a new behavior statistical feature to obtain a behavior fusion feature.

[0016] In some embodiments of the present application, multiple behavior sequence features are lengthened or shortened to obtain multiple behavior sequence features of standard length values, specifically including:

[0017] Compare the length of the behavior sequence feature with the calibrated length;

[0018] Use the number 0 to supplement the behavior sequence that is less than the specified length; the number 0 represents no meaning;

[0019] Alternatively, the behavior sequence numbers of the behavior sequence features that are larger than the calibrated length are truncated.

[0020] In some implementations of the present application, the behavior fusion features are input into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model, which specifically includes:

[0021] The behavior fusion features are sequentially input into the attention layer based on user historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier;

[0022] Abnormal behavior detection is performed through a fully connected layer classifier.

[0023] In some embodiments of the present application, before the behavior fusion features are sequentially input into the attention layer based on the user's historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier, the following steps are also included:

[0024] The behavior sequence features are input into the LSTM-based behavior feature extraction layer for further feature extraction.

[0025] In some implementations of the present application, the description equation of LSTM is:

[0026] i t =σ(W i e t +W i h t-1 +b i );

[0027] f t =σ(W f e t +W f h t-1 +b f );

[0028] o t =σ(W o e t +W o h t-1 +b o );

[0029] g t =tanh(W g e t +W g h t-1 +b g );

[0030] c t =f t ⊙c t-1 +i t ⊙g t ;

[0031] h t =o t ⊙tanh(c t );

[0032] Among them, e t is the input behavior sequence x at time t t Embedded representation of t is the forget gate, which is used to indicate c t-1 Which feature information in c t Receive; t is the input gate, which controls g t Which feature information is used to update c t ; g t It is input by t and the hidden state output h of the previous time step t-1Calculated; o t is the output gate; h t is the hidden layer state output at time t; W and b represent the weight matrix and bias value, respectively, which are randomly initialized and learned and adjusted during the training period.

[0033] According to a second aspect of an embodiment of the present application, a system for detecting abnormal behavior based on a behavior and attention mechanism is provided, which is characterized by specifically including:

[0034] Feature extraction unit: used to obtain user behavior and extract behavior sequence features and behavior statistical features;

[0035] Feature fusion unit: used to fuse behavior sequence features and behavior statistical features to obtain behavior fusion features;

[0036] Model training unit: used to input the behavior fusion features into the LSTM network of the attention mechanism for training to obtain the abnormal behavior detection model;

[0037] Abnormal behavior detection unit: used to input the user behavior to be detected into the abnormal behavior detection model to obtain the abnormal behavior detection result.

[0038] In some embodiments of the present application, the feature fusion unit is specifically used to:

[0039] The different behaviors of users are digitally numbered, and a behavior number sequence arranged based on time is obtained according to the user behaviors, namely, the behavior sequence feature;

[0040] Lengthen or shorten multiple behavior sequence features to obtain multiple behavior sequence features with standard length values;

[0041] Corresponding to the user's behavior number sequence, count the number of user behaviors corresponding to each behavior number to obtain the corresponding behavior statistical sequence, i.e., the behavior statistical feature;

[0042] Each statistical value n of the behavior statistical feature is replaced by 1 / e^(-n) to obtain a new behavior statistical feature;

[0043] Each behavior of the behavior sequence feature is numbered and concatenated with a new behavior statistical feature to obtain a behavior fusion feature.

[0044] According to a third aspect of an embodiment of the present application, there is provided an abnormal behavior detection device based on a behavior and attention mechanism, comprising:

[0045] Memory: used to store executable instructions; and

[0046] Processor: used to connect to the memory to execute executable instructions to complete the abnormal behavior detection method based on behavior and attention mechanism.

[0047] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored; the computer program is executed by a processor to implement an abnormal behavior detection method based on a behavior and attention mechanism.

[0048] The abnormal behavior detection method, system and computer medium based on behavior and attention mechanism in the embodiment of the present application are used to obtain user behavior, extract behavior sequence features and behavior statistical features; fuse behavior sequence features and behavior statistical features to obtain behavior fusion features; input the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; input the user behavior to be detected into the abnormal behavior detection model to obtain abnormal behavior detection results. This application uses a technical means combining user historical behavior with an attention mechanism to realize the recognition of different user behavior patterns, and ultimately realizes a detection model with higher precision and accuracy to reduce the threats and losses caused by abnormal behavior of internal users to some organizations or enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0050] Figure 1 : A schematic diagram of the steps of an abnormal behavior detection method based on behavior and attention mechanism according to an embodiment of the present application is shown;

[0051] Figure 2 : shows a network schematic diagram of an abnormal behavior detection method based on behavior and attention mechanism according to an embodiment of the present application;

[0052] Figure 3 A schematic diagram of the feature fusion process of the abnormal behavior detection method according to an embodiment of the present application is shown in FIG.

[0053] Figure 4 , a network structure diagram of a behavior feature evolution layer based on Bi-LSTM according to an abnormal behavior detection method according to an embodiment of the present application is shown;

[0054] Figure 5 The figure shows the average loss and AUC value of the model evaluated by the test set data at different epochs in the experimental data of the embodiment of the present application;

[0055] Figure 6 The ROC curves of the attention-based LSTM detection model, the MBS detection model, and the model of this application are shown;

[0056] Figure 7: shows a structural schematic diagram of an abnormal behavior detection system based on behavior and attention mechanism according to an embodiment of the present application;

[0057] Figure 8 A structural schematic diagram of an abnormal behavior detection device based on behavior and attention mechanism according to an embodiment of the present application is shown in FIG. DETAILED DESCRIPTION

[0058] In the process of implementing this application, the inventor found that internal threats from personnel caused enterprises or organizations to suffer property losses and negative reputational impacts. Therefore, the mainstream method of internal threat detection is based on the analysis of personnel's user behavior. However, due to the lack of fine-grained detection and the inability to effectively capture the behavior patterns of individual users, the detection precision and accuracy are insufficient.

[0059] In order to solve this problem, this application designs a method for internal threat detection based on user historical behavior and attention mechanism, including: using LSTM (Long Short Term Memory) to extract user behavior sequence information, using attention mechanism based on user history behavior (Attention based on user history behavior, ABUHB) to learn the differences between different user behaviors, and using Bi-LSTM (Bidirectional-LSTM) to learn the evolution of behavior patterns of different users, and finally achieve fine-grained user abnormal behavior detection. In order to evaluate the effectiveness of this method, experiments were conducted on the CMU-CERT internal threat open source dataset. The experimental results show that the effect of this method is 3.1% to 6.3% higher than the baseline model method, and it can detect internal threats in different user behaviors in a fine-grained manner.

[0060] Specifically, user behavior is obtained and behavior sequence features and behavior statistical features are extracted; sequence features and statistical features are fused to obtain behavior fusion features; the behavior fusion features are input into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; the user behavior to be detected is input into the abnormal behavior detection model to obtain abnormal behavior detection results.

[0061] Finally, this application uses a technical means that combines user historical behavior with attention mechanism to realize the recognition of different user behavior patterns, and ultimately realizes a detection model with higher precision and accuracy to reduce the threats and losses caused by abnormal behavior of internal users to some organizations or enterprises.

[0062] In order to make the technical solutions and advantages in the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0063] In recent years, the research directions of internal threat detection based on abnormal behavior detection can be roughly divided into two categories: internal threat detection based on machine learning and internal threat detection based on deep learning.

[0064] Regarding machine learning-based methods, for example, hidden Markov models (HMMs) are used for internal threat detection. HMMs are used to analyze user behavior sequences and extract normal user behavior patterns, and to identify abnormal behaviors that deviate significantly from normal behavior patterns. This model can effectively learn normal user behavior patterns from sequence data, but as the number of states increases, the amount of model calculations also increases, and the number of states also affects the final effect of the model. Another example: a detection framework based on multi-granularity user operation statistical features. This framework applies different machine learning methods to user operation statistical features of different granularities (sessions, days, weeks). Experiments show that coarse-grained features can reflect behavioral information over a longer time range than fine-grained features, but fine-grained features can detect abnormal behaviors faster. However, since machine learning-based methods require a lot of manual work related to feature engineering, it is time-consuming and difficult to select appropriate features, resulting in low detection efficiency.

[0065] Regarding deep learning, with the rapid development of deep learning, the ability of deep neural networks to automatically learn and extract deep-level features has provided a new research direction for internal threat detection. These can be roughly divided into usage statistical features and usage behavior sequence features.

[0066] Using statistical features: For example, an existing internal threat detection method based on a deep learning model is used to detect abnormal behavior. This method divides a user's day into four periods, counts all the user's operations in a day, and trains a deep neural network for each user to detect abnormal user behavior. Another example is a regression model based on LSTM, which avoids training a model for each user by combining the user identity id. Another example is an attribute classification internal threat detection method based on a long short-term memory recurrent neural network (LSTM-RNN). This method consists of multiple components, aggregates and counts event types as features, introduces principal component analysis to reduce feature dimensions, uses LSTM-RNN to generate a classifier to classify user attribute features, and finally calculates the anomaly score based on the classification results. Another example is a method based on LSTM autoencoder to implement an unsupervised user abnormal behavior detection model. This method models user behavior based on the statistical features of session activities and attribute category features such as user roles and departments, thereby identifying abnormal data points. This method solves the problem of low detection sensitivity to a certain extent through fine-grained statistical features.

[0067] Use behavior sequence features: For example, a role-based classification LSTM model detects malicious behavior by learning the behavior patterns of different users. Among them, eight users are assigned a fixed role respectively, and the role id and user behavior sequence are bound during LSTM training. Experiments have shown that LSTM can effectively identify the differences between different user behaviors. Another example is the use of the LSTM-CNN framework to detect internal threats. The framework first trains an LSTM feature extractor to extract user behavior sequence features, and then splices the output of the hidden layer of the LSTM into a fixed-length vector and sends it to the CNN classifier for anomaly detection. However, this method does not take into account the impact of different behaviors on anomaly detection. Therefore, the prior art has proposed an LSTM model based on the attention mechanism to detect internal threats. The model uses the attention mechanism to determine which behavior operations have a greater impact on anomaly detection.

[0068] Coarse-grained aggregation methods such as statistical features tend to ignore abnormal behaviors in a shorter period of time, and have the problem of low sensitivity in internal threat detection. Although methods using behavioral sequence features can solve the coarse-grained problem, such methods do not take into account the inconsistencies in behavioral habits among different users and ignore the differences in behavioral habits among different users.

[0069] Therefore, based on the idea of ​​combining the two types of features, this application proposes an internal threat detection method based on user historical behavior and attention mechanism, so that it can solve the coarse-grained problem while identifying the differences in behavior habits between different users. Specific embodiments are as follows.

[0070] Example 1

[0071] Figure 1 A schematic diagram of the steps of an abnormal behavior detection method based on behavior and attention mechanism according to an embodiment of the present application is shown in FIG. Figure 2 A network diagram of an abnormal behavior detection method based on behavior and attention mechanism according to an embodiment of the present application is shown in FIG.

[0072] like Figure 1 As shown, the abnormal behavior detection method based on behavior and attention mechanism in the embodiment of the present application specifically includes the following steps:

[0073] S101: Obtain user behavior, and extract behavior sequence features and behavior statistical features.

[0074] In order to solve the problem of low detection sensitivity of coarse-grained statistical feature analysis methods, user behavior is used to represent when and where a user performs a certain operation. At the same time, all relevant operations of the user in a day are represented as a user behavior sequence, and the LSTM model is used to extract deep user behavior sequence feature information.

[0075] In order to learn the differences in behavioral habits between different users, the statistical characteristics of user historical behaviors are combined with the attention mechanism, so that the model can learn the differences between different user behaviors and obtain behavioral statistical feature information.

[0076] S102: Fusing the behavior sequence features and the behavior statistical features to obtain the behavior fusion features.

[0077] The final effect is improved by integrating different forms of behavior sequence features and behavior statistical features. Examples of sequence features and statistical features are as follows:

[0078] Sequence features are expressed in the form of [0,1,4,5,9,34,52,…,45], where each number represents a behavior.

[0079] Statistical features are expressed in the form of [34, 2, 88, 99, 77, 8, …, 111]. Each number represents the number of times the corresponding behavior occurs. For example, 34 means that behavior 0 occurs 34 times.

[0080] However, usually, the numbers of behavior sequence features and behavior statistical features have different meanings. For example, the same 1 represents the behavior in the former and the number of times the behavior occurs in the latter. Therefore, they have different meanings and cannot be directly multiplied.

[0081] Therefore, it is necessary to fuse the behavior sequence features and behavior statistical features to obtain behavior fusion features.

[0082] This application takes into account that the length of the statistical feature vector is fixed, while the length of the sequence feature vector is variable, and vector concatenation cannot be performed directly. The feature fusion process specifically includes:

[0083] First, different behaviors of users are numbered, and a behavior number sequence arranged based on time is obtained according to the user behaviors, namely, the behavior sequence feature.

[0084] Then, the multiple behavior sequence features are lengthened or shortened to obtain multiple behavior sequence features with standard length values.

[0085] Specifically,

[0086] Compare the length of the behavior sequence feature with the calibration length; use the number 0 to supplement the behavior sequence that is shorter than the calibration length; the number 0 represents meaninglessness; or, truncate the behavior sequence number of the behavior sequence feature that is longer than the calibration length.

[0087] Secondly, corresponding to the user's behavior number sequence, count the number of user behaviors corresponding to each behavior number to obtain the corresponding behavior statistical sequence, that is, the behavior statistical feature; replace each statistical value n of the behavior statistical feature with 1 / e^(-n) to obtain a new behavior statistical feature;

[0088] Finally, each behavior of the behavior sequence feature is numbered and concatenated into a new behavior statistical feature to obtain the behavior fusion feature.

[0089] Figure 3 A schematic diagram of the feature fusion process of the abnormal behavior detection method according to an embodiment of the present application is shown in FIG.

[0090] In the specific implementation, Figure 3 As shown, multiple behavior sequences, such as behavior sequence 1 and behavior sequence 2, can be obtained through detection according to user behavior.

[0091] Process 1: First, number each behavior, such as booting is 1, opening a file is 2, etc., and then use the numbers to replace the behaviors to form a digital sequence to obtain a behavior number sequence arranged based on time, that is, the behavior sequence feature.

[0092] Process 2: Then, set the standard length value of the behavior sequence feature to 200, add 0 to the end of the behavior sequence that is less than 200 in length, and 0 represents meaninglessness; and cut off the excess part of the behavior sequence that exceeds 200 in length.

[0093] Process 3: Then, count the number of times each user's behavior occurred in the past week. For example, if a user browses the web 5 times and the behavior number of browsing the web is 3, then the third data point of the user's statistical data in the past week is 5.

[0094] Process 4, taking behavior sequence 1 as an example, replace the original value n with 1 / e^(-n) for each number of the behavior statistical feature. The larger n is, the more frequent the behavior is, and the lower the probability of abnormal behavior is. Finally, copy the behavior sequence feature 200 times and add them to each value in the behavior sequence feature. In this way, the number of each behavior in the behavior sequence feature can correspond to the data of the statistical feature. Different user statistical data will get different data for different users even with the same behavior number. Behavior sequence 2 uses the same steps as behavior sequence 1.

[0095] S103: Input the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model.

[0096] Specifically include:

[0097] The behavior fusion features are sequentially input into the attention layer based on user historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier; abnormal behavior detection is performed through the fully connected layer classifier.

[0098] Preferably, before the behavior fusion features are sequentially input into the attention layer based on user historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier, it also includes: inputting the behavior sequence features into the behavior feature extraction layer based on LSTM for further feature extraction.

[0099] S104: Input the user behavior to be detected into the abnormal behavior detection model to obtain the abnormal behavior detection result.

[0100] like Figure 2 The above is the overall design architecture of the model proposed in this application. It mainly includes three layers: a behavior feature extraction layer based on LSTM, an attention layer based on user historical behavior, and a behavior feature evolution layer based on Bi-LSTM.

[0101] 1) LSTM-based behavioral feature extraction layer.

[0102] In order to achieve fine-grained detection, it is necessary to extract the relationships between the various behaviors in the user behavior sequence and analyze them. LSTM has strong processing and analysis capabilities for time series data and can extract deep sequence information in user behavior sequences.

[0103] Set user u k The behavior sequence on day j is denoted as S k,j =[x0,x1,x2,…,x t-1 ,x t ], (1≤t≤T), where T represents the sequence length. t Represents the hidden layer state output at time t.

[0104] Recurrent Neural Network (RNN) makes up for the deficiency of traditional neural network that it cannot learn time sequence features. However, RNN cannot solve the long-term dependency problem in input. LSTM solves the long-term dependency problem by introducing a gate mechanism to control the flow of feature information. LSTM consists of multiple gates: forget gate, input gate and output gate.

[0105] The description equation of LSTM is:

[0106] i t =σ(W i e t +W i h t-1 +b i );

[0107] f t =σ(W f e t +W f h t-1 +b f );

[0108] o t =σ(W o e t +W o h t-1 +b o );

[0109] g t =tanh(W g e t +W g h t-1 +b g );

[0110] c t =f t ⊙c t-1 +i t ⊙g t ;

[0111] h t =o t ⊙tanh(c t );

[0112] Among them, e t is the input behavior sequence x at time t t Embedded representation of t is the forget gate, which is used to indicate c t-1 Which feature information in c t Receive; tis the input gate, which controls g t Which feature information is used to update c t ; g t It is input by t and the hidden state output h of the previous time step t-1 Calculated; o t is the output gate; h t is the hidden layer state output at time t; W and b represent the weight matrix and bias value, respectively, which are randomly initialized and learned and adjusted during the training period.

[0113] 2) Attention layer based on user historical behavior.

[0114] A single LSTM cannot effectively learn the differences in behavioral patterns between different users, but the attention mechanism can achieve differential attention to different local behaviors based on different additional information. k Count the number of times each behavior has occurred recently C k =[c0,c1,c2,…,c n-1 ,c n ], where n represents the number of the user behavior.

[0115] The attention mechanism is used to enable the model to learn the differences between different user behaviors from the statistical characteristics of the user's historical behavior, where e k,h is the statistical value c of each behavior of user k n Take the negative exponent of e, that is It means that the less frequently performed operations in the user's past history should attract more attention. a is the weighted matrix of the attention layer. The attention matrix a is obtained by calculation t , and combine it with each hidden state output h of LSTM t Calculate and get the output h of the attention layer t,a .in:

[0116] e k,h =exp(-C k );

[0117]

[0118] h t,a =a t h t .

[0119] 3) Behavioral feature evolution layer based on Bi-LSTM.

[0120] In order to further improve the accuracy of the model, it is necessary to model the behavior patterns of individual users. Bi-LSTM has the ability to learn more detailed contextual information from each behavior feature and can model user behavior patterns from the evolution of behavior features.

[0121] Figure 4 Graph 1 shows a network structure diagram of a behavior feature evolution layer based on Bi-LSTM according to an abnormal behavior detection method according to an embodiment of the present application.

[0122] like Figure 4 As shown in the figure, Bi-LSTM consists of two LSTM parts: forward LSTM and backward LSTM. k =[h 0,a ,h 1,a ,…,h t,a ] is sent as input to the Bi-LSTM, and the hidden state output h of the forward LSTM is obtained at time t t,f And the hidden state output h of the backward LSTM t,b .

[0123] Where: h t,f =LSTM f (W,h t-1,f );

[0124] h t,b =LSTM b (W,h t-1,b ).

[0125] And h t,f and h t,b It constitutes the hidden state output of Bi-LSTM at time t, that is, h t =[h t,f ,h t,b ]. Finally, the hidden state output h_t of the last moment of Bi-LSTM is used as the result of learning the evolution of user behavior sequence, and is sent to the fully connected layer classifier for internal threat detection.

[0126] in:

[0127]

[0128] v k is the fully connected output, W k , b k is the parameter of full connection training, and the SoftMax function is used for K classification. Finally, the cross entropy is used as the loss function to train and update the weights of the entire model.

[0129] The present application has demonstrated through experiments that the abnormal behavior detection scheme of the present application achieves a detection effect with higher precision and accuracy.

[0130] In order to evaluate the effectiveness of this method, experiments were conducted on the CMU-CERT internal threat open source dataset. The experimental results show that this method is 3.1% to 6.3% better than the baseline model method and can detect internal threats in different user behaviors in a fine-grained manner.

[0131] Specifically, we first describe the dataset and data preprocessing methods used, then introduce the experimental process of model training, and finally present the experimental results and explain them.

[0132] 1. Dataset and preprocessing.

[0133] The version of the CERT internal threat dataset selected for the experiment is r4.2. The dataset contains 1,000 users' activity records in the company for 17 months, of which 70 users have conducted internal threat activities. The dataset contains 5 types of log data: login / logout, email, device usage, file operations, and web browsing. This experiment preprocesses each type of log. Because the operations of each user during working hours and after get off work are quite different, and the probability of abnormal behavior when a user logs into another person's PC is higher, a day is divided into two time periods: working hours and non-working hours. The operation of a user logging into his or her own frequently used PC and the same operation of logging into another person's PC are regarded as different types of behavior. Finally, all the behaviors of each user in a day are organized into a behavior sequence in chronological order.

[0134] Table 1 lists all the behavior types defined for users. The data processing process of this experiment retains the weekend data because abnormal behavior may still occur on weekends. The operation data generated by these 1,000 users in 17 months totaled 32,770,227 lines of logs. This includes 7,323 abnormal activity logs generated by expert simulation, representing three scenarios of internal threats. After preprocessing, a total of 330,452 user behavior sequence records were generated (1,294 of which contained abnormal behaviors), and the number of times each behavior sequence record occurred in the past week was counted as the user's historical behavior data. This experiment divides the data into training and test sets. The training set (70%) is used for weight learning and hyperparameter adjustment, and the test set (30%) is used to evaluate the performance of the model.

[0135]

[0136] Table 1: User behavior types

[0137] 2. About the experimental process.

[0138] The model in this paper was implemented using the Pytorch deep learning framework. During the experiment, in order to obtain the best detection model, the enumeration method was used to tune different hyperparameters. The number of hidden layers (1 to 3) and the number of units in each hidden layer (64 to 256) were tuned in the LSTM layer and Bi-LSTM layer, and different batch sizes (20 to 128) and epoch sizes (10 to 30) were adjusted, and the learning rate was set to 0.001. Finally, Adam was selected as the optimizer, cross entropy loss was used as the loss function, and the batch size was set to 128 and the epoch size was set to 30. The detailed parameters of the final model are shown in Table 2.

[0139]

[0140] Table 2: Model parameter table

[0141] 3. Experimental results.

[0142] The experiment selected the attention-based LSTM detection model and the MBS detection model as comparison models. The former is also a model method that combines attention with LSTM, while the latter is a model method that considers both statistical features and sequence features. In addition, the ROC (Receiver Operating Characteristic) curve and AUC (Area-Under-Curve) are selected as performance evaluation indicators because there is a serious imbalance between abnormal data and normal data in the CERT dataset. Even if the model judges any input as normal, its model's precision and recall will be very high.

[0143] Figure 5 The average loss and AUC value of the model in this paper are evaluated on the test set data at different epoch rounds. The best AUC value was achieved when the average loss was 0.012031 in 30 epochs.

[0144] Figure 6 The ROC curves of the attention-based LSTM detection model, the MBS detection model, and the proposed model are shown. It is clear that the proposed model has achieved very satisfactory results, and from the ROC curves, it can be seen that each model has a similar trajectory, but the proposed model is slightly better than the other two comparison models. Specifically, the AUC value of the proposed model reached 0.9915, which is a strong indication of the effectiveness of the model.

[0145] In order to perform fine-grained detection and capture individual user behavior patterns, this application proposes an internal threat detection method based on user historical behavior and attention mechanism. By using ABUHB, the model method can learn the differences between different user behaviors, and then the Bi-LSTM model is used to learn the evolution of different users' behavior patterns to further improve the detection effect. Experiments were conducted on the CERT internal threat public dataset released by CMU. The experimental results show that the abnormal behavior detection method proposed in this application can not only successfully detect internal threats, but also outperform other comparative model methods. It can identify the differences in behavioral habits between different users while solving coarse-grained problems, and ultimately achieve higher precision and accuracy in internal threat detection.

[0146] Therefore, the abnormal behavior detection method based on behavior and attention mechanism of the embodiment of the present application is adopted to obtain user behavior, and extract behavior sequence features and behavior statistical features; fuse behavior sequence features and behavior statistical features to obtain behavior fusion features; input the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; input the user behavior to be detected into the abnormal behavior detection model to obtain abnormal behavior detection results. This application uses a technical means combining user historical behavior with an attention mechanism to realize the recognition of different user behavior patterns, and ultimately realizes a detection model with higher precision and accuracy to reduce the threats and losses caused by abnormal behavior of internal users to some organizations or enterprises.

[0147] Example 2

[0148] This embodiment provides an abnormal behavior detection system based on behavior and attention mechanism. For details not disclosed in the abnormal behavior detection system based on behavior and attention mechanism of this embodiment, please refer to the specific implementation content of the abnormal behavior detection method based on behavior and attention mechanism in other embodiments.

[0149] Figure 7 A structural diagram of an abnormal behavior detection system based on behavior and attention mechanism according to an embodiment of the present application is shown in FIG.

[0150] like Figure 7 As shown, the abnormal behavior detection system based on behavior and attention mechanism of the embodiment of the present application specifically includes a feature extraction unit 10, a feature fusion unit 20, a model training unit 30 and an abnormal behavior detection unit 40.

[0151] Specifically,

[0152] Feature extraction unit 10: used to obtain user behavior and extract behavior sequence features and behavior statistical features.

[0153] In order to solve the problem of low detection sensitivity of coarse-grained statistical feature analysis methods, user behavior is used to represent when and where a user performs a certain operation. At the same time, all relevant operations of the user in a day are represented as a user behavior sequence, and the LSTM model is used to extract deep user behavior sequence feature information.

[0154] In order to learn the differences in behavioral habits between different users, the statistical characteristics of user historical behaviors are combined with the attention mechanism, so that the model can learn the differences between different user behaviors and obtain behavioral statistical feature information.

[0155] Feature fusion unit 20: used to fuse sequence features and statistical features to obtain behavior fusion features.

[0156] The final effect is improved by integrating different forms of behavior sequence features and behavior statistical features. Examples of sequence features and statistical features are as follows:

[0157] Sequence features are expressed in the form of [0,1,4,5,9,34,52,…,45], where each number represents a behavior.

[0158] Statistical features are expressed in the form of [34, 2, 88, 99, 77, 8, …, 111]. Each number represents the number of times the corresponding behavior occurs. For example, 34 means that behavior 0 occurs 34 times.

[0159] However, usually, the numbers of behavior sequence features and behavior statistical features have different meanings. For example, the same 1 represents the behavior in the former and the number of times the behavior occurs in the latter. Therefore, they have different meanings and cannot be directly multiplied.

[0160] Therefore, it is necessary to fuse the behavior sequence features and behavior statistical features to obtain behavior fusion features.

[0161] This application takes into account that the length of the statistical feature vector is fixed, while the length of the sequence feature vector is variable, and vector concatenation cannot be performed directly. The feature fusion process specifically includes:

[0162] First, different behaviors of users are numbered, and a behavior number sequence arranged based on time is obtained according to the user behaviors, namely, the behavior sequence feature.

[0163] Then, the multiple behavior sequence features are lengthened or shortened to obtain multiple behavior sequence features with standard length values.

[0164] Specifically,

[0165] Compare the length of the behavior sequence feature with the calibration length; use the number 0 to supplement the behavior sequence that is shorter than the calibration length; the number 0 represents meaninglessness; or, truncate the behavior sequence number of the behavior sequence feature that is longer than the calibration length.

[0166] Secondly, corresponding to the user's behavior number sequence, count the number of user behaviors corresponding to each behavior number to obtain the corresponding behavior statistical sequence, that is, the behavior statistical feature; replace each statistical value n of the behavior statistical feature with 1 / e^(-n) to obtain a new behavior statistical feature;

[0167] Finally, each behavior of the behavior sequence feature is numbered and concatenated into a new behavior statistical feature to obtain the behavior fusion feature.

[0168] Model training unit 30: used to input the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model.

[0169] Specifically include:

[0170] The behavior fusion features are sequentially input into the attention layer based on user historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier; abnormal behavior detection is performed through the fully connected layer classifier.

[0171] Preferably, before the behavior fusion features are sequentially input into the attention layer based on user historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier, it also includes: inputting the behavior sequence features into the behavior feature extraction layer based on LSTM for further feature extraction.

[0172] Abnormal behavior detection unit 40: used to input the user behavior to be detected into the abnormal behavior detection model to obtain the abnormal behavior detection result.

[0173] Using the abnormal behavior detection system based on behavior and attention mechanism of the embodiment of the present application, the feature extraction unit 10 obtains user behavior and extracts behavior sequence features and behavior statistical features; the feature fusion unit 20 fuses the behavior sequence features and behavior statistical features to obtain behavior fusion features; the model training unit 30 inputs the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; the abnormal behavior detection unit 40 inputs the user behavior to be detected into the abnormal behavior detection model to obtain abnormal behavior detection results. This application uses a technical means combining user historical behavior with the attention mechanism to realize the recognition of different user behavior patterns, and ultimately realizes a detection model with higher precision and accuracy to reduce the threats and losses caused by abnormal behavior of internal users to some organizations or enterprises.

[0174] Example 3

[0175] This embodiment provides an abnormal behavior detection device based on behavior and attention mechanism. For details not disclosed in the abnormal behavior detection device based on behavior and attention mechanism of this embodiment, please refer to the specific implementation content of the abnormal behavior detection method or system based on behavior and attention mechanism in other embodiments.

[0176] Figure 8 Schematic diagram of the structure of an abnormal behavior detection device 400 based on behavior and attention mechanism according to an embodiment of the present application is shown.

[0177] like Figure 8 As shown, the abnormal behavior detection device 400 includes:

[0178] Memory 402: used to store executable instructions; and

[0179] Processor 401: used to connect with memory 402 to execute executable instructions to complete the motion vector prediction method.

[0180] Those skilled in the art will understand that Figure 8 This is only an example of the abnormal behavior detection device 400 and does not constitute a limitation of the abnormal behavior detection device 400. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the abnormal behavior detection device 400 may also include input and output devices, network access devices, buses, etc.

[0181] The processor 401 (Central Processing Unit, CPU) may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), field-programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor 401 may also be any conventional processor, etc. The processor 401 is the control center of the abnormal behavior detection device 400, and uses various interfaces and lines to connect various parts of the entire abnormal behavior detection device 400.

[0182] The memory 402 can be used to store computer-readable instructions. The processor 401 implements various functions of the abnormal behavior detection device 400 by running or executing the computer-readable instructions or modules stored in the memory 402 and calling the data stored in the memory 402. The memory 402 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the abnormal behavior detection device 400, etc. In addition, the memory 402 can include a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM) or other non-volatile / volatile storage devices.

[0183] If the module integrated in the abnormal behavior detection device 400 is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also instruct the relevant hardware to complete it through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when the computer-readable instructions are executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented.

[0184] Example 4

[0185] This embodiment provides a computer-readable storage medium on which a computer program is stored; the computer program is executed by a processor to implement the abnormal behavior detection method based on behavior and attention mechanism in other embodiments.

[0186] The abnormal behavior detection device and computer storage medium based on behavior and attention mechanism in the embodiment of the present application obtain user behavior, and extract behavior sequence features and behavior statistical features; fuse behavior sequence features and behavior statistical features to obtain behavior fusion features; input the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; input the user behavior to be detected into the abnormal behavior detection model to obtain abnormal behavior detection results. The present application uses a technical means combining user historical behavior with an attention mechanism to realize the recognition of different user behavior patterns, and ultimately realizes a detection model with higher precision and accuracy to reduce the threats and losses caused by abnormal behavior of internal users to some organizations or enterprises.

[0187] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0188] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0189] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0190] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0191] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0192] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0193] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0194] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting abnormal behavior based on behavior and attention mechanism, characterized in that: The following steps are involved: Obtain user behavior and extract behavior sequence features and behavior statistical features; Extract behavior sequence features and behavior statistical features, including: The different behaviors of users are digitally numbered, and a behavior number sequence arranged based on time is obtained according to the user behaviors, namely, the behavior sequence feature; Lengthening or shortening the plurality of behavior sequence features to obtain a plurality of behavior sequence features of standard length values; Corresponding to the user's behavior number sequence, counting the number of user behaviors corresponding to each behavior number to obtain a corresponding behavior statistical sequence, i.e., a behavior statistical feature; Each statistical value n of the behavior statistical feature is replaced by 1 / e^(-n) to obtain a new behavior statistical feature; Number each behavior of the behavior sequence feature and concatenate a new behavior statistical feature to obtain a behavior fusion feature; Inputting the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; The user behavior to be detected is input into the abnormal behavior detection model to obtain the abnormal behavior detection result.

2. The abnormal behavior detection method according to claim 1, characterized in that: The step of lengthening or shortening the plurality of behavior sequence features to obtain a plurality of behavior sequence features of standard length values ​​specifically includes: comparing the length of the behavior sequence feature with a calibrated length; Use the number 0 to supplement the behavior sequence that is less than the calibrated length; the number 0 represents no meaning; Alternatively, the behavior sequence numbers of the behavior sequence features that are larger than the calibrated length are truncated.

3. The abnormal behavior detection method according to claim 1, characterized in that: The behavior fusion feature is input into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model, specifically including: The behavior fusion features are sequentially input into the attention layer based on the user's historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier; Abnormal behavior detection is performed through a fully connected layer classifier.

4. The abnormal behavior detection method according to claim 3, characterized in that: Before sequentially inputting the behavior fusion features into the attention layer based on the user's historical behavior, the behavior feature evolution layer based on Bi-LSTM, and the fully connected layer classifier, the process further includes: The behavior sequence features are input into the LSTM-based behavior feature extraction layer for further feature extraction.

5. The abnormal behavior detection method according to claim 4, characterized in that: The description equation of the LSTM is: i t =σ(W i e t +W i h t-1 +b i ); f t =σ(W f e t +W f h t-1 +b f ); you are t σ(W o e t +W o h t-1 +b o )4 g t =tanh(W g e t +W g h t-1 +b g ); c t =f t ⊙c t-1 +i t ⊙g t ; h t =o t ⊙tanh(c t ); Among them, e t is the input behavior sequence x at time t t Embedded representation of t is the forget gate, which is used to indicate c t-1 Which feature information in c t Receive; t is the input gate, which controls g t Which feature information is used to update c t ; g t It is input by t and the hidden state output h of the previous time step t-1 Calculated; o t is the output gate; h t is the hidden layer state output at time t; W and b represent the weight matrix and bias value, respectively, which are randomly initialized and learned and adjusted during the training period.

6. An abnormal behavior detection system based on behavior and attention mechanism, characterized in that: Specifically include: Feature extraction unit: used to obtain user behavior and extract behavior sequence features and behavior statistical features; Extract behavior sequence features and behavior statistical features, including: The different behaviors of users are digitally numbered, and a behavior number sequence arranged based on time is obtained according to the user behaviors, namely, the behavior sequence feature; Lengthening or shortening the plurality of behavior sequence features to obtain a plurality of behavior sequence features of standard length values; Corresponding to the user's behavior number sequence, counting the number of user behaviors corresponding to each behavior number to obtain a corresponding behavior statistical sequence, i.e., a behavior statistical feature; Feature fusion unit: used to replace each statistical value n of the behavior statistical feature with 1 / e^(-n) to obtain a new behavior statistical feature; number each behavior of the behavior sequence feature and concatenate a new behavior statistical feature to obtain a behavior fusion feature; Model training unit: used for inputting the behavior fusion features into the LSTM network of the attention mechanism for training to obtain an abnormal behavior detection model; Abnormal behavior detection unit: used to input the user behavior to be detected into the abnormal behavior detection model to obtain the abnormal behavior detection result.

7. The abnormal behavior detection system according to claim 6, characterized in that: The feature fusion unit is specifically used for: Each statistical value n of the behavior statistical feature is replaced by 1 / e^(-n) to obtain a new behavior statistical feature; Each behavior of the behavior sequence feature is numbered and then concatenated into a new behavior statistical feature to obtain a behavior fusion feature.

8. An abnormal behavior detection device based on behavior and attention mechanism, characterized in that: include: Memory: used to store executable instructions; as well as Processor: used to connect to the memory to execute the executable instructions to complete the abnormal behavior detection method based on behavior and attention mechanism as described in any one of claims 1-5.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon; the computer program is executed by a processor to implement the abnormal behavior detection method based on behavior and attention mechanism as described in any one of claims 1-5.

Images