Network anomaly detection methods, devices, electronic equipment and storage media

Abstract

This disclosure provides a method, apparatus, electronic device, and storage medium for detecting abnormal network behavior. The method includes: based on a target time period to be analyzed, determining a subset of group behavior features for each object group within the target object group during the target time period from a set of historical behavior features, wherein the set of historical behavior features characterizes the historical access behavior of objects in the target object group to at least one target system within a preset time interval; for any object group, determining candidate abnormal objects within the object group based on the subset of group behavior features of the object group; for any candidate abnormal object, determining a subset of object behavior features for the candidate abnormal object within the preset time interval from the set of historical behavior features; and determining a target abnormal object from at least one candidate abnormal object based on the subset of object behavior features of the at least one candidate abnormal object. This can improve the detection accuracy of abnormal network behavior.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a method, apparatus, electronic device, and storage medium for detecting abnormal network behavior. Background Technology

[0002] With the continuous development of internet technology, cybersecurity issues have become increasingly serious. Currently, attackers frequently use social engineering to steal accounts belonging to legitimate employees within a company. After gaining access to the company's office network using these stolen accounts, they gradually infiltrate and log into internal systems, stealing data or damaging hosts and company assets. Therefore, how to better detect abnormal behavior on the network, promptly identify unusual events, and take effective measures to enhance network security is a crucial issue facing modern enterprises. Summary of the Invention

[0003] This disclosure provides at least one method, apparatus, electronic device, and storage medium for detecting abnormal network behavior, which can improve the detection accuracy of abnormal network behavior and is better suited for detecting abnormal network behavior of target groups.

[0004] This disclosure provides a method for detecting abnormal network behavior, including:

[0005] Based on the target time period to be analyzed, from the historical behavior feature set of the target object group, a subset of group behavior features of each object group in the target object group within the target time period is determined. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined based on the object tags of objects in the target object group.

[0006] For any object group, candidate abnormal objects in the object group are determined based on a subset of the grouping behavior features of the object group;

[0007] For any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval is determined from the set of historical behavior features;

[0008] The target abnormal object is determined from the at least one candidate abnormal object based on a subset of the object behavior features of at least one candidate abnormal object.

[0009] This disclosure provides a network abnormal behavior detection device, including:

[0010] The first data determination module is used to determine, based on the target time period to be analyzed, a subset of group behavior features of each object group within the target object group within the target time period from the historical behavior feature set of the target object group. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined based on the object tags of objects in the target object group.

[0011] The first anomaly detection module determines candidate anomaly objects in any object group based on a subset of the grouping behavior features of the object group.

[0012] The second data determination module determines, for any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval from the set of historical behavior features;

[0013] The second anomaly detection module is used to determine the target anomaly object from the at least one candidate anomaly object based on a subset of the object behavior features of at least one candidate anomaly object.

[0014] This disclosure provides an electronic device, including a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the network abnormal behavior detection method described in any of the above possible embodiments is executed.

[0015] This disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the network abnormal behavior detection method described in any of the possible embodiments above.

[0016] The network anomaly detection method, apparatus, electronic device, and storage medium provided in this disclosure pre-group objects in the target object group according to object labels, making the subset of group behavior features corresponding to any object group similar, thereby improving the accuracy of detecting candidate anomaly objects that deviate from the object group. Furthermore, for any candidate anomaly object, it is also determined whether the candidate anomaly object is the target anomaly object based on the historical behavior feature set of the candidate anomaly object. That is, through hierarchical detection of group detection and individual detection, the accuracy of determining the target anomaly object can be further improved, thereby helping to improve the applicability of the network anomaly detection method in the target object group environment.

[0017] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 The flowchart shown is a method for detecting abnormal network behavior provided by some embodiments of this disclosure;

[0020] Figure 2 This illustration shows a distribution diagram of user behavior data for different parts and different development sequences provided in some embodiments of this disclosure;

[0021] Figure 3 A flowchart illustrating a method for determining a set of historical behavioral features provided by some embodiments of this disclosure is shown.

[0022] Figure 4 This illustration shows a distribution diagram of the degree of deviation of behavioral feature data of a normal dataset provided in some embodiments of this disclosure;

[0023] Figure 5 This illustration shows a distribution diagram of the degree of deviation of behavioral feature data in an anomalous dataset provided by some embodiments of this disclosure;

[0024] Figure 6 A flowchart of another network anomaly behavior detection method provided by some embodiments of this disclosure is shown;

[0025] Figure 7 This diagram illustrates the structure of a network abnormal behavior detection device provided in some embodiments of the present disclosure;

[0026] Figure 8 This diagram illustrates the structure of another network abnormal behavior detection device provided in some embodiments of the present disclosure;

[0027] Figure 9 A schematic diagram of an electronic device provided by some embodiments of the present disclosure is shown. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0029] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0030] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0031] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0032] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0033] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose whether to "agree" or "disagree" to provide personal information to the electronic device.

[0034] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0035] Currently, attackers frequently use social engineering to steal accounts belonging to legitimate employees within a company. They then use these stolen accounts to access the company's office network, gradually infiltrating and logging into internal systems to steal data, damage hosts, or compromise company assets. When attackers use accounts, multiple unauthorized system access actions occur, subtly different from the account holder's historical access behavior. Therefore, detecting these potentially harmful attacks from anomaly perspectives, identifying abnormal events that threaten the company, and taking effective measures to enhance the security of the company's office network is a crucial research area in the security field.

[0036] Anomalies refer to unexpected changes in a dataset or deviations from expected patterns. Anomaly detection is used to discover such deviations. It involves evaluating a specific behavior to determine whether it conforms to common behavioral habits. If it does not, the behavior is considered deviant, i.e., anomaly behavior has been detected. Specifically, anomaly detection can be used to detect whether an individual's behavior matches that of a group, or to detect whether an individual's current behavior conforms to their historical behavioral habits.

[0037] Research has revealed that current behavior detection methods have a wide range of applications, such as detecting abnormal behavior in general user services, game cheating, and e-commerce risk control. In these scenarios, user actions are typically limited to single service usage, exhibiting strong patterns and making abnormal behavior detection relatively easy. However, in specialized scenarios, such as enterprise office environments, where employees' actions not only change with departmental business but also involve numerous internal systems and dispersed, sporadic behaviors, existing abnormal behavior detection methods struggle to detect anomalies. Even when anomalies are detected, false positives are common, negatively impacting the user experience.

[0038] Based on the above research, this disclosure provides a method for detecting abnormal network behavior. First, based on the target time period to be analyzed, a subset of group behavior features for each object group within the target object group is determined from the historical behavior feature set of the target object group within the target time period. The historical behavior feature set characterizes the historical access behavior of objects in the target object group to at least one target system within a preset time interval, which includes the target time period. The object grouping is determined based on the object tags of the objects in the target object group. Next, for any object group, candidate abnormal objects are determined from the subset of group behavior features of the object group. Then, for any candidate abnormal object, a subset of object behavior features for the candidate abnormal object within the preset time interval is determined from the historical behavior feature set. Finally, a target abnormal object is determined from the at least one candidate abnormal object based on the subset of object behavior features of the candidate abnormal object.

[0039] The network anomaly detection method provided in this embodiment improves the accuracy of detecting candidate anomalies that deviate from the target object group by pre-grouping objects in the target object group according to object labels, making the subset of group behavior features corresponding to any object group similar. Furthermore, for any candidate anomaly object, it is also determined whether the candidate anomaly object is the target anomaly object based on the historical behavior feature set of the candidate anomaly object. That is, through hierarchical detection of group detection and individual detection, the accuracy of determining the target anomaly object can be further improved, thereby helping to improve the applicability of the network anomaly detection method in the target object group environment.

[0040] To facilitate understanding of this embodiment, the executing entity of the network abnormal behavior detection method provided in this disclosure will first be described in detail. The executing entity of the network abnormal behavior detection method provided in this disclosure is an electronic device. This electronic device can be a terminal device or a server. The terminal device can also be a mobile device, a user terminal, a terminal, a handheld device, a computing device, an in-vehicle device, a wearable device, etc. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, big data, and artificial intelligence platforms. In other embodiments, the network abnormal behavior detection method can also be implemented by a processor calling computer-readable instructions stored in memory.

[0041] The network abnormal behavior detection method provided in this application embodiment will be described in detail below with reference to the accompanying drawings. See also Figure 1The diagram shown is a flowchart of a network abnormal behavior detection method provided in an embodiment of this disclosure. The network abnormal behavior detection method includes the following steps S101 to S104:

[0042] S101, based on the target time period to be analyzed, determine the subset of group behavior features of each object group in the target object group within the target time period from the historical behavior feature set of the target object group. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval. The preset time interval includes the target time period. The object grouping is determined based on the object tags of objects in the target object group.

[0043] The target group can include enterprises, institutions, and organizations. In this embodiment, enterprises are used as an example. For instance, the target group can be enterprises in the catering industry, enterprises in the internet industry, or manufacturing enterprises. Furthermore, the number of employees in the enterprise is not limited; it can be a large enterprise with a large number of employees or a small enterprise with a small number of employees.

[0044] Optionally, the at least one target system refers to the systems used by the target group during its operation, including but not limited to various instant messaging applications, data management systems (such as code repositories), file management systems (such as databases), and identity authentication systems. Furthermore, the number of systems associated with the target is not limited; for example, it could be several, dozens, or even hundreds.

[0045] It's understandable that in a corporate office environment, objects from different business lines, departments, and technical tracks typically access different systems. For example, for a business line developing a target application, objects within that department usually access systems related to the target application. Within that department, different technical tracks (such as R&D and sales) will also access different systems. Therefore, objects within the target object group can be pre-grouped according to object tags to obtain multiple object groups. Then, anomaly detection can be performed on any object group based on a subset of its behavioral features, improving the detection accuracy of candidate anomalies.

[0046] See Figure 2 As shown, Figure 2This is a visualization of the dimensionality-reduced system access behavior data of multiple (e.g., 3) users over 60 days. The horizontal and vertical axes have no specific meaning; they only show the similarity between data points. From a departmental perspective, 0 and 1 represent the access behavior of users in department A, 2 represents the access behavior of users in department B, and 3 represents the access behavior of users in department C. From a technology sequence perspective, 0, 1, and 2 represent R&D sequences, and 3 represents non-R&D sequences. Therefore, the study found that access behaviors within the same department and within the same technology sequence are similar.

[0047] Therefore, in some embodiments, the object label may include a department and a technology sequence. That is, the target object group can be divided into multiple object groups with similar business responsibilities and similar technology sequences according to the department and technology sequence to which the object belongs, and the objects in each object group have the same object label.

[0048] Specifically, when grouping objects, the number of objects can be preset to avoid situations where some object groups have too many objects while others have too few.

[0049] For example, the functional structure of the target group can be viewed as a tree. Starting from the root node, it is grouped and calculated according to technical job types. If the number of objects is below the maximum threshold, the node becomes the final department label node, and the tree can be addressed up to the sixth level. Optionally, the object number threshold can be different for different technical sequences. This threshold is determined based on the total number of objects in the corresponding technical sequence and the distribution ratio of the number of access systems of the technical sequence in the overall picture. For example, in Internet companies, the object number threshold for R&D sequences is much smaller than the object number threshold for non-R&D sequences (such as operations).

[0050] The generation process of historical behavior feature sets will be explained in detail below.

[0051] For example, see Figure 3 As shown, the historical behavioral feature set of the target group can be obtained through the following steps S301 to S302.

[0052] S301, Obtain access behavior logs of objects in the target object group for the at least one target system within the preset time interval; the access behavior logs include the object identifiers of each object in the target object group, the time identifiers of each time period within the preset time interval, and the system identifiers of each target system.

[0053] S302, based on the object identifier, the time identifier, and the system identifier, generate a historical behavior feature set for the target object group; wherein, the historical behavior feature set includes multiple historical behavior feature data, and any one of the historical behavior feature data is used to characterize the access behavior of the corresponding object to the at least one target system within a corresponding time period.

[0054] It should be understood that each target system generates system logs during operation. System logs record information about hardware, software, and system problems, and can also monitor events occurring within the system. In practical applications, logs can be used to examine the causes of errors or to find traces left by attackers during attacks. In this embodiment of the disclosure, the acquired logs are mainly access behavior logs related to user access behavior. Specifically, depending on the operation type, the operation types of these access behavior logs can include registration, login, deletion, addition, and other behavior logs.

[0055] Each system saves system logs for a certain period of time after they are generated. Therefore, when obtaining system access behavior logs, you can select logs from a preset time range before the current time according to actual needs. For example, the preset time range can be two months, or more or less, without specific limitations here.

[0056] After obtaining the system's access behavior logs, a historical behavior feature set can be generated based on the access behavior logs to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval.

[0057] Among them, the object identifier can be the object's name, account, identity identifier, etc., used to distinguish different objects; the time identifier can be a specific time period identifier, which can be a day or several hours, depending on the actual needs; the system identifier is an identifier used to distinguish different target systems, which can be the system name or system number, etc.

[0058] Specifically, as shown in Table 1, the access behavior logs can be statistically analyzed according to object identifier, time identifier, and system identifier to generate an access behavior feature matrix. This access behavior feature matrix represents the access behavior logs of users of each object in the target object group for systems 1 to n from January to March 2022. Each row in Table 1 represents a behavioral feature data point. The object identifier and time identifier can be used as data identifiers for each behavioral feature data point to distinguish them. Each system identifier serves as a feature field for each behavioral feature data point.

[0059] Optionally, when generating the historical behavior feature set of the target object group based on the object identifier, the time identifier, and the system identifier, the following (a) to (b) may be included:

[0060] (a) For any object in the target object group, determine the system access resource information of the object to the at least one target system in each time period based on a preset rule;

[0061] (b) Based on the object identifier of each object, the time identifier corresponding to each time period within the preset time interval, the system identifier of each target system, and the system access resource information of each object for each target system in the corresponding time period, a historical behavior feature set of the target object group is generated.

[0062] The system access resource information of the target system is also the feature value of the aforementioned feature field.

[0063] Specifically, the weight information of any target system can be obtained first, and the weight information is used to characterize the importance of the target system. Then, for any object in the target object group, the system access information of the object for at least one target system in each time period can be determined based on the access behavior log of the object. The system access information includes the number of system accesses and the type of system operation. Then, based on the system access information of the object for at least one target system in each time period and the weight information corresponding to each target system, the system access resource information of the object for at least one target system in each time period can be determined. For example, after calculation, the system access resource information (also called feature value) of object 1 (object identifier) ​​for system 2 (system identifier) ​​on 2022-01-02 (time identifier) ​​is 733.

[0064] The weight information can be positively correlated with the importance of the operation type. For example, since deleting content will bring certain risks (high importance), the operation type of "delete" can be given a higher weight information, while the operation types of "login" and "register" have lower risks and can be given a lower weight information.

[0065] In this embodiment of the disclosure, by combining weight information to determine the system access resource information of the object to the at least one target system in each time period, the accuracy of determining the system access resource information of different objects to each target system in the corresponding time period can be improved, which is conducive to improving the accuracy of subsequent anomaly detection.

[0066] Table 1

[0067] Object identifier Time stamp System 1 System 2 System 3 System n Object 1 2022-01-02 0 733 3 0 Object 1 … … … … … Object 1 2022-03-30 0 1356 12 0 Object 2 2022-01-02 0 1310 100 0 Object 2 … … … … … Object 2 2022-03-30 0 1200 108 0 object n 2022-01-02 0 0 50 80 object n … … … … … object n 2022-03-30 0 0 80 90

[0068] The target time period to be analyzed can be determined based on the current time, such as the time period to which the current time belongs, or the user can specify the target time period to be analyzed. The specific time period can be determined according to actual needs.

[0069] Based on the above analysis, after determining the target time period to be analyzed, the subset of group behavior features of each object group of the target object group within the target time period can be determined from the historical behavior feature set based on the time identifier corresponding to the target time period and the object identifier in each object group.

[0070] The following uses March 30, 2022 as an example to illustrate the process of determining the subset of grouped behavioral features corresponding to any object group. For example, regarding Table 1, firstly, all behavioral feature data corresponding to the time identifier 2022-03-30 of the target time period can be selected to form a candidate behavioral feature dataset. Then, for any object group, the behavioral feature data corresponding to the object identifiers (such as object 1 to object 50) of the objects contained in that object group are selected from the candidate behavioral feature dataset, thereby obtaining the subset of grouped behavioral features corresponding to the object group.

[0071] S102, for any object group, determine the candidate abnormal objects in the object group based on the subset of grouping behavior features of the object group.

[0072] For example, since the subset of grouping behavior features of the object group includes the behavior feature data of any object in the object group corresponding to the target time period, when determining the candidate abnormal object in the object group based on the subset of grouping behavior features of the object group, the following (1) to (2) may be included:

[0073] (1) For any object in the object group, determine the first degree of abnormality information of the object based on the behavioral feature data corresponding to the object;

[0074] (2) Based on the first abnormality information of each object in the object group, determine the candidate abnormal objects in the object group.

[0075] The process of determining candidate abnormal objects from the object group can be understood as the process of selecting objects that deviate from the group baseline. The group baseline can be understood as the benchmark data (i.e., mean data) of the group behavioral feature subset. Each group behavioral feature subset corresponds to a group baseline, and the group baselines of different group behavioral feature subsets can be different.

[0076] Specifically, regarding step (1) above, when determining the first degree of abnormality information of any object in the object group based on the behavioral feature data corresponding to the object, the following (1.1) to (1.2) may be included:

[0077] (1.1) For any object in the object group, based on a preset anomaly detection algorithm, determine the right tail probability of any target system in the behavioral feature data corresponding to the object, wherein the right tail probability refers to the probability that the system access resource information of the target system is the maximum value;

[0078] (1.2) Based on the right tail probability of each target system in the behavioral feature data corresponding to the object, determine the first degree of abnormality information of the object.

[0079] The first anomaly information can be understood as the anomaly value of any candidate anomaly object's access behavior deviating from the group baseline.

[0080] For example, anomaly detection algorithms can be used to determine a set of candidate outliers that deviate from the population baseline. For instance, a statistical ECOD-based outlier detection algorithm can be used to determine this set; that is, outliers can be obtained by summing the tail probabilities.

[0081] In enterprise office network intrusion scenarios, attackers need to explore laterally and access more systems to obtain more information and data. The attacker's risk is directly proportional to the amount of system access resources. Therefore, the right-tail probability is more suitable for this scenario. Specifically, for each target system in the behavioral feature data corresponding to any candidate abnormal object, the system access resource information of each target system can be compared with the system access resource information of the same target system in other behavioral feature data to obtain the right-tail probability of the target system under the behavioral feature data. Then, based on the right-tail probabilities of each target system in the behavioral feature data, the first degree of abnormality information of the object can be determined.

[0082] Optionally, when determining the first degree of anomaly information, the weight information of each target system can also be combined. That is, for the behavioral feature data of any candidate anomalous object, the sum of the right-tail probabilities of each target system corresponding to the behavioral feature data and the weight products of the target systems can be accumulated to obtain the first degree of anomaly information. In this way, the first degree of anomaly information determined by the right-tail probabilities of each target system in the behavioral feature data corresponding to the object can be more applicable to target object group scenarios.

[0083] Research has revealed differences in the distribution of deviations in behavioral feature data between normal datasets and datasets containing anomalies. For example... Figures 4-5 As shown, where Figure 4 This is a distribution chart showing the degree of deviation of behavioral feature data from a normal dataset. Figure 5 A distribution plot showing the degree of deviation of behavioral feature data in a dataset with anomalies, through... Figure 4 and Figure 5 It can be seen that the deviation of outliers (abnormal behavior feature data) in the abnormal dataset is greater than the deviation of the overall data.

[0084] Therefore, in some embodiments, when determining candidate abnormal objects in the object group based on the first abnormality information of each object in the object group in step (2) above, the following (2.1) to (2.3) may be included:

[0085] (2.1) Determine the first abnormality average and the first abnormality standard deviation of the first abnormality information of each object in the object group;

[0086] (2.2) For any object in the object group, based on the first abnormal average value and the first abnormal standard deviation, determine whether the first abnormality information of the object meets the first preset condition;

[0087] (2.3) If the first abnormality information of the object satisfies the first preset condition, the object is determined to be the candidate abnormal object.

[0088] Specifically, when determining candidate abnormal objects, for the behavioral feature data corresponding to any object in the object group, the deviation value k (first abnormality information) of behavioral feature data d1 can be determined, along with the standard deviation σ1 (first abnormality standard deviation) and the average value m (first abnormality average value) of the deviation values ​​of the overall behavioral feature data in the grouped behavioral feature subset. If km > n*σ1 and n > 2, then it is determined whether the first abnormality information of the object meets the first preset condition, and the object corresponding to the behavioral feature data d1 is designated as a candidate abnormal object. The value of n can be determined according to the actual situation, but is specifically limited here.

[0089] Optionally, for any subset of grouped behavioral features, to improve data processing efficiency, before determining the first degree of anomaly information for each behavioral feature data in the subset, the acquired subset of grouped behavioral features can be filtered to remove the feature fields corresponding to target system identifiers that have not been accessed, resulting in the filtered subset of grouped behavioral features. Then, for each behavioral feature data in the filtered subset of grouped behavioral features, the first degree of anomaly information for each behavioral feature data is determined. For example, for target system 1 in Table 1, since it has not been accessed by the object, the feature fields corresponding to target system 1 can be removed.

[0090] In addition, the filtered subset of grouped behavioral features can be normalized, and then anomaly detection can be performed based on the normalized subset of grouped behavioral features.

[0091] S103, for any candidate abnormal object, determine a subset of the object behavior features of the candidate abnormal object within the preset time interval from the set of historical behavior features.

[0092] Specifically, referring to Table 1, if object 1 is a candidate abnormal object, then behavioral feature data before and including the target time period (March 30, 2022) are obtained from the historical behavioral feature set to obtain the object behavioral feature subset corresponding to object 1.

[0093] S104, determine the target abnormal object from the at least one candidate abnormal object based on the object behavior feature subset of at least one candidate abnormal object.

[0094] The process of identifying the target anomalous object from at least one candidate anomalous object can be understood as determining, for any candidate anomalous object, whether the behavioral feature data of the target time period corresponding to that anomalous object deviates from the historical baseline of the subset of object behavioral features corresponding to that candidate anomalous object. This historical baseline is similar to the aforementioned group baseline, differing only in name due to the different datasets used; it will not be elaborated upon here.

[0095] For example, since the subset of object behavior features corresponding to the candidate abnormal object includes the historical behavior feature data of the candidate abnormal object corresponding to each time period within the preset time interval; therefore, when determining the target abnormal object from the at least one candidate abnormal object based on the subset of object behavior features of at least one candidate abnormal object, the following (I) to (II) may be included:

[0096] (I) For any candidate abnormal object, based on any historical behavior feature data corresponding to the candidate object, determine the second degree of abnormality information of the historical behavior data;

[0097] (II) Based on the second degree of abnormality information corresponding to each historical behavioral feature data of the candidate abnormal object, determine whether the candidate abnormal object is the target abnormal object.

[0098] Regarding step (I) above, when determining the second anomaly degree information of the historical behavior data based on any historical behavior feature data corresponding to the candidate object, the following (II) to (I.II) may be included:

[0099] (II) For any historical behavior data, based on a preset anomaly detection algorithm, determine the right tail probability of any target system in the historical behavior feature data;

[0100] (I.II) Based on the right tail probability of each target system in the historical behavior feature data, determine the second anomaly information of the historical behavior data.

[0101] Regarding step (II) above, when determining whether a candidate abnormal object is the target abnormal object based on the second abnormality information corresponding to each historical behavioral feature data of the candidate abnormal object, the following (II.I) to (II.IV) may be included:

[0102] (II.I) Determine the second anomalous mean and second anomalous standard deviation of the second anomalousness information of each historical behavioral characteristic data of the candidate anomalous object;

[0103] (II.II) For any historical behavioral feature data, based on the second abnormal average value and the second abnormal standard deviation, determine whether the second abnormality information of the historical behavioral feature data meets the second preset condition;

[0104] (II.III) If the second abnormality information corresponding to the historical behavior feature data meets the second preset condition, the historical behavior feature data shall be determined as abnormal behavior feature data.

[0105] (II.IV) If the historical behavioral feature data of the target time period corresponding to the candidate abnormal object is the abnormal behavioral feature data, the candidate abnormal object shall be determined as the target abnormal object.

[0106] It should be noted that the detailed process of step S104 can be found in the description of the process of determining candidate abnormal objects in step S102. The process of determining abnormalities is similar in both cases, only the datasets are different.

[0107] See Figure 6The diagram shows a flowchart of another network abnormal behavior detection method provided in this embodiment of the present disclosure, which includes the following steps S601 to S604:

[0108] S601, based on the target time period to be analyzed, determine the subset of group behavior features of each object group in the target object group within the target time period from the historical behavior feature set of the target object group, wherein the historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined according to the object tags of objects in the target object group.

[0109] This step is similar to the aforementioned step S101, and will not be described again here.

[0110] S602, based on the subset of grouping behavior features of the object group, determine the candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects.

[0111] Unlike step S102, this step, in addition to identifying candidate exception objects, further identifies the first abnormal system access information of the candidate exception object. That is, while identifying the candidate exception object, it is also possible to identify the system access information that caused the exception.

[0112] For example, when determining candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects based on a subset of grouping behavior features of the object group, the following may be included:

[0113] Based on the first degree of abnormality information of the behavioral feature data corresponding to each object in the object group, candidate abnormal objects in the object group are determined.

[0114] Based on the system access resource information of each candidate abnormal object for each target system during the target time period, the first abnormal system access information of any candidate abnormal object is determined.

[0115] For example, please refer to Table 1 again. If, when object 2 is a candidate abnormal object, the system access resource information (1356) of object 1 for system 2 during the target time period (March 30, 2011) is significantly higher than the system access resource information for system 2 at other times (around 733), then it can be determined that the access behavior for system 2 is the object that caused object 1 to generate an abnormality during the target time period.

[0116] It should be noted that, similar to determining the first degree of anomaly information, when determining candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects based on the subset of grouping behavior features of the object group, the following may be included:

[0117] For each candidate behavioral feature data, based on the system access resource information corresponding to each target system in the candidate behavioral feature data, the deviation degree information of each target system in the candidate behavioral feature data is determined;

[0118] Determine the first deviation mean and the first deviation standard deviation for each target system in the subset of grouped behavioral characteristics;

[0119] For each target system, based on the deviation degree information, the first deviation average value, and the first deviation standard deviation, it is determined whether the deviation degree information of the target system meets the first preset requirement, and if the deviation degree information of the target system meets the first preset requirement, it is determined that the target system is included in the first abnormal system access information.

[0120] For example, when determining the first abnormal system access information, for any target system f, the deviation information of the target system f for any behavioral feature data d2 is q. The standard deviation σ2 (first deviation standard deviation) and the mean p (first deviation mean) of the target system f of the grouped behavioral feature subset are given. If there exists qp > n*σ2 and n > 1, then the target system f is determined to meet the first preset requirement and is identified as the first abnormal system access information. Since the deviation value of the overall behavioral data corresponding to the object has a larger range, the minimum value of n is different for the two.

[0121] S603, for any candidate abnormal object, determine a subset of the object behavior features of the candidate abnormal object within the preset time interval from the set of historical behavior features.

[0122] This step is similar to step S103 mentioned above, and will not be described again here.

[0123] S604, based on the object behavior feature subset of the at least one candidate abnormal object, determine the target abnormal object and the second abnormal system access information of the target abnormal object from the at least one candidate abnormal object, and for any target abnormal object, generate target abnormal system access information for the target abnormal object based on the first abnormal system access information and the second abnormal system access information of the target abnormal object.

[0124] This step differs from step S104 in that, in addition to determining the target abnormal object, it also determines the second abnormal system access information of the target abnormal object, and generates target abnormal system access information for the target abnormal object based on the first and second abnormal system access information. For example, if the first abnormal system access information includes system 2 and system 5, and the second abnormal system access information includes system 2 and system 3, then the target abnormal system access information includes system 3. That is, the target abnormal system access information is the intersection of the first and second abnormal system access information.

[0125] In this embodiment of the disclosure, not only can the target abnormal object be identified, but also the target abnormal system access information of the target abnormal object can be identified, thereby clarifying the system with risks and helping to improve the targeting of the detection.

[0126] Specifically, determining the target abnormal object and the target abnormal object's second abnormal system access information from the at least one candidate abnormal object based on a subset of the object behavior features of the at least one candidate abnormal object includes:

[0127] For any candidate abnormal object, based on the second abnormality information of each historical behavioral feature data corresponding to the candidate object, it is determined whether the candidate abnormal object is the target abnormal object;

[0128] For any target abnormal object, based on the system access resource information of the target abnormal object to each target system within the preset time interval, the second abnormal system access information of the target abnormal object is determined.

[0129] This process is similar to the aforementioned process of determining the first abnormal system access information, and will not be described in detail here.

[0130] In this embodiment, since objects in the target object group are pre-grouped according to object labels, the subset of behavioral features corresponding to any object group has similarity, thereby improving the accuracy of detecting candidate abnormal objects that deviate from the object group. Furthermore, for any candidate abnormal object, it is also determined whether the candidate abnormal object is the target abnormal object based on the candidate abnormal object's historical behavioral feature set. That is, through hierarchical detection of group detection and individual detection, the accuracy of determining the target abnormal object can be further improved, thereby helping to improve the applicability of the network anomaly detection method in the target object group environment. In other words, this embodiment, considering the diversity of enterprise business structure and internal systems, as well as the sporadic nature of enterprise user behavior, constructs a behavior matrix of all enterprise users accessing all enterprise systems, combines business lines and technical jobs to group similar business behaviors, and performs hierarchical anomaly detection from two levels: deviation from group anomaly and deviation from individual anomaly, to improve the detection accuracy of abnormal behavior.

[0131] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0132] Based on the same technical concept, this disclosure also provides a network abnormal behavior detection device corresponding to the network abnormal behavior detection method. Since the principle of the device in this disclosure is similar to that of the network abnormal behavior detection method described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0133] Reference Figure 7 The diagram shown is a schematic of a network abnormal behavior detection device 500 provided in an embodiment of this disclosure. The device includes:

[0134] The first data determination module 701 is used to determine, based on the target time period to be analyzed, a subset of group behavior features of each object group of the target object group within the target time period from the historical behavior feature set of the target object group. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval. The preset time interval includes the target time period. The object grouping is determined based on the object tags of the objects in the target object group.

[0135] The first anomaly detection module 702 determines candidate abnormal objects in any object group based on a subset of the grouping behavior features of the object group.

[0136] The second data determination module 703 determines, for any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval from the set of historical behavior features;

[0137] The second anomaly detection module 704 is used to determine the target anomaly object from the at least one candidate anomaly object based on a subset of object behavior features of at least one candidate anomaly object.

[0138] In one possible implementation, see Figure 8 As shown, the device further includes:

[0139] The log information acquisition module 705 is used to acquire access behavior logs of objects in the target object group for the at least one target system within the preset time interval; the access behavior logs include the object identifiers of each object in the target object group, the time identifiers of each time period within the preset time interval, and the system identifiers of each target system.

[0140] The feature data generation module 706 is used to generate a historical behavior feature set of the target object group based on the object identifier, the time identifier, and the system identifier; wherein, the historical behavior feature set includes multiple historical behavior feature data, and any one of the historical behavior feature data is used to characterize the access behavior of the corresponding object to the at least one target system within a corresponding time period.

[0141] In one possible implementation, the feature data generation module 706 is specifically used for:

[0142] For any object in the target object group, the system access resource information of the object to the at least one target system in each time period is determined based on preset rules;

[0143] Based on the object identifiers of each object, the time identifiers corresponding to each time period within the preset time interval, the system identifiers of each target system, and the system access resource information of each object to each target system in the corresponding time period, a historical behavior feature set of the target object group is generated.

[0144] In one possible implementation, the subset of grouped behavioral features of the object group includes behavioral feature data of any object in the object group corresponding to the target time period; the first anomaly detection module 702 is specifically used for:

[0145] For any object in the object group, based on the behavioral feature data corresponding to the object, determine the first degree of abnormality information of the object;

[0146] Based on the first degree of abnormality information of each object in the object group, candidate abnormal objects in the object group are determined.

[0147] In one possible implementation, any of the behavioral feature data includes system access resource information of the object to the respective target systems during the target time period, and the first anomaly detection module 702 is specifically used for:

[0148] For any object in the object group, based on a preset anomaly detection algorithm, determine the right tail probability of any target system in the behavioral feature data corresponding to the object. The right tail probability of the target system refers to the probability that the system access resource information of the target system is at its maximum value.

[0149] Based on the right tail probabilities of each target system in the behavioral feature data corresponding to the object, the first degree of anomaly information of the object is determined.

[0150] In one possible implementation, the first anomaly detection module 702 is specifically used for:

[0151] Determine the first anomalous mean and the first anomalous standard deviation of the first anomalousness information for each object in the object group;

[0152] For any object in the object group, based on the first abnormal average value and the first abnormal standard deviation, determine whether the first abnormality information of the object meets the first preset condition;

[0153] If the first abnormality information of the object meets the first preset condition, the object is determined to be the candidate abnormal object.

[0154] In one possible implementation, the subset of object behavior features corresponding to the candidate abnormal object includes historical behavior feature data of the candidate abnormal object corresponding to each time period within the preset time interval; the second anomaly detection module 704 is specifically used for:

[0155] The step of determining the target abnormal object from at least one candidate abnormal object based on a subset of object behavior features of at least one candidate abnormal object includes:

[0156] For any candidate abnormal object, based on any historical behavioral feature data corresponding to the candidate object, determine the second degree of abnormality information of the historical behavioral data;

[0157] Based on the second degree of abnormality information corresponding to each historical behavioral feature data of the candidate abnormal object, it is determined whether the candidate abnormal object is the target abnormal object.

[0158] In one possible implementation, the historical behavioral feature data includes system access resource information of the candidate abnormal object to each target system during various time periods within the preset time interval; the second anomaly detection module 704 is specifically used for:

[0159] For any historical behavior data, based on a preset anomaly detection algorithm, the right tail probability of any target system in the historical behavior feature data is determined; the right tail probability of the target system refers to the probability that the system access resource information of the target system is at its maximum value.

[0160] Based on the right tail probability of each target system in the historical behavioral feature data, the second anomaly information of the historical behavioral data is determined.

[0161] In one possible implementation, the second anomaly detection module 704 is specifically used for:

[0162] Determine the second anomalous mean and second anomalous standard deviation of the second anomalousness information of each historical behavioral feature data of the candidate anomalous object;

[0163] For any historical behavioral feature data, based on the second abnormal average value and the second abnormal standard deviation, determine whether the second abnormality information of the historical behavioral feature data meets the second preset condition;

[0164] If the second abnormality information corresponding to the historical behavioral feature data meets the second preset condition, the historical behavioral feature data will be determined as abnormal behavioral feature data.

[0165] If the historical behavioral feature data of the target time period corresponding to the candidate abnormal object is the abnormal behavioral feature data, the candidate abnormal object is determined as the target abnormal object.

[0166] In one possible implementation, the first anomaly detection module 702 is specifically used for:

[0167] Based on the subset of grouping behavior features of the object group, determine the candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects;

[0168] The second anomaly detection module 704 is specifically used for:

[0169] Based on a subset of object behavior features of the at least one candidate abnormal object, a target abnormal object and the second abnormal system access information of the target abnormal object are determined from the at least one candidate abnormal object.

[0170] For any target abnormal object, target abnormal system access information is generated based on the first abnormal system access information and the second abnormal system access information of the target abnormal object.

[0171] In one possible implementation, the subset of grouped behavioral features of the object group includes behavioral feature data corresponding to any object in the object group during the time period, and each piece of behavioral feature data includes system access resource information of the object for each target system during the target time period; the first anomaly detection module 702 is specifically used for:

[0172] Based on the first degree of abnormality information of the behavioral feature data corresponding to each object in the object group, candidate abnormal objects in the object group are determined.

[0173] Based on the system access resource information of each candidate abnormal object for each target system during the target time period, the first abnormal system access information of any candidate abnormal object is determined.

[0174] In one possible implementation, the subset of object behavior features corresponding to the candidate abnormal object includes historical behavior feature data of the candidate abnormal object corresponding to each time period within the preset time interval, and each piece of historical behavior feature data includes system access resource information of the candidate abnormal object for each target system within the corresponding time period within the preset time interval; the second anomaly detection module 704 is specifically used for:

[0175] For any candidate abnormal object, based on the second abnormality information of each historical behavioral feature data corresponding to the candidate object, it is determined whether the candidate abnormal object is the target abnormal object;

[0176] For any target abnormal object, based on the system access resource information of the target abnormal object to each target system within the preset time interval, the second abnormal system access information of the target abnormal object is determined.

[0177] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0178] Based on the same technical concept, this disclosure also provides an electronic device. (Refer to...) Figure 9The diagram shows the structure of an electronic device 900 provided in this embodiment of the present disclosure, including a processor 901, a memory 902, and a bus 903. The memory 902 stores execution instructions and includes a main memory 9021 and an external memory 9022. The main memory 9021, also called internal memory, is used to temporarily store computational data in the processor 901, as well as data exchanged with external memory 9022 such as a hard disk. The processor 901 exchanges data with the external memory 9022 through the main memory 9021.

[0179] In this embodiment, the memory 902 is specifically used to store application code that executes the solution of this application, and its execution is controlled by the processor 901. That is, when the electronic device 900 is running, the processor 901 communicates with the memory 902 through the bus 903, so that the processor 901 executes the application code stored in the memory 902, and then executes the method described in any of the foregoing embodiments.

[0180] The memory 902 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0181] Processor 901 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor.

[0182] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 900. In other embodiments of this application, the electronic device 900 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0183] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the network abnormal behavior detection method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0184] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the network abnormal behavior detection method in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0185] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0186] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0187] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0188] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0189] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0190] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A method for detecting abnormal network behavior, characterized in that, include: Based on the target time period to be analyzed, from the historical behavior feature set of the target object group, a subset of group behavior features of each object group in the target object group within the target time period is determined. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined based on the object tags of objects in the target object group. For any object group, candidate abnormal objects in the object group are determined based on a subset of the grouping behavior features of the object group; For any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval is determined from the set of historical behavior features; The target abnormal object is determined from the at least one candidate abnormal object based on a subset of the object behavior features of at least one candidate abnormal object. Wherein, the subset of grouping behavior features of the object group includes the behavior feature data of any object in the object group corresponding to the target time period; the step of determining candidate abnormal objects in the object group based on the subset of grouping behavior features of the object group includes: For any object in the object group, based on the behavioral feature data corresponding to the object, determine the first degree of abnormality information of the object; Based on the first degree of abnormality information of each object in the object group, candidate abnormal objects in the object group are determined.

2. The method according to claim 1, characterized in that, The historical behavioral feature set of the target group is obtained through the following steps: Obtain access behavior logs of objects in the target object group for at least one target system within the preset time interval; the access behavior logs include the object identifier of each object in the target object group, the time identifier of each time period within the preset time interval, and the system identifier of each target system. Based on the object identifier, the time identifier, and the system identifier, a historical behavior feature set of the target object group is generated; wherein, the historical behavior feature set includes multiple historical behavior feature data, and any one of the historical behavior feature data is used to characterize the access behavior of the corresponding object to the at least one target system within a corresponding time period.

3. The method according to claim 2, characterized in that, The step of generating a historical behavior feature set for the target object group based on the object identifier, the time identifier, and the system identifier includes: For any object in the target object group, the system access resource information of the object to the at least one target system in each time period is determined based on preset rules; Based on the object identifiers of each object, the time identifiers corresponding to each time period within the preset time interval, the system identifiers of each target system, and the system access resource information of each object to each target system in the corresponding time period, a historical behavior feature set of the target object group is generated.

4. The method according to claim 1, characterized in that, Any of the behavioral feature data includes system access resource information of the object to each target system during the target time period. The step of determining the first degree of anomaly information of any object in the object group, based on the behavioral feature data corresponding to the object, includes: For any object in the object group, based on a preset anomaly detection algorithm, determine the right tail probability of any target system in the behavioral feature data corresponding to the object. The right tail probability of the target system refers to the probability that the system access resource information of the target system is at its maximum value. Based on the right tail probabilities of each target system in the behavioral feature data corresponding to the object, the first degree of anomaly information of the object is determined.

5. The method according to claim 1, characterized in that, The step of determining candidate abnormal objects in the object group based on the first degree of abnormality information of each object in the object group includes: Determine the first anomalous mean and the first anomalous standard deviation of the first anomalousness information for each object in the object group; For any object in the object group, based on the first abnormal average value and the first abnormal standard deviation, determine whether the first abnormality information of the object meets the first preset condition; If the first abnormality information of the object meets the first preset condition, the object is determined to be the candidate abnormal object.

6. The method according to claim 1, characterized in that, The subset of object behavior features corresponding to the candidate abnormal object includes the historical behavior feature data of the candidate abnormal object in each time period within the preset time interval. The step of determining the target abnormal object from at least one candidate abnormal object based on a subset of object behavior features of at least one candidate abnormal object includes: For any candidate abnormal object, based on any historical behavioral feature data corresponding to the candidate abnormal object, determine the second degree of abnormality information of the historical behavioral feature data; Based on the second degree of abnormality information corresponding to each historical behavioral feature data of the candidate abnormal object, it is determined whether the candidate abnormal object is the target abnormal object.

7. The method according to claim 6, characterized in that, The historical behavioral feature data includes system access resource information of the candidate abnormal object to each target system within the corresponding time period of the preset time interval; the step of determining the second abnormality information of the historical behavioral feature data based on any historical behavioral feature data corresponding to the candidate abnormal object includes: For any historical behavioral feature data, based on a preset anomaly detection algorithm, the right tail probability of any target system in the historical behavioral feature data is determined; the right tail probability of the target system refers to the probability that the system access resource information of the target system is at its maximum value. Based on the right tail probability of each target system in the historical behavioral feature data, the second anomaly information of the historical behavioral feature data is determined.

8. The method according to claim 6, characterized in that, The step of determining whether a candidate abnormal object is the target abnormal object based on the second abnormality information corresponding to each historical behavioral feature data of the candidate abnormal object includes: Determine the second anomalous mean and second anomalous standard deviation of the second anomalousness information of each historical behavioral feature data of the candidate anomalous object; For any historical behavioral feature data, based on the second abnormal average value and the second abnormal standard deviation, determine whether the second abnormality information of the historical behavioral feature data meets the second preset condition; If the second abnormality information corresponding to the historical behavioral feature data meets the second preset condition, the historical behavioral feature data will be determined as abnormal behavioral feature data. If the historical behavioral feature data of the target time period corresponding to the candidate abnormal object is the abnormal behavioral feature data, the candidate abnormal object is determined as the target abnormal object.

9. A method for detecting abnormal network behavior, characterized in that, include: Based on the target time period to be analyzed, from the historical behavior feature set of the target object group, a subset of group behavior features of each object group in the target object group within the target time period is determined. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined based on the object tags of objects in the target object group. For any object group, candidate abnormal objects in the object group are determined based on a subset of the grouping behavior features of the object group; For any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval is determined from the set of historical behavior features; The target abnormal object is determined from the at least one candidate abnormal object based on a subset of the object behavior features of at least one candidate abnormal object. The step of determining candidate abnormal objects in the object group based on a subset of the grouping behavior features of the object group includes: Based on the subset of grouping behavior features of the object group, determine the candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects; The step of determining the target abnormal object from at least one candidate abnormal object based on a subset of object behavior features of at least one candidate abnormal object includes: Based on the subset of object behavior features of the at least one candidate abnormal object, determine the target abnormal object and the second abnormal system access information of the target abnormal object from the at least one candidate abnormal object; For any target abnormal object, target abnormal system access information is generated based on the first abnormal system access information and the second abnormal system access information of the target abnormal object.

10. The method according to claim 9, characterized in that, The subset of grouping behavior features of the object group includes the behavior feature data of any object in the object group corresponding to the target time period, and each piece of behavior feature data includes the system access resource information of the object for each target system in the target time period. The step of determining candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects based on a subset of the grouping behavior features of the object group includes: Based on the first degree of abnormality information of the behavioral feature data corresponding to each object in the object group, candidate abnormal objects in the object group are determined. Based on the system access resource information of each candidate abnormal object to each target system within the target time period, determine the first abnormal system access information of any candidate abnormal object.

11. The method according to claim 9, characterized in that, The subset of object behavior features corresponding to the candidate abnormal object includes historical behavior feature data of the candidate abnormal object in each time period within the preset time interval. Each piece of historical behavior feature data includes system access resource information of the candidate abnormal object for each target system in the corresponding time period within the preset time interval. The step of determining the target abnormal object and the second abnormal system access information of the target abnormal object from the at least one candidate abnormal object based on a subset of object behavior features of the at least one candidate abnormal object includes: For any candidate abnormal object, based on the second abnormality information of each historical behavioral feature data corresponding to the candidate abnormal object, it is determined whether the candidate abnormal object is the target abnormal object; For any target abnormal object, based on the system access resource information of the target abnormal object to each target system within the preset time interval, the second abnormal system access information of the target abnormal object is determined.

12. A network abnormal behavior detection device, characterized in that, include: The first data determination module is used to determine, based on the target time period to be analyzed, a subset of group behavior features of each object group within the target object group within the target time period from the historical behavior feature set of the target object group. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined based on the object tags of objects in the target object group. The first anomaly detection module determines candidate anomaly objects in any object group based on a subset of the grouping behavior features of the object group. The second data determination module determines, for any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval from the set of historical behavior features; The second anomaly detection module is used to determine the target anomaly object from the at least one candidate anomaly object based on a subset of the object behavior features of at least one candidate anomaly object. Wherein, the subset of grouping behavior features of the object group includes the behavior feature data of any object in the object group corresponding to the target time period; the step of determining candidate abnormal objects in the object group based on the subset of grouping behavior features of the object group includes: For any object in the object group, based on the behavioral feature data corresponding to the object, determine the first degree of abnormality information of the object; Based on the first degree of abnormality information of each object in the object group, candidate abnormal objects in the object group are determined.

13. A network abnormal behavior detection device, characterized in that, include: The first data determination module is used to determine, based on the target time period to be analyzed, a subset of group behavior features of each object group within the target object group within the target time period from the historical behavior feature set of the target object group. The historical behavior feature set is used to characterize the historical access behavior of objects in the target object group to at least one target system within a preset time interval, the preset time interval including the target time period, and the object grouping is determined based on the object tags of objects in the target object group. The first anomaly detection module determines candidate anomaly objects in any object group based on a subset of the grouping behavior features of the object group. The second data determination module determines, for any candidate abnormal object, a subset of the object behavior features of the candidate abnormal object within the preset time interval from the set of historical behavior features; The second anomaly detection module is used to determine the target anomaly object from the at least one candidate anomaly object based on a subset of the object behavior features of at least one candidate anomaly object. The step of determining candidate abnormal objects in the object group based on a subset of the grouping behavior features of the object group includes: Based on the subset of grouping behavior features of the object group, determine the candidate abnormal objects in the object group and the first abnormal system access information of the candidate abnormal objects; The step of determining the target abnormal object from at least one candidate abnormal object based on a subset of object behavior features of at least one candidate abnormal object includes: Based on the subset of object behavior features of the at least one candidate abnormal object, determine the target abnormal object and the second abnormal system access information of the target abnormal object from the at least one candidate abnormal object; For any target abnormal object, target abnormal system access information is generated based on the first abnormal system access information and the second abnormal system access information of the target abnormal object.

14. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the network abnormal behavior detection method as described in any one of claims 1-11 is performed.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the network abnormal behavior detection method as described in any one of claims 1-11.

Images