A method, apparatus, device and medium for identifying malicious network behavior
By using a fusion model of adversarial neural networks and anomaly behavior detectors, and through adversarial training of the generator and discriminator, high-fidelity samples are generated, the problems of low accuracy and high cost in identifying malicious network behavior are solved, achieving efficient and low-cost malicious behavior identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XIAN SECLOVER INFORMATION TECH CO LTD
- Filing Date
- 2023-07-31
- Publication Date
- 2026-07-17
AI Technical Summary
Existing methods for identifying malicious network behaviors face problems of low accuracy and high cost in the era of big data and AI. They are particularly ineffective in identifying emerging and unknown malicious behaviors, and traditional methods require a large amount of labeled data for training, resulting in poor generalization performance.
A fusion model of adversarial neural networks and anomaly behavior recognizers is adopted. Through adversarial training of the generator and discriminator, a large number of highly realistic samples are generated to train and update the anomaly behavior recognizer until the classification accuracy of the discriminator reaches the preset accuracy, forming an intermediate anomaly behavior recognizer, which is used to identify malicious behavior in network behavior logs.
It improves the accuracy of identifying malicious network behavior, reduces training costs, eliminates the need for manual annotation, improves training efficiency, and alleviates the problem of insufficient data sources.
Smart Images
Figure CN117278246B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and medium for identifying malicious network behavior. Background Technology
[0002] Network malicious behavior identification is an important research direction in the field of cybersecurity, involving the detection and classification of malicious, abnormal, and attack behaviors on networks. In the era of big data and AI, network malicious behavior identification has become more challenging than before. Traditional identification technologies, solutions, and experience are proving inadequate against current malicious behaviors, leading to low efficiency, insufficient accuracy, high false alarm rates, and frequent network security incidents.
[0003] Currently, network malicious behavior identification is based on machine learning, but this method requires a large amount of labeled data for training. It is difficult to obtain enough labeled samples for emerging and unknown malicious behaviors, resulting in poor generalization performance. It is not accurate enough for rare behaviors and is also costly. Summary of the Invention
[0004] This application provides a method, apparatus, device, and medium for identifying malicious network behavior, which can solve the problems of low accuracy and high cost in identifying malicious network behavior.
[0005] To achieve the above objectives, this application adopts the following technical solution:
[0006] A first aspect of this application provides a method for identifying malicious network behavior, the method comprising:
[0007] Obtain multiple network behavior logs, including logs showing malicious behavior and logs showing no malicious behavior;
[0008] The first model is called, which is a fusion model of adversarial neural network and abnormal behavior recognizer. The first model includes a generator and a discriminator. The generator is the generator after fusing the abnormal behavior recognizer, and the discriminator is the discriminator after fusing the abnormal behavior recognizer.
[0009] The first model is trained using the network behavior logs, and the internal parameters of the abnormal behavior recognizer are updated by each adversarial training of the generator and the discriminator until the classification accuracy of the discriminator is greater than the preset accuracy. Then the trained target first model is obtained.
[0010] The updated abnormal behavior identifier is separated from the first target model to obtain the intermediate abnormal behavior identifier. The intermediate abnormal behavior identifier is then used to identify malicious behaviors in the real-time network behavior logs.
[0011] In one possible implementation, the method further includes the following before invoking the preset first model:
[0012] Feature extraction is performed on the information in each network behavior log to obtain the feature information corresponding to each network behavior log. The feature information is used to indicate the target information in the network behavior log, including network request information, network interaction information, and network interception information.
[0013] Correspondingly, the first model is trained using the network behavior logs, including:
[0014] The first model is trained using the network behavior logs and the corresponding feature information of each network behavior log.
[0015] In one possible implementation, before feature extraction from the information in each network behavior log, the method further includes:
[0016] Data cleaning is performed on the data in each network behavior log to obtain multiple first network behavior logs. Data cleaning includes: dirty data purification, abnormal data deletion and missing data completion.
[0017] Correspondingly, feature extraction is performed on the information in each network behavior log, including:
[0018] Feature extraction is performed on the information in each first network behavior log.
[0019] In one possible implementation, a first model is trained using network behavior logs and the feature information corresponding to each network behavior log, including:
[0020] Each network behavior log and its corresponding feature information are input into the generator. The generator generates corresponding log samples based on the network behavior logs and generates label information corresponding to the feature information.
[0021] The label information corresponding to the log sample and feature information is input into the discriminator. The discriminator identifies whether the log sample is a real log or a log sample generated by the generator, and determines whether there is malicious behavior in the log sample based on the label information.
[0022] Repeat the adversarial training process of the generator and discriminator described above. Each adversarial training session triggers the training update of the internal parameters of the abnormal behavior recognizer until the classification accuracy of the discriminator is greater than the preset accuracy.
[0023] In one possible implementation, after obtaining the intermediate abnormal behavior identifier, the method further includes:
[0024] Obtain target log samples, which are log samples containing malicious behavior;
[0025] The intermediate abnormal behavior recognizer is trained using the target log samples until the recognition accuracy of the intermediate abnormal behavior recognizer reaches a preset threshold, thus obtaining the target abnormal behavior recognizer.
[0026] Correspondingly, an intermediate anomaly behavior identifier is used to identify malicious behaviors in network behavior logs, including:
[0027] Malicious behavior in network behavior logs is identified using a target anomaly behavior identifier.
[0028] In one possible implementation, the method further includes the following before invoking the preset first model:
[0029] The initial adversarial neural network and the abnormal behavior recognizer are invoked. The initial adversarial neural network includes an initial generator and an initial discriminator, and the abnormal behavior recognizer includes a feature recognizer and a behavior recognizer.
[0030] The initial generator is fused with the feature recognizer to obtain the generator;
[0031] The initial discriminator is fused with the behavior recognizer to obtain the discriminator.
[0032] In one possible implementation, a generator is used to generate corresponding log samples based on network behavior logs, and to generate label information corresponding to the feature information, including:
[0033] The initial generator is used to generate log samples corresponding to network behavior logs, and the feature recognizer is used to generate label information corresponding to feature information.
[0034] The discriminator is used to identify whether log samples are real logs or log samples generated by a generator, and the presence of malicious behavior in the log samples is determined based on tag information, including:
[0035] An initial discriminator is used to identify whether the log sample is a real log or a log sample generated by the generator, and a behavior recognizer is used to identify whether there is malicious behavior in the log sample.
[0036] A second aspect of this application provides a network malicious behavior identification device, the device comprising:
[0037] The acquisition module is used to acquire multiple network behavior logs, which include logs containing malicious behavior and logs containing no malicious behavior.
[0038] The calling module is used to call the preset first model. The first model is a fusion model of adversarial neural network and abnormal behavior recognizer. The first model includes a generator and a discriminator. The generator is the generator after fusing the abnormal behavior recognizer, and the discriminator is the discriminator after fusing the abnormal behavior recognizer.
[0039] The training module is used to train the first model using the network behavior logs, and to trigger the training and update of the internal parameters of the abnormal behavior recognizer by each adversarial training of the generator and the discriminator until the classification accuracy of the discriminator is greater than the preset accuracy, thus obtaining the trained target first model.
[0040] The detection module is used to separate the updated abnormal behavior recognizer from the target first model to obtain the intermediate abnormal behavior recognizer, and to use the intermediate abnormal behavior recognizer to identify malicious behaviors in the real-time acquired network behavior logs.
[0041] A third aspect of this application provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, it implements the network malicious behavior identification method of the first aspect of this application.
[0042] In a fourth aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, it implements the network malicious behavior identification method in the first aspect of this application.
[0043] The beneficial effects of the technical solutions provided in this application include at least the following:
[0044] This application provides a method for identifying malicious network behavior. The method involves acquiring multiple network behavior logs, including logs showing malicious behavior and logs showing no malicious behavior; invoking a preset first model, which is a fusion model of an adversarial neural network and an abnormal behavior identifier. The first model includes a generator and a discriminator, where the generator is a generator fused with the abnormal behavior identifier, and the discriminator is a discriminator fused with the abnormal behavior identifier. The first model is trained using the network behavior logs, and each adversarial training iteration of the generator and discriminator triggers the training and updating of the internal parameters of the abnormal behavior identifier until the classification accuracy of the discriminator exceeds a preset accuracy, thus obtaining a trained target first model. An updated abnormal behavior identifier is then separated from the target first model to obtain an intermediate abnormal behavior identifier, which is used to identify malicious behavior in the real-time acquired network behavior logs. By fusing adversarial neural networks and anomaly behavior recognizers, the generator and discriminator are trained adversarially to produce a large number of highly realistic samples. This can greatly alleviate the problem of a large number of data sources and improve the model's recognition accuracy. At the same time, the anomaly behavior recognizer is trained simultaneously with the adversarial training, without the need for manual annotation, which improves training efficiency and reduces costs. Attached Figure Description
[0045] Figure 1 A flowchart illustrating a method for identifying malicious network behavior provided in this application embodiment;
[0046] Figure 2 A structural diagram of a network malicious behavior identification device provided in this application embodiment;
[0047] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0049] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more.
[0050] In addition, the use of “based on” or “according to” implies openness and inclusivity, because processes, steps, calculations or other actions “based on” or “according to” one or more conditions or values can in practice be based on additional conditions or values beyond those conditions.
[0051] Network malicious behavior identification is an important research direction in the field of cybersecurity, involving the detection and classification of malicious, abnormal, and attack behaviors on networks. To achieve efficient and accurate network malicious behavior identification, researchers and experts need to continuously explore cybersecurity technologies tailored to the new era and context.
[0052] In the era of big data and AI, cybersecurity has become increasingly challenging to identify malicious behavior compared to the past. Traditional identification technologies, solutions, and experience are proving inadequate against current malicious activities, leading to low efficiency, insufficient accuracy, high false positive rates, and frequent cybersecurity incidents. Therefore, researching and exploring highly accurate and efficient methods for identifying malicious behavior is crucial.
[0053] Network malicious behavior identification is a complex and critical task that requires the integration and optimization of multiple technologies. In recent years, with the development of technologies such as deep learning and adversarial learning, the accuracy and efficiency of malicious behavior identification have been improved to some extent. However, malicious behaviors and network incidents are constantly evolving and occurring, and malicious behavior identification remains a challenging research field that requires continuous innovation and improvement.
[0054] The prerequisite for ensuring network security is the identification of malicious network events, which requires the organic integration of multiple technologies. Common key technologies for identifying malicious network behavior include rule-based identification methods, statistical identification methods, machine learning-based identification methods, data mining-based identification methods, and big data and cloud computing-based identification methods. However, each technology has its own inherent limitations, as follows:
[0055] Rule-based methods: Rules need to be defined in advance, and updates are often not timely enough, resulting in poor detection of new malicious behaviors. Statistical methods: False positive rates are high for normal network events, while false negatives are severe for complex network events. Machine learning methods: Require large amounts of labeled data for training, and it is difficult to obtain enough labeled samples for emerging and unknown malicious behaviors, leading to poor generalization performance; they are also inaccurate in identifying rare behaviors. Data mining methods: Main problems include difficulty in feature engineering, high data quality requirements, static modeling, and poor model interpretability. Big data and cloud computing methods: These methods suffer from numerous problems such as data privacy and security issues, data transmission latency, high data storage and computing costs, data complexity, and credibility issues. Each technology has its advantages and disadvantages. The above are the disadvantages of common network security behavior recognition technologies. To address these shortcomings, this paper proposes an improved network malicious behavior recognition model, aiming to improve accuracy while reducing model creation and maintenance costs.
[0056] To address the aforementioned issues, this application integrates adversarial neural networks and anomaly behavior recognizers. The generator and discriminator are trained adversarially to produce a large number of highly realistic samples. This can significantly alleviate the problem of large data sources and improve the model's recognition accuracy. At the same time, the adversarial training simultaneously trains the anomaly behavior recognizer without the need for manual annotation, thus improving training efficiency and reducing costs.
[0057] This application provides a method for identifying malicious network behavior, such as... Figure 1 As shown, the method includes the following steps:
[0058] Step 101: Obtain multiple network behavior logs.
[0059] The network behavior log includes logs containing malicious behavior and logs containing no malicious behavior. The content of the network behavior log includes: system access information, user operation information of network devices, Internet access behavior information, network blocking information, network interaction information, etc.
[0060] Step 102: Call the preset first model, which is a fusion model of adversarial neural network and abnormal behavior recognizer.
[0061] The first model includes a generator and a discriminator. The generator is a generator that incorporates an abnormal behavior identifier, and the discriminator is also a discriminator that incorporates an abnormal behavior identifier. The generator mainly generates samples that are as realistic as possible based on the given samples in order to deceive the discriminator. The discriminator mainly classifies the real samples and the generated samples based on the given real samples and the samples generated by the generator.
[0062] Before calling the preset first model, the method also includes: calling the initial adversarial neural network and the abnormal behavior recognizer. The initial adversarial neural network includes an initial generator and an initial discriminator, and the abnormal behavior recognizer includes a feature recognizer and a behavior recognizer; fusing the initial generator and the feature recognizer to obtain the generator; and fusing the initial discriminator and the behavior recognizer to obtain the discriminator.
[0063] In actual implementation, the process of integrating adversarial neural networks and abnormal behavior recognizers can be as follows: anchor the abnormal behavior recognizer to the discriminator (i.e., listen to the discriminator), set up a self-updating mechanism for the abnormal behavior recognizer, i.e., a method for adjusting its own parameters, and trigger the abnormal behavior recognizer update mechanism based on the discriminator's judgment result every time the discriminator performs a judgment behavior.
[0064] Step 103: Train the first model using the network behavior logs, and use each adversarial training of the generator and discriminator to trigger the training and update of the internal parameters of the abnormal behavior recognizer until the classification accuracy of the discriminator is greater than the preset accuracy, then the trained target first model is obtained.
[0065] It should be noted that before executing step 102 to call the preset first model, the method may also include: extracting features from the information in each network behavior log to obtain feature information corresponding to each network behavior log. The feature information is used to indicate the target information in the network behavior log. The target information includes network request information, network interaction information, and network interception information.
[0066] In other words, feature extraction mainly involves characterizing and extracting features relevant to the identification of malicious behavior. For example, if the web log contains a series of online behaviors of a user while shopping, then the feature information of the web log could include user login information, username, password, and device address information, etc.
[0067] Correspondingly, the first model is trained using each network behavior log, including: training the first model using each network behavior log and the feature information corresponding to each network behavior log.
[0068] In addition, before performing feature extraction on the information in each network behavior log, the method may also include: performing data cleaning on the data in each network behavior log to obtain multiple first network behavior logs, the data cleaning including: dirty data purification, abnormal data deletion and missing data completion; correspondingly, performing feature extraction on the information in each network behavior log, including: performing feature extraction on the information in each first network behavior log.
[0069] Specifically, the first model is trained using network behavior logs and the feature information corresponding to each network behavior log, including:
[0070] Each network behavior log and its corresponding feature information are input into the generator. The generator generates corresponding log samples based on the network behavior logs and generates label information corresponding to the feature information.
[0071] The label information corresponding to the log sample and feature information is input into the discriminator. The discriminator identifies whether the log sample is a real log or a log sample generated by the generator, and determines whether there is malicious behavior in the log sample based on the label information.
[0072] Repeat the adversarial training process of the generator and discriminator described above. Each adversarial training session triggers the training update of the internal parameters of the abnormal behavior recognizer until the classification accuracy of the discriminator is greater than the preset accuracy.
[0073] For example, if the feature information is network address information, then the corresponding tag information can be the internal network, external network, or unknown network, etc.
[0074] Furthermore, the process of generating corresponding log samples based on network behavior logs using a generator and generating label information corresponding to feature information can be as follows: generating log samples corresponding to network behavior logs using an initial generator and generating label information corresponding to feature information using a feature recognizer.
[0075] Correspondingly, the process of using a discriminator to identify whether a log sample is a real log or a log sample generated by a generator, and determining whether there is malicious behavior in the log sample based on the tag information, can be as follows: using an initial discriminator to identify whether a log sample is a real log or a log sample generated by a generator, and using a behavior recognizer to identify whether there is malicious behavior in the log sample.
[0076] In practice, the generator and discriminator are trained adversarially, with the two working against each other. The generator aims to maximize the probability that the discriminator classifies the generated samples as real data, while the discriminator aims to maximize the probability of correct classification. Simultaneously, after each discrimination by the discriminator, an update mechanism for the discriminator is executed. Through multiple rounds of updates, the discriminator adjusts its parameters based on the discriminator's judgment results, leading to more accurate discrimination of abnormal behavior. The adversarial training ends once both the generator and discriminator reach their respective target thresholds; otherwise, it continues. If, during training, the predetermined number of iterations or other conditions are met but the threshold is not reached, the corresponding metrics are manually modified as needed, and training continues until the threshold is reached, at which point training stops.
[0077] The generator, after adversarial training, produces a set of network behaviors for training the anomaly behavior recognizer. Since this generator has already reached a threshold, its generated network behaviors can approximate the real network behavior set, thus significantly expanding the dataset. The anomaly behavior recognizer is then retrained using the generated network behavior set to improve its accuracy.
[0078] Step 104: Separate the updated abnormal behavior identifier from the target first model to obtain the intermediate abnormal behavior identifier, and use the intermediate abnormal behavior identifier to identify malicious behaviors in the real-time acquired network behavior logs.
[0079] In addition, after obtaining the intermediate abnormal behavior identifier, the method also includes: obtaining a target log sample, which is a log sample containing malicious behavior; using the target log sample to train the intermediate abnormal behavior identifier until the recognition accuracy of the intermediate abnormal behavior identifier reaches a preset threshold, thus obtaining the target abnormal behavior identifier.
[0080] Correspondingly, the intermediate abnormal behavior identifier is used to identify malicious behavior in the network behavior log, including: using the target abnormal behavior identifier to identify malicious behavior in the network behavior log.
[0081] The abnormal behavior recognizer is retrained using reinforcement learning on a manually collected set of real abnormal behaviors to achieve higher accuracy. (Reinforcement learning can significantly improve the accuracy of the recognizer.) This forms the abnormal behavior recognition model. The reinforced behavior recognizer is then encapsulated and parameterized to form the abnormal behavior recognition model, which can be used to subsequently identify network behaviors. A combination of unsupervised learning and reinforcement learning training is used to reduce data costs while maintaining accuracy.
[0082] This application provides a method for identifying malicious network behavior. The method involves acquiring multiple network behavior logs, including logs showing malicious behavior and logs showing no malicious behavior; invoking a preset first model, which is a fusion model of an adversarial neural network and an abnormal behavior identifier. The first model includes a generator and a discriminator, where the generator is a generator fused with the abnormal behavior identifier, and the discriminator is a discriminator fused with the abnormal behavior identifier. The first model is trained using the network behavior logs, and each adversarial training iteration of the generator and discriminator triggers the training and updating of the internal parameters of the abnormal behavior identifier until the classification accuracy of the discriminator exceeds a preset accuracy, thus obtaining a trained target first model. An updated abnormal behavior identifier is then separated from the target first model to obtain an intermediate abnormal behavior identifier, which is used to identify malicious behavior in the real-time acquired network behavior logs. By fusing adversarial neural networks and anomaly behavior recognizers, the generator and discriminator are trained adversarially to produce a large number of highly realistic samples. This can greatly alleviate the problem of a large number of data sources and improve the model's recognition accuracy. At the same time, the anomaly behavior recognizer is trained simultaneously with the adversarial training, without the need for manual annotation, which improves training efficiency and reduces costs.
[0083] like Figure 2 As shown in the figure, this application embodiment provides a network malicious behavior identification device, which includes:
[0084] The acquisition module 11 is used to acquire multiple network behavior logs, which include logs containing malicious behavior and logs containing no malicious behavior.
[0085] Call module 12, which is used to call the preset first model. The first model is a fusion model of adversarial neural network and abnormal behavior recognizer. The first model includes a generator and a discriminator. The generator is a generator after fusing the abnormal behavior recognizer, and the discriminator is a discriminator after fusing the abnormal behavior recognizer.
[0086] Training module 13 is used to train the first model using the network behavior logs, and to trigger the training and update of the internal parameters of the abnormal behavior recognizer by each adversarial training of the generator and the discriminator until the classification accuracy of the discriminator is greater than the preset accuracy, thus obtaining the trained target first model.
[0087] The detection module 14 is used to separate the updated abnormal behavior recognizer from the target first model to obtain the intermediate abnormal behavior recognizer, and to use the intermediate abnormal behavior recognizer to identify malicious behavior in the real-time acquired network behavior logs.
[0088] In one embodiment, the apparatus further includes a processing module 15, the processing module being configured to:
[0089] Feature extraction is performed on the information in each network behavior log to obtain the feature information corresponding to each network behavior log. The feature information is used to indicate the target information in the network behavior log, including network request information, network interaction information, and network interception information.
[0090] Correspondingly, training module 13 is used to train the first model using each network behavior log and the feature information corresponding to each network behavior log.
[0091] In one embodiment, the processing module 15 is further configured to:
[0092] Data cleaning is performed on the data in each network behavior log to obtain multiple first network behavior logs. Data cleaning includes: dirty data purification, abnormal data deletion and missing data completion.
[0093] Correspondingly, the processing module 15 is specifically used to extract features from the information in each of the first network behavior logs.
[0094] In one embodiment, training module 13 is specifically used for:
[0095] Each network behavior log and its corresponding feature information are input into the generator. The generator generates corresponding log samples based on the network behavior logs and generates label information corresponding to the feature information.
[0096] The label information corresponding to the log sample and feature information is input into the discriminator. The discriminator identifies whether the log sample is a real log or a log sample generated by the generator, and determines whether there is malicious behavior in the log sample based on the label information.
[0097] Repeat the adversarial training process of the generator and discriminator described above. Each adversarial training session triggers the training update of the internal parameters of the abnormal behavior recognizer until the classification accuracy of the discriminator is greater than the preset accuracy.
[0098] In one embodiment, training module 13 is further configured to:
[0099] Obtain target log samples, which are log samples containing malicious behavior;
[0100] The intermediate abnormal behavior recognizer is trained using the target log samples until the recognition accuracy of the intermediate abnormal behavior recognizer reaches a preset threshold, thus obtaining the target abnormal behavior recognizer.
[0101] Correspondingly, the detection module 14 is also used to: identify malicious behavior in network behavior logs using a target abnormal behavior recognizer.
[0102] In one embodiment, the apparatus further includes a fusion module 16, the fusion module being configured to:
[0103] The initial adversarial neural network and the abnormal behavior recognizer are invoked. The initial adversarial neural network includes an initial generator and an initial discriminator, and the abnormal behavior recognizer includes a feature recognizer and a behavior recognizer.
[0104] The initial generator is fused with the feature recognizer to obtain the generator;
[0105] The initial discriminator is fused with the behavior recognizer to obtain the discriminator.
[0106] In one embodiment, training module 13 is specifically used for:
[0107] The initial generator is used to generate log samples corresponding to network behavior logs, and the feature recognizer is used to generate label information corresponding to feature information.
[0108] An initial discriminator is used to identify whether the log sample is a real log or a log sample generated by the generator, and a behavior recognizer is used to identify whether there is malicious behavior in the log sample.
[0109] The network malicious behavior identification device provided in this embodiment can execute the above-described method embodiment, and its implementation principle and technical effects are similar, so they will not be repeated here. Specific limitations on the network malicious behavior identification device can be found in the limitations on the network malicious behavior identification method above, and will not be repeated here.
[0110] The execution subject of the network malicious behavior identification method provided in this application embodiment can be an electronic device, which can be a computer device, a terminal device, a server or a server cluster. This application embodiment does not specifically limit this.
[0111] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of this application. Figure 3 As shown, the electronic device includes a processor and a memory connected via a system bus. The processor provides computing and control capabilities. The memory may include a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. These computer programs can be executed by the processor to implement the steps of the network malicious behavior identification methods provided in the above embodiments. The internal memory provides a cached runtime environment for the operating system and computer programs in the non-volatile storage medium.
[0112] Those skilled in the art will understand that Figure 3 The diagram shown is an internal structure diagram of an electronic device, which is only a block diagram of a part of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. A specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.
[0113] In another embodiment of this application, a computer-readable storage medium is also provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the network malicious behavior identification method as described in the embodiments of this application are implemented.
[0114] In another embodiment of this application, a computer program product is also provided, which includes computer instructions that, when executed on an electronic device, cause the electronic device to perform each step of the network malicious behavior identification method in the method flow shown in the above method embodiment.
[0115] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).
[0116] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0117] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.
Claims
1. A method for identifying malicious network behavior, characterized in that, The method includes: Obtain multiple network behavior logs, including logs showing malicious behavior and logs showing no malicious behavior; The first model is a fusion model of adversarial neural network and abnormal behavior detector. The first model includes a generator and a discriminator. The generator is a generator after fusing the abnormal behavior detector, and the discriminator is a discriminator after fusing the abnormal behavior detector. The first model is trained using the network behavior logs, and the internal parameters of the abnormal behavior recognizer are updated during each adversarial training of the generator and the discriminator until the classification accuracy of the discriminator is greater than the preset accuracy, thus obtaining the trained target first model. An updated abnormal behavior identifier is separated from the target first model to obtain an intermediate abnormal behavior identifier. The intermediate abnormal behavior identifier is then used to identify malicious behaviors in the real-time acquired network behavior logs. Before invoking the preset first model, the method further includes: Feature extraction is performed on the information in each of the network behavior logs to obtain feature information corresponding to each network behavior log. The feature information is used to indicate the target information in the network behavior log. The target information includes network request information, network interaction information, and network interception information. The step of training the first model using the network behavior logs includes: Each network behavior log and its corresponding feature information are input into the generator. The generator generates corresponding log samples based on the network behavior logs and generates tag information corresponding to the feature information. The log sample and the tag information corresponding to the feature information are input into the discriminator. The discriminator is used to identify whether the log sample is a real log or a log sample generated by the generator, and to determine whether there is malicious behavior in the log sample based on the tag information. Repeat the adversarial training process of the generator and the discriminator described above, wherein each adversarial training triggers the training update of the internal parameters of the abnormal behavior recognizer until the classification accuracy of the discriminator is greater than the preset accuracy.
2. The method according to claim 1, characterized in that, Before performing feature extraction on the information in each of the network behavior logs, the method further includes: Data cleaning is performed on the data in each of the network behavior logs to obtain multiple first network behavior logs. The data cleaning includes: dirty data purification, abnormal data deletion, and missing data completion. Correspondingly, feature extraction is performed on the information in each of the aforementioned network behavior logs, including: Feature extraction is performed on the information in each of the first network behavior logs.
3. The method according to claim 1, characterized in that, After obtaining the intermediate abnormal behavior identifier, the method further includes: Obtain a target log sample, wherein the target log sample is a log sample containing malicious behavior; The intermediate abnormal behavior identifier is trained using the target log sample until the recognition accuracy of the intermediate abnormal behavior identifier reaches a preset threshold, thus obtaining the target abnormal behavior identifier. Correspondingly, the intermediate abnormal behavior identifier is used to identify malicious behavior in the network behavior log, including: The target abnormal behavior identifier is used to identify malicious behaviors in the network behavior log.
4. The method according to claim 1, characterized in that, Before invoking the preset first model, the method further includes: The initial adversarial neural network and the abnormal behavior recognizer are invoked. The initial adversarial neural network includes an initial generator and an initial discriminator, and the abnormal behavior recognizer includes a feature recognizer and a behavior recognizer. The initial generator is fused with the feature recognizer to obtain the generator; The initial discriminator is fused with the behavior recognizer to obtain the discriminator.
5. The method according to claim 4, characterized in that, The step of using the generator to generate corresponding log samples based on the network behavior logs and generating label information corresponding to the feature information includes: The initial generator is used to generate log samples corresponding to the network behavior logs, and the feature recognizer is used to generate tag information corresponding to the feature information. The step of using the discriminator to identify whether the log sample is a real log or a log sample generated by the generator, and determining whether there is malicious behavior in the log sample based on the tag information, includes: The initial discriminator is used to identify whether the log sample is a real log or a log sample generated by the generator, and the behavior recognizer is used to identify whether there is malicious behavior in the log sample.
6. A network malicious behavior identification device, characterized in that, The device includes: The acquisition module is used to acquire multiple network behavior logs, which include logs containing malicious behavior and logs containing no malicious behavior. The calling module is used to call a preset first model, which is a fusion model of adversarial neural network and abnormal behavior recognizer. The first model includes a generator and a discriminator. The generator is a generator after fusing the abnormal behavior recognizer, and the discriminator is a discriminator after fusing the abnormal behavior recognizer. The training module is used to train the first model using the network behavior logs, and to trigger the training update of the internal parameters of the abnormal behavior recognizer by each adversarial training of the generator and the discriminator until the classification accuracy of the discriminator is greater than the preset accuracy, thus obtaining the trained target first model. The detection module is used to separate the updated abnormal behavior identifier from the target first model to obtain an intermediate abnormal behavior identifier, and to use the intermediate abnormal behavior identifier to identify malicious behavior in the real-time acquired network behavior logs. The processing module is used to extract features from the information in each network behavior log to obtain feature information corresponding to each network behavior log. The feature information is used to indicate the target information in the network behavior log. The target information includes network request information, network interaction information, and network interception information. The training module is specifically used for: inputting each network behavior log and its corresponding feature information into the generator, using the generator to generate corresponding log samples based on the network behavior logs, and generating label information corresponding to the feature information; inputting the log samples and the label information corresponding to the feature information into the discriminator, using the discriminator to identify whether the log samples are real logs or log samples generated by the generator, and determining whether there is malicious behavior in the log samples based on the label information; repeating the above adversarial training process of the generator and discriminator, wherein each adversarial training triggers the training update of the internal parameters of the abnormal behavior recognizer until the classification accuracy of the discriminator is greater than the preset accuracy.
7. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the network malicious behavior identification method according to any one of claims 1-5.
8. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the network malicious behavior identification method according to any one of claims 1-5.