Network behavior analysis methods, devices, electronic equipment and storage media

Abstract

This application discloses a network behavior analysis method, apparatus, electronic device, and storage medium. Based on acquired raw data, the method precisely classifies and judges the metadata and operation commands in the raw data to generate a first row of graph data. The first row of graph data is then stored in a graph-structured manner to generate a second row of graph data. The second row of graph data includes nodes and edges; nodes indicate entity objects in the metadata, and edges indicate operation commands between entity objects in the metadata. The second row of graph data is then identified to obtain abnormal behavior analysis results. Thus, by combining the entity objects and operation commands in the raw data to construct a graph data model, the relationships between entity objects can be better represented. Furthermore, by using graph computing technology and the graph data model to identify abnormal behavior analysis results, the accuracy and efficiency of network abnormal behavior detection can be improved.

Description

Technical Field

[0001] This application belongs to the field of network security, and in particular relates to a network behavior analysis method, device, electronic device and storage medium. Background Technology

[0002] In today's highly networked environment, network anomaly behavior analysis has become an important research direction in the field of information security. Traditional network security analysis methods mainly rely on the collection and processing of log data, using rule matching and statistical methods to detect anomalies. These methods typically depend on pre-set rules and patterns, and are suitable for detecting known attack patterns and anomalies. However, they often fall short when facing constantly evolving new attacks and complex anomalies. Therefore, a more advanced network anomaly behavior analysis method is needed to overcome the limitations of traditional methods, improve the accuracy and efficiency of anomaly detection, more comprehensively identify potential threats, and respond promptly to various network security challenges. Summary of the Invention

[0003] This application provides a network behavior analysis method, apparatus, electronic device, and storage medium, which can improve the accuracy and efficiency of network abnormal behavior detection by combining graph data models and graph computing techniques.

[0004] In a first aspect, embodiments of this application provide a network behavior analysis method, which may include:

[0005] Obtain raw data, which includes metadata and operation commands in the network environment;

[0006] The raw data is precisely classified and its behavior is determined to generate a first behavior graph data, which is used to indicate the relationship between entity objects and operation commands in the metadata.

[0007] The first row graph data is stored in a graph structured manner to generate the second row graph data. The data form of the second row graph data includes nodes and edges. The nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata.

[0008] The second behavior graph data is identified to obtain abnormal behavior analysis results, which are used to indicate whether there are abnormal behaviors in the original data.

[0009] In one embodiment, the aforementioned step of accurately classifying and judging the behavior of the original data to generate first behavior graph data includes:

[0010] The metadata and operation commands in the original data are decomposed to obtain multiple entity objects and target operation commands between the multiple entity objects;

[0011] The first behavior graph data is generated based on the plurality of entity objects and the target operation commands between the plurality of entity objects;

[0012] The step of storing the first row of graph data in a graph-structured manner to generate the second row of graph data includes:

[0013] The plurality of entity objects and the target operation commands between the plurality of entity objects are decomposed to obtain a node attribute table and an edge attribute table. The node attribute table includes each entity object and the attributes corresponding to each entity object. The edge attribute table includes each entity object connected by each edge and the attributes of each edge. The attributes of the edges are used to indicate the attributes of the target operation command.

[0014] The node attribute table and edge attribute table are stored to generate the second row of graph data.

[0015] In one embodiment, the aforementioned identification of the second behavior graph data to obtain abnormal behavior analysis results includes:

[0016] The second row of graph data is identified and analyzed using graph traversal methods and artificial subgraphs to obtain known abnormal behavior information. The artificial subgraph is graph data constructed based on known abnormal behaviors.

[0017] By using graph embedding methods and the artificial subgraph, the second behavior graph data is identified and analyzed to obtain unknown abnormal behavior information;

[0018] The abnormal behavior analysis result is generated based on the known abnormal behavior information and the location abnormal behavior information.

[0019] In one embodiment, the aforementioned method of identifying and analyzing the second behavioral graph data using graph traversal and artificial subgraphs to obtain known abnormal behavior information includes:

[0020] By using the graph traversal method, the node and edge data in the artificial subgraph and the second row graph data are compared and analyzed to obtain the connection depth between each node.

[0021] The connection depth and depth threshold are matched to determine the known abnormal behavior information.

[0022] In one embodiment, the aforementioned method of identifying and analyzing the second behavioral graph data using graph embedding and the artificial subgraph to obtain unknown abnormal behavior information includes:

[0023] The subgraph similarity between the artificial subgraph and the second row graph data is calculated using the graph embedding method.

[0024] The subgraph similarity and similarity threshold are matched to determine the unknown abnormal behavior information.

[0025] In one embodiment, before the aforementioned method of identifying and analyzing the second behavioral graph data using graph traversal and artificial subgraphs to obtain known abnormal behavior information, the method further includes:

[0026] The behavioral rules in graph data with known normal behavior and graph data with known abnormal behavior are analyzed to construct the artificial subgraph.

[0027] In one embodiment, after identifying the second behavior graph data to obtain an abnormal behavior analysis result, and the abnormal behavior analysis result being used to indicate whether abnormal behavior exists in the original data, the method further includes:

[0028] The abnormal behavior analysis results are reviewed to obtain abnormal event review results, which are used to indicate whether there is a real threat in the original data.

[0029] If the results of the abnormal event review indicate that there is a real threat in the raw data, an alert message and abnormal behavior analysis results will be sent to security personnel.

[0030] Secondly, embodiments of this application provide a network behavior analysis device, which may include:

[0031] The raw data acquisition module is used to acquire raw data, which includes metadata and operation commands in the network environment;

[0032] The first raw data analysis module is used to accurately classify and determine the behavior of the raw data, and generate a first behavior graph data. The first behavior graph data is used to indicate the relationship between entity objects and operation commands in the metadata.

[0033] The second raw data analysis module is used to store the first row graph data in a graph structured manner to generate the second row graph data. The data form of the second row graph data includes nodes and edges. The nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata.

[0034] An anomaly analysis module is used to identify the second behavior graph data and obtain anomaly behavior analysis results, which are used to indicate whether there are abnormal behaviors in the original data.

[0035] Thirdly, embodiments of this application provide an electronic device, the device comprising:

[0036] processor;

[0037] Memory used to store processor-executable instructions;

[0038] The processor is configured to execute instructions to implement the network behavior analysis method as shown in any embodiment of the first aspect.

[0039] Fourthly, embodiments of this application provide a computer storage medium on which a computer program is stored, which, when executed by a processor, implements the network behavior analysis method as shown in any embodiment of the first aspect.

[0040] Fifthly, embodiments of this application also provide a computer program product comprising a computer program stored in a readable storage medium, wherein at least one processor of the device reads from the storage medium and executes the computer program, causing the device to perform the network behavior analysis method shown in any embodiment of the first aspect.

[0041] This application provides a network behavior analysis method, apparatus, electronic device, and storage medium. Compared with the prior art, this application has the following advantages:

[0042] This application discloses a network behavior analysis method, apparatus, electronic device, and storage medium. Based on acquired raw data, the method precisely classifies and judges the metadata and operation commands within the raw data to generate first-row graph data. The first-row graph data is then stored in a graph-structured manner to generate second-row graph data. The second-row graph data includes nodes and edges; nodes indicate entity objects in the metadata, and edges indicate operation commands between these entity objects. The second-row graph data is then identified to obtain abnormal behavior analysis results.

[0043] Therefore, by combining the entity objects and operation commands in the original data to construct a graph data model, the relationships between entity objects can be better represented. Furthermore, by using graph computing techniques and the graph data model to identify abnormal behavior analysis results, the accuracy and efficiency of network abnormal behavior detection can be improved. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating a network behavior analysis method provided in an embodiment of this application;

[0046] Figure 2 This is a schematic diagram of a network behavior graph data model provided in an embodiment of this application;

[0047] Figure 3 This is a functional architecture diagram of a network behavior analysis device provided in an embodiment of this application;

[0048] Figure 4 This is a schematic diagram of the decomposition of a raw data analysis module provided in an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the known threat analysis module provided in an embodiment of this application;

[0050] Figure 6 This is a schematic diagram of an unknown behavior analysis module provided in an embodiment of this application;

[0051] Figure 7 This is a schematic diagram of a module relationship provided in an embodiment of this application;

[0052] Figure 8 This is a schematic diagram of the structure of a network behavior analysis device provided in an embodiment of this application;

[0053] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0054] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0055] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0056] As discussed in the background section, existing technical solutions still have some shortcomings when applying graph data models for network anomaly behavior analysis. Most current solutions focus primarily on graphical modeling of physical entities, such as servers and network devices, while neglecting the modeling of logical node elements such as operators, accounts, and data sensitivity levels. This results in an inability to fully leverage the advantages of graph data models when handling anomaly analysis involving complex behaviors. Furthermore, most existing technologies rely on static rules or simple graph traversal algorithms, lacking dynamic learning and deep analysis capabilities, leading to low efficiency in identifying unknown threats and complex attack patterns.

[0057] To address the problems existing in the prior art, embodiments of this application provide a network behavior analysis method, apparatus, electronic device, and storage medium. Based on the acquired raw data, the metadata and operation commands in the raw data are accurately classified and their behaviors are judged to generate first-row graph data. The first-row graph data is then stored in a graph-structured manner to generate second-row graph data. The second-row graph data includes nodes and edges; nodes indicate entity objects in the metadata, and edges indicate operation commands between entity objects in the metadata. The second-row graph data is then identified to obtain abnormal behavior analysis results.

[0058] Therefore, by combining the entity objects and operation commands in the original data to construct a graph data model, the relationships between entity objects can be better represented. Furthermore, by using graph computing techniques and the graph data model to identify abnormal behavior analysis results, the accuracy and efficiency of network abnormal behavior detection can be improved.

[0059] This application provides a network behavior analysis method, apparatus, electronic device, and storage medium. The network behavior analysis method provided in this application will be described first. Figure 1 As shown in the embodiments of this application, the network behavior analysis method includes the following steps:

[0060] S101: Obtain raw data, which includes metadata and operation commands in the network environment;

[0061] S102: The original data is precisely classified and the behavior is judged to generate first behavior graph data. The first behavior graph data is used to indicate the relationship between entity objects and operation commands in the metadata.

[0062] S103: Store the first row graph data in a graph structured manner to generate second row graph data. The data form of the second row graph data includes nodes and edges. The nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata.

[0063] S104: Identify the second behavior graph data to obtain abnormal behavior analysis results, which are used to indicate whether there are abnormal behaviors in the original data.

[0064] This application provides a network behavior analysis method, apparatus, electronic device, and storage medium. Based on acquired raw data, the method precisely classifies and judges the metadata and operation commands in the raw data to generate first-row graph data. The first-row graph data is then stored in a graph-structured manner to generate second-row graph data. The second-row graph data includes nodes and edges; nodes indicate entity objects in the metadata, and edges indicate operation commands between entity objects in the metadata. The second-row graph data is then identified to obtain abnormal behavior analysis results.

[0065] Therefore, by combining the entity objects and operation commands in the original data to construct a graph data model, the relationships between entity objects can be better represented. Furthermore, by using graph computing techniques and the graph data model to identify abnormal behavior analysis results, the accuracy and efficiency of network abnormal behavior detection can be improved.

[0066] In S101, raw data can include metadata and operation commands within the network environment. Metadata refers to basic information about various entities in the network environment, including but not limited to personnel information, host information, account information, service configuration, and sensitivity information. Metadata can be obtained through log analysis, configuration file parsing, and API calls. Operation commands refer to various operations performed by users or the system in the network environment, including but not limited to system commands, application commands, and network operations. Operation commands can be obtained through real-time monitoring, log file analysis, and command-line logging.

[0067] In step S102, the raw data (including metadata and operation commands) is first precisely classified and its behavior is determined to generate first behavioral graph data. This first behavioral graph data indicates the relationships between entity objects in the metadata (such as personnel, hosts, service configurations, accounts, etc.) and operation commands. In this way, the first behavioral graph data accurately describes operational behaviors and their related entities in the network environment, providing fundamental support for subsequent threat analysis and anomaly detection.

[0068] In a specific embodiment, entity objects are first classified according to metadata attributes. For example, different records in the operation log are identified as different types of entity objects, such as user accounts, hosts, services, and files. The system assigns a unique identifier to each type of entity for convenient subsequent operations. Next, the collected operation commands are analyzed and classified by type. For example, the system classifies commands into file operation commands, network operation commands, user management commands, etc. For complex commands, the system further decomposes them, extracting the core operation content and associated objects. Finally, behavior judgment is performed. Based on the classification of entities and operation commands, the system judges each operation behavior to determine its association with related entity objects. For example, if a command involves access to a sensitive file, the system records the interaction relationship between the command and the file entity. Finally, the judged operation behaviors and related entity objects are represented in the form of a graph, generating the first row of graph data.

[0069] In one embodiment, the step of accurately classifying and judging the behavior of the raw data to generate first behavior graph data includes:

[0070] The metadata and operation commands in the original data are decomposed to obtain multiple entity objects and target operation commands between the multiple entity objects;

[0071] The first behavior graph data is generated based on the plurality of entity objects and the target operation commands between the plurality of entity objects;

[0072] The step of storing the first row of graph data in a graph-structured manner to generate the second row of graph data includes:

[0073] The plurality of entity objects and the target operation commands between the plurality of entity objects are decomposed to obtain a node attribute table and an edge attribute table. The node attribute table includes each entity object and the attributes corresponding to each entity object. The edge attribute table includes each entity object connected by each edge and the attributes of each edge. The attributes of the edges are used to indicate the attributes of the target operation command.

[0074] The node attribute table and edge attribute table are stored to generate the second row of graph data.

[0075] The following specific embodiment illustrates the above embodiment. Assume that in an enterprise network, the original data includes various metadata and operation commands, such as server IP, user account, file path, operation type (e.g., read, write, delete), timestamp, etc. The step of decomposing the metadata and operation commands in the original data to obtain multiple entity objects and target operation commands between these entity objects, and generating the first row graph data based on these entity objects and target operation commands, can specifically include: identifying each entity object (e.g., server, user, file, etc.) and the operation commands between entity objects (e.g., a user connecting to a server via SSH) by analyzing this metadata. That is, the first row graph data can include each entity object (e.g., server, user, file, etc.) and the operation commands between entity objects (e.g., a user connecting to a server via SSH). For example, user A logs into server B via SSH and reads file C on server B. These actions can be decomposed into: entity objects (user A, server B, file C) and target operation commands (SSH login, file read).

[0076] Correspondingly, the step of decomposing the plurality of entity objects and the target operation commands between them to obtain a node attribute table and an edge attribute table, and storing the node attribute table and edge attribute table to generate the second row graph data can be specifically manifested as follows: based on the entity objects (user A, server B, file C) and target operation commands (SSH login, file read) obtained from the above steps, a node attribute table and an edge attribute table can be generated. The node attribute table includes each entity object and its corresponding attributes, and the edge attribute table includes the entity objects connected by each edge and the attributes of the edges (edges represent operation attributes). For example, node A (user A) is connected to node B (server B) through an edge (SSH login), and node B is connected to node C (file C) through another edge (file read). Finally, this row graph data is stored according to the storage structure of the graph database to generate the second row graph data.

[0077] In S103, the first row of graph data is stored in a graph-structured manner. Specifically, each entity object is represented as a node in the graph, and operation commands are represented as edges between nodes, with the direction of the edges indicating the direction of operation execution. For example, a file access operation might generate a graph structure of "user account → access → file," where "user account" and "file" are nodes, and "access" is an edge. Furthermore, after generating the first row of graph data, the system can optimize the graph data to improve storage and query efficiency. For example, the graph structure can be simplified by removing redundant nodes and merging similar edges. The generated second row of graph data is stored in a graph database for subsequent analysis. The graph database can efficiently store and query complex graph structure data and supports large-scale concurrent operations.

[0078] Here's a real-world example: First, collect metadata: In a company's network system, raw data includes operation logs (such as Linux history logs), which record user commands and related host and time information. Second, classify operation commands: The system identifies a complex command, such as `scp / etc / passwduser@remote: / backup / `, which is a file transfer command. The system decomposes the command into several parts: "user account," "source file," "destination host," and "transfer command." Third, generate behavioral graph data: Based on the decomposition, the system generates corresponding behavioral graph data: nodes include "user account," "file entity," and "remote host," and edges represent "transfer" operations, forming graph structures like "user account → transfer → file entity" and "file entity → transfer → remote host." Fourth, storage and subsequent analysis: The generated graph data is stored in a graph database, allowing the system to query and perform further behavioral analysis when needed.

[0079] In S104, the second behavior graph data can be identified through both known anomaly analysis and unknown anomaly behavior analysis. Known anomaly behavior analysis primarily handles anomalies defined by the system and those discovered through past experience. These known behaviors include known attack patterns, violations, and actions that violate security policies. Unknown anomaly behavior analysis aims to detect anomalies that the system cannot directly identify through known rules, especially zero-day attacks, new threats, or atypical attack patterns. Combining known and unknown anomaly behavior analysis allows for more comprehensive anomaly detection and analysis.

[0080] In one embodiment, the step of identifying the second behavior graph data to obtain abnormal behavior analysis results includes:

[0081] The second row of graph data is identified and analyzed using graph traversal methods and artificial subgraphs to obtain known abnormal behavior information. The artificial subgraph is graph data constructed based on known abnormal behaviors.

[0082] By using graph embedding methods and the artificial subgraph, the second behavior graph data is identified and analyzed to obtain unknown abnormal behavior information;

[0083] The abnormal behavior analysis result is generated based on the known abnormal behavior information and the location abnormal behavior information.

[0084] In the above embodiments, "known" mainly refers to the known normal access behavior graph and abnormal access behavior graph, and the commands that the analysis engine can understand and decompose, including basic operation commands and combined operation commands. This module's analysis is based on known basic behavior rules, known complex behavior rules, and known abnormal behavior rules. Known basic behavior rules include basic operable commands (such as file transfer, account creation, etc.). Complex behavior rules can be set manually, such as file transfer link depth, and subgraph association analysis based on the sensitivity importance of data assets and behaviors (e.g., creating an account, what was done with the new account, clearing operations, etc., to outline a subgraph model).

[0085] It should be noted that specific subgraphs can be artificially constructed to describe complex attack behaviors. For example, data might be exported from a database server, encrypted and compressed, transmitted as compressed data or source files, uploaded or downloaded to a machine outside the core area, and then finally downloaded on a specific machine. By modeling this series of actions, the resulting anomalous subgraph model can be stored and searched within the larger graph to find and match similar behaviors. The artificial subgraphs described above include, but are not limited to, specific subgraphs used to describe complex attack behaviors; they are used to refer to artificially constructed subgraphs used for identification and analysis of the second-order graph data. Furthermore, subgraphs can also be constructed using graph traversal algorithms. Starting from a vertex in the graph, all other vertices in the graph are visited, ensuring that each vertex is visited only once. This process is called graph traversal.

[0086] The specific workflow for analyzing known anomalous behavior can include the following: First, the system has a built-in set of known anomalous behavior rules (i.e., artificial subgraphs). These rules are predefined by security experts or learned from historical data. For example, the system may include rules to detect abnormal file transfers, unauthorized account creation or deletion, and abnormal login activity. During the analysis, the system performs rule matching on the real-time generated behavior graph data. The system checks each operation in the behavior graph data to see if it conforms to the known anomalous behavior rules (i.e., artificial subgraphs). For example, a user frequently attempting to log in to multiple different hosts might be flagged as anomalous. Once an anomalous behavior matching the known rules is detected, the system immediately marks the behavior and assigns an anomalous score; a higher score indicates a more severe anomalous behavior. These flagged anomalous behaviors are recorded and reported to security personnel or relevant modules for further processing.

[0087] The specific process of analyzing unknown abnormal behavior can include: First, the system constructs a historical profile of normal behavior by statistically analyzing long-term historical behavioral data. For example, a user typically only accesses certain resources at specific times on weekdays; any behavior outside this range may be considered abnormal. Then, using statistical analysis methods, such as Z-score, the system can identify abnormal changes in behavioral frequency. For example, if a user's operation frequency suddenly increases or decreases, this could be a potential anomaly. For more complex behaviors, the system uses graph embedding technology to map the behavioral graph into a high-dimensional vector space and calculates its similarity with known attack patterns. By calculating the similarity between the behavioral graph and known threat subgraphs, the system can detect potential new threats. The system can also utilize machine learning techniques to continuously adjust and update its detection model based on newly discovered threats, thereby improving its ability to identify unknown threats.

[0088] In one example, before the step of identifying and analyzing the second behavioral graph data using graph traversal methods and artificial subgraphs to obtain known abnormal behavior information, the method further includes:

[0089] The behavioral rules in graph data with known normal behavior and graph data with known abnormal behavior are analyzed to construct the artificial subgraph.

[0090] In the above embodiments, firstly, normal and abnormal behavior rules are analyzed. Rules extracted from the normal and abnormal behavior graph data are comprehensively analyzed to determine which patterns represent normal behavior and which represent abnormal behavior. For example, a normal pattern might include user A logging into server B only from an internal company IP address, while an abnormal pattern might include user A attempting to log into server B from IP addresses in multiple countries. Next, artificial subgraphs are constructed based on the analyzed rules. These subgraphs include nodes and edges representing specific behavior patterns. For example, one subgraph might represent a "normal login pattern," and another might represent an "abnormal login pattern." Subgraph examples: Normal behavior subgraph: includes nodes (user A, server B), edges (normal login). Abnormal behavior subgraph: includes nodes (user A, server B, IP address 1, IP address 2), edges (abnormal login). Finally, the artificial subgraphs are stored and applied. These artificial subgraphs are stored in a graph database and used for matching during abnormal behavior analysis. When new operational behavior data is analyzed, the system compares this data with the artificial subgraphs to detect the presence of abnormal behavior.

[0091] In one embodiment, the step of identifying and analyzing the second behavioral graph data through graph traversal methods and artificial subgraphs to obtain known abnormal behavior information includes:

[0092] By using the graph traversal method, the node and edge data in the artificial subgraph and the second row graph data are compared and analyzed to obtain the connection depth between each node.

[0093] The connection depth and depth threshold are matched to determine the known abnormal behavior information.

[0094] In the above embodiment, for example, firstly, for a known abnormal time, according to the entity attribute table, obtain the entity and attribute information of the event, such as the IP, account, data, etc. involved in the event; the collected entity attribute table can be regarded as a small graph, containing some access, data transmission, link, etc. in this event; start the graph traversal risk association algorithm. The specific logic is as follows: First, determine the entity attribute table obtained in the previous step. For all entities in the table, traverse the existing graph database for entities with the same attributes (which can be considered as the same entity). Taking these entities as the center, analyze all their edge connections. Entities with a connection depth of n or less can be considered to have risks and need to be alerted or investigated. n can be specified by experts a priori or obtained adaptively by the algorithm; the adaptive depth parameter n. For the small graph obtained in step 2, we can calculate all edges and their depth Ki for each entity i. The average depth of all m entities in the current event can be used as the depth parameter n for this graph traversal. That is:

[0095]

[0096] It should be noted that the depth threshold can be set according to actual needs, and is not limited here.

[0097] In one embodiment, the step of identifying and analyzing the second behavioral graph data using a graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information includes:

[0098] The subgraph similarity between the artificial subgraph and the second row graph data is calculated using the graph embedding method.

[0099] The subgraph similarity and similarity threshold are matched to determine the unknown abnormal behavior information.

[0100] In the above embodiments, for example, a historical profile is formed through statistical analysis of existing access behavior, and suspected abnormal behavior is detected through sudden changes in frequency. Specifically, this is achieved by calculating the Z-Score.

[0101]

[0102] For example, if a host or service has an average of 100 accesses per day with a standard deviation of 15, and a Z-score threshold of (-2, 2), then when X > 2*15 + 100 = 130 or x < -2*15 + 100 = 70, it is considered an anomaly requiring further reporting and analysis. Certain advanced attack behaviors can be identified and solidified, i.e., a specific known threat subgraph can be solidified, and then unknown or abnormal behaviors can be matched one by one, selecting those with a similarity greater than the similarity threshold. Because the nodes and attributes of the graph mentioned in this solution have complex properties, traditional graph similarity methods are difficult to measure. Therefore, graph embedding is specifically used to calculate subgraph similarity. It should be noted that the similarity threshold can be set according to actual needs and is not limited here.

[0103] In one embodiment, after identifying the second behavior graph data to obtain an abnormal behavior analysis result, which is used to indicate whether there is abnormal behavior in the original data, the method further includes:

[0104] The abnormal behavior analysis results are reviewed to obtain abnormal event review results, which are used to indicate whether there is a real threat in the original data.

[0105] If the results of the abnormal event review indicate that there is a real threat in the raw data, an alert message and abnormal behavior analysis results will be sent to security personnel.

[0106] In the above embodiments, behaviors identified as threat events by the unknown behavior analysis module and the known threat analysis module are subject to expert review and confirmation to determine whether they are real threats. For events identified as abnormal by experts, an email alert is sent to security personnel, providing detailed information about the abnormal behavior. Events identified as false alarms are marked and adjusted in the corresponding threat module. Security personnel take appropriate behavior blocking strategies based on the severity and characteristics of the event to prevent further spread of the threat.

[0107] To better illustrate the method provided in the embodiments of this application, the following description is based on a specific embodiment. (Reference) Figure 2 The diagram shown illustrates a network behavior graph data model, and the scheme includes:

[0108] This model is based on graph theory and incorporates various subjects, objects, behaviors, and sensitivity levels within the network environment. Relevant subjects and objects mainly include personnel, their associated accounts, hosts, databases, application middleware, big data components, host system logs, host account files, data files, application configuration files, host configuration files, application configuration files, and the sensitivity levels of each object. Relevant behaviors mainly include accessing sensitive data files, transferring or downloading data files, generating data files, creating or deleting accounts, clearing command history, and modifying critical configuration data. A schematic diagram of the network behavior graph data model is shown below. Figure 2 The entire atlas is composed of a massive number of unit graphs connected through account behavior and categories, forming a vast, complex, and three-dimensional graph. Among them, Figure 3 This is a functional architecture diagram of a network behavior analysis device provided in an embodiment of this application.

[0109] The following are general descriptions and breakdowns of each module:

[0110] The raw data analysis module (number 101), such as Figure 4 As shown:

[0111] This module primarily uses metadata (relatively static data, such as personnel, hosts, host service configurations, accounts, etc., which can be further integrated with the result data generated by the data asset discovery system) and related operation commands to perform precise classification and behavior judgment. Each operation command is decomposed, and the decomposed results are suitable for graph storage.

[0112] 101-1: Decompose various operation commands, including background host operation commands and foreground service operation commands. Taking background operation commands as an example, if it is a Linux background, save the historical logs recorded by the Linux `history` command. By continuously accumulating the ability of the command decomposition module, the goal is to decompose basic commands and complex commands (such as complex commands with pipes, `xargs`, etc.). The objective is to extract the account, operation command, operation object, whether it involves sending to external hosts, and whether it involves any suspected high-risk operations. For example, the following example can query the operator who executed the `mysql` command on the background host, the database operation, and whether information about high-risk operations was saved.

[0113] history>history.txt

[0114] grep'mysql'history.txt|awk'{print$1,$3,$5}'

[0115] 101-2: Every operation command is associated with an account, occurs on a specific host, and operates on a specific object. This information is then linked with asset sensitivity metadata, asset sensitivity data, and personnel metadata to obtain detailed behavioral graph data describing the operation. This behavioral data can pinpoint the person, machine, and whether sensitive assets were accessed. For example, if it's a backend operation, it involves the Linux / Windows user account on the backend host; if it's a foreground operation, it involves the login account for the specific business. The specific operator can then be located through a list of primary personnel accounts or other similar ledgers.

[0116] In this step, record the account name (front-end service login account / back-end operation host account, associated personnel account), host IP, and specific operation for each operation, such as the type of object operated on (file, database, log, front-end business, etc.) and the operation type (create, modify, delete, etc.).

[0117] 101-3: Combining the syntax of the specific graph database storage engine (see 201-2 for details), the analyzed behavioral data is generated into a data format that can be imported in batches. Most graph databases accept entity data in the form of nodes and edges. Node data includes the node's own index and node attributes, while edge data includes the connected nodes and edge attributes. See the graph data storage module (number 201) for details.

[0118] 101-4: Utilize the Spark interface of graph databases to distribute, batch, high-speed, and continuously load data into graph data storage.

[0119] Graph data storage module (No. 201):

[0120] This module primarily stores the analyzed behavioral data in a graph format, including points, edges (with image edges), point labels, and edge labels.

[0121] 201-1: Decompose the entities generated in step 101-2, as shown in Table 1 and Table 2:

[0122] Table 1: Entity Attribute Table

[0123]

[0124] Table 2: Edge Attribute Table

[0125]

[0126]

[0127] The edge attributes include mutual visits, operations, generation, creation, deletion, etc.

[0128] 201-2: The decomposed entities and edges are stored using a big data platform and graph database. Taking JanusGraph graph database combined with Spark big data platform as an example, PySpark reads the entity and edge nodes as graphData and then pushes them to the JanusGraph database. The key PySpark code is as follows:

[0129] # Create a JanusGraph connection

[0130] graph=Graph().traversal().withRemote(DriverRemoteConnection('ws: / / janu sgraph-server:8182 / gremlin','g'))

[0131] #Assuming that Spark processing yields a graph data structure `graphData`, containing the processed graph data structure including vertices and edges, store the graph data in `JanusGraph`.

[0132] for vertex in graphData.vertices:

[0133] g.addV(vertex.label).property('property1',vertex.property1).property('property2',vertex.property2).next()

[0134] For edge in graphData.edges:

[0135] gV().has('label',edge.outV).addE(edge.label).to(gV().has('label',edge.inV)).property('property1',edge.property1).next()

[0136] The known threat analysis module (number 301), such as Figure 5 As shown:

[0137] This module focuses on known definitions, primarily referring to known normal and abnormal access behavior graphs, and commands that the analysis engine can understand and decompose, including basic and combined operation commands. This module's analysis is based on known basic behavior rules, known complex behavior rules, and known abnormal behavior rules. Known basic behavior rules include basic operable commands (such as file transfer and account creation). Complex behavior rules can be set manually, such as file transfer link depth, and subgraph correlation analysis based on the sensitivity importance of data assets and behaviors (e.g., creating an account, what was done with the new account, and deleting operations to outline a subgraph model).

[0138] 301-1: By analyzing the sub-graphs between personnel, personnel affiliation, hosts, and accounts, it provides an intuitive analysis of whether accounts are legitimate, whether there are isolated accounts, illegally created accounts, or accounts with excessive actual operational privileges, and marks the compromised hosts.

[0139] 301-2: Common Abnormal Behavior refers to clearly abnormal behaviors. This includes file transfer link tracing (excessively long transfer links, suspected of redirection), account redirection tracing, and abnormal login tracing (login to multiple hosts or important hosts). Abnormal data is identified through graph analysis.

[0140] 301-3: Hotspot Behavior is used to identify hosts, accounts, and accessed files that are used particularly frequently, so that these can be monitored more closely.

[0141] 301-4-1: By manually constructing specific subgraphs, we can describe complex attack behaviors, such as exporting data from a database server, encrypting and compressing the data, transmitting the compressed data or source file, uploading or downloading it to a machine outside the core area, and finally downloading it on a certain machine. By modeling this series of behaviors, we can store the abnormal subgraph model and perform similar searches in the larger graph to find and match similar behaviors.

[0142] 301-4-2: A subgraph can also be constructed using graph traversal algorithms. Starting from a certain vertex in the graph, all other vertices in the graph are visited, and each vertex is visited only once. This process is called graph traversal.

[0143] 1. Combining the data structure in 101, for a known abnormal event, use the parsing logic in 101-1 to obtain the entity and attribute information of the event according to the entity attribute table, such as the IP, account, data and other information involved in the event;

[0144] 2. The entity attribute table collected in the previous step can be regarded as a small diagram, which contains some access, data transmission, linking and other situations in this event;

[0145] 3. Begin the risk association algorithm for graph traversal. The specific logic is as follows: First, determine the entity attribute table obtained in the previous step. For all entities in the table, traverse the existing graph database for entities with the same attributes (which can be considered the same entity). Using these entities as centers, analyze all their edge connections. Entities with a connection depth of n or less can be considered to have risks and require alerting or investigation. n can be specified by experts beforehand or obtained adaptively by the algorithm.

[0146] 4. Adaptive Depth Parameter n. For the small graph obtained in step 2, we can calculate all edges and their depths Ki for each entity i. The average depth of all m entities in the current event can be used as the depth parameter n for this graph traversal. That is...

[0147]

[0148] 5. For details on the reporting of risk entities obtained by the graph traversal algorithm, please refer to module 501.

[0149] Unknown Behavior Analysis Module (No. 401), such as Figure 6 and Figure 7 As shown:

[0150] This module is primarily responsible for further analysis of unknown and abnormal behaviors, including behaviors that existing rules and previous models could not accurately and timely identify.

[0151] 401-1: By statistically analyzing existing access behavior, a historical profile is created, and suspected abnormal behavior is detected through sudden changes in frequency. Specifically, this is achieved by calculating the Z-Score.

[0152]

[0153] For example, if the average number of accesses to a host or service is 100 times per day with a standard deviation of 15 times, and the Z-Score threshold is (-2, 2), then when X > 2*15 + 100 = 130 or x < -2*15 + 100 = 70, it is considered an anomaly that needs to be suspected, and further reporting and analysis will be carried out.

[0154] 401-2: Based on step 301-4, certain advanced attack behaviors can be sorted out and solidified, that is, a subgraph of a certain known threat can be solidified (using the methods of 301-4-1 and 301-4-2). Then, unknown or abnormal behaviors are matched one by one, and those with similarity greater than a certain threshold are selected.

[0155] The nodes and attributes of the graph mentioned in this patent have complex properties, making traditional graph similarity methods difficult to measure. Therefore, this patent specifically uses graph embedding to calculate subgraph similarity. The specific method is as follows:

[0156] 401-2-1: Assign an initial embedding vector to the attributes of each node. Calculate the adjacency matrix A of the original graph.

[0157] 401-2-2: Construct a multi-layer neural network, using node embeddings as input to the neural network.

[0158] 401-2-3: Locate the vectors of the same length as the original embedding in the dimension of the neural network output, calculate the inner product of every pair of vectors as the adjacency matrix A', and use ||A-A'|| as the reconstruction loss function for learning.

[0159] 401-2-4: Obtain the learned embedding of each node, and the embedding of each edge is the concatenation of the embeddings of the connected nodes.

[0160] 401-2-5: The subgraph embedding is the average of all node embeddings concatenated with the average of all edge embeddings.

[0161] 401-2-6: Calculate the cosine distance of the subgraph embedding as the similarity. Select those with a similarity greater than a certain threshold (e.g., 0.5) as suspected anomalies, which need to be reported and analyzed.

[0162] 401-3: Further, extending the method of 401-2, the neural network learning the subgraph reconstruction loss function is expanded into a threat recognition neural network. The specific method is as follows:

[0163] 401-3-1: Same as 401-2-1

[0164] 401-3-2: Same as 401-2-2.

[0165] The above two steps can also directly use the embedding trained by 401-2 as input.

[0166] 401-3-3: Use all known threats (regardless of category) as positive samples, and select normal access / operation records as negative samples at a ratio of 10 times or closer to the actual values ​​to construct supervised learning.

[0167] 401-3-4: Use the trained neural network to screen for anomalies. For those that the model identifies as unknown anomalies or risks, further reporting and analysis will be conducted.

[0168] 401-4: Report any scripts or commands that cannot be determined in a timely manner. See the Abnormal Behavior Analysis module (No. 501) for details.

[0169] Abnormal Behavior Handling Module (No. 501): This module is primarily responsible for the further and final handling of abnormal behaviors. This includes sending the data to experts for review and confirmation, sending alert emails, discarding false alarms, blocking the behavior, notifying the handling system, and displaying the abnormal behavior.

[0170] 501-1: Experts will review and confirm the events identified as threat events in Modules 3 and 4, and determine whether they are real threats.

[0171] 501-2: Send email alerts to security personnel for events identified as anomalous by experts, including detailed information on the anomalous behavior, the event description, timestamp, scope of impact, and other important information; mark events identified as false alarms by experts, confirm whether to delete the event type in the known threats module, and modify the relevant negative samples in the unknown threats module.

[0172] 501-3: Security personnel take appropriate action to block actions based on the severity and characteristics of the incident, such as blocking relevant IP addresses, prohibiting specific operations, or shutting down affected system services.

[0173] Explanation of the working principle of a network anomaly behavior analysis device based on graph data models:

[0174] The working principle involves several key steps, from the analysis of raw data to the storage of graph data, and then to the analysis of known threats, the analysis of unknown behaviors, and the handling of abnormal behaviors. The following is a summary of the working process:

[0175] The raw data analysis process is as follows: First, the device analyzes metadata (such as personnel, hosts, service configurations, accounts, etc.) and operation commands through the raw data analysis module, performing precise classification and behavior judgment. Operation commands are decomposed to meet the needs of graph storage; operation commands (including background host and foreground service operation commands) are decomposed to extract information such as accounts, operation commands, and operation objects (for example, Linux background operation commands are recorded and decomposed to identify whether high-risk operations are involved). The operation commands are then associated with information such as accounts, hosts, and objects to generate behavioral graph data that describes the operation in detail (the data can pinpoint the specific person, machine, and whether sensitive assets were accessed).

[0176] Graph data storage process: The analyzed behavioral data is stored in a graph format through the graph data storage module, including vertices, edges, vertex labels, edge labels, etc.; the entities and edges generated in the steps are decomposed and stored using a big data platform and graph database (such as JanusGraph combined with Spark). Specifically, PySpark is used to read the entity and edge data and then push it to the JanusGraph database to complete the decomposition and storage of entities and edges.

[0177] Known Threat Analysis: The known threat analysis module focuses on analyzing known normal access behavior graphs and abnormal access behavior graphs, including basic and combined operation commands. It analyzes known basic and complex behavior rules, as well as known abnormal behavior rules. Specific subgraphs are manually constructed to describe complex attack behaviors. Furthermore, a graph traversal algorithm is used to construct subgraphs, starting from a vertex and visiting all other vertices to analyze account legitimacy and the existence of orphaned accounts. A risk association algorithm based on graph traversal identifies all entities in the entity attribute table. Entities with attributes matching these entities in the graph database are analyzed for all edge connections. Entities with a connection depth of n or less are considered risky and require alerting or investigation.

[0178] Unknown Behavior Analysis: Historical profiles are created through statistical analysis of existing access behavior. Z-score calculations are used to detect abrupt changes in access frequency and identify suspected abnormal behaviors, thus completing the historical profile and abnormal behavior discovery process. Certain advanced attack behaviors are solidified into subgraphs representing known threats. Unknown or abnormal behaviors are matched against these subgraphs, selecting behaviors with similarity greater than a certain threshold. Subgraph similarity is calculated using graph embedding. Based on graph embedding, the neural network learning the subgraph reconstruction loss function is extended into a threat recognition neural network. Supervised learning is performed using known threats as positive samples and normal access / operation records as negative samples to filter out unknown abnormal risks for subsequent reporting and assessment. Scripts or commands that cannot be judged by the model are reported promptly for further abnormal behavior analysis.

[0179] Handling Abnormal Behavior:

[0180] For behaviors identified as threat events by the Unknown Behavior Analysis Module and the Known Threat Analysis Module, expert review and confirmation are conducted to determine whether they are real threats. For events identified as anomalous by experts, an email alert is sent to security personnel, providing detailed information about the anomalous behavior. Events identified as false alarms are marked and adjusted in the corresponding threat modules. Security personnel take appropriate behavior blocking strategies based on the severity and characteristics of the event to prevent further spread of the threat.

[0181] Based on the network behavior analysis method provided in the above embodiments, correspondingly, such as Figure 8 As shown in the figure, this application embodiment provides a network behavior analysis device 800, which may include:

[0182] The raw data acquisition module 801 is used to acquire raw data, which includes metadata and operation commands in the network environment;

[0183] The first raw data analysis module 802 is used to accurately classify and judge the behavior of the raw data and generate first behavior graph data. The first behavior graph data is used to indicate the relationship between entity objects and operation commands in the metadata.

[0184] The second raw data analysis module 803 is used to store the first row graph data in a graph structured manner to generate the second row graph data. The data form of the second row graph data includes nodes and edges. The nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata.

[0185] Anomaly analysis module 804 is used to identify the second behavior graph data and obtain anomaly behavior analysis results, which are used to indicate whether there is anomaly behavior in the original data.

[0186] In one embodiment, the first raw data analysis module may include:

[0187] The first decomposition unit is used to decompose the metadata and operation commands in the original data to obtain multiple entity objects and target operation commands between the multiple entity objects.

[0188] The first generation unit is configured to generate the first behavior graph data based on the plurality of entity objects and the target operation commands between the plurality of entity objects;

[0189] Correspondingly, the second raw data analysis module can be specifically used for:

[0190] The second decomposition unit is used to decompose the plurality of entity objects and the target operation commands between the plurality of entity objects to obtain a node attribute table and an edge attribute table. The node attribute table includes each entity object and the attributes corresponding to each entity object. The edge attribute table includes each entity object connected by each edge and the attributes of each edge. The attributes of the edges are used to indicate the attributes of the target operation command.

[0191] The second generation unit is used to store the node attribute table and the edge attribute table to generate the second row of graph data.

[0192] In one embodiment, the anomaly analysis module may include:

[0193] The first identification unit is used to identify and analyze the second row graph data through graph traversal method and artificial subgraph to obtain known abnormal behavior information, wherein the artificial subgraph is graph data constructed based on known abnormal behavior;

[0194] The second identification unit is used to identify and analyze the second behavioral graph data through a graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information;

[0195] The third generation unit is used to generate the abnormal behavior analysis result based on the known abnormal behavior information and the location abnormal behavior information.

[0196] In one embodiment, the first identification unit may be specifically used for:

[0197] By using the graph traversal method, the node and edge data in the artificial subgraph and the second row graph data are compared and analyzed to obtain the connection depth between each node.

[0198] The connection depth and depth threshold are matched to determine the known abnormal behavior information.

[0199] In one embodiment, the second identification unit may be specifically used for:

[0200] The subgraph similarity between the artificial subgraph and the second row graph data is calculated using the graph embedding method.

[0201] The subgraph similarity and similarity threshold are matched to determine the unknown abnormal behavior information.

[0202] In one embodiment, the anomaly analysis module may further include:

[0203] The construction unit is used to analyze the behavioral rules in graph data with known normal behavior and graph data with known abnormal behavior, and construct the artificial subgraph.

[0204] In one embodiment, the network behavior analysis apparatus may further include:

[0205] The review module is used to review the abnormal behavior analysis results and obtain the abnormal event review results, which are used to indicate whether there is a real threat in the original data.

[0206] The alarm module is used to send alarm information and abnormal behavior analysis results to security personnel when the abnormal event review results indicate that there is a real threat in the raw data.

[0207] Based on the network behavior analysis method and apparatus provided in the above embodiments, this application also provides an electronic device 900, such as... Figure 9 As shown:

[0208] It includes a processor 901, a memory 902, and a computer program stored in the memory 902 and executable on the processor 901. When the computer program is executed by the processor 901, it implements the various processes of the above-described network behavior analysis method embodiments and achieves the same technical effect.

[0209] Specifically, the processor 901 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0210] Memory 902 may include mass storage for data or instructions. For example, and not limitingly, memory 902 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 902 may include removable or non-removable (or fixed) media. Where appropriate, memory 902 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 902 is non-volatile solid-state memory.

[0211] In certain embodiments, the memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Thus, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this application.

[0212] The processor 901 reads and executes computer program instructions stored in the memory 902 to implement any of the network behavior analysis methods in the above embodiments.

[0213] In one example, the electronic device may also include a communication interface 903 and a bus 910. As an example, such as... Figure 9 As shown, the processor 901, memory 902, and communication interface 903 are connected through bus 910 and complete communication with each other.

[0214] The communication interface 903 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0215] Bus 910 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 910 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0216] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described network behavior analysis method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0217] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0218] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0219] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0220] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus, and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0221] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A network behavior analysis method, characterized in that, include: Obtain raw data, which includes metadata and operation commands in the network environment; The raw data is precisely classified and its behavior is determined to generate a first behavior graph data, which is used to indicate the relationship between entity objects and operation commands in the metadata. The first row graph data is stored in a graph structured manner to generate the second row graph data. The data form of the second row graph data includes nodes and edges. The nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata. The second behavior graph data is identified to obtain abnormal behavior analysis results, which are used to indicate whether there are abnormal behaviors in the original data. The step of identifying the second behavior graph data to obtain abnormal behavior analysis results includes: The second row of graph data is identified and analyzed using graph traversal methods and artificial subgraphs to obtain known abnormal behavior information. The artificial subgraph is graph data constructed based on known abnormal behaviors. By using graph embedding methods and the artificial subgraph, the second behavior graph data is identified and analyzed to obtain unknown abnormal behavior information; The abnormal behavior analysis results are generated based on the known and unknown abnormal behavior information.

2. The method according to claim 1, characterized in that, The step of accurately classifying and judging the behavior of the original data to generate the first behavior graph data includes: The metadata and operation commands in the original data are decomposed to obtain multiple entity objects and target operation commands between the multiple entity objects; The first behavior graph data is generated based on the plurality of entity objects and the target operation commands between the plurality of entity objects; The step of storing the first row of graph data in a graph-structured manner to generate the second row of graph data includes: The plurality of entity objects and the target operation commands between the plurality of entity objects are decomposed to obtain a node attribute table and an edge attribute table. The node attribute table includes each entity object and the attributes corresponding to each entity object. The edge attribute table includes each entity object connected by each edge and the attributes of each edge. The attributes of the edges are used to indicate the attributes of the target operation command. The node attribute table and edge attribute table are stored to generate the second row of graph data.

3. The method according to claim 1, characterized in that, The method of identifying and analyzing the second-row graph data through graph traversal and artificial subgraphs to obtain known abnormal behavior information includes: By using the graph traversal method, the node and edge data in the artificial subgraph and the second row graph data are compared and analyzed to obtain the connection depth between each node. The connection depth and depth threshold are matched to determine the known abnormal behavior information.

4. The method according to claim 3, characterized in that, The step of identifying and analyzing the second behavioral graph data using the graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information includes: The subgraph similarity between the artificial subgraph and the second row graph data is calculated using the graph embedding method. The subgraph similarity and similarity threshold are matched to determine the unknown abnormal behavior information.

5. The method according to claim 1, characterized in that, Before obtaining known abnormal behavior information by identifying and analyzing the second behavioral graph data through graph traversal methods and artificial subgraphs, the method further includes: The behavioral rules in graph data with known normal behavior and graph data with known abnormal behavior are analyzed to construct the artificial subgraph.

6. The method according to any one of claims 1-5, characterized in that, After identifying the second behavior graph data to obtain abnormal behavior analysis results, and these results are used to indicate whether abnormal behavior exists in the original data, the process further includes: The abnormal behavior analysis results are reviewed to obtain abnormal event review results, which are used to indicate whether there is a real threat in the original data. If the results of the abnormal event review indicate that there is a real threat in the raw data, an alert message and abnormal behavior analysis results will be sent to security personnel.

7. A network behavior analysis device, characterized in that, The device includes: The raw data acquisition module is used to acquire raw data, which includes metadata and operation commands in the network environment; The first raw data analysis module is used to accurately classify and determine the behavior of the raw data, and generate a first behavior graph data. The first behavior graph data is used to indicate the relationship between entity objects and operation commands in the metadata. The second raw data analysis module is used to store the first row graph data in a graph structured manner to generate the second row graph data. The data form of the second row graph data includes nodes and edges. The nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata. An anomaly analysis module is used to identify the second behavior graph data and obtain anomaly behavior analysis results, which are used to indicate whether there are abnormal behaviors in the original data. The anomaly analysis module includes: The first identification unit is used to identify and analyze the second row graph data through graph traversal method and artificial subgraph to obtain known abnormal behavior information, wherein the artificial subgraph is graph data constructed based on known abnormal behavior; The second identification unit is used to identify and analyze the second behavioral graph data through a graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information; The third generation unit is used to generate the abnormal behavior analysis results based on the known abnormal behavior information and the unknown abnormal behavior information.

8. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the network behavior analysis method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the network behavior analysis method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the network behavior analysis method as described in any one of claims 1-6.

Images