A method and system for detecting insider threats within a large enterprise network

Abstract

The application discloses a large enterprise network internal threat detection method and system. The method comprises the following steps: calculating pre-training internal user behavior feature data; constructing a behavior feature detection model and pre-training the feature detection model; determining an incremental learning optimization period, calculating internal user behavior feature data in the incremental learning optimization period; obtaining a running stage abnormal score to obtain a large enterprise network internal threat detection result, and using a man-machine loop method to perform incremental learning optimization on the pre-trained behavior feature detection model according to the running stage abnormal score and an expert investigation sample. The man-machine loop method can continuously make the model learn new data over time, improve the detection performance of the model, store historical internal user low-dimensional portraits through a set memory module to reduce the calculation amount and occupied storage resources, and reduce the overfitting of the model, thereby improving the generalization ability of the model.

Description

Technical Field

[0001] This invention relates to the field of internal threat detection in large enterprise networks, and specifically to a method and system for detecting internal threats in large enterprise networks. Background Technology

[0002] With the rapid development of enterprise internal networks, various applications are constantly migrating to these networks in digital form. Large enterprise networks carry a massive amount of business operations and encompass vast amounts of valuable data and resources. Due to the covetousness of these sensitive data and resources by malicious actors, large enterprise networks are easily vulnerable to various threats, including the theft, alteration, and destruction of various data and resources, which can undoubtedly cause incalculable losses to the enterprise. Therefore, it is necessary to conduct real-time monitoring of various data resource operations within large enterprise networks, detect abnormal operational behaviors, and identify threats to ensure the stable and efficient operation of the enterprise network.

[0003] Threats in large enterprise networks can be categorized into external threats and internal threats based on the attacker's origin. External threats refer to attacks from malicious individuals without access to the enterprise's internal network. Internal threats, on the other hand, refer to attacks from malicious individuals who have gained access to the enterprise's internal network resources. These individuals can use their own or stolen accounts to perform various malicious operations, making them more difficult to detect and prevent than external threats, and also posing a greater threat and causing more damage.

[0004] Currently, one method for detecting internal threats in large enterprise networks is to use pre-trained anomaly detection models to detect anomalies in resource operations within the intranet. Anomaly detection models based on popular deep learning methods can automatically learn key features from data, thereby detecting hidden anomalies. This method first optimizes the anomaly detection model using a sufficient amount of pre-obtained historical sample data as training data, and then performs anomaly detection on new data to be detected. However, because existing methods require automatically learning key features from data, it is difficult to obtain an effective anomaly detection model without sufficient prior knowledge or training data. Furthermore, when anomaly patterns change, the performance of the pre-trained anomaly detection model inevitably degrades, making it difficult to handle novel anomalies. Retraining the anomaly detection model requires using all new and old data, increasing computational load and storage resource consumption. Summary of the Invention

[0005] To address the aforementioned shortcomings in existing technologies, this invention provides a method and system for detecting internal threats within large enterprise networks. This method employs a human-machine loopback approach, enabling the model to continuously learn new data over time, thereby improving its detection performance. Furthermore, by storing historical low-dimensional user profiles using a memory module, it reduces computational load and storage resource consumption, and minimizes model overfitting, thus enhancing its generalization ability.

[0006] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:

[0007] A method for detecting internal threats in a large enterprise network includes the following steps:

[0008] S1. Obtain pre-trained internal user data and calculate pre-trained internal user behavior feature data based on the pre-trained internal user data;

[0009] S2. Construct a behavior feature detection model and pre-train the feature detection model based on the pre-trained internal user behavior feature data in step S1.

[0010] S3. Determine the incremental learning optimization period, obtain the internal user data within the incremental learning optimization period, and calculate the internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period.

[0011] S4. Based on the pre-trained behavior feature detection model in step S2 and the internal user behavior feature data within the incremental learning optimization period in step S3, output the abnormal score of the running phase to obtain the internal threat detection results of the large enterprise network. Based on the abnormal score of the running phase and the expert survey samples, use the human-machine loopback method to perform incremental learning optimization on the pre-trained behavior feature detection model.

[0012] Furthermore, step S2 includes the following sub-steps:

[0013] S21. Construct a behavioral feature detection model that includes a behavioral feature distiller and a behavioral anomaly scorer;

[0014] S22. Based on the pre-trained internal user behavior feature data in step S1 and the behavior feature distiller in step S21, obtain the internal user low-dimensional similar profile, internal user low-dimensional similar profile reconstruction data and reconstruction error data.

[0015] S23. Based on the behavior anomaly scorer in step S21 and the internal user low-dimensional similarity profile, internal user low-dimensional similarity profile reconstruction data and reconstruction error data in step S22, obtain the anomaly score in the startup phase.

[0016] S24. Calculate the pre-training loss based on the pre-trained internal user behavior feature data in step S1 and the abnormal score in the startup phase in sub-step S23, so as to pre-train the feature detection model.

[0017] Furthermore, in step S22, the behavioral feature distiller includes an encoder, a memory module, a decoder, and a reconstruction error calculation module connected in sequence;

[0018] The encoder is used to receive internal user behavior feature data, use a dimensionality reduction function to reduce the dimensionality of the internal user behavior feature data to obtain a low-dimensional profile of the internal user, transmit the low-dimensional profile of the internal user to the memory module, and transmit the internal user behavior feature data to the reconstruction error calculation module.

[0019] The memory module is used to store historical internal user low-dimensional profiles, receive internal user low-dimensional profiles, calculate the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile, calculate the weight of the internal user low-dimensional profile using a hard shrinkage function, obtain the internal user low-dimensional similar profile based on the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile and the weight of the internal user low-dimensional profile, and transmit the internal user low-dimensional similar profile to the decoder.

[0020] The decoder is used to receive the low-dimensional similarity profile of the internal user, use the dimensionality-upgrading function to upgrade the low-dimensional similarity profile of the internal user to obtain the reconstruction data of the low-dimensional similarity profile of the internal user, and transmit the reconstruction data of the low-dimensional similarity profile of the internal user to the reconstruction error calculation module.

[0021] The reconstruction error calculation module is used to receive pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data, and calculate reconstruction error data based on the pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data.

[0022] Furthermore, step S23 includes the following sub-steps:

[0023] S231. Based on the internal user low-dimensional similarity profile, the reconstructed data of the internal user low-dimensional similarity profile, and the reconstruction error data from step S22, the splicing features are obtained using the splicing function, as follows:

[0024] x in =Concat(x, z′, e)

[0025] Where: x in For splicing features, Concat is the splicing function, x is the low-dimensional similarity profile of internal users, z′ is the reconstructed data of the low-dimensional similarity profile of internal users, and e is the reconstruction error data;

[0026] S232. Input the concatenated features from step S231 into the behavior anomaly scorer to obtain the anomaly score for each layer of the multilayer perceptron during the startup phase, and output the startup phase anomaly score. The anomaly score for each layer of the multilayer perceptron during the startup phase is represented as follows:

[0027] S j (x)=σ(W j ·x+b j )

[0028] Wherein: S j (x) represents the anomaly score during the startup phase of the j-th layer of the multilayer perceptron, where j is the layer number of the multilayer perceptron, σ is the activation function, and W... j Let x be the weight matrix of the j-th layer of the multilayer perceptron, x be the input variable of the j-th layer of the multilayer perceptron, and x be the concatenated feature x of the first layer of the multilayer perceptron. in b j is the bias coefficient of the j-th layer of the multilayer perceptron.

[0029] Furthermore, step S24 includes the following sub-steps:

[0030] S241. Calculate the memory module loss based on the pre-trained internal user behavior feature data in step S1, expressed as:

[0031] L mem (X i y i )=y i max(0, m) i -m low )+(1-y i max(0, m) high -m i )

[0032] Where: L mem (X i y i X represents the memory module loss. i For internal user behavior characteristic data, y i The labels are internal user behavior feature data, max(·) is the maximum value function, and m i To determine the degree of matching between internal user behavior feature data and the memory module, m low m is the first hyperparameter. high This is the second hyperparameter;

[0033] S242. Calculate the reconstruction error loss based on the pre-trained internal user behavior feature data in step S1, expressed as:

[0034] L err (X i y i )=yi e i +(1-y i )max(0,e high -e i )

[0035] Where: L err (X i y i e represents the reconstruction error loss. i To reconstruct the error value, e high This is the third hyperparameter;

[0036] S243. Calculate the anomaly score loss based on the pre-trained internal user behavior feature data in step S1 and the anomaly score in the startup phase in sub-step S23, expressed as:

[0037] L score (X i y i )=y i score i +(1-y i max(0, score) high -score i )

[0038] Where: L score (X i y i ) represents the outlier score loss, score i The score represents the outlier score. high This is the fourth hyperparameter;

[0039] S244. Calculate the pre-training loss based on the pre-trained internal user behavior feature data from step S1 and the abnormal score during the startup phase from sub-step S23, to pre-train the feature detection model. The pre-training loss is expressed as follows:

[0040]

[0041] Where: L init The value is denoted as 'pre-training loss', where 't' represents the number of detection time granularities of the pre-training internal user behavior feature data, 'u' represents the number of internal users, and 'i' represents the sample sequence number.

[0042] Furthermore, step S4 includes the following sub-steps:

[0043] S41. Based on the pre-trained behavior feature detection model in step S2 and the internal user behavior feature data within the incremental learning optimization period in step S3, output the abnormal score of the running phase to obtain the internal threat detection results of the large enterprise network.

[0044] S42. Determine whether the abnormal score in the operation phase of sub-step S41 is greater than the abnormal score threshold; if so, determine it as an abnormal sample, otherwise determine it as a normal sample, so as to obtain the internal threat detection results of large enterprise networks and determine the detection label of the sample.

[0045] S43. Determine the survey rate, identify suspicious samples within the incremental learning optimization period based on the survey rate, determine the true labels of suspicious samples through expert surveys, and identify other samples within the incremental learning optimization period as normal samples in order to determine the survey labels of the samples.

[0046] S44. Determine incremental learning samples based on the detection labels of the samples in step S42 and the survey labels of the samples in step S43.

[0047] S45. Based on the pre-trained behavior feature detection model in step S2 and the incremental learning samples in step S44, obtain the incremental learning anomaly score.

[0048] S46. Based on the internal user behavior feature data within the incremental learning optimization period in step S3, the abnormal score of the running stage in sub-step S41, and the abnormal score of incremental learning in sub-step S45, calculate the incremental learning loss to perform incremental learning optimization on the pre-trained behavior feature detection model.

[0049] Furthermore, step S46 includes the following sub-steps:

[0050] S461. Based on the internal user behavior feature data within the incremental learning optimization cycle in step S3 and the abnormal scores of the running phase in sub-step S41, calculate the memory module loss, reconstruction error loss and abnormal score loss.

[0051] S462. Calculate the loss due to changes in the memory module, expressed as:

[0052] L dist_mem (M)=MSE(M init M)

[0053] Where: L dist_mem (M) represents the memory module variation loss, and MSE is the mean square error function. init M represents the parameters of the memory module before incremental learning, and M represents the parameters of the memory module during incremental learning.

[0054] S463. Based on the anomaly scores during the operational phase in sub-step S41 and the incremental learning anomaly scores in sub-step S45, calculate the anomaly score change loss, expressed as:

[0055] L dist_score (X i )=|init_score i -scorei |

[0056] Where: L dist_score (X i The loss is for abnormal score changes, and ink_score i Incremental learning of previous samples X i Abnormal scores i Incremental learning of outlier scores;

[0057] S464. Based on the memory module loss, reconstruction error loss, and anomaly score loss in step S461, the memory module change loss in step S462, and the anomaly score change loss in step S463, calculate the incremental learning loss to perform incremental learning optimization on the pre-trained behavior feature detection model. The incremental learning loss is expressed as follows:

[0058]

[0059] Where: L inc The incremental learning loss is w, where w is the number of detection time granularities in the incremental learning optimization cycle, u is the number of internal users, and i is the sample sequence number.

[0060] A large enterprise network internal threat detection system applying the above method includes an internal user feature extraction module and a behavior feature detection module;

[0061] The internal user feature extraction module is used to obtain pre-trained internal user data, calculate pre-trained internal user behavior feature data based on the pre-trained internal user data, and transmit the pre-trained internal user behavior feature data to the behavior feature detection module. It also obtains internal user data within the incremental learning optimization period, calculates internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period, and transmits the internal user behavior feature data within the incremental learning optimization period to the behavior feature detection module.

[0062] The behavior feature detection module receives pre-trained internal user behavior feature data, outputs anomaly scores during the startup phase based on the pre-trained internal user behavior feature data to pre-train the module's internal parameters, receives internal user behavior feature data during the incremental learning optimization period, outputs anomaly scores during the operation phase based on the pre-trained internal parameters and the internal user behavior feature data during the incremental learning optimization period to perform internal threat detection in large enterprise networks, and uses a human-machine loopback method to incrementally learn and optimize the pre-trained internal parameters based on the operation phase anomaly scores and expert survey samples.

[0063] The beneficial effects of this invention are as follows:

[0064] (1) This invention uses the human-machine loop method to identify suspicious samples in the incremental learning optimization cycle, determine the true labels of suspicious samples through expert investigation, and identify other samples in the incremental learning optimization cycle as normal samples. Then, it makes full use of the true labels of suspicious samples and other samples to iteratively improve the model detection performance, so that the model can adapt to the distribution of newly added normal and abnormal samples.

[0065] (2) By setting up a behavior distiller, specifically setting up a memory module in the behavior distiller to store historical internal user low-dimensional profiles, and distilling the internal user behavior feature data into the internal user low-dimensional profiles and comparing it with the historical internal user low-dimensional profiles, the present invention can more generalize the description of typical internal user behavior features, thereby enabling the model to better identify normal behavior and distinguish abnormal behavior, reducing the amount of computation and the storage resources occupied, and also reducing the overfitting of the model, thereby improving its generalization ability;

[0066] (3) The present invention uses a weakly supervised learning model training method, namely, in the human-machine loop method, a small number of samples determined by expert surveys and a large number of unlabeled samples added in each incremental learning optimization cycle are used to correct the model misjudgment, thereby improving the detection performance of the model while reducing the amount of computation and the storage resources occupied.

[0067] (4) This invention proposes a large-scale enterprise network internal threat detection system. The system is designed for real-time internal threat detection scenarios and employs a neural network behavior detection model, namely an internal user feature extraction module and a behavior feature detection model. It can automatically extract internal user behavior feature data from internal user data in a data-driven manner to detect anomalies, thereby avoiding the need for experts to continuously define and update rules manually. Simultaneously, the system can fully utilize feedback from domain experts (expert surveys to determine samples), enabling the detection model to adapt to novel anomalies, improving the model's detection performance, reducing computational load and storage resources, and also reducing model overfitting, thereby improving its generalization ability. Attached Figure Description

[0068] Figure 1 A schematic diagram of a method for detecting internal threats in a large enterprise network;

[0069] Figure 2 This is a schematic diagram illustrating the working principle of the behavioral feature detection model. Detailed Implementation

[0070] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0071] like Figure 1 As shown, a method for detecting internal threats in a large enterprise network includes steps S1-S4, as detailed below:

[0072] S1. Obtain pre-trained internal user data and calculate pre-trained internal user behavior feature data based on the pre-trained internal user data.

[0073] In an optional embodiment of the present invention, the present invention utilizes an internal user feature extraction module to obtain pre-trained internal user data, calculates pre-trained internal user behavior feature data based on the pre-trained internal user data, and transmits the pre-trained internal user behavior feature data to a behavior feature detection model.

[0074] This invention only requires the calculation of internal user behavior feature data that can describe the frequency or correlation information of internal user operations, without relying on a specific internal user feature extraction implementation. Specifically, the internal user feature extraction module can calculate three types of features of internal user data at a defined time granularity: average, maximum, and minimum values.

[0075] S2. Construct a behavior feature detection model and pre-train the feature detection model based on the pre-trained internal user behavior feature data in step S1.

[0076] In an optional embodiment of the present invention, the present invention constructs a behavioral feature detection model and pre-trains the feature detection module based on pre-trained internal user behavioral feature data. For example... Figure 2 As shown, the behavioral feature detection model constructed in this invention includes a behavioral feature distiller and a behavioral anomaly scorer. The behavioral feature distiller includes an encoder, a memory module, a decoder, and a reconstruction error calculation module connected in sequence.

[0077] Step S2 includes the following sub-steps:

[0078] S21. Construct a behavioral feature detection model that includes a behavioral feature distiller and a behavioral anomaly scorer.

[0079] S22. Based on the pre-trained internal user behavior feature data in step S1 and the behavior feature distiller in step S21, obtain the internal user low-dimensional similar profile, internal user low-dimensional similar profile reconstruction data, and reconstruction error data.

[0080] Specifically, this invention maps the input pre-trained internal user behavior feature data x to an internal user low-dimensional profile z, obtains a stored internal user low-dimensional similar profile z′, and maps the internal user low-dimensional similar profile z′ back to the original high-dimensional space to obtain the internal user low-dimensional similar profile reconstruction data x′ as the output. For the input sample's internal user low-dimensional profile z, if the behavior feature detection model finds a similar profile z′ in the stored internal user low-dimensional similar profiles that is sufficiently similar to z, then the reconstructed sample x′, which is remapped back to the high-dimensional space by the decoder, can be sufficiently close to the original input sample x; otherwise, x′ will differ significantly from x.

[0081] The behavioral feature distiller includes an encoder, a memory module, a decoder, and a reconstruction error calculation module connected in sequence.

[0082] The encoder receives internal user behavior feature data, uses a dimensionality reduction function to reduce the dimensionality of the internal user behavior feature data to obtain a low-dimensional profile of the internal user, transmits the low-dimensional profile of the internal user to the memory module, and transmits the internal user behavior feature data to the reconstruction error calculation module.

[0083] Specifically, during the startup phase, the encoder receives pre-trained internal user behavior feature data, uses a dimensionality reduction function to reduce the dimensionality of the pre-trained internal user behavior feature data to obtain a low-dimensional profile of the pre-trained internal users, transmits the low-dimensional profile of the pre-trained internal users to the memory module, and transmits the pre-trained internal user behavior feature data to the reconstruction error calculation module. During the runtime phase, the encoder receives internal user behavior feature data within the incremental learning optimization period, uses a dimensionality reduction function to reduce the dimensionality of the internal user behavior feature data within the incremental learning optimization period to obtain a low-dimensional profile of the internal users within the incremental learning optimization period, transmits the low-dimensional profile of the internal users within the incremental learning optimization period to the memory module, and transmits the internal user behavior feature data within the incremental learning optimization period to the reconstruction error calculation module.

[0084] The memory module is used to store historical internal user low-dimensional profiles, receive internal user low-dimensional profiles, calculate the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile, calculate the weight of the internal user low-dimensional profile using a hard shrinkage function, obtain the internal user low-dimensional similar profile based on the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile and the weight of the internal user low-dimensional profile, and transmit the internal user low-dimensional similar profile to the decoder.

[0085] Specifically, during the startup phase, the historical internal user low-dimensional profile only includes the pre-trained internal user low-dimensional profile; during the operation phase, the historical internal user low-dimensional profile includes the pre-trained internal user low-dimensional profile and the internal user low-dimensional profile from previous incremental learning optimization cycles (before the current cycle).

[0086] This invention uses modified cosine similarity as the similarity vector between the low-dimensional profile of internal users and the low-dimensional profile of historical internal users, expressed as:

[0087]

[0088] Where: sim(a, b) is, a is the low-dimensional profile of internal users, and b is the low-dimensional profile of historical internal users.

[0089] This invention utilizes a hard contraction function to calculate the weights of the internal user low-dimensional profile, expressed as:

[0090] w i =||hardshrink(||s i ||1)||1

[0091] Where: w i The weights for the low-dimensional profiles of internal users are defined by `hardshrink`, which is the hard shrinkage function.

[0092] In this invention, the hard contraction function is expressed as:

[0093]

[0094] Where: hardshrink(||s i ||1) is the hard contraction function, and λ is the fifth hyperparameter.

[0095] This invention utilizes a hard contraction function to reduce noise interference by setting terms with lower similarity to zero, thereby calculating and obtaining representative similar profiles.

[0096] This invention multiplies the low-dimensional profile of internal users with the similarity vector of historical low-dimensional profiles of internal users and the weight of the low-dimensional profile of internal users to obtain a low-dimensional similar profile of internal users.

[0097] The decoder is used to receive the low-dimensional similarity profile of the internal user, use the dimensionality-upgrading function to upgrade the low-dimensional similarity profile of the internal user to obtain the reconstruction data of the low-dimensional similarity profile of the internal user, and then transmit the reconstruction data of the low-dimensional similarity profile of the internal user to the reconstruction error calculation module.

[0098] The reconstruction error calculation module is used to receive pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data, and calculate reconstruction error data based on the pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data.

[0099] S23. Based on the behavior anomaly scorer in step S21 and the internal user low-dimensional similarity profile, internal user low-dimensional similarity profile reconstruction data and reconstruction error data in step S22, obtain the anomaly score for the startup phase.

[0100] Step S23 includes the following sub-steps:

[0101] S231. Based on the internal user low-dimensional similarity profile, the reconstructed data of the internal user low-dimensional similarity profile, and the reconstruction error data from step S22, the splicing features are obtained using the splicing function, as follows:

[0102] x in =Concat(x, z′, e)

[0103] Where: x in For splicing features, Concat is the splicing function, x is the low-dimensional similarity profile of internal users, z′ is the reconstructed data of the low-dimensional similarity profile of internal users, and e is the reconstruction error data.

[0104] S232. Input the concatenated features from step S231 into the behavior anomaly scorer to obtain the anomaly score for each layer of the multilayer perceptron during the startup phase, and output the startup phase anomaly score. The anomaly score for each layer of the multilayer perceptron during the startup phase is represented as follows:

[0105] S j (x)=σ(W j ·x+b j )

[0106] Wherein: S j (x) represents the anomaly score during the startup phase of the j-th layer of the multilayer perceptron, where j is the layer number of the multilayer perceptron, σ is the activation function used to enhance the nonlinear representation capability of the multilayer perceptron, and W j Let x be the weight matrix of the j-th layer of the multilayer perceptron, x be the input variable of the j-th layer of the multilayer perceptron, and x be the concatenated feature x of the first layer of the multilayer perceptron. in b j is the bias coefficient of the j-th layer of the multilayer perceptron.

[0107] Specifically, the multilayer perceptron contains h layers, and the input to the first layer of the multilayer perceptron is the concatenated feature x. in The output is S1(x) in That is, the anomaly score of the first layer startup phase of the multilayer perceptron is S1(x). in The input to the second layer of the multilayer perceptron is S1(x). in Then, the abnormal score of the second-level startup phase is output, until the nth layer of the multilayer perceptron outputs the abnormal score of the startup phase.

[0108] S24. Calculate the pre-training loss based on the pre-trained internal user behavior feature data in step S1 and the abnormal score in the startup phase in sub-step S23, so as to pre-train the feature detection module.

[0109] Step S24 includes the following sub-steps:

[0110] S241. Calculate the memory module loss based on the pre-trained internal user behavior feature data in step S1, expressed as:

[0111] L mem (X i y i )=y i max(0, m) i -m low )+(1-y i max(0, m) high -m i )

[0112] Where: L mem (X i y i X represents the memory module loss. i For internal user behavior characteristic data, y i The labels are internal user behavior feature data, max(·) is the maximum value function, and m i To determine the degree of matching between internal user behavior feature data and the memory module, m low m is the first hyperparameter. high The second hyperparameter is used to train the memory module, which matches the normal and does not match the abnormal.

[0113] S242. Calculate the reconstruction error loss based on the pre-trained internal user behavior feature data in step S1, expressed as:

[0114] L err (X i y i )=y i e i +(1-y i )max(0,e high -e i )

[0115] Where: L err (X i y i e represents the reconstruction error loss. i To reconstruct the error value, e high This is the third hyperparameter, which is used to adjust the reconstruction error, i.e., to adjust the output of the behavioral characteristic distiller.

[0116] S243. Calculate the anomaly score loss based on the pre-trained internal user behavior feature data in step S1 and the anomaly score in the startup phase in sub-step S23, expressed as:

[0117] L score (Xi y i )=y i score i +(1-y i max(0, score) high -score i )

[0118] Where: L score (X i y i ) represents the outlier score loss, score i The score represents the outlier score. high The fourth hyperparameter is used to train the scorer. By adjusting the learnable parameters in the behavior anomaly scorer, the anomaly score of the abnormal sample is not lower than the fourth hyperparameter.

[0119] S244. Calculate the pre-training loss based on the pre-trained internal user behavior feature data in step S1 and the abnormal score during the startup phase in sub-step S23, to pre-train the feature detection module. The pre-training loss is expressed as follows:

[0120]

[0121] Where: L init The value is denoted as 'pre-training loss', where 't' represents the number of detection time granularities of the pre-training internal user behavior feature data, 'u' represents the number of internal users, and 'i' represents the sample sequence number.

[0122] S3. Determine the incremental learning optimization period, obtain the internal user data within the incremental learning optimization period, and calculate the internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period.

[0123] In an optional embodiment of the present invention, the present invention determines an incremental learning optimization period, uses an internal user feature extraction module to obtain internal user data within the incremental learning optimization period, calculates internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period, and transmits the real-time internal user behavior feature data to the behavior feature detection model.

[0124] S4. Based on the pre-trained behavior feature detection model in step S2 and the internal user behavior feature data within the incremental learning optimization period in step S3, output the abnormal score of the running phase to obtain the internal threat detection results of the large enterprise network. Based on the abnormal score of the running phase and the expert survey samples, use the human-machine loopback method to perform incremental learning optimization on the pre-trained behavior feature detection model.

[0125] In an optional embodiment of the present invention, the present invention outputs anomaly scores during the operation phase based on the pre-trained behavioral feature detection model and internal user behavioral feature data within the incremental learning optimization period to obtain the internal threat detection results of large enterprise networks, and uses a human-machine loopback method to perform incremental learning optimization on the pre-trained behavioral feature detection model based on the operational phase anomaly scores and expert survey samples.

[0126] Step S4 includes the following sub-steps:

[0127] S41. Based on the pre-trained behavior feature detection model in step S2 and the internal user behavior feature data within the incremental learning optimization period in step S3, output the abnormal score of the running phase to obtain the internal threat detection results of the large enterprise network.

[0128] S42. Determine whether the abnormal score in the operation phase of sub-step S41 is greater than the abnormal score threshold; if so, determine it as an abnormal sample, otherwise determine it as a normal sample, so as to obtain the internal threat detection results of large enterprise networks and determine the detection label of the sample.

[0129] S43. Determine the survey rate, identify suspicious samples within the incremental learning optimization period based on the survey rate, determine the true labels of suspicious samples through expert surveys, and identify other samples within the incremental learning optimization period as normal samples to determine the survey labels of the samples.

[0130] S44. Determine incremental learning samples based on the detection labels of the samples in step S42 and the survey labels of the samples in step S43.

[0131] S45. Based on the pre-trained behavior feature detection model in step S2 and the incremental learning samples in step S44, obtain the incremental learning anomaly score.

[0132] S46. Based on the internal user behavior feature data within the incremental learning optimization period in step S3, the abnormal score of the running stage in sub-step S41, and the abnormal score of incremental learning in sub-step S45, calculate the incremental learning loss to perform incremental learning optimization on the pre-trained behavior feature detection model.

[0133] Step S46 includes the following sub-steps:

[0134] S461. Based on the internal user behavior feature data within the incremental learning optimization cycle in step S3 and the abnormal scores of the running phase in sub-step S41, calculate the memory module loss, reconstruction error loss, and abnormal score loss.

[0135] S462. Calculate the loss due to changes in the memory module, expressed as:

[0136] L dist_men (M)=MSE(Minit M)

[0137] Where: L dist_mem (M) represents the memory module variation loss, and MSE is the mean square error function. init M represents the parameters of the memory module before incremental learning, and M represents the parameters of the memory module during incremental learning.

[0138] S463. Based on the anomaly scores during the operational phase in sub-step S41 and the incremental learning anomaly scores in sub-step S45, calculate the anomaly score change loss, expressed as:

[0139] L dist_score (X i )=|init_score i -score i |

[0140] Where: L dist_score (X i The loss is for abnormal score changes, init_score i Incremental learning of previous samples X i Abnormal scores i This is for incremental learning of outlier scores.

[0141] S464. Based on the memory module loss, reconstruction error loss, and anomaly score loss in step S461, the memory module change loss in step S462, and the anomaly score change loss in step S463, calculate the incremental learning loss to perform incremental learning optimization on the pre-trained behavior feature detection model. The incremental learning loss is expressed as follows:

[0142]

[0143] Where: L inc The incremental learning loss is w, where w is the number of detection time granularities in the incremental learning optimization cycle, u is the number of internal users, and i is the sample sequence number.

[0144] A large enterprise network internal threat detection system that applies the above method includes an internal user feature extraction module and a behavioral feature detection module.

[0145] In an optional embodiment of the present invention, the internal user feature extraction module is used to acquire pre-trained internal user data, calculate pre-trained internal user behavior feature data based on the pre-trained internal user data, and transmit the pre-trained internal user behavior feature data to the behavior feature detection module, acquire internal user data within the incremental learning optimization period, calculate internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period, and transmit the internal user behavior feature data within the incremental learning optimization period to the behavior feature detection module.

[0146] In an optional embodiment of the present invention, the behavior feature detection module is used to receive pre-trained internal user behavior feature data, output an anomaly score in the startup phase based on the pre-trained internal user behavior feature data to pre-train the module's internal parameters, receive internal user behavior feature data within the incremental learning optimization period, output an anomaly score in the operation phase based on the pre-trained internal parameters and the internal user behavior feature data within the incremental learning optimization period to perform internal threat detection in large enterprise networks, and use a human-machine loopback method to incrementally learn and optimize the pre-trained internal parameters based on the operation phase anomaly score and expert survey samples.

[0147] The behavioral feature detection module includes a behavioral feature distiller and a behavioral anomaly scorer.

[0148] The behavioral feature distiller includes an encoder, a memory module, a decoder, and a reconstruction error calculation module connected in sequence.

[0149] The encoder receives internal user behavior feature data, uses a dimensionality reduction function to reduce the dimensionality of the internal user behavior feature data to obtain a low-dimensional profile of the internal user, transmits the low-dimensional profile of the internal user to the memory module, and transmits the internal user behavior feature data to the reconstruction error calculation module.

[0150] The memory module is used to store historical internal user low-dimensional profiles, receive internal user low-dimensional profiles, calculate the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile, calculate the weight of the internal user low-dimensional profile using a hard shrinkage function, obtain the internal user low-dimensional similar profile based on the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile and the weight of the internal user low-dimensional profile, and transmit the internal user low-dimensional similar profile to the decoder.

[0151] Specifically, the memory module also transmits internal low-dimensional similar user profiles to the behavior anomaly scorer.

[0152] The decoder is used to receive the low-dimensional similarity profile of the internal user, use the dimensionality-upgrading function to upgrade the low-dimensional similarity profile of the internal user to obtain the reconstruction data of the low-dimensional similarity profile of the internal user, and then transmit the reconstruction data of the low-dimensional similarity profile of the internal user to the reconstruction error calculation module.

[0153] Specifically, the decoder also transmits the reconstructed data of the internal low-dimensional similar profiles of users to the behavior anomaly scorer.

[0154] The reconstruction error calculation module is used to receive pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data, and calculate reconstruction error data based on the pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data.

[0155] Specifically, the reconstruction error calculation module transmits the reconstruction error data to the behavior anomaly scorer.

[0156] The behavior anomaly scorer is used to receive the internal user low-dimensional similarity profile transmitted by the memory module, the internal user low-dimensional similarity profile reconstruction data transmitted by the decoder, and the reconstruction error data transmitted by the reconstruction error calculation module. It then obtains the anomaly score for the startup phase based on the internal user low-dimensional similarity profile, the internal user low-dimensional similarity profile reconstruction data, and the reconstruction error data.

[0157] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A method for detecting internal threats in a large enterprise network, characterized in that, Includes the following steps: S1. Obtain pre-trained internal user data and calculate pre-trained internal user behavior feature data based on the pre-trained internal user data; S2. Construct a behavior feature detection model and pre-train the feature detection model based on the pre-trained internal user behavior feature data in step S1. S3. Determine the incremental learning optimization period, obtain the internal user data within the incremental learning optimization period, and calculate the internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period. S4. Based on the pre-trained behavior feature detection model in step S2 and the internal user behavior feature data within the incremental learning optimization period in step S3, output the abnormal score of the running stage to obtain the internal threat detection results of the large enterprise network. Based on the abnormal score of the running stage and the expert survey samples, use the human-machine loopback method to perform incremental learning optimization on the pre-trained behavior feature detection model. Step S4 includes the following sub-steps: S41. Based on the pre-trained behavior feature detection model in step S2 and the internal user behavior feature data within the incremental learning optimization period in step S3, output the abnormal score of the running phase to obtain the internal threat detection results of the large enterprise network. S42. Determine whether the abnormal score in the running phase of sub-step S41 is greater than the abnormal score threshold. If so, it is identified as an abnormal sample; otherwise, it is identified as a normal sample, in order to obtain the internal threat detection results of large enterprise networks and determine the detection label of the sample. S43. Determine the survey rate, identify suspicious samples within the incremental learning optimization period based on the survey rate, determine the true labels of suspicious samples through expert surveys, and identify other samples within the incremental learning optimization period as normal samples in order to determine the survey labels of the samples. S44. Determine incremental learning samples based on the detection labels of the samples in step S42 and the survey labels of the samples in step S43. S45. Based on the pre-trained behavior feature detection model in step S2 and the incremental learning samples in step S44, obtain the incremental learning anomaly score. S46. Based on the internal user behavior feature data within the incremental learning optimization period in step S3, the abnormal score of the running stage in sub-step S41, and the abnormal score of incremental learning in sub-step S45, calculate the incremental learning loss to perform incremental learning optimization on the pre-trained behavior feature detection model. Step S46 includes the following sub-steps: S461. Based on the internal user behavior feature data within the incremental learning optimization cycle in step S3 and the abnormal scores of the running phase in sub-step S41, calculate the memory module loss, reconstruction error loss and abnormal score loss. S462. Calculate the loss due to changes in the memory module, expressed as: in: Loss due to changes in memory modules, Let be the mean square error function. These are the parameters for the incremental learning pre-memory module. These are the parameters of the memory module during incremental learning; S463. Based on the anomaly scores during the operational phase in sub-step S41 and the incremental learning anomaly scores in sub-step S45, calculate the anomaly score change loss, expressed as: in: Loss due to abnormal score changes, Incremental learning of previous samples Abnormal scores, Incremental learning of outlier scores; S464. Based on the memory module loss, reconstruction error loss, and anomaly score loss in step S461, the memory module change loss in step S462, and the anomaly score change loss in step S463, calculate the incremental learning loss to perform incremental learning optimization on the pre-trained behavior feature detection model. The incremental learning loss is expressed as follows: in: For incremental learning loss, To optimize the number of detection time granularities in the incremental learning cycle. For the number of internal users, This is the sample number.

2. The method for detecting internal threats in a large enterprise network according to claim 1, characterized in that, Step S2 includes the following sub-steps: S21. Construct a behavioral feature detection model that includes a behavioral feature distiller and a behavioral anomaly scorer; S22. Based on the pre-trained internal user behavior feature data in step S1 and the behavior feature distiller in step S21, obtain the internal user low-dimensional similar profile, internal user low-dimensional similar profile reconstruction data and reconstruction error data. S23. Based on the behavior anomaly scorer in step S21 and the internal user low-dimensional similarity profile, internal user low-dimensional similarity profile reconstruction data and reconstruction error data in step S22, obtain the anomaly score in the startup phase. S24. Calculate the pre-training loss based on the pre-trained internal user behavior feature data in step S1 and the abnormal score in the startup phase in sub-step S23, so as to pre-train the feature detection model.

3. The method for detecting internal threats in a large enterprise network according to claim 2, characterized in that, In step S22, the behavioral feature distiller includes an encoder, a memory module, a decoder, and a reconstruction error calculation module connected in sequence. The encoder is used to receive internal user behavior feature data, use a dimensionality reduction function to reduce the dimensionality of the internal user behavior feature data to obtain a low-dimensional profile of the internal user, transmit the low-dimensional profile of the internal user to the memory module, and transmit the internal user behavior feature data to the reconstruction error calculation module. The memory module is used to store historical internal user low-dimensional profiles, receive internal user low-dimensional profiles, calculate the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile, calculate the weight of the internal user low-dimensional profile using a hard shrinkage function, obtain the internal user low-dimensional similar profile based on the similarity vector between the internal user low-dimensional profile and the historical internal user low-dimensional profile and the weight of the internal user low-dimensional profile, and transmit the internal user low-dimensional similar profile to the decoder. The decoder is used to receive the low-dimensional similarity profile of the internal user, use the dimensionality-upgrading function to upgrade the low-dimensional similarity profile of the internal user to obtain the reconstruction data of the low-dimensional similarity profile of the internal user, and transmit the reconstruction data of the low-dimensional similarity profile of the internal user to the reconstruction error calculation module. The reconstruction error calculation module is used to receive pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data, and calculate reconstruction error data based on the pre-trained internal user behavior feature data and internal user low-dimensional similar profile reconstruction data.

4. The method for detecting internal threats in a large enterprise network according to claim 2, characterized in that, Step S23 includes the following sub-steps: S231. Based on the internal user low-dimensional similarity profile, the reconstructed data of the internal user low-dimensional similarity profile, and the reconstruction error data from step S22, the splicing features are obtained using the splicing function, as follows: in: For splicing features, For concatenation functions, Create low-dimensional similar profiles of internal users. Data for reconstructing low-dimensional similar profiles of internal users. To reconstruct the error data; S232. Input the concatenated features from step S231 into the behavior anomaly scorer to obtain the anomaly score for each layer of the multilayer perceptron during the startup phase, and output the startup phase anomaly score. The anomaly score for each layer of the multilayer perceptron during the startup phase is represented as follows: in: For the multilayer perceptron Abnormal scores during the layer startup phase This represents the layer number of the multilayer perceptron. For activation function, For the multilayer perceptron Layer weight matrix, For the multilayer perceptron Input variables of the first layer of a multilayer perceptron For splicing features , For the multilayer perceptron Layer offset coefficient.

5. A method for detecting internal threats in a large enterprise network according to claim 2, characterized in that, Step S24 includes the following sub-steps: S241. Calculate the memory module loss based on the pre-trained internal user behavior feature data in step S1, expressed as: in: For memory module loss, For internal user behavior characteristic data, Labels for internal user behavior characteristic data. It is a function with maximum value. To determine the degree of matching between internal user behavior feature data and the memory module, As the first hyperparameter, This is the second hyperparameter; S242. Calculate the reconstruction error loss based on the pre-trained internal user behavior feature data in step S1, expressed as: in: To reconstruct the error loss, To reconstruct the error value, This is the third hyperparameter; S243. Calculate the anomaly score loss based on the pre-trained internal user behavior feature data in step S1 and the anomaly score in the startup phase in sub-step S23, expressed as: in: For outlier score loss, These are abnormal scores. This is the fourth hyperparameter; S244. Calculate the pre-training loss based on the pre-trained internal user behavior feature data from step S1 and the abnormal score during the startup phase from sub-step S23, to pre-train the feature detection model. The pre-training loss is expressed as follows: in: For pre-training loss, The number of detection time granularities for pre-trained internal user behavior feature data. For the number of internal users, This is the sample number.

6. A large enterprise network internal threat detection system applying the method of any one of claims 1-5, characterized in that, Includes an internal user feature extraction module and a behavior feature detection module; The internal user feature extraction module is used to obtain pre-trained internal user data, calculate pre-trained internal user behavior feature data based on the pre-trained internal user data, and transmit the pre-trained internal user behavior feature data to the behavior feature detection module. It also obtains internal user data within the incremental learning optimization period, calculates internal user behavior feature data within the incremental learning optimization period based on the internal user data within the incremental learning optimization period, and transmits the internal user behavior feature data within the incremental learning optimization period to the behavior feature detection module. The behavior feature detection module receives pre-trained internal user behavior feature data, outputs anomaly scores during the startup phase based on the pre-trained internal user behavior feature data to pre-train the module's internal parameters, receives internal user behavior feature data during the incremental learning optimization period, outputs anomaly scores during the operation phase based on the pre-trained internal parameters and the internal user behavior feature data during the incremental learning optimization period to perform internal threat detection in large enterprise networks, and uses a human-machine loopback method to incrementally learn and optimize the pre-trained internal parameters based on the operation phase anomaly scores and expert survey samples.

Images