Epsilon machine-based behavior anomaly detection method and system

Abstract

The invention discloses a behavior anomaly detection method and system based on an epsilon machine. The method comprises the following steps: constructing a workflow finite-state machine based on a workflow of a system business behavior; based on the detected system business operation behavior data and the workflow finite-state machine, constructing a system epsilon machine by using a causal state segmentation reconstruction algorithm; and carrying out anomaly calculation on the state vectors of the epsilon machine of the system obtained by different sequence data through an anomaly threshold, and judging whether the implicit behavior mode corresponding to the state vectors is normal or not. According to the method, a corresponding workflow finite state machine is constructed based on workflow steps of system business behaviors, and a corresponding implicit mode discovery epsilon machine is constructed through detection of finite state data of behaviors and a causal state segmentation reconstruction algorithm; the implicit abnormal mode of the unknown behavior is detected through the epsilon machine, and the method has the advantages of being high in detection precision and dynamic in detection capacity.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an ε machine-based behavior anomaly detection method and system. Background Art

[0002] With the development of the Internet era, internal threats, zero-day vulnerabilities, DoS attacks and other attack behaviors are increasing, and network security is becoming more and more important. Intrusion Detection System (IDS) is a proactive security protection technology that can effectively perceive network attacks by real-time monitoring of the network and provide response decisions for security managers. At present, intrusion detection is widely used in military, medical, transportation, Internet of Things security, industrial control systems and other fields.

[0003] An intrusion detection system is a system that monitors and analyzes network communications and identifies abnormal behavior through active response. Anomaly-based Network Intrusion Detection System (ANIDS) monitors network traffic and finds abnormal patterns that do not conform to expected normal behavior. When the detected behavior deviates greatly from the normal behavior, an alarm message is issued. Since ANIDS does not rely on fixed signatures for detection, it can resist zero-day attacks and signature confusion. However, due to the diversity of network traffic, this often leads to a high false positive rate in ANIDS. And the high volume rate makes it difficult to find the boundary between normal and abnormal profiles for intrusion detection. In addition, ANIDS is vulnerable to imitation attacks, that is, the attacker modifies the attack characteristics to make them similar to benign characteristics, and lacks the ability to detect unknown traffic and behavior.

[0004] Based on this, a new solution is needed. Summary of the invention

[0005] The main purpose of the present invention is to provide a behavior anomaly detection method and system based on ε machine in order to address the insufficient detection ability of the current anomaly-based network intrusion detection system in the field of cyberspace security for unknown traffic and behavior. By integrating workflow state machine, ε machine and other methods, implicit behavior patterns are discovered, thereby being able to detect the implicit unknown traffic and abnormal behavior in the system to meet the needs of cyberspace security protection.

[0006] To achieve the above object, the present invention provides a behavior anomaly detection method based on an ε machine, comprising:

[0007] Construct workflow finite state machine based on the workflow of system business behavior;

[0008] Based on the detected system business operation behavior data and the workflow finite state machine, a system ε machine is constructed using a causal state segmentation and reconstruction algorithm;

[0009] Through the abnormality threshold, the abnormality of the state vector of the system ε machine obtained from different sequence data is calculated to determine whether the implicit behavior pattern corresponding to the state vector is normal.

[0010] In the behavior anomaly detection method based on the ε machine provided by the present invention, time series data generated by the business operation behavior of the detection system is detected;

[0011] Based on the workflow finite state machine, the time series data is symbolized by using a wavelet space method to obtain a symbolized sequence;

[0012] The symbolized sequence is equally divided into a plurality of subsequences of equal length, a Kolmogorov-Smirnov test is performed on each subsequence, an ε machine of each sequence is reconstructed using a causal state segmentation and reconstruction algorithm, and a causal state set expressing the implicit pattern of the system is obtained.

[0013] In the behavior anomaly detection method based on the ε machine provided by the present invention, the abnormality degree of the state vector of the system ε machine obtained from different sequence data is calculated by using the abnormality degree threshold, and the step of determining whether the implicit behavior pattern corresponding to the state vector is normal includes:

[0014] Extract the feature vector of each causal state set;

[0015] The abnormality between different feature vectors is calculated, and when the calculated abnormality is greater than the abnormality threshold, it is determined that the implicit behavior pattern corresponding to the feature vector is abnormal.

[0016] In the behavior anomaly detection method based on the ε machine provided by the present invention, the degree of anomaly between different feature vectors is obtained by calculating the Euclidean distance and the angle between the feature vectors.

[0017] In addition, to achieve the above-mentioned purpose, the present invention also provides a behavior anomaly detection system based on an ε machine, comprising:

[0018] Workflow finite state machine building module, used to build workflow finite state machine based on the workflow of system business behavior;

[0019] A system ε machine construction module, used to construct the system ε machine based on the detected system business operation behavior data and the workflow finite state machine using a causal state segmentation and reconstruction algorithm;

[0020] The behavior anomaly detection module is used to calculate the anomaly degree of the state vector of the system ε machine obtained from different sequence data through the anomaly degree threshold, and determine whether the implicit behavior pattern corresponding to the state vector is normal.

[0021] In the behavior anomaly detection system based on the ε machine provided by the present invention, the system ε machine building module includes:

[0022] A data acquisition unit is used to detect time series data generated by system business operation behaviors;

[0023] A symbolization processing unit, configured to perform time series symbolization on the time series data by using a wavelet space method based on the workflow finite state machine to obtain a symbolized sequence, and to divide the symbolized sequence into a plurality of equal-length subsequences;

[0024] The ε machine reconstruction unit is used to perform the Kolmogorov-Smirnov test on each subsequence, reconstruct the ε machine of each sequence using the causal state segmentation reconstruction algorithm, and obtain the causal state set that expresses the implicit pattern of the system.

[0025] In the behavior anomaly detection system based on the ε machine provided by the present invention, the behavior anomaly detection module includes:

[0026] A feature extraction unit, used to extract a feature vector of each causal state set;

[0027] The judgment unit is used to calculate the abnormality between different feature vectors. When the calculated abnormality is greater than the abnormality threshold, it is determined that the implicit behavior pattern corresponding to the feature vector is abnormal.

[0028] In the behavior anomaly detection system based on the ε machine provided by the present invention, the degree of anomaly between different feature vectors is obtained by calculating the Euclidean distance and the angle between the feature vectors.

[0029] The present invention also provides an ε-machine-based behavior anomaly detection device, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the ε-machine-based behavior anomaly detection method as described above are implemented.

[0030] The behavior anomaly detection system and method based on the ε machine provided by the present invention have the following beneficial effects: the present invention constructs a corresponding workflow finite state machine based on the workflow steps of the system business behavior, constructs a corresponding implicit pattern discovery ε machine through the detection of the finite state data of the behavior and the causal state segmentation and reconstruction algorithm, and detects the implicit abnormal patterns of unknown behaviors through the ε machine, which has the characteristics of high detection accuracy and dynamic detection capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work:

[0032] Figure 1 FIG. 1 is a flow chart of a behavior anomaly detection method based on an ε machine provided by an embodiment of the present invention;

[0033] Figure 2 Shown are two different causal state set diagrams for the system;

[0034] Figure 3 The figure shows the workflow of the query service established according to the behavior anomaly detection method based on the ε machine provided by the invention;

[0035] Figure 4 The figure shows a state machine established according to the behavior anomaly detection method based on the ε machine provided by the invention;

[0036] Figure 5 The figure shows an ε machine established according to the ε machine-based behavior anomaly detection method provided by the invention. DETAILED DESCRIPTION

[0037] In order to facilitate understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Typical embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0039] In view of the shortcoming that the current anomaly-based network intrusion detection system in the field of cyberspace security has insufficient detection capabilities for unknown traffic and behaviors, the present invention constructs a corresponding workflow finite state machine based on the workflow steps of the system business behavior, and constructs a corresponding implicit pattern discovery ε machine through the detection of the finite state data of the behavior and the causal state segmentation and reconstruction algorithm. The ε machine is used to detect implicit anomaly patterns of unknown behaviors, and has the characteristics of high detection accuracy and dynamic detection capabilities.

[0040] In order to better understand the above-mentioned technical scheme, the above-mentioned technical scheme will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical scheme of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0041] Figure 1 FIG. 8 is a flow chart of a method for detecting abnormal behavior based on an ε machine according to an embodiment of the present invention. Figure 1 As shown, the behavior anomaly detection method based on the ε machine includes the following steps:

[0042] Step S1, constructing a workflow finite state machine based on the workflow of the system business behavior;

[0043] Specifically, in one embodiment of the present invention, first, based on the operation process of the system's business behavior, a behavioral workflow of the system is constructed, wherein each business operation step affects the state result of the system; then, the corresponding workflow finite state machine is constructed through the state transition generated by the evolution of each step of the workflow.

[0044] Step S2: Based on the detected system business operation behavior data and the workflow finite state machine, a causal state segmentation and reconstruction algorithm is used to construct a system ε machine;

[0045] Specifically, in one embodiment of the present invention, for the detected system business operation behavior data, the workflow finite state machine constructed in step S1 and the causal state segmentation and reconstruction algorithm are used to construct a system ε machine to express the evolution of the internal characteristics of the system when the critical changes occur. Therefore, step S2 includes:

[0046] Step S21, detecting time series data generated by system business operation behavior;

[0047] Specifically, in one embodiment of the present invention, the time series data generated by the business operation behavior of the detection system is obtained to obtain a time series {x i},i=1,2,…,N.

[0048] Step S22: Based on the workflow finite state machine, the time series data is symbolized by using a wavelet space method to obtain a symbolized sequence;

[0049] Specifically, in one embodiment of the present invention, for the time series {x i}, i = 1, 2, ..., N, and the time series is symbolized by wavelet space method to obtain the symbol sequence {s i}. The so-called symbolization is to transform the real number sequence into a symbol sequence. The research object of the ε machine is a finite symbol set. It cannot directly process the sampled time series. It is necessary to symbolize the time series first and then use the ε machine for analysis. Symbolization requires the removal of irrelevant redundant information while retaining the information of the key features of the original sequence. The wavelet transform can use related wavelet transform or wavelet fast transform algorithm, such as Mallat algorithm. Therefore, the wavelet space method for data symbolization processing includes the following steps:

[0050] 1) Calculate the scale space of wavelet decomposition of the preprocessed sequence v(k) to determine the scale space for signal decomposition [J min ,J max ], let the minimum decomposition scale J min =1, maximum decomposition scale J max The calculation formula is as follows:

[0051] J max =log 2 N-3

[0052] Where N is the length of the time series υ(k) to be analyzed.

[0053] 2) Use the Mallat algorithm to perform scale space-based [J min ,J max ] to perform discrete wavelet transform and obtain the scale space [J min ,J max ], the specific calculation method is as follows:

[0054] If υ(k) is the discrete sampling data of the signal, if The multiscale Mallat algorithm calculates the wavelet coefficients through discrete convolution and second-order downsampling process, the formula is as follows:

[0055]

[0056] Where N is the number of discrete sampling data; h, g are the filter impulse responses, i.e., the filter coefficients of each column; c j,k For υ(k) in 2 j The approximation at the resolution is called the low-frequency coefficient of the signal, which is the approximate coefficient at scale j and j+1 and needs to be further decomposed; d j,k For v(k) in 2 j The discrete details at the resolution are called the high-frequency coefficients of the signal. This part, as the detail value coefficients at scales j and j+1, maintains the information we need in the sequence.

[0057] For example, starting from layer j = 1, the wavelet coefficient scale sequence C obtained after J-layer decomposition is

[0058] c J+1 ,d J+1 ,d J ,…,d 1 .

[0059] 3) In scale space [J min ,J max ], assuming that N wavelet transforms are performed, the following N groups of wavelet coefficient scale sequences will be obtained:

[0060] C 1 (c 11 ,c 12 ,…,c 1n ),

[0061] C 2 (c 21 ,c 22 ,…,c 2n ),

[0062] …

[0063] C N (c N1 ,c N2 ,…,c Nn ),

[0064] The combined scale sequence is: c 11 ,c 12 ,…,c 1n ,c 21 ,c 22 ,…,c 2n ,…,c N1 ,c N2 ,…,c Nn .

[0065] 4) Perform static division on the scale sequence to obtain the symbol sequence.

[0066] It needs to determine the threshold first, and the threshold remains unchanged during the processing. Therefore, the selection of the threshold is the most critical. The value that can fully reflect the trend of the real number sequence should be selected. The degree of detail of the division can also be selected by changing the number of thresholds. The division is as follows:

[0067]

[0068] Where: s i Indicates the symbol, x t represents the amplitude of the time series at time t, x 1 ~x N represents the set threshold, and N represents the size of the symbol set. The threshold can be selected using the equal interval method or the equal probability method.

[0069] Step S23, dividing the symbolized sequence into multiple subsequences of equal length, performing a Kolmogorov-Smirnov test on each subsequence, reconstructing the ε machine of each sequence using a causal state segmentation and reconstruction algorithm, and obtaining a causal state set expressing the implicit pattern of the system.

[0070] Specifically, in one embodiment of the present invention, the symbolized sequence {s i} is divided into equal length subsequences S of length K K If the total length N of the sequence is an integer multiple of K, then N / K segment subsequences can be obtained; if it is not an integer multiple, it is padded with 0. A Kolmogorov-Smirnov (KS) test is performed on each subsequence, and its ε machine is reconstructed using the causal state segmentation and reconstruction (CSSR) algorithm to obtain the causal state set E.

[0071] Furthermore, in one embodiment of the present invention, the ε machine is defined as follows:

[0072] (1) For symbol sets like If it is an infinite random stationary process, then the process can be divided into historical and future Two parts, the L elements past the dividing point are recorded as The first L characters after the demarcation point are denoted by

[0073] (2) To predict First, we need to determine the conditional probability distribution of S about the future. That is to establish a function ε to achieve the mapping from s to P(S|s). By defining the causal state equation Make Map to

[0074]

[0075] If two histories and If the conditional probability density about the future is the same, then the two are considered to belong to the same equivalence class, that is, they are believed to come from the same implicit state. The elements of the same equivalence class in are divided into several division units. When these division units meet the conditions of optimal predictive ability and simplest expression form, they are called causal states.

[0076] (3) Define the causal state as S. For the causal state S i and the first symbolic element s of the future set, if there is p(s|S i )>0, then S exists in a causal state Sj =δ(S i ,s), where δ is the state transition function. Then the causal state S i Transfer to causal state S through element s j The transition probability is:

[0077]

[0078] Where I(s,i,j) is the corresponding indicator function:

[0079]

[0080] Causal State S i With S j The transition probability can also be defined as:

[0081]

[0082] In the formula, S is the current state, S' is its next state, is the combination of an infinite sequence and the symbol s.

[0083] Finally, the ordered pair {ε,T} consisting of the causal state equation ε and the transition probability matrix T is called the ε machine of this process.

[0084] Furthermore, in one embodiment of the present invention, the CSSR algorithm mainly includes the following steps:

[0085] (1) Initialization

[0086] For a finite set of symbols A with a given sequence length N, a is a single character, where all histories map to the same causal state The mapping is:

[0087]

[0088] (2) Homogenization

[0089] For any sequence Its future conditional probability distribution can be estimated by maximum likelihood as follows:

[0090]

[0091] Causal State The future conditional probability distribution of is obtained by weighted average of formula (6):

[0092]

[0093] In the formula, Similarly, we use formula (6) to estimate Regarding the conditional probability of the future, the KS test is then used to determine Is it a new causal state or does it belong to an existing causal state? Then set L = L + 1 and repeat the above steps until L = L max Among them, L max is the maximum history length, which can be defined as:

[0094] L max ≤log 2 N / log 2 k(8)

[0095] Where: N represents the length of the symbol sequence, k represents the size of the symbol set, and L max It should be sufficiently small without affecting performance.

[0096] (3) Determinism

[0097] Determinization is to remove transient states and leave only cyclic states. First, remove the transient state generated in step 2 and keep the cyclic state. Then for Symbol a∈A, by calculating That is, the calculation satisfies The state of the condition, find all The subsequent state If for symbol a, the subsequent state If the number n is greater than 1, then we need to The suffix decomposition in , obtains n-1 new states and there is only one subsequent state for the symbol a. Then for the next state Repeat the above steps until all states are completed, and finally remove the new transient state.

[0098] Step S3, using an abnormality threshold, calculate the abnormality of the state vector of the system ε machine obtained from different sequence data to determine whether the implicit behavior pattern corresponding to the state vector is normal;

[0099] Specifically, in one embodiment of the present invention, by defining a similarity function and anomaly threshold, the anomaly calculation is performed on the ε machine state vector obtained from different sequence data, and it is determined whether the implicit behavior pattern corresponding to the state vector is normal, thereby realizing dynamic behavior anomaly detection. Therefore, step S3 includes:

[0100] Step S31, extracting the feature vector of each causal state set;

[0101] Specifically, in one embodiment of the present invention, from the causal state set E j Extract the feature vector V j . Assume that the causal state set E is calculated from two symbol subsequences 1 ={σ′ 1 ,σ′ 2 ,σ′3 ,σ′ 4 ,σ′ 5},E 2 ={σ″ 1 ,σ″ 2 ,σ″ 3 ,σ″ 4 ,σ″ 5 ,σ″ 6}. Because each causal state set is an expression of the implicit pattern of the system, the elements of the causal state set constitute a partition or division of the system pattern. Figure 2 As shown, the causal state set E 1 ,E 2 They correspond to the left and right different mode divisions of the system respectively.

[0102] Furthermore, it is calculated whether the two causal state sets are similar, that is, whether the patterns corresponding to the two states of the calculation system are similar.

[0103] First, determine two causal state sets E 1 ,E 2 , the correspondence between each element. In the causal state segmentation and reconstruction algorithm, each causal state has a conditional probability distribution about the future, and in the same causal state set, the conditional probability distributions of any two causal states are significantly different. 1 ,E 2 , a KS test is performed on each causal state, and the two causal states with confidence levels higher than the set level are considered to have a corresponding relationship. The results are shown below.

[0104]

[0105] From the calculation results, it is found that σ′ 4 Not only with σ″ 4 Correspondingly, it is also related to σ″ 6 correspond.

[0106] Similarity definition. Let N i (s L ) represents a string s of length L in the causal state L The similarity function of two state modes is defined as follows:

[0107]

[0108] Eigenvector calculation. 1 ,E 2 The corresponding eigenvector is calculated as follows:

[0109] V 1 =[N(σ′ 1 ),N(σ′ 2 ),N(σ′ 3),N(σ′ 4 ),N(σ′ 5 ),0]

[0110] V 2 =[N(σ″ 1 ),N(σ″ 2 ),N(σ″ 3 ),N(σ″ 4 ),N(σ″ 5 ),N(σ″ 6 )]

[0111] Step S32: Calculate the abnormality between different feature vectors. If the calculated abnormality is greater than the abnormality threshold, it is determined that the implicit behavior pattern corresponding to the feature vector is abnormal.

[0112] Specifically, in one embodiment of the present invention, the distance between vectors is used to calculate the abnormality, such as the Euclidean distance and the angle between vectors. The abnormality is calculated using the angle between vectors as follows:

[0113]

[0114] By calculating the size of the angle, it is determined whether it exceeds a predetermined threshold. If so, the mode corresponding to the state is abnormal.

[0115] The present invention constructs a system business workflow and its corresponding state machine based on the system's business behavior operation process steps. By determining whether the evolution of the workflow state reaches the safety critical condition, the system's behavior can be effectively monitored and managed. The system ε machine is constructed through the business workflow state machine to express the evolution of the system's internal characteristics when the dynamic boundary changes. According to the defined abnormal measurement, the system's behavioral abnormality pattern is discovered, and it has the ability to detect implicit unknown behavioral abnormality patterns. Therefore, the behavioral anomaly detection method based on the ε machine provided by the present invention has the characteristics of high detection accuracy and dynamic detection capabilities, and can be applied to the security management and control application scenarios of complex systems.

[0116] The following example uses the query service of the ticket system to illustrate the process of the behavior anomaly detection method based on the ε machine. The query service is for non-business personnel and mainly includes the query function of train, fare, remaining tickets and other information. The process of this embodiment selects the following sub-functions of the railway ticket system and describes them in a simplified form. Through this process, the workflow, state machine, and ε machine of the entire business system are established, and the discovery and detection of hidden mode anomalies of the entire system can be completed.

[0117] (1) Functional description of query service

[0118] The business functions of several selected operation behaviors are described as follows:

[0119] 1. Train number query

[0120] Function description: Query the departure and arrival stations, basic train information or transfer train information.

[0121] Operation method: Enter the combination of conditions, including: "Departure station", "Arrival station", "Train number", "Train grade", and "Query date".

[0122] 2. Check fares by ticket type

[0123] Function description: Query the fare of a specific train or single ticket type.

[0124] Operation method: Enter the combination of conditions, including train number, fare calculation date and ticket type. Click "Search" to calculate the fare and display it in the interface.

[0125] 3. Check fares by seat type

[0126] Function description: Query the fare of a specific train type.

[0127] Operation method: Enter the combination of conditions, including departure number, fare calculation date, departure place, destination, ticket type, and seat class. Click "Search" to calculate the fare and display it in the interface.

[0128] 4. Check fares by train number

[0129] Function description: Comprehensively query the ticket prices of specific trains.

[0130] Operation method: Enter the combination of conditions, including train number, fare calculation date, seat type, and ticket type; click "Search" to search.

[0131] 5. Check remaining tickets

[0132] Function description: Provides train balance overview information query, train balance detailed information query and train remaining seat information query. The query scope can be the train number and ticket remaining situation of all railway stations.

[0133] How to operate: Select the ticket type, departure place, destination, and date; click "Search" to search; the search results are displayed in a table.

[0134] 6. Other queries

[0135] Function description: Query information such as mis-selling, visas, orders, express ticketing, insurance policies, new messages, expired messages, insurance policies, preferential qualifications, ticket quota sharing, electronic ticket transactions, personnel in key areas, etc.

[0136] Operation method: Enter the corresponding query conditions in the query interface and click "Search" or "Submit" to search.

[0137] (2) Query business workflow and state machine model

[0138] The functions of the comprehensive query service mainly include the following basic operation steps:

[0139] 1) The user enters the combined query conditions; the input combined conditions may include the following items or combinations: train number, arrival station, remaining tickets, ticket type, seat type, date, fare, invalid tickets, others (mis-selling, visa, order, express ticket issuance, insurance policy, new message, expired message, insurance policy, preferential qualifications, ticket quota sharing, electronic ticket transaction, personnel in key areas);

[0140] 2) Query submission. After entering the query conditions, the user clicks "Search" or "Submit" to send the query command and submit it to the system for query;

[0141] 3) Database access: Initiate database access according to the submitted query command and return the corresponding query result information.

[0142] 4) Identity authentication. The database performs identity authentication based on the user information contained in the query command to determine the scope of the allowed query content;

[0143] 5) Database response. Based on the user's identity authentication results and the scope of authorization, the database returns the query results within the scope of the permission, such as querying the remaining ticket table, train number information table, route table, fare information table, insurance policy information table, etc.

[0144] 6) Display of query results. Feedback the query results to the user and display them in the interface.

[0145] According to the actual user's query input content and conditions, as well as the above operation process, the workflow of the query business can be simply established as follows Figure 3 as shown.

[0146] The corresponding state machine is constructed according to the workflow model as follows Figure 4 shown.

[0147] (3) Construction of the ε mechanism for query services

[0148] Based on the above state machine model and the detection data of the query service, the ε machine of the query service is constructed. The process is as follows Figure 5 shown.

[0149] 1) Symbolic processing of detection data

[0150] The output response of the business workflow behavior of the detection system is obtained as a time series {x i}, i = 1, 2,, N, the time series is symbolized by wavelet space method, and the symbolized sequence {s i}.

[0151] 2) Calculating causal states

[0152] The symbolized sequence {s i} is divided into equal-length subsequences s of length K K , K is the maximum value of the state element in the workflow step. If the total length N of the sequence is an integer multiple of K, then N / K segment subsequences can be obtained; if it is not an integer multiple, it is padded with 0. For each subsequence KS, CSSR is used to reconstruct its ε machine to obtain the causal state set E.

[0153] (4) Query anomaly detection

[0154] It mainly includes three steps: feature vector extraction, anomaly degree calculation, and anomaly determination.

[0155] 1) Feature vector extraction

[0156] From the causal state set E j Extract the feature vector V j . Assume that the causal state set E is calculated from two symbol subsequences 1 ={σ′ 1 ,σ′ 2 ,σ′ 3 ,σ′ 4 ,σ′ 5},E 2 ={σ″ 1 ,σ″ 2 ,σ″ 3 ,σ″ 4 ,σ″ 5 ,σ″ 6}.

[0157] Eigenvector calculation. 1 ,E 2 The corresponding eigenvector is calculated as follows:

[0158] V 1 =[N(σ′ 1 ),N(σ′ 2 ),N(σ′ 3 ),N(σ′ 4 ),N(σ′ 5 ),0]

[0159] V 2 =[N(σ″ 1 ),N(σ″ 2 ),N(σ″ 3 ),N(σ″ 4 ),N(σ″ 5 ),N(σ″ 6 )]

[0160] 2) Abnormality calculation

[0161] The outlier degree is calculated using the Euclidean distance or the angle between vectors as follows:

[0162]

[0163] 3) Abnormality determination

[0164] By calculating the size of the angle, it is determined whether it exceeds a predetermined threshold. If so, the mode corresponding to the state is abnormal.

[0165] The present invention also provides a behavior anomaly detection system based on an ε machine, comprising: a workflow finite state machine construction module, used to construct a workflow finite state machine based on the workflow of system business behavior; a system ε machine construction module, used to construct a system ε machine based on the system business operation behavior data obtained by detection and the workflow finite state machine, using a causal state segmentation and reconstruction algorithm; a behavior anomaly detection module, used to calculate the anomaly degree of the state vector of the system ε machine obtained from different sequence data through an anomaly degree threshold, and determine whether the implicit behavior pattern corresponding to the state vector is normal.

[0166] Furthermore, in one embodiment of the present invention, the system ε machine building module includes:

[0167] A data acquisition unit is used to detect the time series data generated by the business operation behavior of the system; a symbolization processing unit is used to symbolize the time series data using the wavelet space method based on the workflow finite state machine to obtain a symbolized sequence, and divide the symbolized sequence into a plurality of equal-length subsequences; an ε machine reconstruction unit is used to perform a Kolmogorov-Smirnov test on each subsequence, reconstruct the ε machine of each sequence using a causal state segmentation reconstruction algorithm, and obtain a causal state set that expresses the implicit pattern of the system.

[0168] Furthermore, in one embodiment of the present invention, the behavior anomaly detection module includes: a feature extraction unit, used to extract the feature vector of each causal state set; a judgment unit, used to calculate the degree of abnormality between different feature vectors, and when the calculated abnormality is greater than the abnormality threshold, it is determined that the implicit behavior pattern corresponding to the feature vector is abnormal.

[0169] The embodiment of the present invention further provides a behavior anomaly detection device based on an ε machine, which may include:

[0170] Memory for storing computer programs;

[0171] The processor can implement the following steps when executing the computer program stored in the above memory:

[0172] A workflow finite state machine is constructed based on the workflow of the system business behavior; a system ε machine is constructed using a causal state segmentation and reconstruction algorithm based on the system business operation behavior data obtained by detection and the workflow finite state machine; and the state vector of the system ε machine obtained from different sequence data is calculated through an anomaly threshold to determine whether the implicit behavior pattern corresponding to the state vector is normal.

[0173] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0174] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0175] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0176] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A behavior anomaly detection method based on ε machine, characterized in that: The following steps are involved: Construct workflow finite state machine based on the workflow of system business behavior; Based on the detected system business operation behavior data and the workflow finite state machine, a system ε machine is constructed using a causal state segmentation and reconstruction algorithm; Through the abnormality threshold, the abnormality of the state vector of the system ε machine obtained from different sequence data is calculated to determine whether the implicit behavior pattern corresponding to the state vector is normal.

2. The behavior anomaly detection method based on the ε machine according to claim 1, characterized in that: Based on the detected business workflow state data and the workflow finite state machine, the steps of constructing the system ε machine by using the causal state segmentation and reconstruction algorithm include: Detect the time series data generated by the business operation behavior of the system; Based on the workflow finite state machine, the time series data is symbolized by using a wavelet space method to obtain a symbolized sequence; The symbolized sequence is equally divided into a plurality of subsequences of equal length, a Kolmogorov-Smirnov test is performed on each subsequence, an ε machine of each sequence is reconstructed using a causal state segmentation and reconstruction algorithm, and a causal state set expressing the implicit pattern of the system is obtained.

3. The behavior anomaly detection method based on the ε machine according to claim 2, characterized in that: The abnormality degree of the state vector of the system ε machine obtained from different sequence data is calculated by using the abnormality degree threshold, and the steps of determining whether the implicit behavior pattern corresponding to the state vector is normal include: Extract the feature vector of each causal state set; The abnormality between different feature vectors is calculated, and when the calculated abnormality is greater than the abnormality threshold, it is determined that the implicit behavior pattern corresponding to the feature vector is abnormal.

4. The behavior anomaly detection method based on the ε machine as claimed in claim 3, characterized in that: The degree of abnormality between different eigenvectors is obtained by calculating the Euclidean distance and angle between eigenvectors.

5. A behavior anomaly detection system based on ε machine, characterized in that: The following steps are involved: Workflow finite state machine building module, used to build workflow finite state machine based on the workflow of system business behavior; A system ε machine construction module, used to construct the system ε machine based on the detected system business operation behavior data and the workflow finite state machine using a causal state segmentation and reconstruction algorithm; The behavior anomaly detection module is used to calculate the anomaly degree of the state vector of the system ε machine obtained from different sequence data through the anomaly degree threshold, and determine whether the implicit behavior pattern corresponding to the state vector is normal.

6. The behavior anomaly detection system based on the ε machine as claimed in claim 5, characterized in that: The system ε machine building modules include: A data acquisition unit is used to detect time series data generated by system business operation behaviors; A symbolization processing unit, configured to perform time series symbolization on the time series data by using a wavelet space method based on the workflow finite state machine to obtain a symbolized sequence, and to divide the symbolized sequence into a plurality of equal-length subsequences; The ε machine reconstruction unit is used to perform the Kolmogorov-Smirnov test on each subsequence, reconstruct the ε machine of each sequence using the causal state segmentation reconstruction algorithm, and obtain the causal state set that expresses the implicit pattern of the system.

7. The behavior anomaly detection system based on the ε machine according to claim 6, characterized in that: The behavior anomaly detection module includes: A feature extraction unit, used to extract a feature vector of each causal state set; The judgment unit is used to calculate the abnormality between different feature vectors. When the calculated abnormality is greater than the abnormality threshold, it is determined that the implicit behavior pattern corresponding to the feature vector is abnormal.

8. The behavior anomaly detection system based on the ε machine as claimed in claim 7, characterized in that: The degree of abnormality between different eigenvectors is obtained by calculating the Euclidean distance and angle between eigenvectors.

9. A behavior anomaly detection device based on an ε machine, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the behavior anomaly detection method based on an ε machine as claimed in any one of claims 1 to 4 are implemented.

Images