A multi-factor network abnormal behavior detection method

Abstract

The present invention discloses a multi-factor network abnormal behavior detection method, which belongs to the field of cyberspace security technology. The present invention combines variational autoencoders and generative adversarial networks, integrates multi-factor network dynamic and static information of user information, device information, device status, user authority, account login, access object, and behavior attributes, and can effectively reconstruct normal behavior in the network and detect abnormal behavior in the network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a multi-factor network abnormal behavior detection method. Background Art

[0002] Training deep neural networks usually requires a large amount of labeled data so that the network can learn the feature representations required for visual understanding tasks. However, in many practical scenarios, only a limited amount of labeled data is available for training the network, which greatly limits the applicability of deep neural networks. Due to the small number of labeled samples in the anomaly node detection task, supervised methods are not suitable for attribute network anomaly node detection. Using unsupervised or semi-supervised deep learning methods for anomaly detection has gradually become a research hotspot in the field of network abnormal behavior detection. Due to its unsupervised nature, anomaly detection plays a core role in network security, especially in the detection of unknown attacks.

[0003] Unsupervised graph neural network abnormal node detection can use the original unlabeled sample data to learn the low-dimensional expression of the attribute network, and use the error between the reconstructed data and the original data to detect abnormal nodes. Autoencoders are neural networks that can be learned unsupervised and are composed of multiple encoding functions and decoding functions. They are widely used in natural language processing, computer vision, and speech recognition. The generator of GAN converts random noise into generated data similar to real data by learning the distribution of real data, and has the ability to model complex high-dimensional data distribution. The general steps for using GAN for anomaly detection are to first train GAN with normal sample data so that the generator can fully learn the real distribution of normal data. At this time, GAN has the ability to reconstruct normal data samples. When the input data is an abnormal sample that has never been seen before, the sample reconstructed by GAN will show obvious differences from the original input sample. When this difference exceeds a certain range, the input data is judged to be abnormal.

[0004] Unsupervised or semi-supervised deep generative anomaly detection methods represented by variational autoencoder (VAE) and generative adversarial network (GAN) structures can complete training using unlabeled normal data, breaking through the restrictions on data annotation and positive and negative sample balance requirements. VAE uses the reconstruction probability of distribution parameters as anomaly measurement and can detect input data of different structures. However, due to the lack of restriction guidance during VAE training, its robustness is poor and it is prone to overfitting. GAN generates approximate data by learning the distribution of normal sample data. When abnormal samples are input into the trained GAN, there is a large difference between the generated samples and the input samples. This difference can be used as a basis for anomaly detection, but due to the lack of autoencoders in GAN, it is difficult to detect anomalies in the early stages of training. Traditional GAN ​​uses f-divergence as the objective function for training, and there are problems such as being unable to complete training due to "gradient instability" ("gradient vanishing" or "gradient explosion") and generating a single sample due to "mode collapse". Summary of the invention

[0005] To solve the above problems, the present invention proposes a multi-factor network abnormal behavior detection method. This method uses VAE to perform encoding-decoding operations to reconstruct the input data; at the same time, an encoder is added to enable the hidden layer vector to learn the expression of normal data, and a transformation matrix is ​​added to the input network to enable VAE to learn the transformation of the network; and the discrimination results of WGAN are used for adversarial training, and Wasserstein distance is used as the model loss function, in the hope that the model training will be more robust and avoid problems such as "gradient instability" and "mode collapse". By defining the loss function for training, the best effect is achieved and the abnormal network behavior detection score is obtained.

[0006] The object of the present invention is achieved in that:

[0007] A multi-factor network abnormal behavior detection method comprises the following steps:

[0008] Step 1, obtain the data matrix X, the transformation matrix W, and the transformed data matrix X';

[0009] Step 2: Input X, W, and X' into encoder GE1 to obtain the encoded matrix G E1 (X), G E1 (W), G E1 (X'); The encoder GE1 is composed of a two-layer neural network, and the activation function is a linear rectification function ReLU, which is used to calculate the low-dimensional mean and variance of the input data, sample from the latent variable space, and obtain the intermediate layer variables; G E1 (X), G E1(W) are X and W through G E1 The hidden variables z, θ;

[0010] Step 3, G E1 (X) After decoder G D , generate the reconstruction matrix of X In addition, G E1 (X) and G E1 (X′) passes through the decoder to generate the transformation matrix W′; the decoder G D It is implemented by a two-layer neural network, and the activation function is the linear rectification function ReLU, which is used to restore the data from low dimension to high dimension and recover the new data;

[0011] Step 4: Reconstruct the matrix The transformation matrix W' is input to the encoder G E2 , get the transformation matrix hidden variables z', θ'; encoder G E2 It consists of two layers of neural networks, and the activation function is the linear rectification function ReLU, which is used to reduce the dimension of the data again to obtain hidden variables;

[0012] Step 5: (X, G E1 (X)) and the reconstruction matrix Input the discriminator Dd for training; the discriminator Dd plays the role of the discriminator in GAN and is implemented by a convolutional neural network to determine the reconstruction matrix The truth or falsity of the data compared to the original input data;

[0013] Step 6: Calculate the multi-factor anomaly detection score Score according to the loss function trained in step 5 to obtain the detection result.

[0014] Furthermore, the data matrix X includes multi-dimensional information, which can be expressed as:

[0015] X=X 1 ,X 2 ,...,X i ,...,Xn

[0016] Where i = 1, 2, ..., n, n is the total number of dimensions;

[0017] Multi-dimensional information includes some or all of the following information:

[0018] User information: user ID, user credentials, user attributes, roles;

[0019] Device information: device ID number, device location, device type, device IP address, device MAC address, device certificate, device fingerprint, device ID, log type;

[0020] Device status: installed operating system version, application software version, patch status, network location;

[0021] User permissions: device IP, log type, account, application permissions, operation method, operator;

[0022] Account login: source IP, source device, device IP, log type, account, login method, login status;

[0023] Access object: attributes, categories and levels of resources to be accessed, applications, data, IP addresses of access, and MAC addresses of access;

[0024] Behavioral attributes: user access behavior, operating habits, access time, location, device analysis, source IP address, access frequency, and usage pattern deviation.

[0025] Furthermore, the loss function of training in step 5 is:

[0026] L loss =εLrec+∈Lz+μLGAN+πLtrans

[0027] Among them, ε, ∈, μ, π are weights, and their sum is 1; L rec is the encoder G E1 and decoder G D The loss function is the reconstruction error between the original data and the reconstructed data:

[0028]

[0029] Among them, α i represents the weight, |||| 1 represents the 1-norm;

[0030] L Z After the second encoder G E2 The encoding loss function, whose goal is to make the encoder G E1 The intermediate variable z and the reconstructed variable are obtained through the encoder G E2 The subsequent hidden layer representations are similar; L Z It is expressed as:

[0031]

[0032] Among them, β i represents the weight, |||| 2 represents the 2-norm;

[0033] L GAN is the loss function of GAN, which consists of the decoder G of VAED and the discriminator D d Composition, the decoder G of VAE D As the generator of GAN; L GAN It is expressed as:

[0034]

[0035] Among them, γ i represents the weight, Dd(X i , G E1 (Xi)) is the input (X i , G E1 (Xi)) is the value of the discriminator after, and Dd is the original value of the discriminator;

[0036] L trans Is the loss function of the transformation matrix:

[0037]

[0038] Among them, δ and ρ are weights, and their sum is 1.

[0039] Furthermore, the multi-factor anomaly detection score Score is composed of three parts, namely the improved VAE-GAN reconstruction error, the improved VAE-GAN discrimination error, and the transformation matrix error. The Score is expressed as:

[0040]

[0041] Among them, τ, ω is the weight, and its sum is 1.

[0042] The beneficial effects of the present invention are:

[0043] 1. The present invention fully considers the user information, device information, device status, user authority, account login, access object, behavior attributes and other multi-factor behavior attribute information of users in the network to perform network anomaly detection.

[0044] 2. The present invention can identify anomalies in multi-factor network information, breaking the limitation that labeled data is required for training. It is an innovative method in the field of multi-factor network behavior detection.

[0045] 3. In order to learn normal sub-features as much as possible, the present invention designs a new loss function, which integrates the reconstruction loss of the transformation network, the difference of the latent variables of the transformation network, the reconstruction error of the original data, the difference of the latent variables of the input data, and the discrimination error using the Wasserstein distance. It takes multiple aspects into consideration to improve the accuracy of anomaly detection.

[0046] 4. Based on the loss function during training, the present invention proposes an anomaly detection scoring method. Input data with a score greater than a set threshold is judged as abnormal. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 It is a schematic diagram of the implementation principle of the multi-factor network abnormal behavior detection method in an embodiment of the present invention.

[0049] Figure 2 It is a flow chart of a method for detecting abnormal network behavior by multiple factors in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following text is only used to describe one or several specific embodiments of the present invention, and does not strictly limit the scope of protection of the specific claims of the present invention.

[0051] like Figure 1 and 2 As shown, a multi-factor network abnormal behavior detection method is implemented based on a multi-factor network data input module, a multi-factor anomaly detection module, an anomaly score calculation module and an anomaly determination module.

[0052] The method comprises the following steps:

[0053] Step 1, obtain the data matrix X, the transformation matrix W, and the transformed data matrix X′;

[0054] Step 2: Input X, W, and X′ into encoder GE1 to obtain the encoded matrix G E1 (X), G E1 (W), G E1 (X′); The encoder GE1 is composed of a two-layer neural network, and the activation function is the linear rectification function ReLU, which is used to calculate the low-dimensional mean and variance of the input data, sample from the latent variable space, and obtain the intermediate layer variables; G E1 (X), G E1 (W) are X and W through G E1 The hidden variables z, θ;

[0055] Step 3, G E1 (X) After decoder G D, generate the reconstruction matrix of X In addition, G E1 (X) and G E1 (X') passes through the decoder to generate the transformation matrix W'; the decoder G D It is implemented by a two-layer neural network, and the activation function is the linear rectification function ReLU, which is used to restore the data from low dimension to high dimension and recover the new data;

[0056] Step 4: Reconstruct the matrix The transformation matrix W' is input to the encoder G E2 , get the transformation matrix hidden variables z', θ'; encoder G E2 It consists of two layers of neural networks, and the activation function is the linear rectification function ReLU, which is used to reduce the dimension of the data again to obtain hidden variables;

[0057] Step 5: (X, G E1 (X)) and the reconstruction matrix Input the discriminator Dd for training; the discriminator Dd plays the role of the discriminator in GAN and is implemented by a convolutional neural network to determine the reconstruction matrix The truth or falsity of the data compared to the original input data;

[0058] Step 6: Calculate the multi-factor anomaly detection score Score according to the loss function trained in step 5 to obtain the detection result.

[0059] Among them, the data matrix X includes multi-dimensional information, expressed as:

[0060] X=X 1 , X 2 , ..., X 5

[0061] Multi-dimensional information includes some or all of the following information:

[0062] User information: user ID, user credentials, user attributes, roles;

[0063] Device information: device ID number, device location, device type, device IP address, device MAC address, device certificate, device fingerprint, device ID, log type;

[0064] Device status: installed operating system version, application software version, patch status, network location;

[0065] User permissions: device IP, log type, account, application permissions, operation method, operator;

[0066] Account login: source IP, source device, device IP, log type, account, login method, login status;

[0067] Access object: attributes, categories and levels of resources to be accessed, applications, data, IP addresses of access, and MAC addresses of access;

[0068] Behavioral attributes: user access behavior, operating habits, access time, location, device analysis, source IP address, access frequency, and usage pattern deviation.

[0069] In step 5, the loss function is as follows:

[0070] After encoder G E1 and decoder G D , calculate the reconstruction error between the original data and the reconstructed data as the loss function:

[0071] where α i =0.2

[0072] After the second encoder G E2 , encoding loss function L Z The goal is to make the encoder G E1 The intermediate variable z and the reconstructed variable are obtained through the encoder G E2 The subsequent hidden layer representation is as close as possible; L Z The definition is as follows:

[0073] where β i =0.2

[0074] VAE decoder G D and the discriminator D d Composed of GAN, where the decoder G of VAE D As the generator of GAN. The loss function is:

[0075] where γ i =0.2

[0076] Transform network loss:

[0077] Where δ=ρ=0.5

[0078] Therefore, the total loss function is:

[0079] L loss =0.3Lrec+0.2Lz+0.3LGAN+0.2Ltrans

[0080] The multi-factor anomaly detection score Score consists of three parts: the improved VAE-GAN reconstruction error, the improved VAE-GAN discrimination error, and the transformation network error. Score is defined as:

[0081]

[0082] In summary, the present invention combines variational autoencoders and generative adversarial networks, integrating multi-factor network dynamic and static information such as user information, device information, device status, user permissions, account login, access objects, and behavioral attributes, and can effectively reconstruct normal behaviors within the network and detect abnormal behaviors within the network.

Claims

1. A multi-factor network abnormal behavior detection method, characterized in that: The following steps are involved: Step 1, obtain the data matrix X, the transformation matrix W, and the transformed data matrix X'; Step 2: Input X, W, and X' into encoder G E1 , get the encoded matrix G E1 (X), G E1 (W), G E1 (X'); the encoder G E1 It consists of two layers of neural networks, and the activation function is the linear rectification function ReLU, which is used to calculate the low-dimensional mean and variance of the input data, sample from the latent variable space, and obtain the intermediate layer variables; G E1 (X), G E1 (W) are X and W through G E1 The hidden variables z, θ; Step 3, G E1 (X) After decoder G D , generate the reconstruction matrix of X In addition, G E1 (X) and G E1 (X') passes through the decoder to generate the transformation matrix W'; The decoder GD is implemented by a two-layer neural network, and the activation function is the linear rectification function ReLU, which is used to restore the data from low dimension to high dimension and recover the new data; Step 4: Reconstruct the matrix The transformation matrix W' is input to the encoder G E2 , and obtain the transformation matrix hidden variables z', θ'; the encoder GE2 consists of a two-layer neural network, and the activation function is the linear rectification function ReLU, which is used to reduce the dimension of the data again to obtain the hidden variables; Step 5: (X, G E1 (X)) and the reconstruction matrix Input the discriminator Dd for training; the discriminator Dd plays the role of the discriminator in GAN and is implemented by a convolutional neural network to determine the reconstruction matrix Compared with the truth or falsity of the original input data; the loss function of training is: L loss =εLrec+∈Lz+μLGAN+πLtrans Among them, ε, ∈, μ, π are weights, and their sum is 1; L rec is the encoder G E1 and decoder G D The loss function is the reconstruction error between the original data and the reconstructed data: Among them, α i represents the weight, ‖||1 represents 1-norm; L Z After the second encoder G E2 The encoding loss function, whose goal is to make the encoder G E1 The intermediate variable z and the reconstructed variable are obtained through the encoder G E2 The subsequent hidden layer representations are similar; L Z It is expressed as: Among them, β i represents the weight, ‖||2 represents the 2-norm; L GAN is the loss function of GAN, which consists of the decoder G of VAE D and the discriminator Dd, the decoder G of VAE D As the generator of GAN; L GAN It is expressed as: Among them, γ i represents the weight, Dd(X i , G E1 (Xi)) is the input (X i , G E1 (Xi)) after the discriminator, for The original value obtained by inputting the discriminator; L trans Is the loss function of the transformation matrix: Among them, δ and ρ are weights, and their sum is 1; Step 6: According to the loss function trained in step 5, the multi-factor anomaly detection score Score is calculated to obtain the detection result; the multi-factor anomaly detection score Score consists of three parts, namely the improved VAE-GAN reconstruction error, the improved VAE-GAN discrimination error, and the transformation matrix error. The Score is expressed as: Among them, τ, ω is the weight, and its sum is 1.

2. A multi-factor network abnormal behavior detection method according to claim 1, characterized in that: The data matrix X includes multi-dimensional information, expressed as: X=X1,X2,...,X i ,...,Xn Wherein, i=1, 2, ..., n, n is the total number of dimensions; Multi-dimensional information includes some or all of the following information: User information: user ID, user credentials, user attributes, roles; Device information: device ID number, device location, device type, device IP address, device MAC address, device certificate, device fingerprint, device ID, log type; Device status: installed operating system version, application software version, patch status, network location; User permissions: device IP, log type, account, application permissions, operation method, operator; Account login: source IP, source device, device IP, log type, account, login method, login status; Access object: attributes, categories and levels of resources to be accessed, applications, data, IP addresses of access, and MAC addresses of access; Behavioral attributes: user access behavior, operating habits, access time, location, device analysis, source IP address, access frequency, and usage pattern deviation.

Images