Abnormal behavior detection method combining audit log and honey treading log

Abstract

The invention discloses an abnormal behavior detection method combining an audit log and a honey treading log, which comprises the following steps: firstly, collecting the audit log, combining and simplifying the audit log, extracting structured log information, taking a process as a main body, and constructing a user behavior instance under the guidance of a process control flow; noise reduction is carried out by extracting a redundant information template; finally, by constructing a traceability graph, entity and relation features are extracted by adopting a transR algorithm, and feature vectors of the audit logs are obtained through connection; a sequence coding network is trained in an unsupervised and weakly supervised learning mode in combination with four-honey logs in the shield cube, and features of user behavior examples after noise reduction are obtained; and finally, performing clustering analysis by adopting a DBSCAN algorithm to obtain abnormal user behaviors. According to the method, abnormal behaviors and normal behaviors are learned by using unsupervised and weak supervised learning modes through the behavior semantic information of the audit log and the malicious information of the four-honey log, so that the accuracy of user behavior feature extraction is improved, and the efficiency and accuracy of anomaly detection are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an abnormal behavior detection method combining an audit log and a honeypot log. Background Art

[0002] Existing network intrusion detection methods are mainly divided into three categories according to the technology used: rule-based intrusion detection methods, statistics-based intrusion detection methods and learning-based intrusion detection methods. Among them: rule-based intrusion detection methods rely on pre-defined rule sets to detect malicious behaviors. They are simple, intuitive, highly accurate, easy to understand and implement. However, since the rule sets need to be condensed by relevant personnel based on existing experience and knowledge, they have problems such as high maintenance costs, poor adaptability, and easy to be bypassed. They are also difficult to apply to network attacks that are constantly evolving with the network environment, and their coverage and adaptability may be limited. Statistics-based intrusion detection methods use historical data or specific probability models to distinguish between normal and abnormal behaviors. Although statistics-based intrusion detection methods can capture abnormal behaviors to a certain extent, they only consider the link relationship between system entities, rely on historical data distribution characteristics or model parameter selection, and are prone to generate a large number of false positives. At the same time, they may not perform well for complex attack patterns. Learning-based intrusion detection methods use machine learning algorithms to learn patterns between normal and abnormal behaviors from logs, and perform anomaly detection based on the learned models. They can adapt to new attack patterns and ever-changing threats, and have high detection accuracy and adaptability; but they require sufficient training data and appropriate feature selection, which leads to high costs, and there may be false alarms in the identification of unknown attacks.

[0003] Learning-based intrusion detection methods can make full use of the links and contextual dependencies in logs to detect existing log events in the two dimensions of cause and effect and semantics. They are divided into two categories according to the characteristics of the data used: one is to analyze attack data and establish an abnormal behavior model. This method requires a large amount of data to discover user behavior patterns and habits, and it is difficult to identify user behaviors that are not included in historical data, and there will be a high rate of missed reports for unknown attacks; the other is to discover abnormal behaviors by modeling the user's normal behavior logs, which can discover unknown attacks. For example, in the document "A heterogeneous graph embedding based approach for detecting cyber threats within enterprise", Liu F et al. proposed an abnormal behavior detection method for user behavior logs, which associates and samples user behaviors through specific rules, considers the semantic information of user behaviors from the perspective of user behavior habits, and thus improves the accuracy of anomaly detection. In the paper "WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics", Zeng J et al. proposed a user behavior extraction method for audit logs. By defining user behavior as a means for users to achieve their expected goals, it is further modeled as data transmission. Based on this, the boundaries of user behavior in the log are formulated, and a knowledge graph is constructed in combination with the audit log. The semantic information of entities and relationships in the system is obtained by graph embedding. Aggregation is performed to obtain the semantics (features) of user behavior, and clustering is used to semantically classify user behavior, reducing the semantic gap between logs and user behavior, and reducing the manpower cost required for manual analysis of logs to distinguish between false alarms and real attacks.Based on the literature of Zeng J et al., Zengy J et al. proposed a recommendation-based anomaly detection method (Zengy J, Wang X, Liu J, et al. Shadewatcher: Recommendation-guided cyber threat analysis using system audit records [C] / / 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022: 489-506.). This method believes that semantically similar system entities will show similar interaction preferences. By constructing all entity interactions in a single user behavior instance, the long path dependency information of system entity interactions is supplemented on the basis of the traceability graph, and the existing graph embedding and graph neural network methods are combined to obtain the dependency relationship of entities and learn the feature vectors of corresponding nodes and relationships. The cosine similarity between entities is used to evaluate the possibility of entity interaction, thereby realizing anomaly detection at the granularity of system call events. The other type does not require a large amount of historical data, but relies on the way of constructing user behavior instances, and the effect is greatly affected by the way of defining the behavior boundary. It requires a certain degree of subjective judgment and professional knowledge. In addition, it may be difficult to discover information collection on the host side, DDOS and other attack behaviors.

[0004] Although the above methods can discover unknown attacks by modeling the user's normal behavior logs, they fail to fully consider the semantic gap between logs and behaviors in the field of network security, and have the following problems: 1) Audit logs contain a large number of noise events, which reduces the efficiency and accuracy of identifying behaviors from logs. While recording user behaviors, system audit logs also contain a large number of system behavior logs caused by user behaviors (such as system behaviors such as searching and loading to execute user behaviors). These system behavior logs not only occupy a large amount of storage, but also increase the difficulty of identifying user behaviors and reduce the recognition efficiency. 2) Most existing studies are based on the system entity and system call levels, and fail to fully utilize the behavior information and timing information contained in the logs, and lack the understanding of attack-related behaviors, resulting in low behavior recognition accuracy, as well as missed reports and false reports of attacks when analyzing behaviors. Summary of the invention

[0005] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide an abnormal behavior detection method that combines audit logs and honey-stepping logs to achieve accurate identification and detection of abnormal user behavior on the host.

[0006] In order to achieve the above object, the present invention adopts an abnormal behavior detection method combining audit logs and honey-stepping logs, including the following steps:

[0007] Step 1: User behavior instance construction:

[0008] Use log collection tools to collect audit logs of corresponding systems according to custom collection granularity;

[0009] Merge the log information in the audit log to simplify the audit log;

[0010] The custom extraction rules extract the structured log information of the audit log from the simplified audit log; the structured log information includes process information, data object information, process communication entity, event information and user information;

[0011] Taking the process as the main body and under the guidance of the process control flow, the simplified audit log is constructed into user behavior instances in time sequence according to the subject-event-object triples. Each user behavior instance contains multiple log sequences.

[0012] Step 2: User behavior instance noise reduction:

[0013] Extract redundant information templates and denoise user behavior instances to obtain denoised user behavior instances;

[0014] Step 3: Abnormal behavior analysis:

[0015] Construct a traceability graph for the audit log, use the transR algorithm to learn the semantic information of entities and relationships in the traceability graph, extract entity and relationship features and connect them to obtain the feature vector of the audit log;

[0016] The four honey logs in the Shield Cube are used as honey-stepping logs, and the denoised user behavior instances are combined with the feature vectors of the audit logs and input into the sequence encoding network. Unsupervised and weakly supervised learning methods are used for training to obtain the features of the denoised user behavior instances.

[0017] The DBSCAN algorithm is used to perform cluster analysis on the features of user behavior instances after denoising to obtain abnormal user behaviors.

[0018] As a preferred technical solution, the process information includes process name and process id; the data object information includes file name, file id, file address, socket, socket id; the process communication entity includes a pipeline; the event information includes a command line and a timestamp; the user information includes a user name and a user id;

[0019] In the triple, the subject is a process, the object is a process, a file or a socket, and the event is the relationship between the subject and the object.

[0020] As a preferred technical solution, the merging of log information in the audit log refers to merging logs in the audit log that have completely identical information except for the timestamp.

[0021] As a preferred technical solution, the redundant information template is divided into a single-host redundant information template and a multi-host redundant information template, including a log sequence in the startup phase and a log sequence in the end phase.

[0022] The steps of extracting the single host redundant information template are:

[0023] For a single host audit log, an event graph is constructed based on the temporal relationship of events and objects in the user behavior instances generated by the same-name process; each node in the event graph represents an event and the number of times the event occurs in different user behavior instances, and the edge represents the temporal relationship between events;

[0024] Determine a single host redundant information template by setting a frequency threshold for each node;

[0025] The multi-host redundant information template is extracted based on pattern mining, and the steps are:

[0026] Check the user behavior instances with the same system call sequence in the multi-host audit logs to build the initial set;

[0027] Check the user behavior instances in the same set, perform pattern mining on all objects under a certain event to generate the corresponding regular expression, check whether the remaining events in the set meet the replacement rules of the generated regular expression, and replace them directly if they do; otherwise, use the PrefixSpan algorithm to obtain the common regular expression of all events and record the corresponding replacement rules.

[0028] As a preferred technical solution, the noise reduction of the user behavior instance is specifically as follows:

[0029] According to the extracted redundant information template, the noise behavior dictionary is constructed, which is expressed as:

[0030] Process name: {prefix, suffix},

[0031] Among them, prefix is ​​the log sequence set of the startup phase, and suffix is ​​the log sequence set of the end phase;

[0032] The events in the user behavior instance are compared with the noise behavior dictionary and filtered in turn to obtain the denoised user behavior instance.

[0033] As a preferred technical solution, the transR algorithm maps entities and relationships in the provenance graph to different spaces, and the vectors of the mapped entities and relationships satisfy:

[0034] e h W r +e r ≈e t W r,

[0035] Then graph embedding is performed to extract entity and relationship features, which are expressed as:

[0036]

[0037] Among them, e h Represents the embedding vector of the head entity, e t is the embedding vector of the tail entity, W r is the transformation matrix from entity space to relation space, represents the mapping of the head entity in the relational space, represents the mapping of the tail entity in the relational space, (h, r, t) represents a triple log in the traceability graph, h is the head entity, r is the relationship between entities, t is the tail entity, ||·|| represents the L1 norm distance function; f(h, r, t) is the score of the triple log (h, r, t), the smaller f(h, r, t) is, the greater the probability that the triple log (h, r, t) appears in the audit log;

[0038] Connect the entity and relationship features of the traceability graph to obtain the feature vector of the audit log.

[0039] As a preferred technical solution, the transR algorithm adopts a marginal-based pairwise ranking loss function L tranR To learn, it is expressed as:

[0041] L tranR =softplus(f(h,r,t)-f(h',r',t')+margin),

[0042] Among them, softplus() is the Smoothed ReLu activation function, (h',r',t') represents the negative sample generated by the valid sample (h,r,t) by transforming a node information in it, f(h',r',t') is the score of the negative sample (h',r',t'), and margin is a hyperparameter that controls the distance between the valid sample and the negative sample.

[0043] As a preferred technical solution, the sequence coding network input is a vector combining the denoised user behavior instance and the feature vector of the audit log, and outputs the feature vector of the denoised user behavior instance; the sequence coding network is composed of a three-layer neural network;

[0044] Among them, the first layer is a fully connected layer, which is used to reduce the dimension of the input vector; the second layer is composed of a sequence encoder, which is used to process log sequence data and capture long-distance dependencies; the third layer is a fully connected layer that performs data dimensionality reduction to obtain the characteristics of the user behavior instance after noise reduction.

[0045] As a preferred technical solution, the unsupervised learning method uses infoNCEloss as a loss function for learning, and the loss function is expressed as:

[0046]

[0047] Among them, L self-supervised is the unsupervised loss function, x i is the i-th user behavior instance after denoising, f(x i ) is the feature of the i-th user behavior instance after denoising, For x i The positive sample of For x i The jth negative sample of i is an irrelevant user behavior instance in the honey-tapping log, then Randomly select irrelevant user behavior instances in the honey-tapping log for the process with the same name. is to randomly select user behavior instances under other processes or related user behavior instances in the honey-tapping log; if x i is the relevant user behavior instance in the honey-stepping log, then Other behavior instances of the process with the same name or user behavior instances related to the honey-stepping log. is to randomly select user behavior instances of other processes that are not related to the honey-tapping log; τ is used to control the smoothness of the similarity, and n is the number of x in the training batch. i and and x i and The number of sample pairs; For x i and The feature similarity between i ),f(x j )) is the user behavior instance x after noise reduction i and x j The feature similarity between

[0048] The weakly supervised learning method adopts the mean square error loss function for learning, which is expressed as:

[0049] L weak-supervised =(sim(y i ,y j )-sim(f(x i ),f(x j ))) 2 ,

[0050] Among them, L weak-supervised is the weak supervision loss function, x i is the i-th user behavior instance after denoising, x jis the jth user behavior instance after denoising; y i x in the audit log or honey log i Corresponding command line information or mark information, y j x in the audit log or honey log j The corresponding command line information or mark information; if x i and x j are all user behavior instances in the honey-tapping log, and unsupervised learning is performed on them; if x i and x j If any of them is a user behavior instance in the honey-tapping log, then set sim(y i ,y j )=0; if x i and x j are not user behavior instances in the honey-tapping log, then sim(y i ,y j ) represents the user behavior instance x i and x j Corresponding to the command line similarity in the audit log; sim(f(x i ),f(x j )) is the user behavior instance x i and x j The feature similarity between

[0051] The total loss function of the sequence encoding network is defined as:

[0052] L semi-supervised =L self-supervised +λL weak-supervised ,

[0053] Among them, λ is the weight of weak supervision loss.

[0054] As a preferred technical solution, the DBSCAN algorithm is used to perform cluster analysis on the features of the user behavior instances after noise reduction to obtain abnormal user behaviors, specifically:

[0055] DBSCAN is a density-based clustering algorithm. Its basic idea is to separate the noise points in the low-density area through the high-density area and identify the clusters. The DBSCAN algorithm mainly contains two parameters: the radius ε and the minimum number of points minpts to determine the core points and boundary points. The core point is a point that contains at least the specified number of minpts points within a given radius ε, while the boundary point is a point with less than minpts points in the ε neighborhood, but it is in the ε neighborhood of a core point. Based on this concept, DBSCAN divides the data into three categories: core points, boundary points, and noise points.

[0056] The features of the user behavior instances after denoising are regarded as nodes, and the radius parameter ε and the specified point number parameter minpts in the DBSCAN algorithm are selected;

[0057] Traverse all nodes, determine the area within the radius ε that contains at least minpts points as the core point set, and the points in this area are determined as core points;

[0058] Traverse all other nodes of the non-core point set again, determine the area with less than minpts points within the radius ε as the boundary point set, and the points in this area are determined as boundary points; mark the remaining points as noise points;

[0059] Starting from the core point set, all density-reachable points are grouped into a cluster until all points are labeled as core points, boundary points, or noise points;

[0060] User behavior instances in the same cluster are considered to be the same user behavior, and noise points are marked as anomalies.

[0061] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0062] 1. The present invention constructs user behavior instances from the audit logs at the bottom of the system and reduces noise to reduce the noise information in the user behavior instances. On the one hand, it can improve data quality, and on the other hand, it can reduce the number of logs, reduce storage space, and reduce computing overhead for subsequent behavior instance representations. Then, a traceability graph is constructed to learn the semantic information of entities and relationships using the transR algorithm, and the semantic information of entities and relationships in the audit logs is more accurately represented as feature vectors, thereby improving the expressive power of features and enabling subsequent representation models to better understand and process data. Subsequently, a sequence coding network is used to train on the feature vectors of the audit logs and the annotated malicious Shield Cube Four Honey logs using unsupervised and weakly supervised learning methods to learn the boundaries between abnormal behaviors and normal behaviors, thereby obtaining the characteristics of user behavior instances, making user behavior recognition and anomaly detection more accurate. Finally, cluster analysis is used to detect abnormal behaviors on the host.

[0063] 2. When the present invention performs noise reduction on user behavior instances, it adopts a pattern mining method to filter the redundant information logs contained in the user behavior instances from both the single-host and multi-host stages, thereby improving the efficiency and accuracy of user behavior identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 It is a flow chart of the abnormal behavior detection method combining audit logs and honey-stepping logs in an embodiment of the present invention.

[0066] Figure 2 The flowchart of constructing a user behavior instance in an embodiment of the present invention.

[0067] Figure 3 Schematic diagram of the audit log corresponding to the mv instruction in an embodiment of the present invention.

[0068] Figure 4 The flowchart of user behavior instance noise reduction in an embodiment of the present invention.

[0069] Figure 5 This is an example diagram of repeated logs in an embodiment of the present invention.

[0070] Figure 6 This is a phased diagram of a behavior example generated by a single host executing an mv instruction in an embodiment of the present invention.

[0071] Figure 7 The flowchart of user behavior instance feature extraction in an embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0073] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0074] In order to solve the limitations of existing methods, the present invention proposes an abnormal behavior detection method that combines audit logs and honey-stepping logs. The command line information in the audit log is used to identify and analyze user behavior, and the honey-stepping behavior is annotated in combination with the honey-stepping log information; the corresponding behavior features are obtained by using the comparative learning method through the annotated information and user behavior instances to distinguish the boundaries between normal behavior and abnormal behavior, thereby discovering abnormal behavior. This method defines the performance of user behavior on the host as process behavior, and the process behavior is recorded in the audit log. Therefore, the command line information in the audit log is used to identify the manifestation of user behavior in the audit log, that is, the user behavior instance, to ensure the interpretability of the constructed user behavior instance. On this basis, by analyzing the connection between audit logs and user behaviors, we can identify effective logs to construct user behavior instances and reduce the noise contained in user behavior instances. We also construct audit logs as traceability graphs to obtain the associations between entities, and combine graph embedding methods to obtain feature vectors of entities and relationships. We use encoders to learn the events contained in user behavior instances, and use user behavior instance similarity and command line similarity to guide the feature extraction effect of user behavior instances, thereby improving the accuracy of user behavior feature extraction. Finally, we use cluster analysis to detect abnormal behaviors on the host. Figure 1 As shown, this embodiment combines the abnormal behavior detection method of the audit log and the honey-stepping log, including the following steps:

[0075] Step 1: User behavior instance construction:

[0076] Use log collection tools to collect audit logs of corresponding systems according to custom collection granularity;

[0077] Then merge the log information in the audit log to simplify the audit log;

[0078] Then, the structured log information of the audit log is extracted from the simplified audit log by customizing the extraction rules, including process information, data object information, process communication entity, event information and user information;

[0079] Taking the process as the main body and under the guidance of the process control flow, the simplified audit log is constructed into user behavior instances in time sequence according to the subject-event-object triples. Each user behavior instance contains multiple log sequences.

[0080] Step 2: User behavior instance noise reduction:

[0081] Extract redundant information templates and denoise user behavior instances to obtain denoised user behavior instances;

[0082] Step 3: Abnormal behavior analysis:

[0083] Construct a traceability graph for the audit log, use the transR algorithm to learn the semantic information of entities and relationships in the traceability graph, extract entity and relationship features and connect them to obtain the feature vector of the audit log;

[0084] The four honey logs in the Shield Cube are used as honey-stepping logs, and the denoised user behavior instances are combined with the feature vectors of the audit logs and input into the sequence encoding network. Unsupervised and weakly supervised learning methods are used for training to obtain the features of the denoised user behavior instances.

[0085] The DBSCAN algorithm is used to perform cluster analysis on the features of user behavior instances after denoising to obtain abnormal user behaviors.

[0086] Furthermore, the existing methods for constructing user behavior instances are mainly based on pattern mining and information flow. However, these methods lack interpretability for the constructed user behavior instances. The reason is that the pattern mining-based methods themselves rely on a large amount of log information, which makes the generated patterns more complex and difficult to interpret. The information flow-based methods may be affected by the complexity and noise of the information flow data itself, making the constructed user behavior instances difficult for security analysts to understand and interpret. The interpretability of user behavior instances is crucial for security analysts to understand audit logs and analyze user behavior. Therefore, Figure 2 As shown, the steps for constructing the user behavior instance of this application are:

[0087] 1.1. Use the log collection tool to collect the audit log of the corresponding system according to the custom collection granularity; to analyze the audit log, firstly, it is necessary to extract the fields that can describe the user behavior; since the user behavior is reflected in the terminal through the activity of the process, the entities in the existing collected data are mainly aimed at the relationship between the process and the data object (such as files, sockets, registries, etc.) and other events with obvious user behavior semantics (such as login events), so by setting the corresponding filtering rules, the events that are obviously unrelated to the user behavior, such as memory allocation, can be screened out. In this embodiment, the ETW log collection tool is used to collect audit logs for the Windows system; the audit log collection tool is used to collect audit logs for the Linux system.

[0088] 1.2. Then merge the log information in the audit log to simplify the audit log; because the system log is relatively low-level, one user behavior often corresponds to a lot of log information, which may contain some useless log information, such as memory allocation, environment loading, etc. This information brings huge computing and storage pressure for analyzing user behavior instances. Figure 3In the Linux audit log, when the user executes the mv command, the system records the execution of mv and also records a large number of logs used to confirm the location of the mv execution and load the content of the mv instruction. Moreover, compared with the logs generated when mv is executed, the process of searching and loading mv generates more logs. Figure 3 The gray box in the middle is the action before the process executes the mv instruction, including creation and execution of mv. The rest is the log information generated when executing the mv instruction. Lines 1-19 are the preparation actions required for executing mv: lines 1-3 describe that the process reads the dynamic link library mapping file, lines 4-7 describe that the process reads the system shared library path information, lines 8-15 describe that the process reads and maps it to memory, lines 16-19 describe the interaction with the HPET device to obtain high-precision time measurement, line 20 uses the rename system call to implement the function of moving files, and line 21 is the process exit action. It can be seen that most of the logs are for preparation to execute the mv instruction. For user behavior, the key log is only line 20, which means that only the log of line 20 is enough to describe the user's behavior of executing mv. Other logs not only occupy a large amount of storage, but also increase the difficulty of identifying user behavior and reduce the recognition efficiency.

[0089] In the process of constructing user behavior instances, one of the most common sources of redundant information is the continuous identical events triggered by user operations, such as continuous data reading, data loading, etc. Figure 5 Therefore, when processing user behavior instances, we first focus on processing this type of logs and merge those logs that have exactly the same information except for the timestamp, so as to reduce the storage pressure on the user behavior instances. This processing method effectively reduces the existence of redundant data and makes the generated user behavior instances more compact and effective.

[0090] 1.3. Custom extraction rules are used to extract structured log information of audit logs from simplified audit logs. Due to the diversity of terminal devices and collection, the collected data is unstructured, so it is necessary to structure the collected audit logs to achieve an efficient and concise log representation structure. Since the purpose of the present invention is to detect abnormal behavior from audit logs, by analyzing the correlation between user behavior and logs, structured log information is extracted from the audit log, including process information, data object information, process communication entity, event information and user information.

[0091] Among them, process information includes process name, process id, etc.; data object information includes file name, file id, file address, socket, socket id, etc.; process communication entities include pipes, etc.; event information includes command line, timestamp, etc.; user information includes user name, user id, etc.; and obtain the (global) unique identifier corresponding to the above content in the log.

[0092] 1.4. Finally, taking the process as the main body and under the guidance of the process control flow, the simplified audit log is constructed into user behavior instances in chronological order according to the subject-event-object triples.

[0093] With respect to the structured log information extracted above, through analyzing the user behavior and the log generated by it, it is found that the log generated by the user behavior is often rooted in the corresponding process. Considering that the user behavior is reflected in the system through the process, that is, the user behavior will generate a corresponding control flow in the process program, so that the process is executed under the generated control flow and recorded by the system log. Therefore, the system log can reflect the user's behavior while containing the process control flow information. As one of the ways for users to interact with the system, the command line often has corresponding behavioral semantics, configuration information, etc., so as to generate a corresponding control flow to implement the command line content input by the user. Therefore, the present invention takes the process as the center (subject) and under the guidance of the process control flow, the simplified audit log is represented in the form of a subject-event-object triple in time sequence, thereby constructing a user behavior instance; in the triple, the subject is the process, the object can be a process, a file or a socket, etc., and the event is the relationship between the subject and the object. For example, the triple (mv, read, / etc / libmap.conf) indicates the log information that the move process (move) reads (read) the shared library replacement rule file (file address / etc / libmap.conf).

[0094] Furthermore, in order to solve the huge storage pressure brought by the audit log, the traditional method filters the log from the perspective of tracing the source without affecting the tracing process. However, this method has very limited effect on user behavior analysis. In order to solve this problem, the present invention designs a noise reduction method for user behavior instances. The specific process is as follows: Figure 4 As shown in the figure, this method uses pattern mining to obtain the noise patterns contained in the user behavior instances based on the characteristics of the user behavior in the logs and filters them to achieve the purpose of noise reduction. The specific details are as follows:

[0095] Extract redundant information templates and denoise user behavior instances, that is, denoise user behavior instances based on the relationship between user behavior and user behavior instances. According to relevant research content, a running program can be divided into three stages: the startup stage, which is used to load various libraries and configuration information; the execution stage, which is used to process user request information; and the end stage, which is used to release occupied resources. Considering the relationship between user behavior and user behavior instances in these three stages, a corresponding denoising algorithm or model can be designed to identify and filter out log information that does not have real meaning.

[0096] This application considers the relationship between user behavior and user behavior instances, extracts the log sequence of the startup phase and the log sequence of the end phase in the user behavior instance as redundant information templates, and then filters out meaningless log information. The redundant information templates are divided into single-host redundant information templates and multi-host redundant information templates, and the extraction methods of the two are also different.

[0097] For the extraction of single host redundancy information template:

[0098] For user behavior instances on a single host, since the system environment on a single host generally does not change, the noise information contained in its user behavior instances generally has a more obvious behavior pattern compared to multi-hosts. Take the mv command to move a single file as an example, the results are as follows: Figure 6 As shown, as mentioned before, the user's behavior of moving files through the mv command only caused the change of the 20th log information. Although part of the file moving behavior was not successful, its behavior pattern still conforms to the pattern of the preparation stage. By performing template extraction on user behavior instances on a single host, the computational pressure of subsequent pattern mining can be effectively reduced, thereby improving the efficiency of the algorithm. Since the process name of a process generally does not change during execution, the present invention merges the user behavior instances generated by the processes with the same name on a single host. The specific details are as follows:

[0099] For user behavior instances generated by processes with the same name, the events and objects contained therein are constructed into an event graph according to the temporal relationship. In the event graph, each node describes an event and the number of times the event occurs in different user behavior instances, and the edge describes the temporal relationship between events.

[0100] Since the control flow of the process in the startup and end stages is fixed, the behavior template of the noise on a single host can be obtained through frequency information; by setting a frequency threshold for each node in the event graph, the redundant information pattern existing in the user behavior instance on a single host can be simply determined.

[0101] For mining of multi-host redundant information templates:

[0102] Due to the different environments of different hosts, the redundant information patterns of user behaviors on different hosts are not exactly the same. Common ones include user directories: / home / username, or program installation directories, which make it difficult to directly obtain frequency information between different hosts. Direct pattern mining on multiple hosts will have the problem of high computational overhead. Therefore, by utilizing the stable environment of a single host system, we avoid using pattern mining and directly use the association between events to reduce overhead. Therefore, we first perform pattern mining on user behavior instances on multiple hosts to obtain a common redundant information template, and then use the association between events to make the obtained redundant information behavior sequence universal. The specific method is as follows:

[0103] Check the user behavior instances with the same system call sequence in the multi-host audit logs to build the initial set;

[0104] Check the user behavior instances in the same set, perform pattern mining on all objects at a certain time to generate the corresponding generation regular expression. If there is a replacement rule, check whether the remaining events in the set meet the replacement rule of the generation regular expression. If so, replace them directly; otherwise, use the PrefixSpan algorithm to obtain the universal regular expression of all events and record the corresponding replacement rule.

[0105] In the same set, the length of the redundant information template of each user behavior instance is the same because of the same system call sequence. When the system process is executed, the process name and the corresponding system call are the same, so when checking, only the object needs to be checked. The purpose is to generate a regular expression for different object parts in the redundant information template, so that the redundant information template can be applied to multiple hosts. For example, if two hosts are installed with a Firefox, and the installation paths are different, different objects (firefox paths) will be generated here when starting firefox, such as: Sh exec / usr / local / firefox / firefox and Sh exec / opt / firefox / firefox; here, the pattern mining of / usr / local / firefox / firefox and exec / opt / firefox / firefox is performed to obtain the generated general regular expression *firefox / firefox$.

[0106] The PrefixSpan algorithm used in this application is an effective algorithm for sequential pattern mining, which can find frequent patterns in sequence data sets; its core idea is to use prefix growth to recursively find frequent patterns in sequences; PrefixSpan starts from a length of 1, finds prefixes and prefix projections (suffixes) of corresponding lengths, counts them, and deletes corresponding items with support below a threshold from the data set, thereby obtaining all frequent item sequences. The PrefixSpan algorithm reduces unnecessary calculations through depth-first search and pruning strategies, and returns all frequent patterns through recursive backtracking.

[0107] Finally, the user behavior instance denoising is achieved based on the extracted redundant information template, as follows:

[0108] According to the extracted redundant information template, the corresponding noise behavior dictionary is constructed. The specific data structure is as follows:

[0109] Process name: {prefix, suffix},

[0110] Among them, prefix is ​​the log sequence set of the startup phase, and suffix is ​​the log sequence set of the end phase;

[0111] The events in the user behavior instance are compared with the noise behavior dictionary and filtered in turn to complete the noise reduction of the user behavior instance and obtain the noise-reduced user behavior instance.

[0112] This embodiment takes the mobile process mv as an example, and constructs the noise behavior dictionary as follows:

[0113] mv:{

[0114] prefix:[

[0115] (mv,open, / etc / libmap.conf,FILE_OBJECT_FILE,None,None),

[0116] (mv,read, / etc / libmap.conf,FILE_OBJECT_FILE,None,None),

[0117] (mv,close, / etc / libmap.conf,FILE_OBJECT_FILE,None,None),

[0118] (mv,open, / var / run / ld-elf.so.hints,FILE_OBJECT_FILE,None,None),

[0119] (mv,read, / var / run / ld-elf.so.hints,FILE_OBJECT_FILE,None,None),

[0120] (mv,close, / var / run / ld-elf.so.hints,FILE_OBJECT_FILE,None,None),

[0121] (mv,open, / lib / libc.so.d+,FILE_OBJECT_FILE,None,None),

[0122] (mv,mmap, / lib / libc.so.d+,FILE_OBJECT_FILE,None,None),

[0123] (mv,close, / lib / libc.so.d+,FILE_OBJECT_FILE,None,None),

[0124] (mv,open, / dev / hpet0,FILE_OBJECT_FILE,None,None),

[0125] (mv,mmap, / dev / hpet0,FILE_OBJECT_FILE,None,None),

[0126] (mv,close, / dev / hpet0,FILE_OBJECT_FILE,None,None)

[0127] ],

[0128] suffix:[

[0129] (mv,exit,process,FILE_OBJECT_FILE,None,None) ]

[0131] }.

[0132] Furthermore, after obtaining the denoised user behavior instance, it is necessary to characterize and analyze the user behavior instance to implement abnormal behavior detection. First, entity and relationship features are extracted and the feature vector of the audit log is obtained, specifically:

[0133] 3.1. Constructing a traceability graph for audit logs. Although audit logs contain a lot of noise information about user behaviors, these contents can often reflect the meaning of common entities in the system. Therefore, the traceability graph constructed by the present invention uses the transR algorithm to learn the semantic information of entities and relationships in the audit logs. The transR algorithm maps the entities and relationships in the traceability graph to different spaces to avoid possible problems in many-to-many entity relationships. After mapping, the vectors of entities and relationships satisfy:

[0134] e h W r +e r ≈e t W r

[0135] Then graph embedding is performed to extract entity and relationship features, expressed as:

[0136]

[0137] Among them, e h Represents the embedding vector of the head entity, e t is the embedding vector of the tail entity, W r is the transformation matrix from entity space to relation space, represents the mapping of the head entity in the relational space, represents the mapping of the tail entity in the relational space, (h, r, t) represents a triple log in the traceability graph, h is the head entity (subject), r is the relationship between entities (event), t is the tail entity (object), ||·|| represents the L1 norm distance function; f(h, r, t) is the score of the triple log (h, r, t), the smaller f(h, r, t) is, the greater the probability of the triple (h, r, t) appearing in the audit log.

[0138] In this embodiment, in order to optimize the transR algorithm, a pairwise ranking loss function L based on margin is adopted. tranR To learn, it is expressed as:

[0140] L tranR =softplus(f(h,r,t)-f(h',r',t')+margin),

[0141] Among them, softplus() is the Smoothed ReLu activation function, (h',r',t') represents the negative sample generated by the valid sample (h,r,t) by transforming a node information in it, f(h',r',t') is the score of the negative sample (h',r',t'), and margin is a hyperparameter that controls the distance between the valid sample and the negative sample.

[0142] 3.2. Use the four honey logs in the Shield Cube as honey-stepping logs, combine the denoised user behavior instances with the feature vectors of the audit logs and input them into the sequence coding network, use semi-supervised learning methods (unsupervised and weakly supervised) for training, and obtain the features of the user behavior instances after denoising. The reason why both honey-stepping logs and audit logs are used at the same time is to fully understand the behaviors occurring in the system from different perspectives and provide more semantic information for subsequent analysis and detection. However, the entire processing process converts the logs into user behavior instances, and then obtains the vectors of entities and relationships in the logs through embedding methods. The feature vectors that combine the user behavior instances with the feature vectors of the audit logs are then input into the sequence coding network for further compression and feature extraction. Figure 7 As shown in the figure, the input of the sequence encoding network is a vector combining the denoised user behavior instance and the feature vector of the audit log, and the output is the feature vector of the denoised user behavior instance; the network is mainly composed of three layers of neural network: the first layer is a fully connected layer, which is used to reduce the dimension of the input vector and reduce the feature dimension to adapt to the processing requirements of the subsequent encoder layer, while reducing the computational complexity and storage requirements; the second layer is composed of a sequence encoder, which is used to process log sequence data and capture long-distance dependencies; finally, the fully connected layer performs data dimensionality reduction to obtain the features of the denoised user behavior instance, which is suitable for subsequent clustering tasks.

[0143] In this embodiment, the user behavior instance is composed of a log sequence, and the log is represented as a triple (subject, event, object). Assuming that each log sequence can be represented as a vector of size 3*32, and the number of log sequences contained in a user behavior instance is 128, then the user behavior instance can be represented as a 128*3*32 vector, so the input of the sequence decoding network is this 128*3*32 vector.

[0144] In this embodiment, for the user behavior instance without command line, comparative learning is performed and infoNCEloss is used as the loss function L self-supervised To learn, it is expressed as:

[0145]

[0146] Among them, L self-supervised is the unsupervised loss function, x i is the i-th user behavior instance after denoising, f(x i ) is the feature of the i-th user behavior instance after denoising, For x i The positive sample of For x i The jth negative sample of i is an irrelevant user behavior instance in the honey-tapping log, then Randomly select irrelevant user behavior instances in the honey-tapping log for the process with the same name. is to randomly select user behavior instances under other processes or related user behavior instances in the honey-tapping log; if x i is the relevant user behavior instance in the honey-stepping log, then Other behavior instances of the process with the same name or user behavior instances related to the honey-stepping log. is to randomly select user behavior instances of other processes that are not related to the honey-tapping log; τ is used to control the smoothness of the similarity, and n is the number of x in the training batch. i and and x i and The number of sample pairs; For x i and The feature similarity between i ),f(x j )) is the user behavior instance x after noise reduction i and x j The feature similarity between them. For the similarity measurement function sim(a,b), the formula is:

[0147]

[0148] Where D(f(a),f(b)) is the Euclidean distance between f(a) and f(b), and m is a custom parameter used to control the relationship between sample similarity and distance, so that when the sample distance reaches a certain value, the sample similarity will not change significantly with the increase of the sample distance.

[0149] By minimizing L self-supervised , it can maximize the similarity of positive sample pairs, ensure the similarity of features between user behavior instances related to honey-stepping logs and the similarity between behavior instances generated by the same process that are unrelated to honey-stepping logs; at the same time, it can also minimize the similarity between positive and negative sample pairs, ensuring the boundary between honey-stepping logs and non-honey-stepping logs.

[0150] For user behavior instances with command line information, the learned features need to meet the following conditions: that is, the distance between the embeddings learned from two user behavior instances should be negatively correlated with the similarity between the two user behavior instances. This paper designs two sample weak supervision losses L by combining the similarity of the two sample command lines. weak-supervised , as follows:

[0151] L weak-supervised =(sim(y i ,y j )-sim(x i ,x j ))2 ,

[0152] Among them, L weak-supervised is the weak supervision loss function, x i is the i-th user behavior instance after denoising, x j is the jth user behavior instance after denoising, y i x in the audit log or honey log i Corresponding command line information or mark information, y j x in the audit log or honey log j The corresponding command line information or tag information (used to distinguish audit logs from honey-stepping logs), if x i and x j are all user behavior instances in the honey-tapping log, and unsupervised learning is performed on them; if x i and x j If any of them is a user behavior instance in the honey-tapping log, then set sim(y i ,y j )=0; if x i and x j are not user behavior instances in the honey-tapping log, then sim(y i ,y j ) represents the user behavior instance x i and x j Corresponding to the command line similarity in the audit log; sim(f(x i ),f(x j )) is the user behavior instance x i and x j The feature similarity between them.

[0153] The total loss function of the sequence encoding network in this method is defined as: L semi-supervised =L self-supervised +λL weak-supervised , where λ is the weight of the weak supervision loss.

[0154] 3.3. Use the DBSCAN algorithm to perform cluster analysis on the features of user behavior instances after denoising to detect abnormal user behavior.

[0155] DBSCAN is a density-based clustering algorithm. Its basic idea is to separate the noise points in the low-density area through the high-density area and identify the clusters. The DBSCAN algorithm mainly contains two parameters: the radius ε and the minimum number of points minpts to determine the core points and boundary points. The core point is a point in an area that contains at least minpts points within a given radius ε, while the boundary point is a point in an area where the number of points in the ε neighborhood is less than minpts, but the points in the area are within the ε neighborhood of a core point. Based on this concept, DBSCAN divides the data into three categories: core points, boundary points, and noise points. Therefore, the clustering analysis process of this application is:

[0156] The features of the user behavior instances after denoising are regarded as nodes, and the radius parameter ε and the specified point number parameter minpts in the DBSCAN algorithm are selected;

[0157] Traverse all nodes, determine the area within the radius ε that contains at least minpts points as the core point set, and the points in this area are determined as core points;

[0158] Traverse all other nodes of the non-core point set again, determine the area with less than minpts points within the radius ε as the boundary point set, and the points in this area are determined as boundary points; mark the remaining points as noise points;

[0159] Starting from the core point set, all density-reachable points are grouped into a cluster until all points are labeled as core points, boundary points, or noise points;

[0160] User behavior instances in the same cluster are considered to be the same user behavior, and noise points are marked as abnormal.

[0161] In summary, the present invention proposes an abnormal behavior detection method that combines audit logs and honey-stepping logs, aiming to identify user behavior from audit logs and discover abnormal behavior. On the one hand, the present invention designs a new pattern mining method specifically for user behavior instance noise reduction to filter the user behavior instance noise contained in the audit log and improve the efficiency and accuracy of user behavior identification; on the other hand, the present invention uses the behavioral semantic information and annotated malicious information in the audit log, and adopts a framework for behavioral feature extraction based on semi-supervised contrastive learning. Through the semantic information contained in the log, the user behavior instance is feature extracted, making user behavior identification and anomaly detection more accurate. Through the annotated honey-stepping log information, the boundary between abnormal behavior and normal behavior is learned to improve the accuracy of anomaly detection; finally, cluster analysis is used to detect abnormal behavior on the host.

[0162] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0163] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0164] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. The abnormal behavior detection method combining audit logs and honey-stepping logs is characterized by: The steps include: Step 1: User behavior instance construction: Use log collection tools to collect audit logs of corresponding systems according to custom collection granularity; Merge the log information in the audit log to simplify the audit log; Custom extraction rules are used to extract structured log information of audit logs from simplified audit logs; The structured log information includes process information, data object information, process communication entity, event information and user information; Taking the process as the main body and under the guidance of the process control flow, the simplified audit log is constructed into user behavior instances in time sequence according to the subject-event-object triples. Each user behavior instance contains multiple log sequences. Step 2: User behavior instance noise reduction: Extract redundant information templates and denoise user behavior instances to obtain denoised user behavior instances; Step 3: Abnormal behavior analysis: Construct a traceability graph for the audit log, use the transR algorithm to learn the semantic information of entities and relationships in the traceability graph, extract entity and relationship features and connect them to obtain the feature vector of the audit log; The four honey logs in the Shield Cube are used as honey-stepping logs, and the denoised user behavior instances are combined with the feature vectors of the audit logs and input into the sequence encoding network. Unsupervised and weakly supervised learning methods are used for training to obtain the features of the denoised user behavior instances. The DBSCAN algorithm is used to perform cluster analysis on the features of user behavior instances after denoising to obtain abnormal user behaviors.

2. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The process information includes process name and process id; the data object information includes file name, file id, file address, socket, socket id; the process communication entity includes pipeline; the event information includes command line and timestamp; the user information includes user name and user id; In the triple, the subject is a process, the object is a process, a file or a socket, and the event is the relationship between the subject and the object.

3. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The merging of log information in the audit log refers to merging logs in the audit log that have completely identical information except for the timestamp.

4. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The redundant information template is divided into a single-host redundant information template and a multi-host redundant information template, which includes a log sequence in the startup phase and a log sequence in the end phase. The steps of extracting the single host redundant information template are: For a single host audit log, an event graph is constructed based on the temporal relationship of events and objects in the user behavior instances generated by the same-name process; each node in the event graph represents an event and the number of times the event occurs in different user behavior instances, and the edge represents the temporal relationship between events; Determine a single host redundant information template by setting a frequency threshold for each node; The multi-host redundant information template is extracted based on pattern mining, and the steps are: Check the user behavior instances with the same system call sequence in the multi-host audit logs to build the initial set; Check the user behavior instances in the same set, perform pattern mining on all objects under a certain event to generate the corresponding regular expression, check whether the remaining events in the set meet the replacement rules of the generated regular expression, and replace them directly if they do; otherwise, use the PrefixSpan algorithm to obtain the common regular expression of all events and record the corresponding replacement rules.

5. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The noise reduction of the user behavior instance is specifically as follows: According to the extracted redundant information template, the noise behavior dictionary is constructed, which is expressed as: Process name: {prefix, suffix}, Among them, prefix is ​​the log sequence set of the startup phase, and suffix is ​​the log sequence set of the end phase; The events in the user behavior instance are compared with the noise behavior dictionary and filtered in turn to obtain the denoised user behavior instance.

6. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The transR algorithm maps entities and relationships in the provenance graph to different spaces. After mapping, the vectors of entities and relationships satisfy: have been h W r +e r ≈e t W r , Then graph embedding is performed to extract entity and relationship features, which are expressed as: Among them, e h Represents the embedding vector of the head entity, e t is the embedding vector of the tail entity, W r is the transformation matrix from entity space to relation space, represents the mapping of the head entity in the relational space, represents the mapping of the tail entity in the relational space, (h, r, t) represents a triple log in the traceability graph, h is the head entity, r is the relationship between entities, t is the tail entity, ||·|| represents the L1 norm distance function; f(h, r, t) is the score of the triple log (h, r, t), the smaller f(h, r, t) is, the greater the probability that the triple log (h, r, t) appears in the audit log; Connect the entity and relationship features of the traceability graph to obtain the feature vector of the audit log.

7. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 6 is characterized in that: The transR algorithm adopts a margin-based pairwise ranking loss function L tranR To learn, it is expressed as: L tranR =softplus(f(h,r,t)-f(h’,r’,t’)+margin), Among them, softplus() is the Smoothed ReLu activation function, (h',r',t') represents the negative sample generated by the valid sample (h,r,t) by transforming a node information in it, f(h',r',t') is the score of the negative sample (h',r',t'), and margin is a hyperparameter that controls the distance between the valid sample and the negative sample.

8. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The sequence coding network inputs a vector combining the denoised user behavior instance and the feature vector of the audit log, and outputs the feature vector of the denoised user behavior instance; the sequence coding network is composed of a three-layer neural network; Among them, the first layer is a fully connected layer, which is used to reduce the dimension of the input vector; the second layer is composed of a sequence encoder, which is used to process log sequence data and capture long-distance dependencies; the third layer is a fully connected layer that performs data dimensionality reduction to obtain the characteristics of the user behavior instance after noise reduction.

9. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 8 is characterized in that: The unsupervised learning method uses infoNCEloss as the loss function for learning, and the loss function is expressed as: Among them, L self-supervised is the unsupervised loss function, x i is the i-th user behavior instance after denoising, f(x i ) is the feature of the i-th user behavior instance after denoising, For x i The positive sample of For x i The jth negative sample of i is an irrelevant user behavior instance in the honey-tapping log, then Randomly select irrelevant user behavior instances in the honey-tapping log for the process with the same name. is to randomly select user behavior instances under other processes or related user behavior instances in the honey-tapping log; if x i is the relevant user behavior instance in the honey-stepping log, then Other behavior instances of the process with the same name or user behavior instances related to the honey-stepping log. is to randomly select user behavior instances of other processes that are not related to the honey-tapping log; τ is used to control the smoothness of the similarity, and n is the number of x in the training batch. i and and x i and The number of sample pairs; For x i and The feature similarity between i ),f(x j )) is the user behavior instance x after noise reduction i and x j The feature similarity between The weakly supervised learning method adopts the mean square error loss function for learning, which is expressed as: L weak-supervised =(sim(y i ,y j )-sim(f(x i ),f(x j ))) 2 , Among them, L weak-supervised is the weak supervision loss function, x i is the i-th user behavior instance after denoising, x j is the jth user behavior instance after denoising; y i x in the audit log or honey log i Corresponding command line information or mark information, y j x in the audit log or honey log j The corresponding command line information or mark information; if x i and x j are all user behavior instances in the honey-tapping log, and unsupervised learning is performed on them; if x i and x j If any of them is a user behavior instance in the honey-tapping log, then set sim(y i ,y j )=0; if x i and x j are not user behavior instances in the honey-tapping log, then sim(y i ,y j ) represents the user behavior instance x i and x j Corresponding to the command line similarity in the audit log; sim(f(x i ),f(x j )) is the user behavior instance x i and x j The feature similarity between The total loss function of the sequence encoding network is defined as: THE semi-supervised =L self-supervised +λL weak-supervised , Among them, λ is the weight of weak supervision loss.

10. The abnormal behavior detection method combining audit logs and honey-stepping logs according to claim 1 is characterized in that: The DBSCAN algorithm is used to perform cluster analysis on the features of the user behavior instances after noise reduction to obtain abnormal user behaviors, specifically: DBSCAN is a density-based clustering algorithm. Its basic idea is to separate the noise points in the low-density area through the high-density area and identify the clusters. The DBSCAN algorithm mainly contains two parameters: the radius ε and the minimum number of points minpts to determine the core points and boundary points. The core point is a point that contains at least the specified number of minpts points within a given radius ε, while the boundary point is a point with less than minpts points in the ε neighborhood, but it is in the ε neighborhood of a core point. Based on this concept, DBSCAN divides the data into three categories: core points, boundary points, and noise points. The features of the user behavior instances after denoising are regarded as nodes, and the radius parameter ε and the specified point number parameter minpts in the DBSCAN algorithm are selected; Traverse all nodes, determine the area within the radius ε that contains at least minpts points as the core point set, and the points in this area are determined as core points; Traverse all other nodes of the non-core point set again, determine the area with less than minpts points within the radius ε as the boundary point set, and the points in this area are determined as boundary points; mark the remaining points as noise points; Starting from the core point set, all density-reachable points are grouped into a cluster until all points are labeled as core points, boundary points, or noise points; User behavior instances in the same cluster are considered to be the same user behavior, and noise points are marked as anomalies.

Images