User behavior anomaly processing method, device, equipment, medium and program product

Abstract

The application relates to the field of network security, and provides a user behavior anomaly processing method, device, equipment, medium and program product. The method comprises the following steps: obtaining corresponding user data according to a user request, inputting the user data into an anomaly detection model, and obtaining a prediction classification result of user behavior output by the anomaly detection model; wherein the prediction classification result is obtained by performing feature extraction on the user data, performing feature fusion on the extracted user features, and performing classification on the fused features; and obtaining a processing strategy of the prediction classification result from a policy engine according to the prediction classification result. The application predicts whether a current access or operation request of a user is abnormal through a model, and accesses according to a processing strategy corresponding to a model prediction result, so that the false positive rate of anomaly detection is reduced, and the accuracy of anomaly behavior determination is improved.

Description

Technical Field

[0001] This application relates to the field of network security, specifically to a method, apparatus, device, medium, and program product for handling abnormal user behavior. Background Technology

[0002] Currently, zero-trust architecture includes zero-trust clients, zero-trust controllers, and zero-trust gateways, enabling authentication-based business access authorization. Untrusted personnel cannot access backend business systems; only terminals carrying legitimate identity information can be trusted to discover and access protected resources. Existing zero-trust systems detect abnormal user behavior based on statistical rules to distinguish anomalies in different behaviors, and then differentiate abnormal behavior data based on baseline data. However, this anomaly detection method has a high false positive rate, resulting in low accuracy in identifying abnormal behavior. Summary of the Invention

[0003] This application provides a method, apparatus, device, medium, and program product for handling abnormal user behavior, in order to solve the problem of low accuracy in the determination of abnormal behavior in the prior art.

[0004] In a first aspect, embodiments of this application provide a method for handling abnormal user behavior, including:

[0005] According to an embodiment of this application, a method for handling abnormal user behavior is provided, wherein the abnormal detection model includes multiple sub-models, a feature fusion layer, and a multi-classifier;

[0006] The sub-model is used to extract user features from the user data and input the user features into the feature fusion layer;

[0007] The feature fusion layer is used to fuse the user features extracted by multiple sub-models to obtain the fused features, and input the fused features into the multi-classifier;

[0008] The multi-classifier is used to classify the fused features to obtain the predicted classification result.

[0009] According to an embodiment of this application, a method for handling abnormal user behavior is provided, wherein the user data includes user behavior data, user profile data, and user operation data; and the sub-model includes a Long Short-Term Memory Network (LSTM) model, a Convolutional Neural Network (CNN) model, and a Transformer model.

[0010] The LSTM model is used to extract time-series features from the user behavior data;

[0011] The CNN model is used to extract user profile features from the user profile data;

[0012] The Transformer model is used to extract user operation features from the user operation data.

[0013] The time series features, user profile features, and user operation features are all represented in matrix form.

[0014] According to an embodiment of this application, a method for handling abnormal user behavior is provided, wherein the feature fusion is implemented in the following manner:

[0015] The time series features, user profile features, and user operation features are dimensionally aligned using feature matrices.

[0016] The cross-attention of the time series features, user profile features, and user operation features after dimension alignment is calculated to determine the correlation information among the time series features, user profile features, and user operation features;

[0017] Based on the correlation information, the time series features, the user profile features, and the user operation features are fused to obtain the fused features.

[0018] According to an embodiment of this application, a user behavior anomaly handling method is provided, wherein the anomaly detection model is trained based on the following method:

[0019] A training set is constructed based on user behavior sample data, user profile sample data, and user operation sample data.

[0020] The word vector feature matrix of the user behavior sample data is determined, as well as the word meaning vector and relative position encoding of the user operation sample data; the relative position encoding is obtained by adding an encoding to each position in the user operation sample data; the position is determined based on the temporal order of the user operation.

[0021] An initial LSTM model is trained based on the word vector feature matrix to obtain the LSTM model;

[0022] An initial CNN model is trained based on the user profile sample data to obtain the CNN model;

[0023] The initial Transformer model is trained based on the word sense vectors and relative position encodings to obtain the Transformer model.

[0024] The model architecture is trained using the training set to obtain the anomaly detection model; the model architecture includes the LSTM model, the CNN model, the Transformer model, the feature fusion layer, and the multi-classifier.

[0025] According to an embodiment of this application, a method for handling abnormal user behavior includes determining the word vector feature matrix of the user behavior sample data, which includes:

[0026] The user behavior sample data is aggregated using user ID as the dimension to obtain the first aggregated data;

[0027] The content of each field in the first aggregated data is converted into word vectors to obtain the word vector feature matrix;

[0028] Determining the word sense vector and relative position encoding of the user operation sample data includes:

[0029] The user operation sample data is aggregated using user ID as the dimension to obtain second aggregated data;

[0030] The text content in the second aggregated data is converted into a word sense vector representation to obtain the word sense vector;

[0031] The relative position code is obtained by adding an encoding to each position in the second aggregated data.

[0032] Secondly, embodiments of this application provide a user behavior anomaly handling device, comprising:

[0033] The prediction module is used to obtain corresponding user data according to user requests, input the user data into an anomaly detection model, and obtain the prediction classification result of user behavior output by the anomaly detection model; wherein, the prediction classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features;

[0034] The processing module is used to obtain the processing strategy for the predicted classification result from the strategy engine based on the predicted classification result.

[0035] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the user behavior anomaly handling method described in the first aspect.

[0036] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the user behavior anomaly handling method described in the first aspect.

[0037] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the user behavior exception handling method described in the first aspect.

[0038] The user behavior anomaly handling method, apparatus, device, medium, and program product provided in this application obtains corresponding user data according to user requests, inputs the user data into an anomaly detection model, and obtains the predicted classification result of user behavior output by the anomaly detection model. The predicted classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features. Based on the predicted classification result, a processing strategy for the predicted classification result is obtained from a strategy engine. This application predicts whether a user's current access or operation request is abnormal through a model and performs access according to the processing strategy corresponding to the model's prediction result, thereby reducing the false positive rate of anomaly detection and improving the accuracy of anomaly behavior judgment. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating the user behavior anomaly handling method provided in the embodiments of this application;

[0041] Figure 2 This is a schematic diagram of the interaction flow of the user behavior anomaly detection system provided in the embodiments of this application;

[0042] Figure 3 This is a schematic diagram of the user behavior anomaly detection algorithm architecture provided in the embodiments of this application;

[0043] Figure 4 This is a schematic diagram of the user behavior anomaly detection system architecture provided in the embodiments of this application;

[0044] Figure 5 This is a schematic diagram of the interaction flow of the user behavior anomaly handling system provided in the embodiments of this application;

[0045] Figure 6 This is a schematic diagram of the user behavior anomaly detection device provided in the embodiments of this application;

[0046] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] Existing zero-trust architectures have relatively weak capabilities in detecting abnormal user behavior during resource access after a user successfully logs into the zero-trust client. For example, they rely on traditional rule-based methods to statistically analyze and identify unusual access times, unusual IP addresses, abnormal access frequency, and abnormal command operations. This neglects the temporal relationships between user access behaviors, the correlation characteristics of user profile data, and the feature analysis of user operation data, leading to numerous false positives and low accuracy in abnormal behavior detection. Furthermore, traditional rule-based anomaly detection methods require manual rule design and addition. With a large number of rules, the computational resources consumed increase, detection efficiency remains low, and they cannot identify abnormal behaviors beyond those defined by statistical rules.

[0049] Based on the above problems, this application proposes a method for handling abnormal user behavior.

[0050] Figure 1 This is a flowchart illustrating the user behavior anomaly handling method provided in an embodiment of this application. (Refer to...) Figure 1 This application provides a method for handling abnormal user behavior, which may include:

[0051] Step 100: Obtain the corresponding user data according to the user request, input the user data into the anomaly detection model, and obtain the predicted classification result of user behavior output by the anomaly detection model.

[0052] The execution entity of this application embodiment is a user behavior anomaly detection system, such as... Figure 2 As shown, the user behavior anomaly detection system is located in the intranet area, and the zero-trust gateway interacts with the user behavior anomaly detection system through an encrypted channel.

[0053] After a user successfully logs in via the Zero Trust client, requests to access backend resources pass through the Zero Trust gateway and enter the user behavior anomaly detection system. For example, a user sends a request to the Zero Trust gateway through the Zero Trust client; this request can be an access request or a user operation request. The Zero Trust gateway forwards the user request sent by the Zero Trust client to the user behavior anomaly detection system through an encrypted channel.

[0054] After receiving a user request forwarded by the zero-trust gateway, the user behavior anomaly detection system obtains the user data corresponding to the request. This user data includes user behavior data, user profile data, and user operation data. Then, the user data is input into a pre-trained anomaly detection model to obtain the predicted classification results of the user behavior output by the anomaly detection model. The predicted classification results include high risk, medium risk, low risk, and normal.

[0055] The predicted classification result is obtained by extracting features from user data, fusing the extracted user features, and classifying the fused features. For example, an anomaly detection model extracts features from input user behavior data, user profile data, and user operation data, fuses the extracted user features to obtain fused features, and finally classifies the fused features to obtain the predicted classification result of user behavior. The user features include time-series features of user behavior, user profile features, and user operation features.

[0056] Step 200: Based on the predicted classification result, obtain the processing strategy for the predicted classification result from the strategy engine.

[0057] The model's multi-class classification results are categorized into four types: high-risk, medium-risk, low-risk, and normal. Different processing strategies can be configured for each of these four results and stored in the strategy engine. The user behavior anomaly detection system obtains the processing strategies for the predicted classification results from the strategy engine through the model training module. For example, it matches the predicted classification results with the classification results corresponding to the processing strategies stored in the strategy engine to obtain the successfully matched processing strategies. Then, the model training module sends the processing strategies for the predicted classification results to the zero-trust gateway. The zero-trust gateway calls the adaptive access module to execute specific access control actions based on the processing strategies for the predicted classification results, such as direct interception, secondary access verification, pop-up warnings of dangerous operations, and logging. Subsequently, manual review and verification are performed based on the model's processing results, and the verification results are updated to the sample set. The model is iteratively trained based on the new sample set to continuously optimize its accuracy.

[0058] The user behavior anomaly handling method provided in this application obtains corresponding user data based on user requests, inputs the user data into an anomaly detection model, and obtains the predicted classification result of user behavior output by the anomaly detection model. The predicted classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features. Based on the predicted classification result, a processing strategy for the predicted classification result is obtained from a strategy engine. This application predicts whether a user's current access or operation request is abnormal through a model and performs access according to the processing strategy corresponding to the model's prediction result, thereby reducing the false positive rate of anomaly detection and improving the accuracy of anomaly behavior judgment.

[0059] Based on the above embodiments, the anomaly detection model includes multiple sub-models, a feature fusion layer, and a multi-classifier;

[0060] The sub-model is used to extract user features from the user data and input the user features into the feature fusion layer;

[0061] The feature fusion layer is used to fuse the user features extracted by multiple sub-models to obtain the fused features, and input the fused features into the multi-classifier;

[0062] The multi-classifier is used to classify the fused features to obtain the predicted classification result.

[0063] Since user access to business systems includes common operations such as accessing business service resources, maintenance operations, login, and file uploads, existing technical solutions using LSTM alone to analyze user access records can only statistically analyze the temporal features of user resource access. Some user-related habits, i.e., user profile features, cannot be extracted. Furthermore, some user operation commands, such as Linux maintenance operation commands, also cannot have their corresponding features extracted, resulting in low accuracy in anomaly detection. This application's embodiment uses the LSTM algorithm to extract temporal feature information of user access behavior, the CNN algorithm to extract profile features from user profile data, and the Transformer algorithm to extract features from user operation commands. Then, a feature fusion layer based on a self-attention mechanism is used to discover the intrinsic relationships between features, fusing the three features together to better represent overall user behavior. Finally, deep learning is performed based on these features to output model results, which are then applied to user behavior anomaly prediction.

[0064] LSTM is a variant of Recurrent Neural Network (RNN) specifically designed for processing sequential data. Compared to traditional RNN structures, LSTM introduces a gating mechanism, which better captures long-term dependencies in sequential data. CNNs can automatically learn features from input data without requiring manual feature extractors. Through convolutional and pooling layers, CNNs can extract abstract features layer by layer, thus better representing the data. Transformers are deep learning models that use self-attention mechanisms. Compared to traditional RNNs and convolutional neural networks, they can achieve fully parallel computation, better capture long-range dependencies, compute global dependencies, more easily interpret prediction results, handle variable-length sequences, have a flexible and scalable structure, good pre-training performance, require no feature engineering, handle multimodal data, and support transfer learning.

[0065] like Figure 3As shown, the anomaly detection model includes multiple sub-models, a feature fusion layer, and a multi-classifier. The sub-models include a Long Short-Term Memory (LSTM) network model, a Convolutional Neural Network (CNN) model, and a Transformer model. The functions of each model are as follows:

[0066] The LSTM model is used to extract time-series features from user behavior data and input these features into a feature fusion layer.

[0067] The CNN model is used to extract user profile features from user profile data and input these features into the feature fusion layer.

[0068] The Transformer model is used to extract user operation features from user operation data and input these features into a feature fusion layer.

[0069] The feature fusion layer employs a self-attention mechanism to fuse the temporal sequence features TC of user behavior, the user profile features TP, and the user operation features OC. Since both user behavior features and user operation features contain temporal information, and the user profile features have different degrees of influence on the two temporal features, it is necessary to extract this correlation through feature fusion so that the fused features can better represent the abnormal information of user behavior.

[0070] Specifically, the time series features, user profile features, and user operation features are dimensionally aligned; the cross-attention of the dimensionally aligned time series features, user profile features, and user operation features is calculated to determine the correlation information among them; based on the correlation information, the time series features, user profile features, and user operation features are fused to obtain fused features.

[0071] For example, first use a fully linked algorithm to align the dimensions of the TC, TP, and OC feature matrices, and then use the following feature fusion algorithm:

[0072]

[0073] Where d is the number of modes, and V is the concatenation of the three characteristic matrices:

[0074] V = Concat(TC,TP,OC);

[0075] After determining the correlation information between features, feature fusion can be performed based on this correlation information. The purpose of feature fusion is to take into account the correlation between different features in order to generate a more comprehensive and informative feature representation. For example, the following methods can be used for feature fusion:

[0076] (1) Concatenation / Connection: Concatenate different features together to form a longer feature vector.

[0077] (2) Weighted summation: Assign a weight to each feature and sum them up to obtain the fused features.

[0078] (3) Feature interaction / product: For certain feature pairs, new features can be generated through interaction or product between elements.

[0079] After feature fusion, a new feature matrix is ​​obtained and input into a multi-classifier for classification prediction. The multi-classifier uses an MLP structure. Finally, the predicted classification result of user behavior is calculated using the normalization function softmax. During the training phase, the cross-entropy of the multi-class classification is used as the loss function. Based on this loss function, the adaptive moment estimation optimization algorithm (Adam) is used to fine-tune the model parameters. The multi-class cross-entropy loss function is used to measure the difference between the neural network's output and the actual label.

[0080] The formula for the multi-class cross-entropy loss function is shown below:

[0081]

[0082] Where J is the loss function, used to measure the predicted value p. i and actual label y i The difference between them; K is the number of categories, y i For the actual label, p i These are the predicted values ​​generated by the neural network.

[0083] This application's embodiments introduce a deep learning LSTM+CNN+Transformer algorithm to detect abnormal user behavior. LSTM extracts temporal features of user access behavior, CNN extracts profile features from user profile data, and Transformer extracts operational features from user operation data. A feature fusion layer based on a self-attention mechanism fuses these three features to fully extract the feature correlations of user behavior, better representing user behavior characteristics. The model is then trained to predict in real time whether the user's current access and operation behavior is abnormal. Based on this, the false positive rate of anomaly detection is reduced, and the accuracy of abnormal behavior judgment is improved.

[0084] Based on the above embodiments, the anomaly detection model is trained in the following manner:

[0085] Step 111: Construct a training set based on user behavior sample data, user profile sample data, and user operation sample data;

[0086] Step 112: Determine the word vector feature matrix of the user behavior sample data, and determine the word meaning vector and relative position encoding of the user operation sample data; the relative position encoding is obtained by adding an encoding to each position in the user operation sample data; the position is determined based on the temporal order of the user operation.

[0087] Step 113: Train an initial LSTM model based on the word vector feature matrix to obtain the LSTM model;

[0088] Step 114: Train an initial CNN model based on the user profile sample data to obtain the CNN model;

[0089] Step 115: Train an initial Transformer model based on the word sense vectors and relative position encodings to obtain the Transformer model;

[0090] Step 116: Using the training set, train the model architecture to obtain the anomaly detection model; the model architecture includes the LSTM model, the CNN model, the Transformer model, the feature fusion layer, and the multi-classifier.

[0091] After acquiring user behavior sample data, user profile sample data, and user operation sample data, the user behavior anomaly detection system needs to process this data in order to build a training set and train the model.

[0092] The data structure of user behavior data is shown in Table 1:

[0093] Table 1

[0094]

[0095] The user behavior sample data is processed as follows:

[0096] 1. Data cleaning: Remove records that do not meet the analysis criteria, such as empty field values ​​or incorrect field value formats. The purpose is to ensure the data quality and accuracy of subsequent analysis.

[0097] 2. Aggregate user behavior sample data by user ID to obtain the first aggregated data. For example, group user behavior sample data by user ID and merge all behavior records of the same user together to form aggregated data by user. This approach allows analysts to better understand and describe the overall behavioral patterns of each user, rather than processing each behavior record individually.

[0098] 3. Convert the content of each field in the first aggregated data into word vector form to obtain the word vector feature matrix. For example, use the content of each field in the first aggregated data as input to the Word2Vec word vector extraction algorithm to obtain the word vector feature matrix.

[0099] 4. Using a 24-hour sliding window, the word vector feature matrix is ​​input into the initial LSTM model for training, resulting in the LSTM model. The LSTM model learns the temporal relationships between sequence data to extract user time-series feature information (TC), which includes the user's temporal access characteristics.

[0100] The data structure of user profile data is shown in Table 2:

[0101] Table 2

[0102]

[0103]

[0104] The user profile sample data was processed as follows:

[0105] 1. Data cleaning: Remove records that do not meet the analysis criteria, such as empty field values ​​or incorrect field value formats.

[0106] 2. User profiles are divided into three tag dimensions: basic user information, user behavior tags, and user statistics tags. Basic user information includes the user's own basic information, such as user ID, bound terminal information (generated from terminal MAC address + terminal type + terminal operating system), and frequently used login locations (derived from the city with the most logins). User behavior tags are statistics on the user's specific actions within the system, including login, access, and operation commands. User statistics tags are derived based on user access logs, traffic logs, and other information according to certain statistical rules.

[0107] To update user profile data on a monthly basis, first aggregate data by user ID field, then statistically analyze specific fields as follows:

[0108] 2.1 Periods of frequent user logins, periods of frequent user resource access, periods of frequent user command execution, and periods of high-risk user command operations:

[0109] The cumulative values ​​of login count, access count, and command execution count for different users in each different time period are calculated using two-hour intervals. Then, the data for each time period is standardized using Z-Score to ensure an even distribution of the data.

[0110]

[0111] Where x is the value of a specific data point, i.e., the original value; μ is the mean of all data points; σ is the standard deviation of all data points; and Z is the standard score.

[0112] Then, outliers in the corresponding time periods are removed using the distribution detection algorithm (3sigma). Finally, the average of the remaining data is calculated and multiplied by 30 days to obtain the final result. The top three time periods are taken as the frequent time periods, which is calculated using the following formula:

[0113]

[0114] Where i represents the number of times the sample is taken, and i can take values ​​of 0, 1, 2, or 3 times; n represents the number of data points; z j The results for the time period after removing outliers.

[0115] 2.2 Average number of user logins, average number of user visits, average number of user file uploads, average number of user file downloads, and average number of times high-risk commands are executed:

[0116] The number of user logins, accesses, file uploads, and file downloads are counted daily within a statistical month. Z-Score normalization is used to standardize each count to ensure an even distribution of the data. Then, a distribution detection algorithm (3 sigma) is used to remove prominent outliers. Finally, the average of the remaining data is calculated and multiplied by 30 days to obtain the final result, as shown in the following formula:

[0117]

[0118] Where, x i This represents the daily results after removing outliers, where n1 is the amount of data.

[0119] 2.3. Time of the most recent high-risk operation: Obtain the time of the user's last high-risk operation on a monthly basis.

[0120] 2.4 Percentage of High-Risk User Operations: The percentage of high-risk user operations out of all operations is calculated monthly.

[0121] 2.5 User login success rate: Monthly statistics of the number of successful user logins / total number of user logins.

[0122] 2.6 Top N High-Risk User Operation Commands: Monthly statistics of the top N highest-risk user operation commands.

[0123] 2.7 Top N Resources Accessed Most Frequently by Users: Monthly statistics of the top N resources accessed most frequently by users.

[0124] 2.8 Top N User Request Protocols: Monthly statistics on the top N application layer protocols used by user terminals to request the system, such as HTTP and SFTP.

[0125] 2.9 Average User Access Traffic: Monthly statistics on user terminal access traffic.

[0126] 2.10 Average time interval for accessing different resources: The interval between users accessing different resources is calculated monthly, i.e., total time - resource access time / number of resources accessed.

[0127] 3. Input the user profile sample data into the initial CNN model for training to obtain the CNN model. The CNN model processes the profile data by selecting different convolutional layers, and then extracts user profile features (TP) from multiple aspects for use in subsequent feature fusion layers.

[0128] The data structure of user operation data is shown in Table 3:

[0129] Table 3

[0130]

[0131] User operation data is mainly used to track the commands executed by users on the server, such as when the command to delete a file, e.g., rm -rf xx.txt, was executed on a specific business server.

[0132] The user operation sample data is processed as follows:

[0133] 1. Data cleaning: Remove records that do not meet the analysis criteria, such as empty field values ​​or incorrect field value formats.

[0134] 2. Aggregate user operation sample data by user ID to obtain the second aggregated data.

[0135] 3. Convert the text content in the second aggregated data into a word sense vector representation to obtain word sense vectors. For example, based on the pre-trained GloVe word vectors and the InferSent sentence embedding model, perform word sense vectorization on the user operation sample data to obtain word sense vectors.

[0136] 4. Add an encoding to each position in the second aggregated data to obtain a relative position encoding. For example, a sinusoidal position encoding matrix can be used to generate a relative position encoding for user operation data. Here, the relative position encoding is obtained by adding an encoding to each position in the user operation sample data; the position is determined based on the chronological order of the user operations. In essence, relative position encoding is a technique that adds an encoding to each position in sequence data to represent the relative positional relationship between different positions. Position refers to the order or relative order of user operations in the sequence; each operation has a corresponding position, which can be determined based on the chronological or relative order of the operations.

[0137] 5. Using a 24-hour sliding window, the word meaning vectors and relative position encodings of user operation data are input into the initial Transformer model for training, resulting in the Transformer model. The Transformer model extracts the user's operation feature information (OC), which includes the user's temporal operation and maintenance behavior characteristics.

[0138] After training the LSTM, CNN, and Transformer models, an anomaly detection model architecture is constructed based on the LSTM, CNN, Transformer models, feature fusion layers, and multi-classifiers. Finally, the model architecture is trained using a training set constructed from user behavior sample data, user profile sample data, and user operation sample data to obtain the anomaly detection model.

[0139] This application's embodiments introduce a deep learning LSTM+CNN+Transformer algorithm to detect abnormal user behavior. LSTM extracts temporal features of user access behavior, CNN extracts profile features from user profile data, and Transformer extracts operational features from user operation data. A feature fusion layer based on a self-attention mechanism fuses these three features to fully extract the feature associations of user behavior, better representing user behavior characteristics. The model is then trained to predict in real time whether the user's current access and operation behavior is abnormal. Supervised iterative training based on proprietary feature extraction and feature fusion repeatedly optimizes the model, improving model accuracy, reducing the false positive rate, and increasing the efficiency of abnormal user behavior detection.

[0140] To further explain the user behavior anomaly handling method proposed in this application, please refer to... Figure 2 , Figure 4 and the following examples.

[0141] This application specifically proposes a method for detecting abnormal user behavior based on zero trust.

[0142] like Figure 2 As shown, the Zero Trust Controller and Zero Trust Security Gateway (i.e., the Zero Trust Gateway) are located in the DMZ zone. The DMZ zone is a specific area within the network, situated between the internal trusted network and the external untrusted network, used to carry services provided externally and isolate the internal and external networks. The user behavior anomaly detection system is located in the internal network zone, i.e., the trusted internal network. The Zero Trust Gateway interacts with the user behavior anomaly detection system through an encrypted channel.

[0143] The initial model training of the user behavior anomaly detection system is based on expert experience and uses data such as behavior logs from a big data statistical system. Sample information is labeled according to four categories: high-risk, medium-risk, low-risk, and normal. Following the zero-trust principle of never trusting and continuous monitoring, after a user successfully logs in through the zero-trust client, requests to access backend resources pass through the zero-trust gateway and enter the user behavior anomaly detection system. Based on the user's request or operation information, the system calls the anomaly detection model to output a prediction result. If the prediction result is high-risk, the strategy engine is invoked to match a high-risk handling strategy, and then the adaptive access module is called to execute the strategy, such as performing secondary verification. Simultaneously, abnormal results are recorded, and the sample set is updated and iteratively trained through manual review.

[0144] like Figure 4 As shown, the user behavior anomaly detection system is mainly used for detecting abnormal user behavior in zero-trust systems, including abnormal access to business systems and abnormal operations. It extracts and processes user access logs, user profile information, and user operation information, then uses anomaly detection algorithms to train corresponding data and outputs an anomaly detection model. Finally, the anomaly detection model is used to predict the anomaly classification of user behavior and apply different access actions based on the classification. The user behavior anomaly detection system includes a data processing module, a model training module, a policy engine, and an adaptive access module. The functions of each module are as follows:

[0145] Data processing module: Responsible for providing data cleaning, data processing, and data analysis capabilities, mainly used for processing sample data.

[0146] Model training module: Responsible for training algorithms on user access logs, user profile information and user operation information connected to the user behavior anomaly detection system, and outputting the trained model, providing capabilities such as model training interface and model calling interface.

[0147] Strategy Engine: Responsible for providing the ability to configure model training parameters and the ability to configure strategies for processing model prediction results.

[0148] Adaptive Access Module: Responsible for executing adaptive access functions based on the policy results generated by the policy engine, including two-factor authentication, SMS verification code authentication, multi-factor authentication, and access denial.

[0149] The user behavior anomaly detection system provides a unified model training process through the model training module. It predicts whether user behavior is abnormal and its classification by calling the model results. If anomalies are found, it uses an adaptive access control mechanism through a graded protection mechanism, then manually reviews the relevant anomalies to update the sample set, and iterates to optimize the model to improve the accuracy of the model's judgment.

[0150] Furthermore, this application also proposes a user behavior anomaly handling system, including a zero-trust client, a zero-trust gateway, and a user behavior anomaly detection system;

[0151] The zero-trust client is used to send user requests to the zero-trust gateway;

[0152] Zero-trust gateways are used to forward user requests to user behavior anomaly detection systems;

[0153] The user behavior anomaly detection system is used to obtain corresponding user data according to user requests, input the user data into the anomaly detection model, and obtain the predicted classification result of user behavior output by the anomaly detection model. The predicted classification result is obtained by extracting features from user data, fusing the extracted user features, and classifying the fused features. Based on the predicted classification result, the processing strategy of the predicted classification result is obtained from the strategy engine.

[0154] like Figure 5 As shown, after the model is trained using the anomaly detection algorithm, the user behavior anomaly detection system (hereinafter referred to as the anomaly detection system) can use the model results to predict whether a user's access or operation request is abnormal, and perform different processing based on the model prediction classification. The specific process is as follows:

[0155] a. User access requests or user operation requests initiated by users through access terminals (such as zero-trust clients) are forwarded by the zero-trust gateway to the model training module of the anomaly detection system.

[0156] b. The zero-trust gateway calls the model training module to determine the model prediction result of this request.

[0157] c. The model training module requests the strategy engine to obtain the processing strategy corresponding to the prediction result based on the model prediction result.

[0158] d. Return the processing strategy corresponding to the prediction result to the zero-trust gateway.

[0159] e. The zero-trust gateway calls the adaptive access module to execute specific access control actions based on the processing strategy corresponding to the prediction results.

[0160] f. The model training module records the model prediction results of this request for subsequent manual review and verification of the updated sample set.

[0161] This application provides a zero-trust-based user behavior anomaly detection method. As an AI-based user behavior anomaly detection system, it supports access to different types of user request logs. It employs LSTM+CNN+Transformer algorithms to extract user behavior features, and then fuses these features to extract their inherent relationships. A multi-classifier is then used to classify user behavior, intelligently identifying user behavior anomalies in real time. Adaptive restrictions are applied to user access based on different levels of anomaly handling strategies, progressively increasing access verification restrictions according to the anomaly level to improve system security. Simultaneously, it reduces the false positive rate of anomaly detection and improves the accuracy of anomaly behavior judgment.

[0162] The user behavior anomaly handling device provided in the embodiments of this application is described below. The user behavior anomaly handling device described below can be referred to in correspondence with the data center water utilization efficiency prediction method described above.

[0163] refer to Figure 6 , Figure 6 This is a schematic diagram of the user behavior anomaly handling device provided in this application embodiment. The user behavior anomaly handling device provided in this application embodiment includes:

[0164] The prediction module 601 is used to obtain corresponding user data according to user requests, input the user data into an anomaly detection model, and obtain the prediction classification result of user behavior output by the anomaly detection model; wherein, the prediction classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features.

[0165] The processing module 602 is used to obtain the processing strategy of the predicted classification result from the strategy engine based on the predicted classification result.

[0166] The user behavior anomaly handling device provided in this application obtains corresponding user data according to user requests, inputs the user data into an anomaly detection model, and obtains the predicted classification result of user behavior output by the anomaly detection model. The predicted classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features. Based on the predicted classification result, a processing strategy for the predicted classification result is obtained from a strategy engine. This application predicts whether a user's current access or operation request is abnormal through a model and performs access according to the processing strategy corresponding to the model's prediction result, thereby reducing the false positive rate of anomaly detection and improving the accuracy of anomaly behavior judgment.

[0167] In one embodiment, the anomaly detection model includes multiple sub-models, a feature fusion layer, and a multi-classifier;

[0168] The sub-model is used to extract user features from the user data and input the user features into the feature fusion layer;

[0169] The feature fusion layer is used to fuse the user features extracted by multiple sub-models to obtain the fused features, and input the fused features into the multi-classifier;

[0170] The multi-classifier is used to classify the fused features to obtain the predicted classification result.

[0171] In one embodiment, the user data includes user behavior data, user profile data, and user operation data; the sub-models include a Long Short-Term Memory (LSTM) network model, a Convolutional Neural Network (CNN) model, and a Transformer model.

[0172] The LSTM model is used to extract time-series features from the user behavior data;

[0173] The CNN model is used to extract user profile features from the user profile data;

[0174] The Transformer model is used to extract user operation features from the user operation data.

[0175] The time series features, user profile features, and user operation features are all represented in matrix form.

[0176] In one embodiment, the feature fusion is implemented in the following manner:

[0177] The time series features, user profile features, and user operation features are dimensionally aligned using feature matrices.

[0178] The cross-attention of the time series features, user profile features, and user operation features after dimension alignment is calculated to determine the correlation information among the time series features, user profile features, and user operation features;

[0179] Based on the correlation information, the time series features, the user profile features, and the user operation features are fused to obtain the fused features.

[0180] In one embodiment, the anomaly detection model is trained based on the following method:

[0181] A training set is constructed based on user behavior sample data, user profile sample data, and user operation sample data.

[0182] The word vector feature matrix of the user behavior sample data is determined, as well as the word meaning vector and relative position encoding of the user operation sample data; the relative position encoding is obtained by adding an encoding to each position in the user operation sample data; the position is determined based on the temporal order of the user operation.

[0183] An initial LSTM model is trained based on the word vector feature matrix to obtain the LSTM model;

[0184] An initial CNN model is trained based on the user profile sample data to obtain the CNN model;

[0185] The initial Transformer model is trained based on the word sense vectors and relative position encodings to obtain the Transformer model.

[0186] The model architecture is trained using the training set to obtain the anomaly detection model; the model architecture includes the LSTM model, the CNN model, the Transformer model, the feature fusion layer, and the multi-classifier.

[0187] In one embodiment, determining the word vector feature matrix of the user behavior sample data includes:

[0188] The user behavior sample data is aggregated using user ID as the dimension to obtain the first aggregated data;

[0189] The content of each field in the first aggregated data is converted into word vectors to obtain the word vector feature matrix;

[0190] Determining the word sense vector and relative position encoding of the user operation sample data includes:

[0191] The user operation sample data is aggregated using user ID as the dimension to obtain second aggregated data;

[0192] The text content in the second aggregated data is converted into a word sense vector representation to obtain the word sense vector;

[0193] The relative position code is obtained by adding an encoding to each position in the second aggregated data.

[0194] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call a computer program in the memory 730 to execute steps of a user behavior exception handling method, such as including:

[0195] Receive user requests forwarded by the zero-trust gateway;

[0196] The user data corresponding to the user request is obtained, and the user data is input into the anomaly detection model to obtain the predicted classification result of the user behavior output by the anomaly detection model; wherein, the predicted classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features;

[0197] A processing strategy for obtaining the predicted classification result is obtained, and the processing strategy is sent to the zero-trust gateway so that the zero-trust gateway can perform access control operations.

[0198] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0199] On the other hand, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of the user behavior anomaly handling method provided in the above embodiments, such as including:

[0200] Receive user requests forwarded by the zero-trust gateway;

[0201] The user data corresponding to the user request is obtained, and the user data is input into the anomaly detection model to obtain the predicted classification result of the user behavior output by the anomaly detection model; wherein, the predicted classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features;

[0202] A processing strategy for obtaining the predicted classification result is obtained, and the processing strategy is sent to the zero-trust gateway so that the zero-trust gateway can perform access control operations.

[0203] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the user behavior anomaly handling method provided in the above embodiments, such as including:

[0204] Receive user requests forwarded by the zero-trust gateway;

[0205] The user data corresponding to the user request is obtained, and the user data is input into the anomaly detection model to obtain the predicted classification result of the user behavior output by the anomaly detection model; wherein, the predicted classification result is obtained by extracting features from the user data, fusing the extracted user features, and classifying the fused features;

[0206] A processing strategy for obtaining the predicted classification result is obtained, and the processing strategy is sent to the zero-trust gateway so that the zero-trust gateway can perform access control operations.

[0207] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0208] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0209] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A user behavior anomaly handling method, characterized by, Comprise: According to the user request, the corresponding user data is obtained, the user data is input into the anomaly detection model, and the prediction classification result of the user behavior output by the anomaly detection model is obtained; wherein, the prediction classification result is obtained by feature extraction on the user data, feature fusion on the extracted user features and classification on the fused features; the user request is initiated by a zero trust client and forwarded to a user behavior anomaly detection system through an encryption channel by a zero trust gateway; According to the prediction classification result, the processing strategy of the prediction classification result is obtained from the policy engine; The processing strategy is sent to the zero trust gateway, so that the zero trust gateway performs corresponding access control operation according to the processing strategy; The anomaly detection model comprises a plurality of sub models, a feature fusion layer and a plurality of classifiers; the sub model is used to extract the user features of the user data, and the user features are input into the feature fusion layer; the feature fusion layer is used to fuse the user features extracted by a plurality of sub models, obtain the fused features, and input the fused features into the multi classifier; wherein, feature fusion is used to extract the influence of user portrait features on time sequence features and user operation features, so as to obtain the fused features which can represent the association relationship embodied by the influence; the multi classifier is used to classify the fused features to obtain the prediction classification result; The user data comprises user behavior data, user portrait data and user operation data; the sub model comprises a long short time memory network LSTM model, a convolutional neural network CNN model and a Transformer model; the LSTM model is used to extract the time sequence features of the user behavior data; the CNN model is used to extract the user portrait features of the user portrait data; the Transformer model is used to extract the user operation features of the user operation data; wherein, the time sequence features, the user portrait features and the user operation features are represented in the form of matrix; The feature fusion is realized based on the following way: The dimensions of the feature matrix of the time sequence features, the user portrait features and the user operation features are aligned; the cross attention of the time sequence features, the user portrait features and the user operation features after dimension alignment is calculated to determine the association information between the time sequence features, the user portrait features and the user operation features; based on the association information, the time sequence features, the user portrait features and the user operation features are fused to obtain the fused features; wherein, the full link algorithm is used to align the dimensions of TC, TP and OC three feature matrices, and the following feature fusion algorithm is used: Wherein, d is the number of modes, TC, TP and OC are the feature matrices corresponding to the time sequence features, the user portrait features and the user operation features respectively, V is the connection of the three feature matrices: V = Concat(TC, TP, OC).

2. The user behavior anomaly handling method of claim 1, wherein, The anomaly detection model is obtained based on the following manner: Based on user behavior sample data, user portrait sample data and user operation sample data, a training set is constructed; Determine the word vector feature matrix of the user behavior sample data, and determine the word sense vector and relative position encoding of the user operation sample data; The relative position encoding is obtained by adding encoding to each position in the user operation sample data; The position is determined based on the time sequence of user operation occurrence; Based on the word vector feature matrix, an initial LSTM model is trained to obtain the LSTM model; Based on the user portrait sample data, an initial CNN model is trained to obtain the CNN model; Based on the word sense vector and relative position encoding, an initial Transformer model is trained to obtain the Transformer model; The training set is used to train the model architecture to obtain the anomaly detection model; The model architecture includes the LSTM model, the CNN model, the Transformer model, the feature fusion layer and the multi-classifier.

3. The user behavior anomaly handling method of claim 2, wherein, The determination of the word vector feature matrix of the user behavior sample data includes: Aggregate the user behavior sample data by user ID to obtain first aggregated data; Convert the content of each field in the first aggregated data into a word vector form to obtain the word vector feature matrix; The determination of the word sense vector and relative position encoding of the user operation sample data includes: Aggregate the user operation sample data by user ID to obtain second aggregated data; Convert the text content in the second aggregated data into a word sense vector representation to obtain the word sense vector; Add encoding to each position in the second aggregated data to obtain the relative position encoding.

4. A user behavior anomaly handling apparatus characterized by comprising: It includes: A prediction module is configured to obtain corresponding user data according to a user request, input the user data into an anomaly detection model, and obtain a prediction classification result of user behavior output by the anomaly detection model; wherein the prediction classification result is obtained by feature extraction on the user data, feature fusion on the extracted user features, and classification on the fused features; The user request is initiated by a zero trust client and forwarded to a user behavior anomaly detection system through an encryption channel by a zero trust gateway; A processing module is configured to obtain a processing strategy of the prediction classification result from a policy engine according to the prediction classification result; send the processing strategy to the zero trust gateway, so that the zero trust gateway performs corresponding access control operations according to the processing strategy; The anomaly detection model comprises a plurality of sub-models, a feature fusion layer, and a multi-classifier; the sub-models are configured to extract user features of the user data and input the user features to the feature fusion layer; the feature fusion layer is configured to perform feature fusion on the user features extracted by the plurality of sub-models to obtain fusion features, and input the fusion features to the multi-classifier; wherein the feature fusion is configured to extract an influence of user portrait features on time sequence features and user operation features to obtain fusion features capable of representing a correlation relationship embodied by the influence; and the multi-classifier is configured to classify the fusion features to obtain the predicted classification result; The user data comprises user behavior data, user portrait data, and user operation data; the sub-models comprise a long short-term memory (LSTM) model, a convolutional neural network (CNN) model, and a Transformer model; the LSTM model is configured to extract time sequence features of the user behavior data; the CNN model is configured to extract user portrait features of the user portrait data; and the Transformer model is configured to extract user operation features of the user operation data; wherein the time sequence features, the user portrait features, and the user operation features are all represented in the form of a matrix; The feature fusion is implemented based on the following manner: The time sequence features, the user portrait features, and the user operation features are subjected to dimension alignment of feature matrices; cross-attention of the time sequence features, the user portrait features, and the user operation features after the dimension alignment is calculated to determine associated information between the time sequence features, the user portrait features, and the user operation features; and the time sequence features, the user portrait features, and the user operation features are fused based on the associated information to obtain the fusion features; wherein the three feature matrices TC, TP, and OC are subjected to dimension alignment using a full-link algorithm, and the following feature fusion algorithm is used: wherein d is the number of modalities, TC, TP, and OC are feature matrices corresponding to the time sequence features, the user portrait features, and the user operation features respectively, and V is a connection of the three feature matrices: V = Concat(TC, TP, OC).

5. An electronic device comprising a processor and a memory having stored therein a computer program, characterized in that, The processor executes the computer program to implement the user behavior anomaly processing method of any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the user behavior anomaly processing method of any one of claims 1 to 3.

7. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the user behavior anomaly processing method of any one of claims 1 to 3.

Images