Behavior detection method and device for uncontrolled heterogeneous access terminals and storage medium

Abstract

The application discloses a kind of non-controlled heterogeneous access terminal behavior detection method, device and storage medium, equipment normal behavior characteristics are generated by the equipment flow obtained by passive bypass monitoring, the calculation and prediction of equipment normal behavior characteristics are carried out using the cortical learning algorithm in deep learning technology, and equipment security behavior fingerprint is generated.The security behavior fingerprint is used to calculate the prediction error and distribution with the current behavior characteristics, determine the abnormal probability of terminal, and finally judge whether the current behavior of terminal is abnormal by the abnormal probability detection terminal.The security of non-controlled heterogeneous terminal access is thus guaranteed, and the problem that legal terminal is imitated or maliciously used for access and cannot be authenticated and identified is solved.

Description

Technical Field

[0001] This invention relates to the field of power system security technology, specifically to a method, device, and storage medium for detecting the behavior of uncontrolled heterogeneous access terminals. Background Technology

[0002] With the development of new power systems, the State Grid Corporation's external service terminals exhibit characteristics such as massive access, diversified network layer communication methods, cross-application data sharing at the platform layer, flexible application layer business access points, and business interconnection. Furthermore, a large number of uncontrolled heterogeneous terminals are gradually accessing the system. Given the current uncontrolled nature of these new business terminals, the sheer number and heterogeneity of the terminals, coupled with limited computing resources, make it difficult to customize and robustly modify security protection. This results in insufficient trusted authentication technology across the "hardware-software-user" chain, leading to unauthorized terminal access. More seriously, legitimate terminals may be counterfeited or maliciously exploited for access without proper authentication.

[0003] Current technologies for ensuring the security of access terminals include physical protection and system hardening. Sufficient physical security measures are employed to prevent damage to the physical entity during operation, while host-level security systems and software are installed to achieve system-level protection. Trusted environments are constructed based on trusted components and virtualization technologies, including trusted computing, sandboxes, virtual machines, diskless workstations, and desktop clouds. While these three protection methods are general terminal protection techniques, due to the limited computing, storage, and power supply capabilities, as well as the uncontrolled nature of new power business terminals, only physical protection methods can be applied by the terminal's owner to the security of uncontrolled new business terminals. The other two methods are unsuitable. Therefore, a new security protection method for uncontrolled new business terminals is needed.

[0004] Correct identification of IoT terminal identities is a crucial prerequisite for establishing secure IoT connections, with the identification of smart terminals being particularly important. Existing technical solutions include: (1) terminal identifier identification; (2) device feature identifier identification; and (3) device fingerprint identification, etc. Currently, various technical methods emerging in the field of IoT terminal identification and authentication can only cover a single level of hardware, software, or user authentication, and cannot perform full-level identity authentication of uncontrolled power terminals, encompassing the entire range of hardware, software, and user aspects. Therefore, it is difficult to solve the problem of illegal terminals and the forgery of legitimate terminals accessing the network. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a behavior detection method, apparatus and storage medium for uncontrolled heterogeneous access terminals, in order to solve the technical problem in the prior art that it is difficult to solve the problem of illegal terminals and legitimate terminals being forged for access.

[0006] The technical solution proposed in this invention is as follows:

[0007] The first aspect of this invention provides a behavior detection method for an uncontrolled heterogeneous access terminal, comprising: extracting normal behavior features of the uncontrolled heterogeneous access terminal at historical times and behavior features at the current time based on traffic acquired by passive bypass monitoring; performing sparse encoding on the normal behavior features at historical times and behavior features at the current time respectively to obtain a first encoding result and a second encoding result corresponding to the normal behavior features; predicting a security behavior fingerprint at the current time using a cortical learning algorithm based on the first encoding result; calculating the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current time using prediction error and its distribution based on the second encoding result and the security behavior fingerprint at the current time; and determining whether the uncontrolled heterogeneous access terminal exhibits abnormal behavior based on the probability of abnormal behavior at the current time.

[0008] Optionally, the normal behavior characteristics of the historical moment or the behavior characteristics of the current moment include: protocol header field values, clock deviation of the timestamp, and data stream distribution characteristics.

[0009] Optionally, sparse coding is performed on the normal behavior features of historical moments and the behavior features of the current moment to obtain a first coding result and a second coding result corresponding to the normal behavior features. This includes: sparse coding is performed on the protocol header field values, the clock offset of the timestamp, and the data stream distribution features according to three encoders to obtain the corresponding coding results; and the corresponding coding results are concatenated to obtain the first coding result and the second coding result corresponding to the normal behavior features.

[0010] Optionally, based on the first encoding result, a cortical learning algorithm is used to predict the security behavior fingerprint at the current moment, including: using a spatial pooling algorithm to extract the spatial correlation of the first encoding result, mapping the normal behavior features of historical moments into vectors with fixed sparsity; and using a sequence memory algorithm to predict the security behavior fingerprint at the current moment from the vectors with fixed sparsity.

[0011] Optionally, based on the second encoding result and the security behavior fingerprint at the current moment, the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment is calculated using the prediction error and its distribution, including: calculating the scalar values ​​of the second encoding result and the security behavior fingerprint at the current moment as the prediction error; and calculating the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error.

[0012] Optionally, calculating the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error includes: calculating the distribution of the prediction error within a first preset time window and the distribution within a second preset time window; and calculating the probability of abnormal behavior at the current moment using Gaussian tail probability based on the distribution within the first preset time window and the distribution within the second preset time window.

[0013] Optionally, determining whether an uncontrolled heterogeneous access terminal exhibits abnormal behavior based on the current abnormal behavior probability includes: determining whether the current abnormal behavior probability is greater than or equal to a threshold parameter; if the current abnormal behavior probability is greater than or equal to the threshold parameter, then determining that the uncontrolled heterogeneous access terminal exhibits abnormal behavior.

[0014] A second aspect of this invention provides a behavior detection device for an uncontrolled heterogeneous access terminal, comprising: a feature extraction module for extracting normal behavior features of the uncontrolled heterogeneous access terminal at historical times and behavior features at the current time based on traffic acquired by passive bypass monitoring; an encoding module for sparsely encoding the normal behavior features at historical times and the behavior features at the current time to obtain a first encoding result and a second encoding result corresponding to the normal behavior features; a prediction module for predicting a security behavior fingerprint at the current time based on the first encoding result using a cortical learning algorithm; a probability calculation module for calculating the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current time based on the second encoding result and the security behavior fingerprint at the current time, using prediction error and its distribution; and a behavior detection module for determining whether the uncontrolled heterogeneous access terminal exhibits abnormal behavior based on the probability of abnormal behavior at the current time.

[0015] Optionally, the normal behavior characteristics of the historical moment or the behavior characteristics of the current moment include: protocol header field values, clock deviation of the timestamp, and data stream distribution characteristics.

[0016] Optionally, the encoding module is specifically used to: perform sparse encoding on the protocol header field values, timestamp clock offset, and data stream distribution characteristics according to the three encoders to obtain the corresponding encoding results; and concatenate the corresponding encoding results to obtain the first encoding result corresponding to the normal behavior characteristics and the second encoding result corresponding to the behavior characteristics.

[0017] Optionally, the prediction module is specifically used to: extract the spatial correlation of the first encoding result using a spatial pooling algorithm, map the normal behavior features of historical moments into vectors with fixed sparsity, and use a sequence memory algorithm to predict the security behavior fingerprint of the current moment from the vectors with fixed sparsity.

[0018] Optionally, the probability calculation module includes: an error calculation module, used to calculate the scalar values ​​of the second encoding result and the security behavior fingerprint at the current moment as the prediction error; and a probability calculation submodule, used to calculate the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error.

[0019] Optionally, the probability calculation submodule is specifically used to: calculate the distribution of the prediction error within a first preset time window and the distribution within a second preset time window; and calculate the probability of abnormal behavior at the current moment using Gaussian tail probability based on the distribution within the first preset time window and the distribution within the second preset time window.

[0020] Optionally, the behavior detection module is specifically used to: determine whether the probability of abnormal behavior at the current moment is greater than or equal to a threshold parameter; if the probability of abnormal behavior at the current moment is greater than or equal to the threshold parameter, then determine that the uncontrolled heterogeneous access terminal has abnormal behavior.

[0021] A third aspect of the present invention provides a computer-readable storage medium storing computer instructions for causing the computer to perform the behavior detection method for an uncontrolled heterogeneous access terminal as described in the first aspect and any one of the first aspects of the present invention.

[0022] A fourth aspect of the present invention provides an electronic device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the behavior detection method for an uncontrolled heterogeneous access terminal as described in the first aspect and any one of the first aspects of the present invention.

[0023] The technical solution provided by this invention has the following effects:

[0024] The present invention provides a method, apparatus, and storage medium for detecting the behavior of uncontrolled heterogeneous access terminals. It generates normal behavior characteristics of the device (terminal) by acquiring device traffic through passive bypass monitoring. Using a cortical learning algorithm from deep learning technology, it calculates and predicts these normal behavior characteristics to generate a secure behavior fingerprint. This secure behavior fingerprint is then compared with the currently acquired behavior characteristics to calculate the prediction error and distribution, determining the probability of the terminal's anomaly. Finally, the anomaly probability is used to determine whether the terminal's current behavior is abnormal. This ensures the security of uncontrolled heterogeneous terminal access and solves the problem of legitimate terminals being impersonated or maliciously exploited for access without authentication. Attached Figure Description

[0025] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a behavior detection method for uncontrolled heterogeneous access terminals according to an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of sparse representation according to an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of the mapping from the input space to the space pooling column according to an embodiment of the present invention;

[0029] Figure 4 This is a structural block diagram of a behavior detection device for an uncontrolled heterogeneous access terminal according to an embodiment of the present invention;

[0030] Figure 5 This is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] The terms "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] According to an embodiment of the present invention, a behavior detection method for an uncontrolled heterogeneous access terminal is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] This embodiment provides a behavior detection method for uncontrolled heterogeneous access terminals, which can be used in electronic devices such as computers, mobile phones, and tablets. Figure 1 This is a flowchart of a behavior detection method for uncontrolled heterogeneous access terminals according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0036] Step S101: Extract the normal behavior characteristics of uncontrolled heterogeneous access terminals at historical moments and the behavior characteristics at the current moment based on the traffic obtained from passive bypass monitoring.

[0037] Specifically, uncontrolled heterogeneous access terminals refer to terminal equipment (hereinafter referred to as terminals or equipment) connected to the power system. Passive bypass monitoring refers to monitoring device traffic through the "port mirroring" function of network devices such as switches. The principle of port mirroring is to instruct the switch to copy all data packets from one port to another. In this mode, monitoring equipment only needs to connect to the designated mirroring port of the switch to completely collect traffic flowing through all ports of the switch.

[0038] By passively bypassing and monitoring device traffic, a set of behavioral fingerprint features for terminal device identification is constructed based on the traffic. Normal behavioral features from historical moments refer to those extracted from device traffic monitored up to the current moment. These features indicate that the behavior of uncontrolled heterogeneous terminals accessed in the past was normal, or that the accessed terminals were legitimate and not being spoofed or maliciously exploited (if the terminal was already detected as abnormal in the past moment, it was already blocked from access, and there was no need for detection in the current moment; therefore, the behavioral features obtained from the past moment are considered normal behavioral features). Behavioral features from the current moment refer to those extracted from device traffic monitored in the current moment.

[0039] Step S102: Perform sparse coding on the normal behavior features of historical moments and the behavior features of the current moment to obtain the first coding result and the second coding result of the corresponding normal behavior features.

[0040] In this process, upon receiving normal behavioral features from historical moments and behavioral features from the current moment, a sparse coding algorithm is first employed to sparsely encode the features. The sparse coding algorithm is based on the Sparse Distributed Representation (SDR) strategy. "Sparse" means that the number of neurons active at the same time is small, and "distributed" means that the representation of something requires the activation of multiple neurons. A neuron expresses some meaning and can be interpreted within its scope to convey the complete meaning, such as... Figure 2 The diagram shown is a schematic of sparse representation.

[0041] Assuming the array length (total number of input bits) is n and the number of active input bits is w, then the sparsity and total capacity are:

[0042]

[0043]

[0044] This arrangement of bit arrays approximates the human cerebral cortex, while SDR approximates the memory matrix stored in the human brain. SDR has semantics, therefore SDRs with similar representations have similar semantics.

[0045] Sparse coding algorithms are used to sparsely encode the input behavioral features into SDR (Sparse Data Representation) form. Depending on the encoding method, they can be divided into scalar encoders and random distribution encoders. Random distribution encoders encode data into a non-continuous, distributed form. In this encoding method, a bucket represents the number of SDR categories currently recorded. The parameter resolution is defined as the number of values ​​contained in a bucket. Resolution = m means that the SDR encoding results of the m values ​​from No.i to No.i+m-1 are completely identical. For example, resolution = 1 means that the encoding result of each value differs from the encoding result of its neighboring values ​​by only one bit. Scalar encoders, on the other hand, use a continuous encoding method, where the input data is converted into n consecutive active input bits after encoding. A bucket represents the maximum number of categories the system can represent. For each actual value (min ≤ value ≤ max), assuming the total number of input bits in the system is n, it is represented by w consecutive active input bits; therefore, bucket = n - w + 1.

[0046] Step S103: Based on the first encoding result, a cortical learning algorithm is used to predict the security behavior fingerprint at the current moment. Specifically, when terminal behavior is abnormal or insecure, such as when the accessed terminal is an illegal terminal or a legitimate terminal is impersonated or maliciously used, the features extracted from the monitored traffic will exhibit abnormal behavioral characteristics or unprecedented behavioral patterns. This provides researchers with the possibility to detect anomalies through data analysis and mining, and to take timely and effective measures. In practical application scenarios, the amount of data involved in terminal traffic is huge and the speed is extremely high, making manual intervention almost impossible. Therefore, a suitable deep learning algorithm is needed for anomaly detection. This deep learning algorithm needs to pay attention to the temporal order of the data, i.e., the time-varying nature of the data. Cortical learning has a strong learning ability for time-varying data and can adaptively adjust when data features and behavioral patterns change.

[0047] Hierarchical Temporal Memory (HTM), also known as a hierarchical real-time memory algorithm, aims to simulate the working principle of the neocortex, transforming complex problems into pattern matching and prediction. HTM continuously receives device behavioral features for anomaly detection in subsequent inputs. Therefore, in this step, the cortical learning algorithm learns the first encoding results corresponding to normal behavioral features from historical moments, enabling the prediction of the current moment's security behavior fingerprint—that is, predicting the current moment's security behavior fingerprint by learning normal behavioral features. This predicted current moment's security behavior fingerprint can serve as a terminal behavior fingerprint template. Anomaly detection is achieved by matching acquired real-time data with this template.

[0048] Step S104: Based on the second encoding result and the security behavior fingerprint at the current moment, calculate the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment using the prediction error and its distribution. Specifically, the prediction error refers to the error between the security behavior fingerprint at the current moment and the second encoding result. The smaller the prediction error, the more likely the pattern features of the input have been seen at a previous moment. Therefore, a threshold can generally be preset to determine whether abnormal behavior is detected; inputs with smaller prediction errors are less likely to have an abnormality at the corresponding moment. However, in situations with high environmental noise, such as during certain feature acquisition processes, the calculated prediction error is generally large, making it difficult to distinguish between abnormal and normal situations. Therefore, based on the prediction error, further analysis of the prediction error is considered, and the probability of abnormal behavior is determined by calculating the distribution, and abnormal behavior is detected using the probability of abnormal behavior.

[0049] Step S105: Determine whether there is abnormal behavior in the uncontrolled heterogeneous access terminal based on the current abnormal behavior probability. Specifically, by pre-setting a threshold parameter and comparing the abnormal behavior probability with the threshold parameter, it can be determined whether there is abnormal behavior in the accessed uncontrolled heterogeneous access terminal.

[0050] The behavior detection method for uncontrolled heterogeneous access terminals provided in this invention generates normal behavior features of devices (terminals) by acquiring device traffic through passive bypass monitoring. It then uses a cortical learning algorithm from deep learning technology to calculate and predict these normal behavior features, generating a secure behavior fingerprint. This secure behavior fingerprint is compared with the currently acquired behavior features to calculate prediction error and distribution, determining the probability of the terminal's anomaly. Finally, the anomaly probability is used to determine whether the terminal's current behavior is abnormal. This ensures the security of uncontrolled heterogeneous terminal access and solves the problem of legitimate terminals being impersonated or maliciously exploited for access without authentication.

[0051] In one embodiment, the normal behavior characteristics of the historical moment or the behavior characteristics of the current moment include: protocol header field values, clock offset of the timestamp, and data stream distribution characteristics.

[0052] During operation, devices exhibit varying network behaviors due to the execution of different tasks. During device startup, the transition from power failure to normal operation involves a complete and rigorous loading process, providing a period during which the device can output stable traffic. Therefore, obtaining the header field values ​​of traffic data packets during startup—specifically, the protocol header field values—is used to characterize the device's behavior. The header fields primarily focus on the device's behavior at the network and transport layers. This mainly involves the differences in IP / TCP / UDP header fields between different devices.

[0053] Devices can be identified based on their specific clock behavior, which is determined by their unalterable hardware settings. Clocks experience "clock skew," causing them to run faster or slower than a precise clock. These characteristics can be remotely measured using TCP timestamps, and the results are added to the device's data packets and can be directly retrieved. In practice, timestamp values ​​are stored in the IAT (Internal-Arrival Time) option field of the TCP packet, which represents the time interval between the arrival of consecutive packets. Besides clock skew, other statistical characteristics can be used to better identify devices, such as the increment between two consecutive timestamp values, or the mean, variance, etc.

[0054] Besides differences in the values ​​of fields in the device data packet header, most devices occasionally send short bursts of data. By analyzing the size, frequency, and patterns of each burst during the service phase, it can be found that these bursts are periodic. This characteristic varies among different devices, and these distribution characteristics of statistical data streams can be used as a basis for device identification.

[0055] For example, both Amazon Echo and LiFX bulbs use DNS (port 53) and NTP (port 123). However, Amazon Echo uses HTTP (port 80), HTTPS (port 443), and ICMP (port 0), while LiFX bulbs do not use any of these applications. Furthermore, each device appears to communicate with a unique port number on the WAN server. Amazon Echo accesses multiple domains: softwareupdates.amazon.com, device-metrics-su.amazon.com, example.org, pindorama.amazon.com, and pool.ntp.org. LiFX bulbs, on the other hand, communicate with only two domains: v2.broker.lifx.co and pool.ntp.org. Additionally, the frequency of DNS lookups is an important attribute characterizing a device.

[0056] In one embodiment, sparse encoding is performed on the normal behavior features of historical moments and the behavior features of the current moment to obtain a first encoding result and a second encoding result corresponding to the normal behavior features. This includes: sparse encoding the protocol header field values, timestamp clock offset, and data flow distribution features using three encoders to obtain corresponding encoding results; and concatenating the corresponding encoding results to obtain the first encoding result and the second encoding result corresponding to the normal behavior features. Specifically, semantics is the most important characteristic of SDR. Since the behavior features specifically include three types of features, a behavior encoder is constructed based on the semantics of the features. In this embodiment, the access terminal behavior is subdivided into three encoders based on the semantics: protocol header field values, timestamp clock offset, and data flow distribution features. The results of the three different semantic encoders are concatenated using a macro encoder to display the complete encoding result. Specifically, during sparse encoding, three encoders can be used first to encode the three features in the normal behavior features of historical moments, and the encoding results can be concatenated to obtain the first encoding result; then, three encoders can be used to encode the three features in the behavior features of the current moment, and the encoding results can be concatenated to obtain the second encoding result.

[0057] In one embodiment, based on the first encoding result, a cortical learning algorithm is used to predict the security behavior fingerprint at the current moment, including the following steps:

[0058] Step S201: Spatial pooling algorithm is used to extract the spatial correlation of the first encoding result, mapping the normal behavioral features of historical moments into vectors with fixed sparsity. Specifically, spatial pooling algorithm can completely simulate the working mode of the cerebral cortex. The basic function of spatial pooling algorithm is to further transform the input data into a standardized vector with fixed dimension and fixed sparsity while maintaining the semantic similarity of overlap. Over time, spatial pooling extracts the spatial correlation of the macro encoder data results, mapping the SDR composed of active input bits into active functional columns.

[0059] The spatial pooling algorithm's processing flow is as follows: The original data is sparsely encoded and converted into a sparse distribution form, SDR-IS (SDR-Input Space), which is easier to process. The potential percent is defined as the proportion of the maximum number of input bits connected to each column (the size of the potential pool) to the total number of input bits; this connection is random. The potential percent is set so that a certain number of input bits in the input space enter the potential pool. The connection strength (permanences) between the functional column and each input bit in the potential pool is determined to be greater than or equal to the connection threshold (t); if so, the connection is successfully established. Next, the similarity between the current spatial pooler's encoding result and the original input space's SDR-IS is determined. The overlap score is defined as the number of overlapping input bits between two vectors. All functional columns' overlap scores are arranged from largest to smallest, and a threshold is set. Functional columns with an overlap number greater than or equal to the threshold are activated and participate in subsequent learning; functional columns with an overlap number less than the threshold are suppressed, or a boosting strategy is used to enhance the model's fine-grainedness. These active functional columns constitute the final output vector SDR-SP (Spatial Pooler) of the spatial pooling algorithm. SDR-SP continuously learns the spatial features of the input data, strengthening or suppressing existing connections. Over time, the spatial pooler learns to recognize the spatial features of the input at each time step. After one computation cycle, some existing connections will disappear, and some new connections will be generated, with the number of disappearing connections exceeding the number of new connections. This allows the spatial pooling algorithm to find the most concise mapping result in space that best represents the original input features.

[0060] It should be noted that whether or not to use Boosting can be determined based on actual needs.

[0061] Step S202: Use the sequence memory algorithm to predict the security behavior fingerprint at the current moment from the vector with fixed sparsity.

[0062] Specifically, the spatial pooling algorithm described above extracts the spatial features of the input data, identifies the active functional pillars that can represent each spatial pattern, and maps the input space into a normalized representation with fixed sparsity. The temporal pooling algorithm further learns these spatial pattern sequences that change over time, obtaining a sparse distribution representation of the temporal patterns. The sequence memory algorithm is the essence of the temporal pooling algorithm, responsible for learning the sequence of active functional pillars in the spatial pooling algorithm and predicting the next spatial pattern based on the contextual information of each input.

[0063] Cortical learning is achieved through the collaborative efforts of spatial and temporal pooling. Temporal pooling follows spatial pooling, learning data with contextual information, storing and arranging it into a sequence to predict values ​​for the next stage. The entire learning process is similar in both spatial and temporal pooling, requiring the establishment of connections or synapses between cells.

[0064] The time pooling process consists of two phases: first, determining which cells in the active column are activated and enter the active state at this moment; second, selecting a group of nerve cells and placing them in the predicted state, where cells in the predicted state will be activated at the next moment.

[0065] The time pooling operation is summarized as follows:

[0066] (1) For each dendritic segment on each cell in the region, calculate the number of synapses that are connected to active cells. If the number exceeds a threshold, the dendritic segment is marked as active, and the cells with active dendritic segments are in the predicted state. The set of cells in the predicted state is the prediction for that region.

[0067] (2) When a dendritic segment becomes active, the connection strength of all synapses within that segment is modified. For each potential synapse on an active dendritic segment, the connection strength connected to the active cell synapse is increased, and the connection strength connected to the inactive cell synapse is decreased. The changes in synaptic connection strength are temporary, and this operation modifies the synapses on other segments that have been trained multiple times to activate a particular dendritic segment, thus generating a prediction. However, to further extend the prediction time, a second dendritic segment is selected on the same cell for training. For the second segment, the segment that best matches the terminal behavior in the previous time step is selected. For this segment, using the terminal behavior from the previous time step, the same operation is repeated: increasing the connection strength of those synapses connected to active cells and decreasing the connection strength of those connected to inactive cells. Again, these changes in synaptic connection strength are labeled as temporary.

[0068] (3) When a cell switches from an inactive state to an active state due to feedforward input, each potential synapse associated with that cell is traversed and any temporary markers are removed. Therefore, synaptic connection strengths are only updated if they correctly predict the cell’s feedforward activity.

[0069] (4) When a cell switches from an active state to an inactive state, the temporary intensity value of each potential synapse in that cell is changed. The system does not want to boost the intensity values ​​of synapses that would incorrectly predict a cell to be active via feedforward. Only cells that are active due to feedforward input will spread their activity within the region; otherwise, prediction will lead to further predictions. The output of the region formed by all active cells (due to feedforward and predicted activity) is propagated to the next region in the hierarchy.

[0070] In one embodiment, the abnormal behavior probability of the uncontrolled heterogeneous access terminal at the current moment is calculated using the prediction error and its distribution based on the second encoding result and the security behavior fingerprint at the current moment. This includes: calculating the scalar values ​​of the second encoding result and the security behavior fingerprint at the current moment as the prediction error; and calculating the abnormal behavior probability of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error.

[0071] Specifically, if the behavioral feature at the current moment is xt, a(xt) is the sparse code of xt, and π(Xt-1) represents the predicted value of a(Xt) by the cortical learning algorithm, that is, the predicted value obtained by inputting the input xt-1 from the previous moment into the cortical learning network model. Both a(xt) and π(xt-1) are sparse binary vectors, and the dimension of the two vectors is equal to the number of functional columns in the HTM network. The prediction error St is defined as a scalar value that measures the difference between the actual and predicted binary vectors:

[0072]

[0073] Where |a(xt)| is the scalar norm, i.e., the number of 1-bit (active functional pillars) in xt. In the above equation, if the current a(xt) perfectly matches the predicted π(xt-1), the error St will be 0; if the two binary vectors are perfectly orthogonal (i.e., they do not share common active bits), the error St will be 1. Therefore, St provides an immediate measure of how well the cortical learning network model predicts the current behavior xt. Due to the continuous learning nature of HTM, changes to the underlying statistics are automatically handled. If the terminal behavior changes, the prediction error will be high at the point of change and will automatically decrease to zero as the model adapts to the "new normal".

[0074] The probability of abnormal behavior is determined by modeling and calculating the distribution of prediction error. The probability of abnormal behavior is a probability metric that analyzes the degree of abnormality of the current behavior based on the prediction of the HTM model.

[0075] In one embodiment, calculating the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error includes the following steps:

[0076] Step S301: Calculate the distribution of prediction errors within the first preset time window and the distribution within the second preset time window. Specifically, the first preset time window is a window containing the last W prediction errors. When cortical learning learns the first encoding result corresponding to the normal behavioral features of historical moments, since each historical moment corresponds to multiple historical moments, and each moment corresponds to a corresponding actual value and predicted value, a corresponding prediction error can be calculated for each moment. The window containing the last W prediction errors specifically represents the W prediction errors before the current moment. Since each moment generates a prediction error, the distribution within the first preset time window, i.e., the mean and variance, is continuously updated. The mean and variance are expressed as follows:

[0077]

[0078]

[0079] The second preset time window specifically refers to the short-term window W' for calculating the average dynamic error. This short-term window can refer to the most recent moment, when the average dynamic error... This refers to the average short-term dynamic prediction error at the most recent moment. At the same time, the average dynamic error is the distribution within the second preset time window, and this value is continuously updated based on the prediction of the cortical learning algorithm.

[0080] Step S302: Based on the distribution within the first preset time window and the distribution within the second preset time window, calculate the probability of abnormal behavior at the current moment using the Gaussian tail probability. Specifically, the Gaussian tail probability refers to the probability that a random variable falls outside the interval of the mean plus x times the standard deviation σ. Therefore, the probability of abnormal behavior is expressed as:

[0081]

[0082] in:

[0083]

[0084] In one embodiment, determining whether an uncontrolled heterogeneous access terminal exhibits abnormal behavior based on the current behavior anomaly probability includes: determining whether the current behavior anomaly probability is greater than or equal to a threshold parameter; if the current behavior anomaly probability is greater than or equal to the threshold parameter, then it is determined that the uncontrolled heterogeneous access terminal exhibits abnormal behavior. The threshold parameter is represented as 1-γ; if abnormal behavior exists, then anomaly detection is confirmed. t ≡L t ≥1-γ.

[0085] In one embodiment, the behavior detection method for the uncontrolled heterogeneous access terminal is implemented using the following process:

[0086] By passively bypassing and monitoring device traffic, a set of behavioral features for device identification is constructed based on the traffic. Specifically, this set of behavioral features includes normal behavioral features at historical moments and behavioral features at the current moment. Furthermore, the normal behavioral features at historical moments and the behavioral features at the current moment include three types of features: protocol header field values, timestamp clock deviation, and data stream distribution characteristics.

[0087] Depending on the actual data packet, the protocol header field values ​​include {TOS, TTL, DF, MSS, TCPflags, Version, IHL, Protocol}. TOS (Type of Service) indicates the service type, declaring how the datagram can be processed when transmitted by the network system. TTL (Time to Live) sets the maximum number of routers the datagram can traverse. DF (Don't Fragment) indicates whether the packet is fragmented; 1 indicates no fragmentation, and 0 indicates fragmentation. Version distinguishes between IPv4 and IPv6. IHL indicates the header length; a protocol value of 6 represents TCP, and a value of 17 represents UDP. These characteristics are based on the TCP / IP protocol header field values, indirectly reflecting the device's operating status. In practice, 0 represents TCP, 1 represents UDP, and 2 represents other protocols.

[0088] The clock offset of the timestamp is selected using {maximum value, minimum value, mean, variance} as features, and its calculation method is shown in Table 1 below. i The time deviation of the TCP timestamp for a particular measurement.

[0089] Table 1

[0090]

[0091] Based on the actual situation, the data flow distribution characteristics are determined by selecting from the input and output flows of DNS and NTP. Two key attributes of the flow, namely the average packet size and average rate, are used as features. Furthermore, calculating traffic attributes at multiple time scales can better characterize individual devices. Therefore, the average size and average rate of flows generated at n different time granularities are statistically analyzed, providing 2n attributes for each data flow. Since data flows are divided into input and output flows, each device can extract 2n × 2 = 4n features based on DNS and NTP flows. For example, calculating the average size and average rate of flows generated at a 1-minute time granularity, and dividing data flows into input and output flows, each device can extract 8 features based on DNS and NTP flows: {average size of DNS input flow, average rate of DNS input flow, average size of DNS output flow, average rate of DNS output flow, average size of NTP input flow, average rate of NTP input flow, average size of NTP output flow, average rate of NTP output flow} as the data flow distribution characteristics.

[0092] Based on the selected features, sparse encoding is performed on the normal behavior features of historical moments and the behavior features of the current moment. In this implementation, a scalar encoder is selected for sparse encoding. The scalar encoder adopts a continuous encoding method, where the input features are converted into n consecutive active input bits after encoding. `bucket` represents the maximum number of categories that the system can represent. For each actual value `value` (min ≤ value ≤ max), assuming the total number of input bits in the system is n, it is represented by w consecutive active input bits; therefore, `bucket = n - w + 1`. Furthermore, encoders are constructed for three types of features: protocol header field values, timestamp clock skew, and data stream distribution characteristics. A macro encoder is then used to display the complete encoding results. Moreover, when setting the encoder parameters, `n` should not be too small; here, `n = 16` is chosen as the macro encoder parameter.

[0093] When constructing encoders for three types of features—protocol header field values, timestamp clock skew, and data stream distribution characteristics—since {TOS, TTL, DF, MSS, TCP flags, Version, IHL, Protocol} are selected as features, the encoder n for the protocol header field values ​​is set to 8. Each row of the 8x8 encoder represents one type of feature, and the value of each feature is represented in binary and reflected in the encoding. The encoder n for the timestamp clock skew is set to 4, selecting {maximum value, minimum value, mean, variance} as features. Each row of the 4x4 encoder represents one type of feature, and the value is reflected in the encoding. The data stream distribution features selected the average size and average rate of DNS and NTP streams generated within 1 minute. Eight features were extracted from the input and output streams. The data stream distribution feature encoder n was set to 8, that is, the following features were selected: average size of DNS input stream, average rate of DNS input stream, average size of DNS output stream, average rate of DNS output stream, average size of NTP input stream, average rate of NTP input stream, average size of NTP output stream, average rate of NTP output stream}. Similarly, each row of the encoder represents a type of feature, and the values ​​are reflected in the encoding.

[0094] When the first encoding result obtained by sparsely encoding the normal behavioral features of historical moments is input into the cortical learning model for prediction, it first passes through the spatial pooler; that is, the first encoding result constitutes the input space of the spatial pooler. Simultaneously, since the encoder parameters differ for different features during sparse encoding, the encoding dimension will vary. Therefore, the basic function of the spatial pooler is to further transform the input space into a standardized vector with fixed dimension and fixed sparsity while maintaining overlapping semantic similarity. Over time, the spatial pooler extracts the spatial correlation of the macro-encoder data results, mapping the SDR (Spatial Data Representation) obtained by the encoder, composed of active input bits, into active functional columns. The specific mapping process from the input space to the spatial pooler columns is as follows: Figure 3 As shown.

[0095] The spatial pooling result is then fed into the temporal pooler of the cortical learning model. The temporal pooler further learns these temporally varying spatial pattern sequences, obtaining a sparse distribution representation of the temporal patterns. The sequence memory algorithm is the core of the temporal pooling module, responsible for learning the sequence of active functional pillars in the spatial pooling module and predicting the next spatial pattern based on the contextual information of each input. Thus, if the encoding result at time t is input to the spatial pooler, a sparse binary vector a(xt) is obtained, carrying the spatial pattern features of the original input. After passing through the temporal pooler, based on the sequence memory algorithm, the temporal patterns in a(xt) are modeled and output as another binary sparse vector π(xt). Therefore, π(xt) is the prediction for a(xt+1), i.e., time t+1.

[0096] Therefore, after predicting the security behavior fingerprint at the current moment through the cortical learning model, the prediction error between the fingerprint and the second encoding result is calculated. Then, the abnormal behavior probability of the two is calculated using the above-mentioned method of calculating the abnormal behavior probability. Finally, the abnormal behavior probability and the threshold parameter are compared to determine whether the behavior of the current access terminal is abnormal.

[0097] This invention also provides a behavior detection device for uncontrolled heterogeneous access terminals, such as... Figure 4 As shown, the device includes:

[0098] The feature extraction module is used to extract the normal behavior features of uncontrolled heterogeneous access terminals at historical times and the behavior features at the current time based on the traffic obtained by passive bypass monitoring; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0099] The encoding module is used to perform sparse encoding on the normal behavior features at historical moments and the behavior features at the current moment, respectively, to obtain the first encoding result and the second encoding result of the corresponding normal behavior features; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0100] The prediction module is used to predict the security behavior fingerprint at the current moment based on the first encoding result using a cortical learning algorithm; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0101] The probability calculation module is used to calculate the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the second encoding result and the security behavior fingerprint at the current moment, using the prediction error and its distribution; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0102] The behavior detection module is used to determine whether there is abnormal behavior in uncontrolled heterogeneous access terminals based on the probability of abnormal behavior at the current moment. For details, please refer to the corresponding sections of the above method embodiments, which will not be repeated here.

[0103] The behavior detection device for uncontrolled heterogeneous access terminals provided in this invention generates normal behavior characteristics of devices (terminals) by acquiring device traffic through passive bypass monitoring. It then uses a cortical learning algorithm from deep learning technology to calculate and predict these normal behavior characteristics, generating a secure behavior fingerprint. This secure behavior fingerprint is compared with the currently acquired behavior characteristics to calculate prediction error and distribution, determining the probability of the terminal's anomaly. Finally, the anomaly probability is used to determine whether the terminal's current behavior is abnormal. This ensures the security of uncontrolled heterogeneous terminal access and solves the problem of legitimate terminals being impersonated or maliciously exploited for access without authentication.

[0104] For a detailed description of the function of the behavior detection device for uncontrolled heterogeneous access terminals provided in this embodiment of the invention, please refer to the description of the behavior detection method for uncontrolled heterogeneous access terminals in the above embodiments.

[0105] Optionally, the normal behavior characteristics of the historical moment or the behavior characteristics of the current moment include: protocol header field values, clock deviation of the timestamp, and data stream distribution characteristics.

[0106] Optionally, the encoding module is specifically used to: perform sparse encoding on the protocol header field values, timestamp clock offset, and data stream distribution characteristics according to the three encoders to obtain the corresponding encoding results; and concatenate the corresponding encoding results to obtain the first encoding result corresponding to the normal behavior characteristics and the second encoding result corresponding to the behavior characteristics.

[0107] Optionally, the prediction module is specifically used to: extract the spatial correlation of the first encoding result using a spatial pooling algorithm, map the normal behavior features of historical moments into vectors with fixed sparsity, and use a sequence memory algorithm to predict the security behavior fingerprint of the current moment from the vectors with fixed sparsity.

[0108] Optionally, the probability calculation module includes: an error calculation module for calculating the scalar values ​​of the second encoding result and the security behavior fingerprint at the current moment as a prediction error; and a probability calculation submodule for calculating the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error.

[0109] Optionally, the probability calculation submodule is specifically used to: calculate the distribution of the prediction error within a first preset time window and the distribution within a second preset time window; and calculate the probability of abnormal behavior at the current moment using Gaussian tail probability based on the distribution within the first preset time window and the distribution within the second preset time window.

[0110] Optionally, the behavior detection module is specifically used to: determine whether the probability of abnormal behavior at the current moment is greater than or equal to a threshold parameter; if the probability of abnormal behavior at the current moment is greater than or equal to the threshold parameter, then determine that the uncontrolled heterogeneous access terminal has abnormal behavior.

[0111] This invention also provides a storage medium, such as... Figure 5 As shown, a computer program 601 is stored on it. When executed by a processor, this program implements the steps of the behavior detection method for the uncontrolled heterogeneous access terminal in the above embodiments. The storage medium also stores audio and video stream data, feature frame data, interactive request signaling, encrypted data, and a preset data size. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0112] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0113] This invention also provides an electronic device, such as... Figure 6 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 6 Taking the example of a connection between China and Israel via a bus.

[0114] Processor 51 can be a central processing unit (CPU). Processor 51 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0115] The memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. The processor 51 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 52, thereby implementing the behavior detection method for uncontrolled heterogeneous access terminals in the above method embodiments.

[0116] The memory 52 may include a program storage area and a data storage area. The program storage area may store applications required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. Furthermore, the memory 52 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 52 may optionally include memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0117] The one or more modules are stored in the memory 52, and when executed by the processor 51, they perform the following: Figure 1-2 The embodiment shown illustrates a behavior detection method for uncontrolled heterogeneous access terminals.

[0118] For specific details regarding the aforementioned electronic devices, please refer to the relevant documentation. Figures 1 to 2 The relevant descriptions and effects in the illustrated embodiments are for understanding purposes only and will not be repeated here.

[0119] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A behavior detection method for an uncontrolled heterogeneous access terminal, characterized in that, include: Based on traffic acquisition from passive bypass monitoring, normal behavior characteristics and current behavior characteristics of uncontrolled heterogeneous access terminals at historical moments are extracted. Sparse coding is performed on the normal behavior features at historical moments and the behavior features at the current moment to obtain the first coding result and the second coding result of the corresponding normal behavior features; Based on the first encoding result, a cortical learning algorithm is used to predict the security behavior fingerprint at the current moment. Based on the second encoding result and the security behavior fingerprint at the current moment, the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment is calculated using the prediction error and its distribution. Determine whether there is abnormal behavior in the uncontrolled heterogeneous access terminal based on the probability of abnormal behavior at the current moment; Based on the first encoding result, a cortical learning algorithm is used to predict the security behavior fingerprint at the current moment, including: The spatial pooling algorithm is used to extract the spatial correlation of the first encoding result, and the normal behavior features of historical moments are mapped into vectors with fixed sparsity. The sequential memory algorithm is used to predict the security behavior fingerprint at the current moment from a vector with fixed sparsity.

2. The behavior detection method for uncontrolled heterogeneous access terminals according to claim 1, characterized in that, The normal behavior characteristics at historical moments or the behavior characteristics at the current moment include: protocol header field values, timestamp clock deviation, and data stream distribution characteristics.

3. The behavior detection method for uncontrolled heterogeneous access terminals according to claim 2, characterized in that, Sparse coding is performed on the normal behavior features at historical moments and the behavior features at the current moment to obtain the first coding result and the second coding result corresponding to the normal behavior features, including: The corresponding encoding results are obtained by sparsely encoding the protocol header field values, timestamp clock offset, and data stream distribution characteristics using three encoders. The corresponding encoding results are concatenated to obtain the first encoding result and the second encoding result of the corresponding normal behavioral characteristics.

4. The behavior detection method for uncontrolled heterogeneous access terminals according to claim 1, characterized in that, Based on the second encoding result and the security behavior fingerprint at the current moment, the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment is calculated using the prediction error and its distribution, including: The scalar values ​​of the second encoding result and the security behavior fingerprint at the current moment are calculated as the prediction error; The probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment is calculated based on the distribution of the prediction error.

5. The behavior detection method for uncontrolled heterogeneous access terminals according to claim 4, characterized in that, The probability of abnormal behavior of uncontrolled heterogeneous access terminals at the current moment is calculated based on the distribution of the prediction error, including: Calculate the distribution of prediction error within the first preset time window and the distribution within the second preset time window; Based on the distribution within the first preset time window and the distribution within the second preset time window, the probability of abnormal behavior at the current moment is calculated using Gaussian tail probability.

6. The behavior detection method for uncontrolled heterogeneous access terminals according to claim 1, characterized in that, Determine whether uncontrolled heterogeneous access terminals exhibit abnormal behavior based on the probability of abnormal behavior at the current moment, including: Determine whether the probability of abnormal behavior at the current moment is greater than or equal to a threshold parameter; If the probability of abnormal behavior at the current moment is greater than or equal to the threshold parameter, then it is determined that the uncontrolled heterogeneous access terminal has abnormal behavior.

7. A behavior detection device for an uncontrolled heterogeneous access terminal, characterized in that, include: The feature extraction module is used to extract the normal behavior features of uncontrolled heterogeneous access terminals at historical moments and the behavior features at the current moment based on the traffic obtained from passive bypass monitoring. The encoding module is used to perform sparse encoding on the normal behavior features of historical moments and the behavior features of the current moment, respectively, to obtain the first encoding result of the corresponding normal behavior features and the second encoding result of the corresponding behavior features; The prediction module is used to predict the security behavior fingerprint at the current moment based on the first encoding result using a cortical learning algorithm; The probability calculation module is used to calculate the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the second encoding result and the security behavior fingerprint at the current moment, using the prediction error and its distribution. The behavior detection module is used to determine whether there is abnormal behavior in uncontrolled heterogeneous access terminals based on the probability of abnormal behavior at the current moment. The prediction module is specifically used to: extract the spatial correlation of the first encoding result using a spatial pooling algorithm, map the normal behavior features of historical moments into vectors with fixed sparsity, and use a sequence memory algorithm to predict the security behavior fingerprint of the current moment from the vectors with fixed sparsity.

8. The behavior detection device for an uncontrolled heterogeneous access terminal according to claim 7, characterized in that, The normal behavior characteristics at historical moments or the behavior characteristics at the current moment include: protocol header field values, timestamp clock deviation, and data stream distribution characteristics.

9. The behavior detection device for an uncontrolled heterogeneous access terminal according to claim 8, characterized in that, The encoding module is specifically used to: perform sparse encoding on the protocol header field values, timestamp clock deviations, and data stream distribution characteristics according to the three encoders to obtain the corresponding encoding results; and concatenate the corresponding encoding results to obtain the first encoding result corresponding to the normal behavior characteristics and the second encoding result corresponding to the behavior characteristics.

10. The behavior detection device for an uncontrolled heterogeneous access terminal according to claim 7, characterized in that, The probability calculation module includes: an error calculation module, used to calculate the scalar value of the second encoding result and the security behavior fingerprint at the current moment as the prediction error; and a probability calculation submodule, used to calculate the probability of abnormal behavior of the uncontrolled heterogeneous access terminal at the current moment based on the distribution of the prediction error.

11. The behavior detection device for an uncontrolled heterogeneous access terminal according to claim 10, characterized in that, The probability calculation submodule is specifically used to: calculate the distribution of prediction error within the first preset time window and the distribution within the second preset time window; and calculate the probability of abnormal behavior at the current moment using Gaussian tail probability based on the distribution within the first preset time window and the distribution within the second preset time window.

12. The behavior detection device for an uncontrolled heterogeneous access terminal according to claim 7, characterized in that, The behavior detection module is specifically used to: determine whether the probability of abnormal behavior at the current moment is greater than or equal to a threshold parameter; if the probability of abnormal behavior at the current moment is greater than or equal to the threshold parameter, then it is determined that the uncontrolled heterogeneous access terminal has abnormal behavior.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the behavior detection method for an uncontrolled heterogeneous access terminal as described in any one of claims 1-6.

14. An electronic device, characterized in that, include: The system includes a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the behavior detection method for an uncontrolled heterogeneous access terminal as described in any one of claims 1-6.

Images