A behavior analysis system and method based on a security large model

Abstract

The application provides a behavior analysis system and method based on a security large model, belonging to the field of network security and cloud security, and through the use of advanced natural language processing (NLP), machine learning and deep learning technology, an efficient and intelligent security large model is constructed to realize real-time and dynamic analysis and prediction of network behavior, thereby significantly improving the intelligentization and automation level of network security protection. The model aims to accurately analyze network behavior data, identify abnormalities in a timely manner, and ensure the security and stability of the network system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security-cloud security, and particularly relates to a behavior analysis system and method based on a security large model. BACKGROUND

[0002] With the development and popularization of information technology, network security problems have become a global challenge. Especially under the promotion of emerging technologies such as big data, cloud computing and artificial intelligence, the means of network attacks are becoming increasingly complex, concealed and diversified, bringing unprecedented pressure to the traditional network security protection system. In this context, a new type of security protection technology is urgently needed to cope with the evolving network security threats.

[0003] Traditional network security protection methods, such as firewalls and intrusion detection systems, have played a protective role to some extent, but their limitations have gradually emerged in the face of increasingly complex network attacks. These traditional methods often rely on static defense rules and strategies, making it difficult to analyze network behavior in real time and dynamically, and even more difficult to accurately identify potential threats hidden in massive data. SUMMARY

[0004] To solve the above technical problems, the present application provides a behavior analysis method based on a security large model, which realizes real-time and dynamic analysis of network behavior through innovative technical means, to improve the intelligent, automated and accurate capabilities of network security protection.

[0005] The technical solution of the present application is:

[0006] A behavior analysis system based on a security large model, comprising

[0007] A data preprocessing module responsible for cleaning, denoising and standardizing the original network data, including network traffic, log records and system events using NLP technology;

[0008] A feature extraction module based on the preprocessed data to construct a security data graph model;

[0009] A behavior analysis module using a supervised learning algorithm to classify and predict network behavior.

[0010] Further,

[0011] The behavior analysis module uses a support vector machine (SVM) algorithm as the supervised learning algorithm.

[0012] The working steps of the data preprocessing module are as follows:

[0013] Remove duplicate data: use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data;

[0014] Handling missing values: For missing values in text data, use GPT generation model in NLP to generate similar content to the missing text;

[0015] Handling outliers: Outliers may include spelling errors, syntax errors, format errors, etc. Spelling checking tools, syntax checking tools and text cleaning tools in NLP can identify and correct these outliers;

[0016] Text vectorization, using Word2Vec word embedding technology in NLP to map words or phrases into high-dimensional vector space, so as to preserve their semantic information.

[0017] Feature extraction module, the working steps are as follows:

[0018] 1) Build a security data graph model: convert security data into a security data graph model; each device or system can be represented as a node in the graph, and their communication or association is represented as an edge in the graph;

[0019] 2) Extract node features: for each node, you can extract its security-related features;

[0020] 3) Extract edge features: for edges, i.e. communication or association between devices, extract edge features;

[0021] 4) Extract local features on the graph: use the neighbor node information around the node to extract the features of the subgraph where the node is located;

[0022] 5) Extract global features on the graph: through the structure and attributes of the whole graph, global features can be extracted.

[0023] Behavior analysis module, the working steps are as follows:

[0024] 1) Feature extraction and selection: extract node attributes, edge attributes and graph structure information from the security data graph model as the input of SVM;

[0025] 2) Data preprocessing: preprocess the extracted features to ensure that different features have similar scales and reduce noise and redundant information;

[0026] 3) Establish SVM model: according to the characteristics of behavior analysis and the size of data set, select Gaussian radial basis function (RBF) kernel to establish SVM classification model;

[0027] 4) Train SVM model: use the labeled training data set to train SVM model and determine the optimal hyperplane parameters by optimizing the objective function, and use the least optimal SMO optimization algorithm to iteratively optimize the parameters;

[0028] 5) Evaluation and tuning: Use independent test dataset to evaluate the performance of the SVM model and tune the model according to the evaluation results;

[0029] 6) Prediction and classification: Represent new network behavior as nodes and edges in the security data graph model, and extract corresponding features, input these features into the trained SVM model, the model will output a class label, representing the predicted class of the network behavior;

[0030] 7) Real-time detection and response: Integrate the trained SVM model into the network security system to realize real-time monitoring and prediction of network behavior.

[0031] In addition, the present application also provides a behavior analysis method based on a security large model, comprising the following steps:

[0032] 1) Collecting original network data;

[0033] 2) Extracting feature data;

[0034] 3) Establishing an SVM model;

[0035] 4) Training the SVM model;

[0036] 5) Whether the expected result is achieved, if yes, proceed to the next step; if no, return to step 4);

[0037] 6) Input behavior as a dataset to perform behavior analysis based on a security large model;

[0038] 7) Whether there is an anomaly, if yes, the behavior is abnormal; if no, the behavior is normal.

[0039] Further,

[0040] The collected data is preprocessed, and the specific steps are as follows:

[0041] Remove duplicate data: use Jaccard similarity algorithm in NLP to identify and delete duplicate text data;

[0042] Handle missing values: for missing values in text data, use GPT generation model in NLP to generate similar content to missing text;

[0043] Handle abnormal values: abnormal values may include spelling errors, syntax errors, format errors, etc. Spelling checking tools, syntax checking tools and text cleaning tools in NLP can identify and correct these abnormal values;

[0044] Text vectorization, using Word2Vec word embedding technology in NLP to map words or phrases to high-dimensional vector space, so as to preserve their semantic information.

[0045] Extracting feature data, the specific steps are as follows:

[0046] 1) Construct a security data graph model: convert security data into a security data graph model; each device or system can be represented as a node in the graph, and their communication or association is represented as an edge in the graph;

[0047] 2) Extract node features: for each node, its security-related features can be extracted;

[0048] 3) Extract edge features: for the edge, i.e. the communication or association between devices, the features of the edge can be extracted;

[0049] 4) Extract local features on the graph: use the neighbor node information around the node to extract the features of the subgraph where the node is located;

[0050] 5) Extract global features on the graph: through the structure and properties of the entire graph, global features can be extracted.

[0051] Using a supervised learning algorithm, support vector machine SVM, to classify and predict network behavior, the specific steps are as follows:

[0052] 1) Feature extraction and selection: extract node attributes, edge attributes, and graph structure information from the security data graph model as input to the SVM;

[0053] 2) Data preprocessing: preprocess the extracted features to ensure that different features have similar scales and reduce noise and redundant information;

[0054] 3) Establish SVM model: according to the characteristics of behavior analysis and the size of the data set, select the Gaussian radial basis function (RBF) kernel to establish the SVM classification model;

[0055] 4) Train SVM model: use the labeled training data set to train the SVM model and determine the optimal hyperplane parameters by optimizing the objective function, and use the least optimal SMO optimization algorithm to iteratively optimize the parameters;

[0056] 5) Evaluation and tuning: use independent test data set to evaluate the performance of SVM model, and according to the evaluation result, the model is tuned;

[0057] 6) Prediction and classification: represent new network behavior as nodes and edges in the security data graph model, and extract the corresponding features, input these features into the trained SVM model, the model will output a class label, representing the predicted class of the network behavior;

[0058] 7) Real-time detection and response: integrate the trained SVM model into the network security system to realize real-time monitoring and prediction of network behavior.

[0059] The beneficial effects of the present application are

[0060] Enhanced security risk identification capability: By utilizing the security large model for deep learning and pattern recognition on behavior data, this method can effectively improve the identification capability of potential security risk behaviors, including network intrusion, malicious software activities, etc., thereby helping to prevent and respond to security threats in advance.

[0061] Reduced false positive rate: Compared with traditional security analysis methods, this method can more accurately distinguish between normal behavior and abnormal behavior, thereby reducing the false positive rate, reducing the workload of the security team to handle false alarms, and improving the overall security incident handling efficiency.

[0062] Improved response speed: The behavior analysis method based on the security large model can quickly respond to abnormal behavior, even before the situation worsens, and make early warning and intervention, thereby minimizing the loss caused by security incidents.

[0063] Strong adaptability: Since the security large model has strong generalization ability, this method can adapt to various security scenarios and data types, including network traffic, system logs, user behavior, etc., making it widely applicable.

[0064] Continuous optimization: The behavior analysis method based on the security large model can continuously learn and optimize the model through feedback, constantly improving the identification capability of new security threats and attack methods, and maintaining a competitive advantage in the constantly evolving security environment.

[0065] Reduced security cost: Through automated behavior analysis and security decision-making, the cost of manual security detection and response is reduced, while the overall security protection effect is improved, thereby reducing the overall cost of security operation.

[0066] The above beneficial effects show that the behavior analysis method based on the security large model has important application prospects in improving security protection effect, reducing security risk, and improving security operation efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0067] Figure 1 is a module structure schematic diagram of the present application;

[0068] Figure 2 is a working process schematic diagram of the present application. DETAILED DESCRIPTION

[0069] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0070] In today's highly developed digital and networked era, network security has become an important issue that cannot be ignored by countries, enterprises, and even individuals. With the increasing complexity of the network environment and the ever-increasing network security threats, traditional static defense strategies have been difficult to meet the needs of modern network security protection. Therefore, the present application aims to achieve real-time and dynamic analysis of network behavior through innovative technical means, in order to improve the intelligence, automation and accuracy of network security protection.

[0071] The primary purpose of the present application is to build an efficient and intelligent security big model. This model will be based on advanced natural language processing (NLP), machine learning and deep learning techniques, and will be able to collect and analyze massive amounts of network behavior data in real time. Through deep mining and intelligent analysis of these data, the security big model can identify abnormal behavior patterns and predict potential security threats. This analysis method based on big data and artificial intelligence technology can more accurately grasp the network security situation and improve the pertinence and effectiveness of network security protection.

[0072] Secondly, the purpose of the present application is to improve the intelligence and automation level of network security protection. Traditional network security protection often relies on manual monitoring and analysis, which is not only inefficient but also prone to omissions. By building a security big model, automatic monitoring and analysis of network behavior can be achieved. This not only greatly reduces the workload of security management personnel and improves the efficiency and accuracy of security response, but also enables continuous monitoring and real-time warning of network security, ensuring the security and stability of network systems.

[0073] In addition, the purpose of the present application is also to improve the adaptability and scalability of network security protection. With the continuous development of network technology and the continuous emergence of new security threats, traditional security protection strategies often struggle to adapt to this rapidly changing environment. The behavior analysis method based on the security big model can continuously update and optimize itself according to new data and threat intelligence, maintaining its sensitivity and response capability to the latest threats. At the same time, the model is scalable and can be customized and optimized according to actual needs to adapt to network environments of different scales and complexities.

[0074] Finally, the purpose of the present application is also to promote the innovation and development of network security technology. Network security is a constantly evolving field that requires continuous technological innovation and breakthroughs. By developing a behavior analysis method based on a security large model, not only can some of the current challenges and difficulties faced by the network security field be solved, but also new ideas and directions for future network security technology development can be provided. This will help to promote the progress and development of the entire network security industry and improve the overall level of network security protection.

[0075] The present application realizes real-time and dynamic analysis of network behavior by constructing an efficient and intelligent security large model, improving the intelligence, automation and accuracy level of network security protection. At the same time, the present application aims to improve the adaptability and scalability of network security protection and promote the innovation and development of network security technology.

[0076] The security large model is based on advanced technologies such as natural language processing (NLP), machine learning and deep learning, and is used to analyze and identify network behavior. As shown in Figure 1 The present application includes a data preprocessing module, a feature extraction module and a behavior analysis module.

[0077] 1) The data preprocessing module is responsible for cleaning, denoising, standardizing and other processing of original network data, including network traffic, log records, system events, etc. using NLP technology to improve data quality, the method is as follows:

[0078] Remove duplicate data: use the Jaccard similarity algorithm in NLP to identify and delete duplicate text data;

[0079] Handle missing values: for missing values in text data, use the GPT generation model in NLP to generate similar content to the missing text;

[0080] Handle outliers: outliers may include spelling errors, syntax errors, format errors, etc. Spelling check tools, syntax check tools and text cleaning tools in NLP can identify and correct these outliers;

[0081] Text vectorization: use the Word2Vec word embedding technology in NLP to map words or phrases to high-dimensional vector space, thereby preserving their semantic information.

[0082] 2) The feature extraction module constructs a security data graph model based on the preprocessed data, the steps are as follows:

[0083] a) Construct a security data graph model: convert security data into a security data graph model. Each device or system can be represented as a node in the graph, while their communication or association is represented as an edge in the graph;

[0084] b) Extract node features: For each node (device or system), its security-related features can be extracted, such as the node's activity pattern, the number of historical security events, open ports or services, etc.

[0085] c) Extract edge features: For edges (communication or association between devices), the features of the edge can be extracted, such as communication frequency, communication protocol, data transmission volume, etc.

[0086] d) Extract local features on the graph: With the information of neighboring nodes around the node, the features of the subgraph where the node is located can be extracted, such as the density of the subgraph, the aggregation of abnormal behavior, etc.

[0087] e) Extract global features on the graph: Through the structure and attributes of the entire graph, global features can be extracted, such as the connection pattern of the entire network, the distribution of abnormal activities, etc.

[0088] 3) The behavior analysis module uses a supervised learning algorithm (Support Vector Machine, SVM) to classify and predict network behavior, with the following steps:

[0089] a) Feature extraction and selection: Extract node attributes, edge attributes, and graph structure information from the security data graph model as input for SVM;

[0090] b) Data preprocessing: Perform preprocessing operations on the extracted features, such as missing value processing, feature scaling, standardization, normalization, etc., to ensure that different features have similar scales and reduce noise and redundant information;

[0091] c) Establish SVM model: According to the characteristics of behavior analysis and the size of the data set, select Gaussian Radial Basis Function (RBF) kernel to establish SVM classification model;

[0092] d) Train SVM model: Use the labeled training data set to train the SVM model and determine the optimal hyperplane parameters by optimizing the objective function, and use the Sequential Minimal Optimization (SMO) optimization algorithm to iteratively optimize the parameters;

[0093] e) Evaluation and tuning: Use independent test data set to evaluate the performance of SVM model, and tune the model according to the evaluation results;

[0094] f) Prediction and classification: Represent new network behavior as nodes and edges in the security data graph model, and extract corresponding features, input these features into the trained SVM model, the model will output a class label, representing the predicted class of the network behavior (such as normal or abnormal);

[0095] g) Real-time detection and response: Integrate the trained SVM model into the network security system to realize real-time monitoring and prediction of network behavior.

[0096] The overall flow is as shown in Figure 2

[0097] The reasons why the behavior analysis module uses the support vector machine (SVM) algorithm as the supervised learning algorithm are mainly the following five points:

[0098] Strong classification ability: SVM is a binary classification model that is good at handling small sample classification problems and has strong generalization ability. SVM can handle linear classification problems, and through kernel function skills, it can also handle non-linear classification problems. This enables SVM to accurately classify various behavior patterns in the behavior analysis module;

[0099] Robustness: SVM has certain robustness to noise and outliers in training data, and can effectively handle noise in input data. In behavior analysis, data often contains a large amount of noise and outliers, so the robustness of SVM makes it an ideal choice;

[0100] Avoiding local optimal solution: SVM uses the principle of structural risk minimization, which helps to avoid falling into local optimal solution and has lower generalization error. In behavior analysis, finding a global optimal solution is crucial for accurate classification of behavior patterns;

[0101] High-dimensional space effective: SVM maps non-linear problems in low-dimensional space to high-dimensional space through kernel trick, and performs linear partition in high-dimensional space, effectively solving complex non-linear problems. This is very useful for processing behavior data with complex features;

[0102] Controllable overfitting: SVM controls the complexity of the model by adjusting the regularization parameter and the relaxation variable, so it can effectively avoid the problem of overfitting. In behavior analysis, overfitting is a common problem, and the controllability of SVM enables it to ensure model accuracy while avoiding overfitting.

[0103] The present application utilizes natural language processing (NLP), machine learning and deep learning technology to build a security big model capable of real-time and dynamic analysis of network behavior data. The model has strong data processing and pattern recognition capabilities, can collect and analyze network behavior data in real time, and through deep learning and pattern recognition technology, it can discover abnormal behavior patterns and potential threats, providing strong support for network security protection.

[0104] ​The advantages of the security large model lie in its real-time, dynamic and accurate nature. It can collect and analyze network behavior data in real time, discover abnormal behavior and generate early warnings in a timely manner, so as to quickly respond to potential security threats. At the same time, the security large model can continuously update and optimize its model according to new data and threat intelligence, maintaining its sensitivity and response capability to the latest threats. In addition, through machine learning and deep learning techniques, the security large model can more accurately identify abnormal behavior and potential threats, reducing false positive and false negative rates, and improving the efficiency and accuracy of network security protection.

[0105] Behavior analysis is a key link in network security protection. Through in-depth analysis of network behavior data, abnormal behavior patterns and potential threats can be discovered, providing important threat intelligence for security management personnel. At the same time, behavior analysis can help security management personnel understand the attack path, motive and intention of attackers, providing strong support for the development of effective security strategies.

[0106] In summary, the behavior analysis method based on the security large model is an innovative and practical network security protection technology. It can not only analyze network behavior data in real time and dynamically, discover potential threats, but also provide important threat intelligence and decision support for security management personnel.

[0107] The above is only the preferred embodiment of the present application, which is only used to illustrate the technical solutions of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A behavior analysis system based on a large security model, characterized in that, include The data preprocessing module is responsible for cleaning, denoising, and standardizing raw network data, including network traffic, log records, and system events, using NLP technology. The feature extraction module constructs a secure data graph model based on the preprocessed data; The working steps are as follows: 1) Construct a security data graph model: Transform security data into a security data graph model; each device or system is represented as a node in the graph, and the communication or association between them is represented as an edge in the graph; 2) Extract node features: For each node, extract its security-related features; 3) Extract edge features: Extract edge features based on the communication or association between devices; 4) Extract local features from the graph: Use the information of the neighboring nodes around the node to extract features from the subgraph where the node is located; 5) Extract global features from the graph: Extract global features based on the structure and attributes of the entire graph; The behavior analysis module uses the Support Vector Machine (SVM) algorithm as a supervised learning algorithm to classify and predict network behavior; The working steps are as follows: 1) Feature extraction and selection: Extract node attributes, edge attributes, and graph structure information from the secure data graph model as input to the SVM; 2) Data preprocessing: Preprocess the extracted features to ensure that different features have similar scales and reduce noise and redundant information; 3) Establishing an SVM model: Based on the characteristics of behavioral analysis and the size of the dataset, a Gaussian radial basis function (RBF) kernel is selected to establish an SVM classification model; 4) Training the SVM model: Use the labeled training dataset to train the SVM model and determine the optimal hyperplane parameters by optimizing the objective function, and use the minimum optimization SMO optimization algorithm to iteratively optimize the parameters; 5) Evaluation and tuning: Use independent test datasets to evaluate the performance of the SVM model and tune the model based on the evaluation results; 6) Prediction and classification: Represent new network behaviors as nodes and edges in a secure data graph model, extract the corresponding features, input these features into a trained SVM model, and the model will output a category label representing the predicted category of the network behavior; 7) Real-time detection and response: Integrate the trained SVM model into the network security system to achieve real-time monitoring and prediction of network behavior.

2. The system according to claim 1, characterized in that, The data preprocessing module operates as follows: Remove duplicate data: Use the Jaccard similarity algorithm in NLP to identify and remove duplicate text data; Handling missing values: For missing values ​​in text data, use the GPT generative model in NLP to generate content similar to the missing text; Handling outliers: Outliers include spelling errors, syntax errors, and formatting errors; Spell checking tools, grammar checking tools, and text cleaning tools in NLP identify and correct these outliers; Text vectorization uses the Word2Vec word embedding technique in NLP to map words or phrases into a high-dimensional vector space, thereby preserving their semantic information.

3. A behavior analysis method based on a large security model, characterized in that, Includes the following steps: 1) Collect raw network data and preprocess the collected data, that is, to use NLP technology to clean, denoise and standardize the raw network data, including network traffic, log records and system events; 2) Extract feature data; The specific steps are as follows: 2.1) Construct a security data graph model: Transform security data into a security data graph model; each device or system is represented as a node in the graph, and the communication or association between them is represented as an edge in the graph; 2.2) Extract node features: For each node, extract its security-related features; 2.3) Extract edge features: Extract edge features based on the communication or association between devices; 2.4) Extracting local features from the graph: Using information about the neighboring nodes around a node, extract features from the subgraph where the node is located; 2.5) Extract global features from the graph: Extract global features based on the structure and attributes of the entire graph; 3) Establish an SVM model; based on the characteristics of behavioral analysis and the size of the dataset, select the Gaussian radial basis function (RBF) kernel to establish an SVM classification model; 4) Train the SVM model; use a labeled training dataset to train the SVM model and determine the optimal hyperplane parameters by optimizing the objective function, and use the minimum optimization SMO algorithm to iteratively optimize the parameters; use an independent test dataset to evaluate the performance of the SVM model, and fine-tune the model based on the evaluation results; 5) Has the expected result been achieved? If yes, proceed to the next step; otherwise, return to step 4). 6) Input behavior is used to perform behavior analysis based on a security big data model on the dataset; new network behaviors are represented as nodes and edges in a security data graph model, and corresponding features are extracted. These features are then input into a trained SVM model, which outputs a category label representing the predicted category of the network behavior. The trained SVM model is then integrated into a network security system to achieve real-time monitoring and prediction of network behaviors. 7) Is there any abnormality? If yes, the behavior is abnormal; if no, the behavior is normal.

4. The method according to claim 3, characterized in that, The collected data undergoes preprocessing, and the specific steps are as follows: Remove duplicate data: Use the Jaccard similarity algorithm in NLP to identify and remove duplicate text data; Handling missing values: For missing values ​​in text data, use the GPT generative model in NLP to generate content similar to the missing text; Handling outliers: Outliers include spelling errors, syntax errors, and formatting errors; Spell checking tools, grammar checking tools, and text cleaning tools in NLP identify and correct these outliers; Text vectorization uses the Word2Vec word embedding technique in NLP to map words or phrases into a high-dimensional vector space, thereby preserving their semantic information.

Images