A host intrusion detection method and device based on multi-view collaborative learning

Abstract

The present invention belongs to the technical field of network security and machine learning, and discloses a host intrusion detection method and device based on multi-view collaborative learning. It includes collecting host kernel log data to construct a traceability graph, extracting the structural features, operation features and semantic features of each node in the traceability graph, and training unsupervised anomaly detection models with the structural features, operation features and semantic features of process nodes respectively; for process node sample sets, if the detection results of three unsupervised anomaly detection models are consistent, the process nodes and the detection results are put into a labeled training sample set; otherwise, they are put into an unlabeled training sample set; the labeled training sample set is used to train three supervised sub-models respectively; the unlabeled training sample set is used to perform semi-supervised collaborative training on the three supervised sub-models to obtain three host intrusion detection models, and the host intrusion detection model is used to obtain the detection results of the process node to be detected. The present invention improves the accuracy and efficiency of APT detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and machine learning, and specifically relates to a host intrusion detection method and device based on multi-view collaborative learning. Background Art

[0002] APT (Advanced Persistent Threat) attacks refer to the use of advanced attack methods to carry out long-term, confrontational network attacks on specific targets. It is one of the biggest hidden dangers threatening the security of cyberspace. Compared with traditional network attacks, APT attacks are highly concealed, have a long incubation period, and have a variety of attack methods, making it difficult for traditional detection methods to deal with them.

[0003] At present, the industry mainly uses rule-based detection methods to detect APT attacks. Rule-based detection methods are simple to implement and efficient, but have poor scalability and weak adaptability. With the development of deep learning, new ideas have been provided for solving APT attack detection. Deep learning technology can automatically learn features and patterns from massive data, reduce dependence on expert rules, and enhance the ability to learn unknown attacks. However, there are still the following problems in using deep learning technology to detect APT attacks: (1) The amount of system log data containing APT attacks is huge and complex, making it difficult to model them. (2) Attack entities are difficult to label. The persistence of APT attacks means that a single attack involves a large number of system entities (such as processes, files, and network ports), while the concealment of APT attacks makes the boundary between malicious attack entities and normal system entities very vague. The above reasons make it extremely difficult to perform fine-grained, "entity-level" labeling on the collected system log data. Therefore, most existing public APT attack datasets use a rule-based attack entity labeling strategy, but this strategy will cause the trained deep detection model to degenerate into a rule-based detection model. (3) The diversity of APT attacks. General deep learning models find it difficult to capture and identify a wide range of attack methods.

[0004] In view of the above problems, how to reasonably model the system log data and establish a detection model that can identify multiple attack methods and has a low false alarm rate without the need for manual labeling is the problem that the present invention intends to solve. Summary of the invention

[0005] One of the purposes of the present invention is to provide a host intrusion detection method based on multi-view collaborative learning, to reasonably model system log data, and to establish a detection model that can identify multiple attack methods and has a low false alarm rate without the need for manual labeling, thereby improving the accuracy and efficiency of APT attack detection.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A host intrusion detection method based on multi-view collaborative learning, the host intrusion detection method based on multi-view collaborative learning comprising:

[0008] Collect host kernel log data to build a traceability graph, and extract the structural features, operational features, and semantic features of each node in the traceability graph from the three perspectives of structure, operation, and semantics. Use the structural features, operational features, and semantic features of the process nodes in the nodes to train unsupervised anomaly detection models.

[0009] For the process node sample set, three unsupervised anomaly detection models are used for anomaly detection. If the detection results of the three unsupervised anomaly detection models are consistent, the process node and the detection result are put into the labeled training sample set as pseudo-labeled samples; otherwise, the process node is put into the unlabeled training sample set;

[0010] Take pseudo-annotated samples from the annotated training sample set, and train supervised sub-models respectively with the structural features, operational features, and semantic features of the process nodes in the pseudo-annotated samples;

[0011] The three supervised sub-models are semi-supervisedly co-trained using the unlabeled training sample set to obtain three final host intrusion detection models. The three final host intrusion detection models are used to perform anomaly detection on the process nodes to be detected to obtain the detection results of the process nodes to be detected.

[0012] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0013] Preferably, the structural feature extraction process is as follows:

[0014] Take the number of edge types in the traceability graph as , then the structural feature vector of the node is ,in, is the structural feature vector of node v, is the number of edges of type i in the incoming edge set of node v in the traceability graph, is the number of the i-th type of edges in the outgoing edge set of node v in the traceability graph, .

[0015] Preferably, the extraction process of the operation feature is as follows:

[0016] Get the entity operation description of the node, assign the corresponding label to the node according to the entity operation description-label comparison table, then the dimension of the node's operation feature vector is the total number of labels in the entity operation description-label comparison table, and the element value corresponding to the label assigned to the node in the operation feature vector is 1, and the other element values ​​are 0.

[0017] Preferably, the semantic feature extraction process is as follows:

[0018] Obtain the node attributes and edge attributes corresponding to the node, generalize the node attributes and edge attributes, and take all the generalized attributes as a sentence and represent them into a semantic feature vector using word2vec word vector technology.

[0019] Preferably, in the training of the unsupervised anomaly detection model, an isolation forest algorithm is used as a training algorithm.

[0020] Preferably, in the training of the supervised sub-model, a random forest algorithm is used as the training algorithm.

[0021] Preferably, among the three supervised sub-models, the supervised sub-model trained with structural features is recorded as TM, the supervised sub-model trained with operational features is recorded as AM, and the supervised sub-model trained with semantic features is recorded as SM. The three supervised sub-models are semi-supervised and collaboratively trained using an unlabeled training sample set to obtain three final host intrusion detection models, including:

[0022] Sample labeling operation: Take the supervised sub-model TM as the target model and label each unlabeled training sample p in the unlabeled training sample set. j , supervised sub-model AM and supervised sub-model SM are used to train unlabeled training samples p j For anomaly detection, if the detection results of the two supervised sub-models are l j If the As a labeled training sample, put it into the first round of labeled training sample set TTS of the supervised sub-model TM 1 Similarly, the supervised sub-model AM and the supervised sub-model SM are used as target models to obtain the first round of labeled training sample set TAS of the supervised sub-model AM. 1 And the first round of labeled training sample set TSS of the supervised sub-model SM 1 ;

[0023] Model update operation: TTS 1 As the training sample set, the supervised sub-model TM is retrained based on the structural features; 1 As the training sample set, the supervised sub-model AM is retrained based on the operation characteristics; TSS 1As a training sample set, retrain the supervised sub-model SM based on semantic features;

[0024] Repeat the sample labeling operation and model updating operation until the labeled training sample set of the kth round is completely consistent with the labeled training sample set of the k-1th round, and output the latest trained supervised sub-model TM, supervised sub-model AM and supervised sub-model SM as the three final host intrusion detection models.

[0025] Preferably, the method of using the three final host intrusion detection models to perform abnormal detection on the process node to be detected to obtain the detection result of the process node to be detected includes:

[0026] Given a real-time process node v to be detected 0 , three final host intrusion detection models are used for detection, and the final detection results are output based on the majority voting strategy.

[0027] The second object of the present invention is to provide a host intrusion detection device based on multi-view collaborative learning, including a processor and a memory storing a plurality of computer instructions. When the computer instructions are executed by the processor, the steps of a host intrusion detection method based on multi-view collaborative learning are implemented.

[0028] The present invention provides a host intrusion detection method and device based on multi-view collaborative learning, which has the following beneficial effects compared with the prior art: (1) Through the "unsupervised" and "anomaly detection" strategies, it gets rid of the dependence on labeled APT attack samples. (2) By designing multi-view features, establishing multiple independent anomaly detection models, and performing semi-supervised collaborative training on multi-layer sub-models, it can better adapt to the complexity and ambiguity of attack entities and detect more complex attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A flowchart of a host intrusion detection method based on multi-view collaborative learning of the present invention;

[0030] Figure 2 A schematic diagram of generating a labeled training sample set and training an initial host intrusion detection model according to the present invention;

[0031] Figure 3 This is a schematic diagram of the semi-supervised collaborative training of the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0034] In order to overcome the defects of APT attack detection in the prior art, this embodiment provides a host intrusion detection method based on multi-view collaborative learning, such as Figure 1 As shown, the following steps are included:

[0035] (1) Construction of multi-view anomaly detection model: Collect host kernel log data to build a traceability graph, and extract node features from three perspectives: structure, operation, and semantics, and build unsupervised anomaly detection models respectively.

[0036] This embodiment collects host kernel log data to build a traceability graph, and extracts the structural features, operational features, and semantic features of each node in the traceability graph from the three perspectives of structure, operation, and semantics, and trains the unsupervised anomaly detection model with the structural features, operational features, and semantic features of the process nodes in the node. The specific steps are as follows:

[0037] (1-1) Provenance graph construction: Use operating system kernel log collection tools (such as ETW (Event Tracing for Windows), Auditd) to collect host kernel log data, and then build a provenance graph G = (V, E) based on the host kernel log data. V is the node set of the provenance graph, and each node v represents a system entity (such as a process or file); E is the edge set of the provenance graph, and each edge e represents an interaction event between system entities (such as creating a process or reading or writing a file).

[0038] (1-2) Node feature extraction: Extract features for each node from the perspectives of structure, operation, and semantics. The specific methods are as follows:

[0039] (1-2-1) Structural features: Assume that the number of edge types in the traceability graph G is , then the structural feature vector of node v is , where a iis the number of the i-th type of edges in the incoming edge set of node v in the traceability graph G, b i is the number of the i-th type of edges in the outgoing edge set of node v in Siyuanta G, .

[0040] (1-2-2) Operational characteristics: Get the entity operation description of the node, and assign corresponding labels to the nodes according to the entity operation description-label comparison table. The dimension of the node's operation feature vector is the total number of labels, and the element value corresponding to the label assigned to the node in the operation feature vector is 1, and the other element values ​​are 0.

[0041] Refer to Table 1 and label the entities in the traceability graph that meet the preset operation rules accordingly. For example, label the process that reads sensitive data as "PT2". Then the operation feature vector of node v is , where a label is given, the corresponding dimension is 1, otherwise it is 0.

[0042] Table 1 Entity operation description-label comparison table

[0043] Label Entity Operation Description PT0 Normal process PT1 Process network connection PT2 Process reads sensitive data PT3 Process accesses data from the network PT4 Process calls sensitive commands PT5 The ancestor process of the process makes a network connection PT6 Process reads uploaded file PT7 The ancestor process of the process loads the uploaded file PT8 The process reads or modifies the registry PT9 The process modified sensitive files PT10 Process access to system resources FT0 Ordinary files FT1 Default sensitive files FT2 File contains data from the network FT3 The file is uploaded FT4 The file was recently modified or created NTO For network flow MTO Memory Node STO Socket Node

[0044] (1-2-3) Semantic features: For each node, first extract its node attributes and edge attributes, such as the file path P 1 "C:\Windows\system32\netsh.exe", registry address R 2 "HKCU\Software\Microsoft\Windows\CurrentVersion\Run", the called instruction I 3 "netstat", etc. Then, these attributes are generalized, that is, the attributes are first segmented according to common separators (such as:, \,., etc.), and uncommon words are replaced with wildcards. For example, P 1 It can be generalized to "C:\Windows\system32\*.exe". Among them, the common word library can be obtained by statistical analysis of a large number of attributes, and the words whose occurrence times in the attribute are greater than the threshold or the occurrence ratio is greater than the ratio threshold are regarded as common words. Finally, the generalized attribute corresponding to the node is regarded as a sentence, and the word2vec word vector technology is used to represent it into a semantic feature vector sx v , sx v is the semantic feature vector of node v.

[0045] (1-3) Construction of unsupervised anomaly detection model: Since all system behaviors (including malicious behaviors) are initiated by "processes", and other system entities (such as files and registries) are resources that support "processes" to complete system behaviors, this embodiment detects abnormal behaviors for "process" nodes (referred to as process nodes). A large number of normal process nodes are used as unsupervised training sample sets, and iForest (Isolation Forest) is used as the training algorithm. Three unsupervised anomaly detection models are trained based on structural features, operational features, and semantic features, respectively, and are denoted as UTM, UAM, and USM.

[0046] (2) Generation of multi-view pseudo-annotated samples: Select detection results with high confidence from multiple anomaly detection models as pseudo-annotated samples and train the initial host intrusion detection model.

[0047] In this embodiment, for a process node sample set containing normal and abnormal processes, three unsupervised anomaly detection models are used to perform anomaly detection. If the detection results of the three unsupervised anomaly detection models are consistent, the process node and the detection result are put into the labeled training sample set as pseudo-annotated samples; otherwise, the process node is put into the unlabeled training sample set. Then, the pseudo-annotated samples in the labeled training sample set are taken to train supervised sub-models with the structural features, operational features, and semantic features of the process nodes in the pseudo-annotated samples.

[0048] like Figure 2 As shown in Figure 2, given a process node sample set (denoted as PS), the detailed steps for generating multi-view pseudo-annotated samples are as follows:

[0049] (2-1) Pseudo-labeled sample generation: For each process node p in the process node sample set PS k , use the unsupervised anomaly detection models UTM, UAM, and USM to perform anomaly detection on it respectively. If the detection results of the three unsupervised anomaly detection models are consistent (the detection result is pl k ), then (p k , pl k ) as a pseudo-annotated sample (the sample label is pl k ), and put them into the labeled training sample set TS. Finally, all process nodes in the process node sample set PS that are not put into the labeled training sample set TS are put into the unlabeled training sample set US as unlabeled training samples.

[0050] (2-2) Initial host intrusion detection model training: Using the labeled training sample TS as the training sample set and the Random Forest as the training algorithm, three supervised sub-models are trained based on structural features, operational features, and semantic features as three initial host intrusion detection models, denoted as TM, AM, and SM. The supervised sub-model is a binary classification model, corresponding to the label of the node being normal or abnormal.

[0051] (3) Semi-supervised collaborative model training: Use the remaining unlabeled training samples to collaboratively train multiple initial host intrusion detection models to obtain the final host intrusion detection model.

[0052] This embodiment uses an unlabeled training sample set to perform semi-supervised collaborative training on three supervised sub-models to obtain three final host intrusion detection models. The three final host intrusion detection models are used to perform anomaly detection on the process nodes to be detected to obtain the detection results of the process nodes to be detected. Figure 3 As shown, the specific steps are as follows:

[0053] (3-1) Sample labeling operation: Taking the supervised sub-model TM as the target model, for each unlabeled training sample p in the unlabeled training sample set US j , the supervised sub-model AM and the supervised sub-model SM are used to detect anomalies respectively. If the detection results of the two models are consistent (the detection result is recorded as l j ), then (p j , l j ) as a labeled training sample and put it into the first round of labeled training sample set TTS of the supervised sub-model TM 1 .

[0054] Taking the supervised sub-model AM as the target model, for each unlabeled training sample p in the unlabeled training sample set US j , use the supervised sub-model TM and the supervised sub-model SM to detect anomalies respectively. If the detection results of the two models are consistent (the detection result is recorded as l j ), then (p j , l j ) as a labeled training sample and put it into the first round of labeled training sample set TAS of the supervised sub-model AM 1 .

[0055] Taking the supervised sub-model SM as the target model, for each unlabeled training sample p in the unlabeled training sample set US j , use the supervised sub-model TM and the supervised sub-model AM to detect anomalies respectively. If the detection results of the two models are consistent (the detection result is recorded as l j ), then (pj , l j ) as a labeled training sample and put it into the first round of labeled training sample set TSS of the supervised sub-model SM 1 .

[0056] (3-2) Model update operation: using the labeled training sample set TTS 1 As a training sample set, based on the labeled training sample set TTS 1 Retrain the model TM based on the structural features of the process nodes; use the labeled training sample set TAS 1 As a training sample set, based on the labeled training sample set TAS 1 Retrain the model AM based on the operation characteristics of the process nodes; use the labeled training sample set TSS 1 As a training sample set, based on the labeled training sample set TSS 1 The semantic features of the process nodes are used to retrain the model SM.

[0057] (3-3) Iterative training: Repeat steps (3-1) and (3-2) until the kth round of labeled training sample set (TTS k , TAS k , TSS k ) and the k-1th round of labeled training sample sets (TTS k-1 , TAS k-1 , TSS k-1 ) are exactly the same (here, exactly the same can be understood as 100% overlap of samples in the corresponding three labeled training sample sets, or overlap within a certain error range (for example, 2%)), and the latest trained supervised sub-model TM, supervised sub-model AM, and supervised sub-model SM are output as the three final host intrusion detection models.

[0058] (3-4) Real-time detection based on model fusion: Given a real-time process node v to be detected 0 , respectively use three trained host intrusion detection models TM, AM and SM to detect the process node v 0 Perform detection and output the final detection result based on the majority voting strategy.

[0059] The host intrusion detection method based on multi-view collaborative learning proposed in the present invention is compared with the existing host intrusion detection method in terms of detection performance. The test standards use precision, recall, false alarm rate and F1 value. The test set uses the most authoritative DARPA TC (Transparent Computing) data set in the world (three subsets of CADETS, THEIA and TRACE are selected). The existing methods compared are the intrusion detection method Log2vec based on heterogeneous graph embedding, MAGIC (from Zian Jia, Yun Xiong, Yuhong Nan, Yao Zhang, Jinjing Zhao, Mi Wen. MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning. In Proc. of USENIX, 2024.) and the intrusion detection and tracing method THREATRACE based on audit logs and graph neural networks. The test results are shown in Table 2. It can be seen that the host intrusion detection method proposed in the present invention is generally superior to the existing methods in all test indicators, that is, the present invention can be separated from manual labeling, and realize APT detection with low false alarm rate and identification of multiple attack methods.

[0060] Table 2 Test results

[0061]

[0062] In another embodiment, the present invention also provides a host intrusion detection device based on multi-view collaborative learning, including a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the host intrusion detection method based on multi-view collaborative learning.

[0063] For the specific limitations of the host intrusion detection device based on multi-view collaborative learning, please refer to the limitations of the host intrusion detection method based on multi-view collaborative learning above, which will not be repeated here.

[0064] The memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The memory stores a computer program that can be run on the processor, and the processor implements the method of the present invention by running the computer program stored in the memory.

[0065] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory is used to store a program, and the processor executes the program after receiving an execution instruction.

[0066] The processor may be an integrated circuit chip with data processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0067] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0068] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A host intrusion detection method based on multi-view collaborative learning, characterized in that: The host intrusion detection method based on multi-view collaborative learning includes: Collect host kernel log data to build a traceability graph, and extract the structural features, operational features, and semantic features of each node in the traceability graph from the three perspectives of structure, operation, and semantics. Use the structural features, operational features, and semantic features of the process nodes in the nodes to train unsupervised anomaly detection models. For the process node sample set, three unsupervised anomaly detection models are used for anomaly detection. If the detection results of the three unsupervised anomaly detection models are consistent, the process node and the detection result are put into the labeled training sample set as pseudo-labeled samples; otherwise, the process node is put into the unlabeled training sample set; Take pseudo-annotated samples from the annotated training sample set, and train supervised sub-models respectively with the structural features, operational features, and semantic features of the process nodes in the pseudo-annotated samples; The three supervised sub-models are trained semi-supervisedly using the unlabeled training sample set to obtain three final host intrusion detection models. The three final host intrusion detection models are used to perform anomaly detection on the process nodes to be detected to obtain the detection results of the process nodes to be detected. The structural feature extraction process is as follows: Take the number of edge types in the traceability graph as , then the structural feature vector of the node is ,in, is the structural feature vector of node v, is the number of edges of type i in the incoming edge set of node v in the traceability graph, is the number of the i-th type of edges in the outgoing edge set of node v in the traceability graph, ; The extraction process of the operation features is as follows: Obtain the entity operation description of the node, and assign the corresponding label to the node according to the entity operation description-label comparison table. The dimension of the node's operation feature vector is the total number of labels in the entity operation description-label comparison table, and the element value corresponding to the label assigned to the node in the operation feature vector is 1, and the other element values ​​are 0; The extraction process of the semantic features is as follows: Obtain the node attributes and edge attributes corresponding to the node, generalize the node attributes and edge attributes, and use word2vec word vector technology to represent all the generalized attributes as a sentence into a semantic feature vector; Among the three supervised sub-models, the supervised sub-model trained with structural features is recorded as TM, the supervised sub-model trained with operational features is recorded as AM, and the supervised sub-model trained with semantic features is recorded as SM. The three supervised sub-models are semi-supervised and collaboratively trained using the unlabeled training sample set to obtain three final host intrusion detection models, including: Sample labeling operation: Take the supervised sub-model TM as the target model and label each unlabeled training sample p in the unlabeled training sample set. j , supervised sub-model AM and supervised sub-model SM are used to train unlabeled training samples p j For anomaly detection, if the detection results of the two supervised sub-models are l j If the As a labeled training sample, put it into the first round labeled training sample set TTS1 of the supervised sub-model TM; similarly, take the supervised sub-model AM and the supervised sub-model SM as the target models, and get the first round labeled training sample set TAS1 of the supervised sub-model AM and the first round labeled training sample set TSS1 of the supervised sub-model SM; Model update operation: Using TTS1 as the training sample set, retrain the supervised sub-model TM based on the structural features; using TAS1 as the training sample set, retrain the supervised sub-model AM based on the operational features; using TSS1 as the training sample set, retrain the supervised sub-model SM based on the semantic features; Repeat the sample labeling operation and model updating operation until the labeled training sample set of the kth round is completely consistent with the labeled training sample set of the k-1th round, and output the latest trained supervised sub-model TM, supervised sub-model AM and supervised sub-model SM as the three final host intrusion detection models.

2. The host intrusion detection method based on multi-view collaborative learning according to claim 1 is characterized in that: In the training of the unsupervised anomaly detection model, the isolation forest algorithm is used as the training algorithm.

3. The host intrusion detection method based on multi-view collaborative learning according to claim 1 is characterized in that: In the training of the supervised sub-model, the random forest algorithm is used as the training algorithm.

4. The host intrusion detection method based on multi-view collaborative learning according to claim 1 is characterized in that: The three final host intrusion detection models are used to perform abnormal detection on the process node to be detected, and the detection results of the process node to be detected are obtained, including: Given a real-time process node v0 to be detected, three final host intrusion detection models are used for detection, and the final detection result is output based on the majority voting strategy.

5. A host intrusion detection device based on multi-view collaborative learning, comprising a processor and a memory storing a plurality of computer instructions, characterized in that: When the computer instructions are executed by the processor, the steps of the host intrusion detection method based on multi-view collaborative learning described in any one of claims 1 to 4 are implemented.

Images