Internal user abnormal behavior detection and evaluation method based on quantum generative adversarial network

Abstract

The present invention discloses a method for detecting and evaluating abnormal behavior of internal users based on a quantum generative adversarial network. The method utilizes the superposition and parallelism of quantum states to make quantum computing powerful in processing high-dimensional data. In view of the extremely unbalanced ratio of positive and negative sample data encountered in abnormal behavior detection, and the complex, changeable and unpredictable user behavior in a large-scale network system environment, the present invention proposes an algorithm for detecting and evaluating abnormal behavior of internal users (QBDE) based on a quantum generative adversarial network. The QBDE algorithm includes a quantum-classical hybrid architecture generative adversarial network (QGAN) and a classical neural network for detection and evaluation. Simulation tests and numerical analysis show that the QBDE algorithm can effectively detect and evaluate abnormal behavior of internal users. It provides new ideas for the detection and evaluation of abnormal behavior, and also provides new application scenarios for quantum computing.

Description

Technical Field

[0001] The present invention relates to the fields of quantum computing, artificial intelligence and information security, and specifically to a method for detecting and evaluating abnormal behavior of internal users based on a quantum generative adversarial network. Background Art

[0002] Quantum computing uses the characteristics of quantum parallelism, entanglement, and coherence generated by the superposition of quantum states, and shows special advantages in processing high-dimensional data. Currently, quantum computing is in the era of noisy intermediate-scale quantum (NISQ). The number of bits of quantum devices is limited, and they work with noise in a limited coherence time. Exploring the possible applications of quantum computing is a hot topic in the context of NISQ. Among them, the field of machine learning is considered to be one of the most promising applications of quantum computing in the future. It has been proven that it can partially alleviate the problem of computational complexity and the growing computational cost of classical neural networks.

[0003] Generative Adversarial Network (GAN) has been widely used in the field of machine learning due to its excellent data generation capabilities. However, when generating discrete data, GAN may suffer from gradient vanishing, leading to network difficulties in convergence and modal collapse. At the same time, as the network becomes more complex, its parameters continue to increase, resulting in a sharp increase in the computational cost of training.

[0004] Internal user abnormal behavior detection is a threat to network information systems caused by malicious behavior of authorized users, i.e. internal personnel. Their familiarity with the system makes it difficult to detect their malicious behavior. A major challenge in detecting internal user abnormal behavior is that the ratio of positive and negative sample data is extremely unbalanced. The traditional supervised learning method for modeling normal and abnormal user behavior is prone to a high false alarm rate. In addition, user behavior in large-scale network system environments is complex, changeable and difficult to predict, and existing detection methods face great challenges. GAN is one of the most promising methods for unsupervised learning on complex distributions in recent years. Due to its advantages in generating small sample data, it provides a new idea for user behavior threat detection and evaluation. In order to use the parallel advantages of QGAN to solve the difficulties encountered in the aforementioned internal user abnormal behavior detection, a QGAN based on a quantum-classical hybrid architecture is specially developed to detect user abnormal behavior. Summary of the invention

[0005] The purpose of this invention is to provide a method for detecting and evaluating internal user abnormal behavior based on quantum generative adversarial networks. This method realizes the detection of user abnormal behavior based on QGAN with a quantum-classical hybrid architecture, namely, a quantum abnormal behavior detection and evaluation algorithm (Quantum Behavior Detection and Evaluation, QBDE), and demonstrates its feasibility and effectiveness through simulation experiments.

[0006] The technical solution for achieving the purpose of the present invention is:

[0007] A method for detecting and evaluating abnormal behavior of internal users based on quantum generative adversarial networks, comprising the following steps:

[0008] (1) Data preprocessing: Select the original user data set from multiple different files, filter out quantitative and qualitative indicator data based on the indicator system of the behavior domain, divide the data into data sets of different users, and normalize the filtered indicator data;

[0009] (2) User behavior modeling based on quantum generative adversarial network: Select the user's normal behavior data as the training set, use QGAN to generate negative samples, and then train the network to build the user's normal behavior model. QGAN adopts a quantum-classical hybrid architecture to input / output classical data through a hybrid architecture of quantum and classical.

[0010] (3) Behavioral detection and evaluation:

[0011] In order to characterize the security of user behavior, the user behavior threat score d(x) is defined, and the threat threshold is defined according to the behavior characteristics. The threat behavior is determined based on the threat score and threat threshold. Assuming that the current data to be detected is x, the threat score d(x) calculation formula is:

[0012] d(x)=(1-λ)R d +λR n (1)

[0013] Among them, λ represents the weight, R d and R n Represent the reconstruction errors of the generator and classifier, R d The difference between the data x and the data generated by the trained generative model G(z):

[0014] R d =||xG(z)|| (2)

[0015] R n It represents the difference between x and the generated sample from the perspective of the classifier. The classifier is selected as the representation of the middle layer. The calculation formula is as follows:

[0016] R n =||f n (x)-f n (G(z))|| (3)

[0017] f n (·) represents a classifier;

[0018] Based on the threat score and threshold Th d By comparing the user behavior X t (x) Classification into normal behavior and threatening behavior:

[0019]

[0020] Where D test The data to be tested;

[0021] According to the calculated threat score d(x), the evaluation function f(d(x)) is used to evaluate the threatening user behavior, and then the evaluation threshold Th is used to evaluate the threat score d(x). f Classify the threat level of threatening user behaviors into low-risk behaviors and high-risk behaviors;

[0022] The evaluation function is f(d(x)) and is expressed as follows:

[0023]

[0024] Among them, Low_threat and High_threat are threat levels. Low_threat means there is no malicious behavior or fewer abnormal operations, while High_threat means there is malicious behavior or more frequent abnormal operations.

[0025] Furthermore, when a user takes malicious actions or any abnormal operation, the behavior score d(x) exceeds 2 times Th d Therefore, the threat threshold

[0026] Th f =2 d (6).

[0027] The quantitative indicator data in step (1) is a numerical indicator. According to different users, the time unit is selected to calculate and count frequency characteristics, such as the number of system logins during working hours / outside working hours, the number of connections to removable devices, etc.

[0028] The qualitative indicators in step (1) are non-numerical indicators, such as whether it is a working day, whether a dangerous website is logged in, etc.

[0029] The QGAN described in step (2) adopts a quantum-classical hybrid architecture, in which the generator adopts a quantum parameterized circuit model and the discriminator adopts a classical fully connected neural network. The classical data is input / output through the hybrid architecture of quantum and classical, which is more conducive to the processing of data by classical computers.

[0030] The advantage of the present invention is that by utilizing the superposition and parallelism of quantum states, quantum computing has a powerful ability to process high-dimensional data. In view of the extremely unbalanced ratio of positive and negative sample data encountered in abnormal behavior detection, and the complex, changeable and unpredictable user behavior in a large-scale network system environment, the present invention proposes an internal user abnormal behavior detection and evaluation algorithm (QBDE) based on a quantum generative adversarial network. The QBDE algorithm includes a quantum-classical hybrid architecture generative adversarial network (QGAN) and a classical neural network for detection and evaluation. Simulation tests and numerical analysis show that the QBDE algorithm can effectively detect and evaluate the abnormal behavior of internal users. Our invention provides new ideas for the detection and evaluation of abnormal behavior, and also provides new application scenarios for quantum computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the framework of the embodiment method;

[0032] Figure 2 A schematic diagram of a quantum generator for an embodiment method;

[0033] Figure 3 For example, the quantum generator U e Schematic diagram;

[0034] Figure 4 A schematic diagram of an embodiment method identifier;

[0035] Figure 5 It is a schematic diagram of the performance test of the embodiment method; DETAILED DESCRIPTION

[0036] The content of the present invention is further described below in conjunction with the drawings and embodiments, but the present invention is not limited thereto.

[0037] Example:

[0038] Reference Figure 1 , a method for detecting and evaluating abnormal behavior of internal users based on quantum generative adversarial networks, including data preprocessing, construction of user behavior model (NUBM) and behavior detection and evaluation (BDE). The specific implementation steps are as follows:

[0039] (1) Data preprocessing

[0040] First, select the original user data set from multiple different files. Second, select quantitative and qualitative indicator data based on the indicator system of the behavior domain. Quantitative indicator data mainly refers to numerical indicators. According to different users, the time unit is selected to calculate and count frequency characteristics, such as the number of system logins during working hours / outside working hours, the number of connections to removable devices, etc. Qualitative indicators refer to non-numerical indicators, such as whether it is a working day, whether a dangerous website is logged in, etc. Considering the different characteristics of different users, the data needs to be divided into data sets of different users. Finally, the selected indicator data is normalized.

[0041] (2) User behavior modeling based on quantum generative adversarial networks

[0042] When detecting internal abnormal user behavior, the samples of abnormal behavior are usually smaller than normal samples, or even covered by a large amount of normal data. In other words, the ratio of positive samples to negative samples is extremely unbalanced. Therefore, normal user behavior is selected to form a training set, negative samples are generated with QGAN, and then the network is trained to achieve the construction of NUBM. Considering the limited sources of current quantum systems, QGAN in QBDE adopts a hybrid quantum classical architecture, in which the generator is a parameterized quantum circuit (PQC) and the discriminator is a classical neural network.

[0043] 1) Quantum generator: quantum generator G θ The PQC architecture is composed of a series of single-parameterized quantum gates and controlled quantum gates. Considering that the data for abnormal user behavior detection is discrete, G θ The specific structure of PQC is as follows: Figure 2 Each floor consists of a series of single rotating Pauli-Y doors R Y (θ i,j ) and the entanglement gate U e Composition, where θ i,j represents the rotation angle of the i-th quantum bit in the j-th layer. e like Figure 3 As shown, it consists of multiple controlled Z gates. The entire PQC circuit rotates the gate and the entanglement gate alternately. Assume that the system consists of n quantum bits, and k represents the depth of the quantum circuit. Quantum generator G Q is trained for a given input state | in >Convert to output state

[0044]

[0045] in, represents the probability in the ground state |>, and θ is a parameter. Preferably, the input state is | in >

[0046] Y (θ 0 )|0…00>, G θ It can be expressed as

[0047] G θ = Y (θ k ) e ... Y (θ 2 ) e R Y (θ 1 ) e

[0048] in is the Pauli-Y in the jth layer.

[0049] 2) Classical Discriminator: In current quantum systems, the performance of quantum devices is limited due to the limited number of qubits and circuit depth. In this case, it is not appropriate to select a particularly complex network in the discriminator to ensure that D C Won't overwhelm G Q Therefore, in the classical discriminator D of QBDE C In the Figure 4 The fully connected neural network shown in Figure 1 consists of two simple fully connected layers and an output layer of neurons.

[0050] 3) Training and optimization: The objective function of QGAN is a maximum-minimum optimization problem, where the goal of the QGAN generator is to learn the probability distribution of samples through training, and then obtain new generated samples similar to real samples; the discriminator network judges the input samples, and the goal is to distinguish between real samples and generated samples. Considering practical applications, batch processing technology is used. Let the batch size be m, and the training and generated samples be x l and g l .QBDE G Q The loss function is

[0051]

[0052] The loss function of Dc is:

[0053]

[0054] PennyLane, a software framework for quantum computer differentiable programming, can be used to program G Q Parameters θ and D C parameter Alternate optimization.

[0055] (3) Behavior detection and evaluation (BDE).

[0056] In order to characterize the security of user behavior, the user behavior threat score d(x) is defined, and the threat threshold is defined according to the behavior characteristics. The threat behavior is determined based on the threat score and threat threshold. Assuming that the current data to be detected is x, the threat score d(x) calculation formula is:

[0057] d(x)=(1-λ)R d +λR n (1) Where λ represents the weight, R d and R n Represent the reconstruction errors of the generator and classifier respectively. R d The difference between the data x and the data generated by the trained generative model G(z):

[0058] R d =||xG(z)|| (2)R n It represents the difference between x and the generated sample from the perspective of the classifier. The classifier is selected as the representation of the middle layer. The calculation formula is as follows:

[0059] R n =||f n (x)-f n (G(z))|| (3)

[0060] f n (·) represents a classifier.

[0061] Based on the threat score and threshold Th d By comparing the user behavior X t (x) Classification into normal behavior and threatening behavior:

[0062]

[0063] Where D test The data to be tested.

[0064] The main purpose of threat detection and assessment based on user behavior is to analyze the threat level of user behavior to the network and system, so as to carry out targeted defense of the network and system. The threat behavior detected by the user behavior threat detection method based on QGAN is used to evaluate the threat behavior of the threatening user behavior based on the calculated threat score d(x) using the evaluation function f(d(x)), and then the evaluation threshold Th is used to evaluate the threat level of the threatening user behavior. f The threat level of threatening user behaviors is divided into low-risk behaviors and high-risk behaviors.

[0065] The evaluation function is f(d(x)) and is expressed as follows:

[0066]

[0067] Among them, Low_threat and High_threat are threat levels. Low_threat means there is no malicious behavior or fewer abnormal operations, while High_threat means there is malicious behavior or more frequent abnormal operations.

[0068] Usually, when a user takes malicious actions or any abnormal operation, the behavior score d(x) exceeds 2 times Th d .

[0069] Therefore, it is better to use the threat threshold

[0070] Th f =2Th d (6)

[0071] In order to demonstrate the performance of this algorithm, three different user behaviors are tested. The behavior score d(x) of the test data is as follows: Figure 5 From these figures, we can observe that for different users, almost all behaviors can be successfully detected and evaluated by the QBDE algorithm with accuracy rates of 97.98%, 98.28%, and 97.30%, respectively.

Claims

1. A method for detecting and evaluating abnormal behavior of internal users based on quantum generative adversarial networks, comprising the following steps: (1) Data preprocessing: Select the original user data set from multiple different files, filter out quantitative and qualitative indicator data based on the indicator system of the behavior domain, divide the data into data sets of different users, and normalize the filtered indicator data; (2) User behavior modeling based on quantum generative adversarial network: select the user's normal behavior data as the training set, use QGAN to generate negative samples, and then train the network to realize the construction of the user's normal behavior model, wherein QGAN adopts a quantum-classical hybrid architecture, and inputs / outputs classical data through the hybrid architecture of quantum and classical; the QGAN adopts a quantum-classical hybrid architecture, wherein the generator adopts a quantum parameterized circuit model, and the discriminator adopts a classical fully connected neural network, and inputs / outputs classical data through the hybrid architecture of quantum and classical, which is more conducive to the processing of data by classical computers; (3) Behavioral detection and evaluation: In order to characterize the security of user behavior, the user behavior threat score d(x) is defined, and the threat threshold is defined according to the behavior characteristics. The threat behavior is determined according to the threat score and the threat threshold. Assuming that the current data to be detected is x, the threat score d(x) calculation formula is d(x) = (1-λ)R d +λR n (1) Among them, λ represents the weight, R d and R n Represent the reconstruction errors of the generator and classifier, R d The difference between the data x and the data generated by the trained generative model G(z): R d =‖x-G(z)‖ (2) R n It represents the difference between x and the generated sample from the perspective of the classifier. The classifier is selected as the representation of the middle layer. The calculation formula is as follows: R n =‖f n (x)-f n (G(z))‖ (3) f n (·) represents a classifier; Based on the threat score and threshold Th d By comparing the user behavior X t (x) Classification into normal behavior and threatening behavior: Where D test The data to be tested; According to the calculated threat score d(x), the evaluation function f(d(x)) is used to evaluate the threatening user behavior, and then the evaluation threshold Th is used to evaluate the threat score d(x). f Classify the threat level of threatening user behaviors into low-risk behaviors and high-risk behaviors; The evaluation function is f(d(x)) and is expressed as follows: Among them, Low_threat and High_threat are threat levels. Low_threat means no malicious behavior or fewer abnormal operations, while High_threat means malicious behavior or more frequent abnormal operations. Furthermore, when a user takes malicious actions or any abnormal operation, the behavior score d(x) exceeds 2 times Th d Therefore, the threat threshold Th f =2Th d (6)。 2. The method for detecting and evaluating abnormal behavior of internal users based on quantum generative adversarial networks according to claim 1 is characterized in that: The quantitative indicator data in step (1) is a numerical indicator. According to different users, the time unit is selected to calculate and count the frequency characteristics.

3. The method for detecting and evaluating abnormal behavior of internal users based on quantum generative adversarial networks according to claim 1 is characterized in that: The qualitative index in step (1) is a non-numerical index.

Images