Data security analysis method and intelligent calculation data security workstation

Abstract

The invention provides a data security analysis method and an intelligent calculation data security workstation, and the method comprises the steps that the intelligent calculation data security workstation obtains data of different data sources, and the data comprises a user operation log and a data access and transmission log; classifying and grading the data based on a preset rule base and a machine learning model, and marking sensitive data; analyzing a user behavior mode based on the user operation log, and identifying an abnormal behavior; and based on the data access and transmission log, evaluating a data leakage risk, and generating a risk report.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of information security technology, and in particular to a data security analysis method and an intelligent computing data security workstation. Background Art

[0002] With the development of big data and artificial intelligence technology, the amount of data accumulated by enterprises continues to grow. However, due to the lack of effective data security management methods, enterprises face security risks. The existing data security analysis technology has the following main shortcomings:

[0003] The efficiency of data sensitivity identification is low, and sensitive data cannot be quickly and accurately marked;

[0004] Insufficient user behavior analysis capabilities make it difficult to effectively identify abnormal operations by internal personnel;

[0005] Data leakage risk assessment is not comprehensive and cannot detect complex advanced persistent threats. Therefore, there is an urgent need for a more comprehensive and efficient data security analysis method that can accurately identify sensitive data, monitor user behavior in real time, and deeply assess data leakage risks, so as to enhance the data security protection capabilities of enterprises. Summary of the invention

[0006] In view of this, the embodiments of the present disclosure provide a data security analysis method and an intelligent data security workstation, which can improve the accuracy of the interpretation of legal documents.

[0007] The present disclosure provides a data security analysis method, including:

[0008] The intelligent computing data security workstation obtains data from different data sources, including user operation logs, data access and transmission logs;

[0009] Based on a preset rule base and machine learning model, the data is classified and graded, and sensitive data is marked;

[0010] Analyze user behavior patterns based on the user operation logs to identify abnormal behaviors;

[0011] Based on the data access and transmission logs, the risk of data leakage is assessed and a risk report is generated.

[0012] Optionally, based on a preset rule base and a machine learning model, the data is classified and graded, and sensitive data is marked, including:

[0013] Using natural language processing (NLP) technology to extract text information from the data;

[0014] Extracting keywords from the text information by using term frequency-inverse document frequency (TF-IDF) technology;

[0015] Constructing a preset rule library, wherein the preset rule library includes sensitive information types, keyword matching rules, and regular expression rules;

[0016] Constructing an SVM model, and training the SVM model using the training data set of the preset rule base;

[0017] The SVM model is used to classify and grade the keywords in the text information, and different categories of sensitive data are marked.

[0018] Optionally, based on a preset rule base and a machine learning model, the data is classified and graded, and sensitive data is marked, including:

[0019] Using natural language processing (NLP) technology to extract text information from the data;

[0020] Constructing a preset rule library, wherein the preset rule library includes sensitive information types, keyword matching rules, and regular expression rules;

[0021] Constructing a support vector machine (SVM) model, and training the SVM model using the training data set of the preset rule base;

[0022] Extracting feature vectors from the text information;

[0023] Perform mean centering processing on the feature vectors: calculate the mean of each feature vector, and subtract the corresponding mean from the mean to eliminate the offset between features;

[0024] Performing feature sparse processing on the feature vector after mean centering processing: using L1 regularization technology, setting feature values ​​in the feature vector that are lower than a preset threshold to zero to reduce feature redundancy;

[0025] The features after mean centering and feature sparsification are input into the SVM model to mark sensitive data of different categories.

[0026] Optionally, analyzing the user behavior pattern based on the user operation log to identify abnormal behavior includes:

[0027] Deploy a user behavior analysis UEBA system in the intelligent computing data security workstation to obtain the user operation log from the data;

[0028] Constructing a random forest model, training the random forest model, and establishing a baseline of normal user behavior;

[0029] The user operation log is input into the trained random forest model to identify the user's abnormal behavior pattern.

[0030] Optionally, the method according to claim 1 is characterized in that analyzing user behavior patterns based on the user operation logs and identifying abnormal behaviors comprises:

[0031] Obtaining the user operation log;

[0032] Define the semantic security super attributes of the user operation log, including login time, login IP address, and device information used;

[0033] Generate simulated abnormal login attack patterns, including login attempts during non-working hours, login attempts from IP addresses in different regions, and / or login attempts using different devices;

[0034] Mixing the simulated abnormal login attack mode and normal login behavior mode to form a training data set;

[0035] Constructing an SVM model or a random forest model, and inputting the training data set into the SVM model or the random forest model;

[0036] The semantic security super attribute is input into the trained SVM model or random forest model to perform abnormal behavior recognition.

[0037] Optionally, based on the data access and transmission logs, assess the risk of data leakage and generate a risk report, including:

[0038] Construct Bayesian network models;

[0039] Using historical data to train the Bayesian network model;

[0040] The data access and transmission logs are input into the Bayesian network model to evaluate data leakage risks, identify potential risk points and abnormal behaviors, and generate risk reports.

[0041] Optionally, based on the data access and transmission logs, assess the risk of data leakage and generate a risk report, including:

[0042] Using a self-supervised sequence learning algorithm to build an advanced persistent threat APT detection model, wherein the APT detection model is a Transformer, BERT or LSTM model;

[0043] Acquire historical system behavior data, wherein the historical system behavior data includes normal behavior and known APT attack behavior data;

[0044] Using a context-aware anomaly detection method, context information in historical system behavior data is obtained, and the context information is embedded and combined with the behavior sequence to form a context feature vector, wherein the context information includes user identity, access time, geographic location, and operation type;

[0045] Using the context feature vector to train the APT detection model so that the APT detection model learns system behavior sequence embedding and understands normal and abnormal behavior patterns;

[0046] The data access and transmission logs are input into the APT detection model to evaluate data leakage risks in real time, identify potential APT attack behaviors, and generate risk reports.

[0047] Optionally, the APT detection model is a Transformer-based pre-trained large language model LLM, and the APT detection model is trained using the context feature vector, including:

[0048] Fine-tuning the LLM using the context feature vector;

[0049] The data access and transmission logs are input into the APT detection model to assess data leakage risks in real time, identify potential APT attack behaviors, and generate risk reports, including:

[0050] converting the data access and transmission logs into natural language descriptions;

[0051] Using the fine-tuned LLM to perform semantic understanding on the natural language description to identify potential APT attack behavior characteristics;

[0052] LLM's language generation capabilities are used to automatically generate risk reports for APT attack incidents.

[0053] Optionally, the method further comprises:

[0054] The LLM extracts key information from the generated reports, including attackers, attack methods, and target assets, and constructs an APT attack knowledge graph;

[0055] Use knowledge graphs for reasoning and association analysis to discover potential APT attack chains and attacker teams.

[0056] The embodiment of the present invention further provides an intelligent computing data security workstation, including:

[0057] An acquisition module, used to acquire data from different data sources, including user operation logs, data access and transmission logs;

[0058] A sensitive data labeling module, used to classify and grade the data and label sensitive data based on a preset rule base and a machine learning model;

[0059] An abnormal behavior identification module, used to analyze user behavior patterns based on the user operation logs and identify abnormal behaviors;

[0060] The data leakage risk assessment module is used to assess the data leakage risk and generate a risk report based on the data access and transmission logs.

[0061] Compared with the prior art, the technical solution of the embodiment of the present disclosure has the following advantages:

[0062] Use NLP, machine learning and other technologies to accurately and efficiently identify sensitive information in the data, providing a basis for subsequent security analysis;

[0063] Starting from user operation logs, we can gain in-depth insights into the behavior patterns of internal personnel and effectively detect potential illegal operations;

[0064] Conduct multi-dimensional risk assessments on the data access and transmission process, combine new technologies such as large language models to identify advanced threats, and enhance data leakage protection capabilities;

[0065] It provides an intelligent data security workstation that integrates functions such as data collection, sensitive information marking, behavior anomaly detection, and leakage risk assessment, providing enterprises with a one-stop data security analysis solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments of the present disclosure or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0067] Figure 1 A flow chart of a data security analysis method in some embodiments of the present disclosure is shown;

[0068] Figure 2 A schematic diagram of the architecture of an intelligent computing data security workstation in an embodiment of the present disclosure is shown;

[0069] Figure 3 The UEBA system topology diagram in the embodiment of the present disclosure is shown;

[0070] Figure 4 A schematic diagram of the Bayesian network structure in an embodiment of the present disclosure is shown;

[0071] Figure 5A structural schematic diagram of a data security analysis intelligent computing data security workstation in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0072] The embodiment of the present invention discloses an intelligent computing data security workstation, which is an integrated system specially designed for data security governance. It realizes efficient management and protection of sensitive data by integrating multiple data security products. The workstation adopts advanced artificial intelligence technology, including but not limited to user behavior anomaly identification, sensitive data risk analysis, data classification, data flow monitoring, data desensitization processing and data watermark processing, etc., to ensure the security and compliance of data. Intelligent computing data security workstation, which is an integrated system specially designed for data security governance.

[0073] It integrates multiple data security products to achieve efficient management and protection of sensitive data. The workstation uses advanced artificial intelligence technology, including but not limited to user behavior anomaly identification, sensitive data risk analysis, data classification, data flow monitoring, data desensitization and data watermarking, to ensure data security and compliance.

[0074] The innovation of this workstation lies in its deep integration and optimization with the trusted computing server, providing a solution similar to an all-in-one machine. By tailoring the server, this workstation not only greatly improves the performance of data processing and security governance, but also simplifies the deployment and operation and maintenance processes. The integration of the intelligent engine (AISecOps+DataSecOps) enables the workstation to have powerful data risk management capabilities and visibility of data assets. At the same time, it uses UEBA technology, machine learning content recognition, network traffic analysis and other technologies to achieve monitoring and tracing of the entire data chain. In addition, this workstation also provides a data space security governance platform that supports the collaborative operation mode of data security governance, as well as data security monitoring and analysis and situational awareness functions. Through natural language processing, RPA technology, etc., the automation and intelligence level of data security operations has been further improved.

[0075] See also Figure 1 The flowchart of a data security analysis method in an embodiment of the present disclosure is shown in FIG. 1 , which is applied in the above-mentioned intelligent computing data security workstation. Figure 1 As shown, the following steps can be performed:

[0076] S1: The intelligent computing data security workstation obtains data from different data sources, including user operation logs, data access and transmission logs;

[0077] Figure 2 This is a schematic diagram of the architecture of the intelligent data security workstation. Figure 2As shown in the figure, it consists of the underlying hardware platform, the middleware layer and the upper-layer application. The underlying hardware platform is customized and optimized based on the Xinchuang server, the middleware layer includes data storage, data transmission and security protocols, and the upper-layer application covers various functional modules.

[0078] Among them, the intelligent computing data security workstation collects various data sources in the system, including databases, file systems, and log files, and pre-processes the collected data, including data cleaning, format standardization, and deduplication operations.

[0079] S2: Based on the preset rule base and machine learning model, classify and grade the data and mark sensitive data;

[0080] Specifically, S2 first extracts the text part of the original data and forms structured text information through operations such as word segmentation and part-of-speech tagging.

[0081] Then, a preset rule base for sensitive information was built. The rule base defines the characteristics of various types of sensitive data, such as ID card numbers are usually 18 digits and mobile phone numbers are 11 digits. In addition, common sensitive words such as "password" and "confidential" are summarized. The differences in sensitive data in different industries and scenarios are fully considered, and the preset rules are enriched as much as possible.

[0082] Next, the keyword features are extracted from the text information using algorithms such as TF-IDF. These keywords represent the theme and characteristics of the text, which are helpful for the subsequent identification of sensitive data. The embodiment of the present invention combines the keyword features with the preset rules to train the support vector machine (SVM) model. SVM can efficiently and accurately classify text features and determine whether they belong to sensitive data.

[0083] For the obtained text feature vector, optimization processing such as mean centering and sparsification is designed. Mean centering unifies the features of different texts into the same numerical range to eliminate the impact of offset; feature sparsification eliminates redundant low-value features, reduces feature dimensions, and improves model performance.

[0084] Finally, the optimized text features are input into the SVM model for prediction, and different categories of sensitive data can be automatically marked to accurately identify sensitive information. For example, for an employee information table, the embodiment of the present invention can accurately locate sensitive data columns from fields such as name, mobile phone number, and salary.

[0085] Specifically include:

[0086] S2.1: Using natural language processing (NLP) technology to extract text information from the data;

[0087] S2.1 Use the text preprocessing technology in natural language processing (NLP) to perform structured extraction on the original data. First, use regular expression matching or string positioning methods to extract pure text information from the original data and filter out non-text data such as pictures, videos, and binaries.

[0088] Next, perform Chinese word segmentation on the extracted text data. Use mainstream Chinese word segmentation tools such as jieba to segment the text into meaningful lexical units. At the same time, use a stop word list to filter out function words such as "de" (的) and "shi" (是) that have no actual contribution to semantic analysis.

[0089] Then, perform part-of-speech tagging on the word segmentation results. Use tools such as Harbin Institute of Technology LTP and Stanford CoreNLP to determine the part of speech of each word in the context, such as nouns, verbs, adjectives, etc. Part-of-speech information helps improve the accuracy of subsequent sensitive information matching.

[0090] Furthermore, perform named entity recognition on the text. Use deep learning models such as BiLSTM-CRF to extract entity words of specific types such as person names, place names, and organization names from the text. These named entities are usually the key review objects of sensitive information.

[0091] At this point, the original data is processed into a structured text information representation. Each text document is represented as a word sequence d = <w1, w2,..., wn>, where wi is a word in the text and has attribute labels such as part of speech and named entity type, preparing for subsequent sensitive information recognition.

[0092] Taking the employee information form as an example, through this step, the name column is extracted as structured text such as "Zhang San nr (person name)" and "Li Si nr", and the salary column is represented as numerical sensitive words such as "10000 cd (cardinal number)" and "8000 cd". This structured conversion is the basis for accurately identifying sensitive information.

[0093] S2.2: Extract keywords from the text information through the term frequency-inverse document frequency (TF-IDF) technology;

[0094] Use the TF-IDF algorithm to automatically extract keyword features from the structured text. TF-IDF can comprehensively consider the importance of vocabulary at the document internal and corpus levels and select the most representative feature words for the document theme.

[0095] First, in each text document, count the term frequency TF(w i of each word w i , d), that is, the number of times w i appears in d, where i is a custom positive integer. At the same time, count the number of documents DF(w i that contain wi ), which indicates how many documents in the corpus contain word w i .

[0096] Then, the inverse document frequency (IDF) of each word is calculated. i ). IDF reflects the scarcity of words. If a large number of documents contain word w i , then w i The IDF value of is small. Its formula is:

[0097] Log(|D| / (DF(w i )+1))

[0098] Where |D| is the total number of documents in the corpus, and the denominator +1 is used to smooth out division by zero errors.

[0099] Next, calculate the word w i TF-IDF weight in document d:

[0100] TF-IDF(w i ,d)=TF(w i ,d)IDF(w i )

[0101] The larger the TF-IDF value, the more likely the word w i The higher the importance in document d.

[0102] Finally, a TF-IDF vector is generated for each document d, where each dimension corresponds to a word in the vocabulary, and the value of the dimension is the TF-IDF weight of the word. All dimensions are sorted from large to small according to the value, and the top-ranked words are the keyword features of the document.

[0103] For example, for an employee's resume text, if the TF-IDF values ​​of words such as "graduation", "certificate", and "skills" are the highest, then these words are likely to reflect the main content of the resume and can be used as the focus of sensitive information identification.

[0104] S2.3: Build a preset rule library, which contains sensitive information types, keyword matching rules and regular expression rules;

[0105] In this step, based on business scenarios, a rule knowledge base for sensitive information identification is manually defined. The knowledge base uses empirical rules summarized by domain experts to characterize the characteristics of sensitive data from multiple dimensions.

[0106] First, enumerate and define the types of sensitive information. Common types of sensitive data include personal privacy information (such as ID number, mobile phone number), commercial confidential information (such as contracts, patents), internal management information (such as salary records, organizational charts), etc. For different industries, it is also necessary to customize unique sensitive information types, such as electronic medical records in the medical industry and user portraits of Internet companies.

[0107] Then, for each type of sensitive information, summarize its characteristic keywords. For example, "ID card" and "bank card" are often prompts for personal privacy information; "confidentiality agreement" and "non-competition" are common in commercial confidential documents. The appearance of these keywords greatly increases the possibility that the text belongs to the corresponding sensitive type.

[0108] In addition to keyword matching, the embodiment of the present invention also applies regular expressions to model the grammatical pattern of sensitive information. For example, the ID card number is usually 18 digits, the first 17 digits are the body, and the last digit is the check code, which meets specific encoding rules. Using the regular expression "\d{17}[\dxX]" (matching 18 digits or digits + X), the candidate ID card number text can be quickly located.

[0109] In addition, the construction of the rule base also needs to consider the correlation between different sensitive information. For example, a text containing a name, home address, and contact number is more sensitive than a text containing only a name. By combining multiple rules, more fine-grained sensitive information identification can be achieved.

[0110] The construction of the rule base is usually completed by security experts and business personnel. The collected sensitive information identification rules are uniformly stored in the configuration file or database as an important knowledge supplement for subsequent machine learning models. The rule base needs to be continuously optimized and updated according to practical conditions.

[0111] S2.4: constructing an SVM model, and training the SVM model using the training data set of the preset rule base;

[0112] This step uses the support vector machine (SVM) algorithm to build a sensitive information classification model. SVM can find the optimal classification plane in high-dimensional space, and has a good processing effect on nonlinearly separable data, and performs well in text classification tasks.

[0113] First, the original corpus data is annotated based on the preset rule base. The text that meets a certain rule is labeled with the corresponding sensitive type label as a training sample; the text that does not meet any rule is marked as a safe type. During the annotation process, experts can also manually identify sensitive information that is not covered by the rule base to further enrich the training data.

[0114] Next, feature vectorization is performed on the training text. Commonly used text feature representations include bag-of-words models, TF-IDF vectors, word vectors, etc. Among them, TF-IDF vectors have been obtained in S2.2. In addition, word embedding models such as word2vec and bert can also be used to learn the distributed representation of words in the corpus.

[0115] Then, select a suitable SVM kernel function. Commonly used kernel functions include linear kernel, Gaussian radial basis kernel RBF, etc. RBF kernel can map the original feature space to infinite dimensional space, which is more suitable for processing high-dimensional text features. The formula is as follows:

[0116] K(x,x')=exp(-γ∣∣x-x'∣∣ 2 )

[0117] Among them, x and x` are two samples, and γ is a hyperparameter.

[0118] Next, we use grid search and other techniques to optimize the hyperparameters C and γ of SVM. The larger the C, the more the classifier tends to reduce the training error, which may bring the risk of overfitting; otherwise, it is underfitting. γ controls the impact of a single sample on the classification decision surface. The larger the value, the fewer the Support Vector.

[0119] Finally, the text features and labels are input into the SVM model for training. SVM will automatically find the decision hyperplane that maximizes the classification interval to form a sensitive information classifier. When a new text to be reviewed arrives, its feature vector is input into the classifier to predict its sensitive type.

[0120] S2.5: using the SVM model to classify and grade the keywords in the text information, and marking different categories of sensitive data;

[0121] S2.5 uses the trained SVM model to predict the sensitivity of keywords in text information and realize automatic labeling of sensitive information at the document level. Considering the diversity of sensitive information types in real scenarios, SVM models are often multi-classifiers rather than binary classifiers.

[0122] Specifically, in the first step, TF-IDF keyword features are extracted from the text to be detected and converted into feature vectors.

[0123] Second, the feature vector is input into the SVM multi-classifier to predict the probability or confidence of each keyword belonging to different sensitive types. Common strategies of SVM multi-classifiers include One-vs-One and One-vs-Rest. The former trains k(k-1) / 2 binary classifiers, each classifier targets a combination of two sensitive types; the latter trains k binary classifiers, each classifier distinguishes a certain sensitive type from all other types.

[0124] After predicting the sensitive type of each keyword, the document can be labeled with sensitive information. One approach is to label the entire document as sensitive if the document contains a keyword of a certain sensitive type. This is suitable for scenarios where sensitive information is densely distributed. Another approach is to assign a comprehensive sensitivity score to the document based on the sensitive type of the keyword, its density in the document, and its importance. Documents that exceed the preset threshold are labeled as sensitive. This grading mechanism can reduce the false alarm rate.

[0125] Considering that different types of sensitive information have different degrees of harm to the enterprise, the embodiment of the present invention can also classify them into different levels. The classification scheme should be flexibly defined by the enterprise security policy.

[0126] For texts that are identified as sensitive information by the SVM model, the system automatically adds a warning label to remind managers to pay special attention. For texts that are identified as safe, they are directly released.

[0127] In S2.1, there are the following technical difficulties:

[0128] 1. Data sparsity: Sensitive information in text data is often sparse, resulting in poor feature extraction results.

[0129] 2. Feature redundancy: There may be a large number of redundant features in high-dimensional text features, which increases the complexity of the model and the training time.

[0130] 3. Model training: Due to feature sparsity and redundancy, machine learning models are prone to overfitting during training, affecting the accuracy of classification and grading.

[0131] Therefore, the embodiment of the present invention provides another solution: mean center feature sparse enhancement training. The mean center feature sparse enhancement training technology can effectively solve the above problems. This technology enhances the training effect of the model and improves the accuracy of sensitive information recognition and classification through feature sparseness and mean centering processing. Steps B1-B7:

[0132] B1-B3, same as steps S2.1-S2.3;

[0133] B4: extracting feature vectors from the text information;

[0134] Commonly used text feature representation methods include:

[0135] 1) Bag-of-Words. The text is considered as a bag full of words, without considering word order and grammar. The bag-of-words model uses the frequency (TF) of a word in a document as a feature value to generate a high-dimensional sparse vector. 2) TF-IDF vector. Based on the bag-of-words model, the inverse document frequency (IDF) factor is introduced to highlight the importance of rare words. The TF-IDF feature can reflect the significance of words at the document and corpus levels. Suppose the word frequency of word w in document d is tf(w,d), the document frequency of w is df(w), and the total number of corpus documents is N, then the TF-IDF value is:

[0136]

[0137] 3) Topic model. Through unsupervised learning algorithms such as LDA and LSA, implicit topics are automatically extracted from the document set, and a single document is characterized by a topic distribution vector. A topic corresponds to a group of related words, such as "export" and "tariff" which are common words under the topic of "trade". The topic model can reveal the deep semantic structure of the text.

[0138] 4) Word Embedding. Using neural network models such as word2vec and glove, we learn low-dimensional real-valued vector representations of words. The geometric relationship between word vectors reflects the semantic similarity of words. The mean and maximum pooling of all word vectors in the document are used as document features. Word embedding overcomes the dimensionality curse of the bag-of-words model and better describes the meaning of words.

[0139] B5: performing mean centering processing on the feature vectors: calculating the mean of each feature vector, and subtracting the corresponding mean from the mean to eliminate the offset between features;

[0140] B5 performs central processing on the extracted text feature vector to eliminate the numerical deviation between different feature dimensions and improve the learning effect of subsequent classifiers.

[0141] Suppose there are m text samples, and each sample extracts n-dimensional features to form a feature matrix X:

[0142]

[0143] Calculate the mean of X column by column to get the mean vector of the feature μ=(μ1,μ2,...,μ n ):

[0144]

[0145] Then subtract the mean of the corresponding feature from each element of X to obtain the centralized feature matrix X`:

[0146] x′ ij =x ij -μ j

[0147] Right now

[0148]

[0149] Intuitively, centering is equivalent to translating all sample points along each feature axis so that they are centered on the origin. This process does not change the relative position relationship between samples.

[0150] The significance of centralization is that many machine learning algorithms (such as SVM) are sensitive to the origin of features. If the numerical ranges of different features vary greatly, the classification surface may tend to the feature axis with large values, resulting in underfitting. Centralization unifies the mean of the features to 0, alleviating the above problem and making the classifier more robust.

[0151] In addition, centering is a prerequisite for data preprocessing methods such as Z-score standardization and principal component analysis. When implementing, pay attention to calculating the mean vector on the training set and then use it to center the test set to prevent test information leakage.

[0152] B6: performing feature sparse processing on the feature vector after mean centering processing: using L1 regularization technology, setting feature values ​​in the feature vector that are lower than a preset threshold to zero to reduce feature redundancy;

[0153] After centralization, B6 further sparses the text features, removes redundant weakly correlated feature dimensions, reduces the complexity of the feature space, and improves the generalization performance of the model.

[0154] The core of the sparsification process is to introduce the L1 regularization term into the objective function of the SVM. For linear SVM, its original form is:

[0155]

[0156] Where w is the normal vector of the classification hyperplane, b is the intercept, and x i is the i-th training sample, y i ={-1, +1} for x i The category label of .

[0157] After adding L1 regularization, the optimization objective becomes:

[0158]

[0159] Where in is the regularization coefficient, which weighs the classification error and model complexity.

[0160] ||w||1=∑ n j =1|wj| is the L1 norm of w, w j is the jth component of w.

[0161] Since the L1 norm is non-smooth and non-continuous, in w j = 0, the sub-gradient is not unique, and the optimization solution is difficult. However, L1 regularization is sparse-inducing, that is, it tends to compress multiple wj to exactly 0. Intuitively, the L1 norm constrains the weight vector w to be near the intersection of each coordinate axis. Therefore, the solved w is usually sparse, that is, the weights of multiple features are 0. This is in line with the principle of Occam's razor, the simpler the model structure, the better.

[0162] In comparison, L2 regularization (ridge regression) can prevent overfitting, but it does not have feature selectivity. L1 regularization forms a built-in feature screening mechanism that automatically removes many useless features and retains only a small number of key features, making the model more concise.

[0163] When implementing L1 regularization, iterative optimization algorithms such as axis descent method and minimum angle regression are generally used to solve the SVM parameters. The algorithm will repeatedly adjust the classification weight w to minimize the objective function. When the weight wj of some features drops below a preset threshold (such as 0.001), it will be eliminated and the weight will be set to zero. After the iteration is terminated, the feature sparse SVM model is obtained.

[0164] Sparsification can significantly compress the model size, making it easier to store, transmit, and deploy the model. At the same time, sparse models are more efficient in prediction because only a small number of non-zero features need to be calculated. In addition, L1 regularization also gives the model stronger interpretability, with a larger weight for key features, which is consistent with how humans discern sensitive information.

[0165] B7: Input the features after mean centering and feature sparsification into the SVM model to mark sensitive data of different categories;

[0166] First, the feature matrix X of the training text is centered and sparsed to form an optimized matrix X`. At the same time, the sensitive type label y corresponding to the text is prepared i ={c1, c2, .., c k}, where k is the number of sensitive information categories.

[0167] The mainstream strategy of SVM multi-classification is "One-vs-Rest". This strategy trains k binary SVMs, each of which considers a certain category ci as a positive example and all other categories as negative examples. The category of the sample is determined by the votes of the k SVMs. Formally:

[0168]

[0169] y=c st in

[0170] Where fi is the i-th SVM and y is the predicted category label of the sample.

[0171] When training SVM, since the features have been mean-centered and L1-sparsed in advance, the optimization objective can be simplified to:

[0172]

[0173] Among them l ij =1 if x j Belongs to c i class, otherwise l ij =-1. Compared with the traditional SVM, the above form has fewer regularization terms and slack variables, and the parameter solution is more efficient.

[0174] After obtaining k SVM models, the test text is sequentially extracted for features, mean-centered, and L1-sparsed, and then the above voting rules are used to predict the sensitive category to which it belongs. If the test sample does not belong to any known sensitive class, SVM will classify it as other classes.

[0175] In order to balance the precision and recall of classification, the decision threshold of SVM can be adjusted. For example, the recall of each binary SVM is fixed to be greater than 0.9, thereby reducing the rate of missed detection of sensitive information and preferring excessiveness to insufficientness.

[0176] S3: Analyze user behavior patterns based on the user operation logs and identify abnormal behaviors;

[0177] Timely discovery of abnormal user behavior is the focus of data security analysis. The embodiment of the present invention constructs a behavior anomaly detection model from two perspectives to achieve behavior security monitoring.

[0178] 1. Learning baseline behaviors from user operation logs

[0179] The UEBA system obtains various operation logs generated during the user's daily office work, including file reading and writing, network access, USB access, etc. The embodiment of the present invention uses the random forest algorithm to establish the user behavior baseline. The random forest integrates multiple decision trees and comprehensively analyzes massive logs to characterize the standard operation modes of different user roles at different times and occasions.

[0180] When a new user operation log is generated, it is input into the trained random forest model. If the operation deviates from the user's usual behavior pattern, such as downloading files in batches during non-working hours, it is likely to be an abnormal behavior. With the help of random forest feature importance analysis, the embodiment of the present invention can also gain insight into the impact of each factor on user behavior, providing a decision-making reference for subsequent investigation and tracing.

[0181] (II) Discovering abnormal logins through simulation modeling

[0182] System login is the basis for users to carry out various operations, and its security is of vital importance. The embodiment of the present invention defines the semantic security super-attribute of login behavior, covering multi-dimensional features such as login time, location, and device used.

[0183] Then, the embodiment of the present invention simulates several common abnormal login attack modes, such as: attempting to log in at midnight, initiating a login from an overseas IP, logging in with a brand new device, etc. Through a large number of simulations, a rich sample of abnormal login data is obtained.

[0184] Mix the real normal login log and the simulated abnormal login data to form a training sample. Use SVM or random forest algorithm to train the abnormal login recognition model. When a new login event occurs, extract the semantic security super attribute from it and input it into the model for anomaly detection. This active simulation combined with machine learning enhances the system's ability to deal with unknown login threats.

[0185] Specifically, method 1 includes steps S3.1-S3.3:

[0186] S3.1: Deploy a user behavior analysis UEBA system in the intelligent computing data security workstation and obtain the user operation log from the data;

[0187] Build a UEBA system in the workstation. UEBA stands for User and Entity Behavior Analytics. Its core is to automatically establish a dynamic risk baseline from massive behavioral events through machine learning and discover high-risk anomalies. Mainstream UEBA usually adopts a complex event processing (CEP) framework, integrating multiple heterogeneous data sources, behavioral analysis models, and visual alarm modules. Typical deployment topologies are as follows: Figure 3Among them, the data collector is responsible for accessing various data sources, including operating system logs, application system logs, database audit logs, etc. These logs record various user operations and are the data source for abnormal analysis. To ensure the breadth and depth of collection, it is necessary to connect to the log management system (such as ELK), security management audit and analysis system (SIEM), etc., to normalize and aggregate the data scattered in every corner of the network.

[0188] After collecting the original logs, data cleaning and format standardization are required. Since the log formats of different data sources vary, it is necessary to write regular scripts to parse them into a unified key-value pair format (such as JSON). Common fields include timestamp, user ID, operation type, object, client IP, etc. At the same time, noise data should be filtered out and missing fields should be completed. The standardized data can be stored in a big data platform (such as Hadoop) for backup.

[0189] Next, the feature engineering module extracts attribute features from the standardized logs that help characterize user behavior patterns. Commonly used statistical features include:

[0190] Counting features: number of times a user logs in in a day, number of times a user accesses sensitive tables, etc.

[0191] Probabilistic features: the frequency of users’ operations during non-working hours, the frequency of accessing high-risk assets, etc.

[0192] Proportional features: the proportion of users modifying data, the proportion of deleted records, etc.

[0193] Trend characteristics: Statistics of operation frequency changes by day / week / month;

[0194] Deviation characteristics: the degree of deviation between this week's behavior and the same period in history, etc.

[0195] These features quantify user behavior from different perspectives and provide a richer basis for abnormality determination. After feature extraction, further normalization / standardization processing is usually required.

[0196] Finally, write the standardized log data into the UEBA system to prepare for model training. Ideally, the log data should contain user behavior trajectories for as long as possible (such as several months), so that the learned behavior baseline is more comprehensive and stable. To balance timeliness and performance, it is recommended to synchronize new logs from the data source to UEBA in an incremental manner on a regular basis.

[0197] S3.2: construct a random forest model, train the random forest model, and establish a baseline of normal user behavior;

[0198] In this step, a machine learning algorithm is used to automatically model the user behavior patterns from historical logs, form a description of normal behavior, and provide a reference for the determination of abnormal behavior.

[0199] Among numerous machine learning algorithms, the embodiment of the present invention selects Random Forest to construct a behavior baseline model. Random Forest is a supervised learning algorithm based on the integration of decision trees, which can be used for both classification and regression. In the field of anomaly detection, Random Forest stands out for its ease of use, robustness, and interpretability.

[0200] The basic idea of Random Forest is to randomly draw multiple different subsamples from the training set through Bootstrapping, train a decision tree on each subsample, and then vote or average the determination results of these decision trees to obtain the final prediction value. Formally, assume the training sample is D = {(xi, yi)} (i = 1, 2,..., N), where xi is the feature vector of the i-th user and yi is the corresponding label (normal or abnormal). The process of Random Forest training and prediction is as follows:

[0201] 1) Repeat the following steps m times to generate m decision trees:

[0202] a. Randomly draw a subset D' of the same size as D from D with replacement; b. Train a decision tree on D': at each split, randomly select k (k << d) from all d features, select the optimal feature as the split node, and recursively generate subtrees;

[0203] c. The decision tree grows until stopping conditions such as reaching the maximum depth and the minimum number of samples in leaf nodes are met.

[0204] 2) For the feature vector x of a new user new , use the m decision trees to make predictions respectively, and estimate the probability {p1, p2,..., pm} that it is an abnormal behavior;

[0205] 3) When the prediction task is classification, the voting method is adopted, that is

[0206] if (1 / m) * ∑ m i＝1 I(p i > θ) > 0.5, where I is the indicator function and θ is the anomaly determination threshold,

[0207] then x new is an abnormal behavior,

[0208] else x new is a normal behavior;

[0209] 4) When the prediction task is regression, the average method is used, that is,

[0210] if(1 / m)*∑ m i＝1 I(pi)>θ

[0211] then x new For abnormal behavior,

[0212] else x new is normal behavior.

[0213] The above process shows that random forests adaptively learn decision rules from data without manually setting hard rules. Each decision tree can be regarded as a weak classifier. By integrating a large number of weak classifiers, a strong classifier can be obtained to avoid the one-sidedness of a single model. In addition, the two randomnesses in random forests (row sampling and column sampling) reduce the correlation between different decision trees, significantly improving the generalization ability of the system.

[0214] In the training of random forests, there are several key hyperparameters that need to be tuned:

[0215] The number of decision trees m: The larger the m, the stronger the fitting ability, but the greater the computational overhead. Generally, a trade-off is made based on the learning curve and resource constraints;

[0216] Feature sampling number k: The larger k is, the more complex a single decision tree is, and the easier it is to overfit. The empirical value is k = d^0.5;

[0217] Maximum depth of decision tree, minimum number of node samples: control the complexity of a single decision tree. Too large or too small will affect performance. Cross-validation can be used for optimization.

[0218] In addition to the above general parameters, random forests in anomaly detection scenarios also need to consider:

[0219] Sample imbalance problem: Abnormal behaviors are rare after all. If left untreated, negative samples can easily be overwhelmed. Strategies such as undersampling, oversampling, and cost-sensitive learning can be used;

[0220] Selection of abnormality judgment threshold: If the threshold is too high, abnormalities will be missed; if it is too low, normality will be falsely reported. The optimal selection of the threshold needs to balance security and user experience, and can be dynamically adjusted in combination with specific scenarios;

[0221] Impact of noisy data: Hackers may deliberately forge some normal behavior logs to confuse the audience. Measures such as data cleaning and feature weighting need to be taken to enhance the robustness of the model.

[0222] After training, the random forest summarizes granular normal behavior "pixels" from the behavior logs, and multiple "pixels" are spliced ​​into a complete "user portrait". This dynamically updated portrait is the baseline of user behavior.

[0223] The training of random forest is a continuous iterative process. When new behavior logs are generated, the model needs to be retrained periodically to promptly incorporate new behavior patterns into the baseline. At the same time, the model performance should be evaluated regularly, and features and parameters should be optimized against expert knowledge. Only by giving equal importance to training and operation can the behavior baseline keep up with the pace of business development.

[0224] S3.3: Inputting the user operation log into the trained random forest model to identify the user's abnormal behavior pattern;

[0225] Use the trained random forest model to perform anomaly detection and early warning on user behavior data collected in real time.

[0226] When the UEBA system receives a new user operation log, it first performs data standardization and feature engineering on it to extract the feature vector x that is the same as the training data. new For specific feature types, please refer to the description of S3.1.

[0227] Next, xnew is input into the random forest model. The model observes x from different perspectives. new , and judge their abnormal probability one by one. Assume that the model contains m decision trees, and each tree learns a set of abnormality judgment rules (i.e., the feature threshold on the split node). For the i-th tree, if x new If x satisfies all the rules on its split path and finally falls into a leaf node, then new The probability of anomaly p on this tree i , is equal to the abnormal proportion of the training samples in the leaf node. After repeating m times, m abnormal probability estimates {p1, p2, ..., pm} are obtained.

[0228] Then, the prediction results of m decision trees are aggregated using voting method or averaging method to obtain the final abnormal judgment of xnew.

[0229] When abnormal behavior is detected, the UEBA system automatically triggers an alert and notifies security operators via email, SMS, page pop-up windows, etc. Alert information usually includes detailed clues such as user account, time and location of the behavior, abnormal score / label, decision path, etc., which makes it easier for on-duty personnel to quickly locate and trace abnormalities.

[0230] Considering the complexity of the real environment, a single abnormal behavior does not necessarily mean that the user has malicious intent. Therefore, alerts are usually divided into multiple levels, such as suspicious, high-risk, and serious, representing the harm of abnormal behavior to the security of the organization. For low-level abnormalities, the system only issues an alarm prompt; for high-risk abnormalities, manual intervention is required for verification; serious abnormalities may also trigger linkage controls such as account locking and permission recovery. Through graded response, the negative impact of false alarms is reduced, and major risk events can be curbed in a timely manner.

[0231] The effectiveness evaluation of abnormal behavior recognition can be divided into two methods: offline and online:

[0232] Offline evaluation: Randomly extract a batch of samples from historical logs as the test set, and calculate the accuracy, recall, F1 value and other indicators by comparing the prediction labels of random forest and expert annotations;

[0233] Online evaluation: Statistics on the hit rate, missed alarm rate, and false alarm rate of early warnings over a period of time, analysis of changes in the activity of abnormal users, manual sampling of high-risk / serious anomalies, and evaluation of the effectiveness of identification and response.

[0234] The abnormal behavior identification model is not a one-time solution. Hackers' methods are constantly being updated, and their routines are becoming increasingly hidden. Therefore, it is necessary to use external knowledge such as security incidents and expert feedback to continuously iterate and optimize the random forest model to keep up with the pace of the opponent. Specific measures include: introducing new data sources, updating feature engineering solutions, adjusting forest scale and stop conditions, weighting obvious abnormal samples, maintaining blacklists and whitelists, etc. Only when the model and operations evolve synchronously can the safety net of behavioral anomaly detection be continuously woven tighter and tighter.

[0235] Method 2 includes steps C1-C6:

[0236] C1: Obtain the user operation log;

[0237] Collect user login-related operation logs from various IT systems to provide data support for abnormal login behavior detection.

[0238] First, we need to comprehensively sort out the account login scenarios and data sources within the enterprise. Common login events occur in:

[0239] Operating system: Windows / Linux servers, employee computers, etc.;

[0240] Office applications: ERP, OA, CRM, financial systems, etc.;

[0241] Development platform: code repository, bug management system, CI / CD pipeline, etc.;

[0242] Network equipment: VPN, firewall, network audit system, etc.

[0243] It is necessary to evaluate the importance of each system one by one and determine the priority of login data collection.

[0244] Next, write a log parsing and conversion tool to standardize heterogeneous login logs into a unified format. Take the Linuxsecure log as an example:

[0245] ```

[0246] Jan 1 12:34:56localhost sshd

[1234] :Accepted password for user1 from192.168.1.100port 12345ssh2

[0247] ```

[0248] The key fields that can be extracted include: time of event occurrence (datetime), user name (user), login IP (ip), port (port), etc. These fields need to be converted into structured Key-Value pairs for subsequent processing:

[0249] ```

[0250] {

[0251] "datetime":"2022-01-01 12:34:56",

[0252] "user":"user1",

[0253] "ip":"192.168.1.100",

[0254] "port":12345,

[0255] "type":"login"

[0256] }

[0257] ```

[0258] For application system login, there are usually more abundant user attributes and environment attributes available for collection, such as:

[0259] ```

[0260] {

[0261] "datetime":"2022-01-01 12:34:56",

[0262] "user":"zhangsan",

[0263] "ip":"10.20.30.40",

[0264] "device":"iPhone 12",

[0265] "os":"iOS15.1",

[0266] "browser":"Safari",

[0267] "type":"login",

[0268] "result":"success",

[0269] "authmethod":"faceid"

[0270] }

[0271] ```

[0272] In addition to successful logins, logs of failed logins should also be collected to record the reasons for failure (such as incorrect passwords, account lockouts) as clues to potential threats.

[0273] The frequency of log collection can be determined based on the enterprise's network scale and security baseline requirements, usually in real-time or near-real-time. Big data collection tools such as Flume and Logstash can be used to efficiently and reliably transmit login logs to the data analysis platform.

[0274] Considering that the volume of login logs may be very large, it is recommended to use lightweight data formats (such as JSON) for storage, buffer them through message queues such as Kafka, and finally store them in distributed storage engines such as Elasticsearch and ClickHouse to support subsequent real-time computing and interactive query analysis.

[0275] C2: defines the semantic security super attributes of the user operation log, including login time, login IP address, and device information used;

[0276] This step extracts the most valuable semantic attributes for determining the legitimacy of user identity from the login log, laying the foundation for feature engineering of abnormal login behavior.

[0277] The abnormality of login behavior is essentially the degree to which the login event deviates from the user's usual behavior pattern. Assuming that the user usually only logs in during the day and with a company IP, if there is a sudden login in the early morning or an overseas IP, it is very likely to be a danger signal. In order to characterize this deviation, it is necessary to extract the behavioral features that best reflect the user's habits from the massive login events, which are called semantic security super attributes in the embodiment of the present invention.

[0278] Based on login scenarios and attack experience, this solution focuses on the following three types of semantic security super attributes:

[0279] 1) Login time. The following indicators are used to describe the distribution characteristics of users’ login time:

[0280] Login frequency during working hours: the number of times you log into the system from 9:00 a.m. to 6:00 p.m.;

[0281] Non-working hours login frequency: the number of system logins from 10 pm to 4 am the next day;

[0282] Holiday login frequency: the number of times you log into the system on holidays and weekends.

[0283] Generally speaking, the login behavior of legitimate users has obvious time patterns (such as 9 to 5), while abnormal logins such as database collisions and brute force attacks ignore time boundaries.

[0284] 2) Login IP address. The following indicators are used to describe the geographical distribution characteristics of users’ logins:

[0285] Frequently used IP login frequency: count the number of times users log in from office IP and home IP respectively;

[0286] New IP login frequency: count the number of first-time login IPs;

[0287] Frequency of IP logins from other cities: counts the number of IP logins that occur in non-resident cities;

[0288] Suspicious IP login frequency: counts the number of IP logins from Tor nodes and botnets.

[0289] Legitimate users usually access the system in a fixed trusted network, while abnormal login IPs are more random and dynamic.

[0290] 3) Device information used. The following indicators are used to describe the distribution characteristics of the user's login device:

[0291] Frequent login frequency of common devices: count the number of times users log in using PC and mobile phone respectively;

[0292] New device login frequency: count the number of first-time login devices;

[0293] Login frequency of suspicious devices: count the number of logins using mobile phones and simulators.

[0294] Legitimate users tend to use fixed devices to access the system, while abnormal logins usually come from a variety of unfamiliar devices.

[0295] The above indicators quantify the distribution pattern of user login behavior from the perspectives of time, location, and device. When extracting semantic security super attributes, it is necessary to make flexible adjustments based on the business model and personnel attributes of the enterprise. For example, for sales personnel who travel frequently, the restrictions on remote login can be appropriately relaxed.

[0296] In addition, when counting indicators related to the time dimension, it is necessary to pay attention to the impact of time zones and daylight saving time. When counting indicators in the IP dimension, it is necessary to correctly identify special addresses such as NAT gateways and IPv6. When counting indicators in the device dimension, it is necessary to identify abnormal traffic from group control devices and disguised UAs.

[0297] An effective way to calculate semantic security super attributes is to first count the overall distribution of users' semantic attributes over the entire period based on the full login logs to establish their behavioral baselines; then use a sliding time window to count the distribution of users' semantic attributes over the most recent period of time (such as 1 hour or 1 day) as their real-time portraits. By comparing the two, possible behavioral anomalies can be discovered.

[0298] C3: Generate a simulated abnormal login attack pattern, wherein the abnormal login attack pattern includes login attempts during non-working hours, login attempts from IP addresses in different regions, and / or login attempts using different devices;

[0299] Through expert knowledge, various abnormal login attack scenarios are artificially constructed, and corresponding login log data are simulated for subsequent model training.

[0300] Machine learning models usually require a large number of positive and negative samples (i.e. normal logins and abnormal logins) for training, but in reality, abnormal logins are few and far between, and the samples are seriously unbalanced. To expand the abnormal data set, security experts can combine threat situations and attack and defense experience to actively simulate various abnormal login scenarios and artificially generate simulated attack traffic. This method is called data augmentation.

[0301] Referring to well-known threat frameworks such as MITRE ATT&CK, the abnormal login attacks that this solution intends to simulate are mainly:

[0302] 1) Database attack: using user accounts and passwords leaked from other websites to attempt batch login. Its characteristics are:

[0303] Repeated use of a small number of accounts, with a high rate of incorrect passwords;

[0304] The traffic peaks are concentrated in a short period of time.

[0305] Use an anonymous proxy IP to forge a login address.

[0306] To simulate a credential stuffing attack, we can collect publicly leaked account and password repositories from the Internet, randomly select some samples, and construct a large number of login failure logs.

[0307] 2) Brute force cracking: exhaustively search for common weak passwords in the dictionary and try to log in repeatedly. Its characteristics are:

[0308] Detecting a large number of accounts, the login failure rate is extremely high;

[0309] Intensive attempts in a short period of time, showing periodic peaks and troughs;

[0310] They tend to be launched during times such as late at night and on holidays when people are less alert.

[0311] To simulate brute force attacks, you can use tools such as Hydra and Medusa, set up password dictionaries, initiate timed and quantitative automated logins to the target system, and generate regular failure logs.

[0312] 3) Cookie impersonation: stealing the user's login cookies and disguising them as legitimate session access. Its characteristics are:

[0313] Use Cookie or Token directly and skip password authentication;

[0314] Forge user information in cookies and pretend to be a victim.

[0315] To simulate Cookie spoofing, you can manually modify the Cookie captured by the packet capture tool, such as changing the user name to administrator, changing the login IP to overseas, etc., and then replay the request to generate an abnormal login log.

[0316] 4) Two-factor bypass: Stealing dynamic passwords and breaking through two-factor restrictions. Its features are:

[0317] Ability to verify by second factor such as SMS or dynamic token;

[0318] The dynamic code is replayed immediately after a password failure, and the interval between two logins is extremely short.

[0319] To simulate 2FA bypass, you can use the real user's account and password, manually intercept the dynamic verification code, and initiate a second login within the validity period to generate a login event with abnormal time.

[0320] C4: Mixing the simulated abnormal login attack mode and normal login behavior mode to form a training data set;

[0321] Artificially simulated abnormal login events and normal login events collected in the real environment are summarized and mixed in appropriate proportions to form a data set for training the abnormal login detection algorithm.

[0322] Through C1-C3, the embodiment of the present invention obtains a large number of normal login logs and a small number of simulated abnormal login logs. In order to build a classification model, it is necessary to combine the two into a structured training sample according to a certain strategy. The training sample usually consists of three parts: semantic security super attribute, original login log, and label. Take the login IP as an example (as shown in Table 1):

[0323] Table 1

[0324]

[0325] Among them, semantic security super attributes (login frequency, new IP frequency, etc.) are extracted from the original login log through feature engineering, showing the deviation between the login event and the user's historical behavior. The original login log (login time, host, result, etc.) retains the scene information when the event occurred. The label indicates the nature of the login event, which is determined by security experts based on attack simulation and threat conditions. Abnormal logins are marked as 1 and normal logins are marked as 0.

[0326] C5: constructing an SVM model or a random forest model, and inputting the training data set into the SVM model or the random forest model;

[0327] Using machine learning algorithms, based on the training data set built by C4, the classification rules for abnormal login detection are automatically learned.

[0328] In order to realize the abnormal detection of login events, the embodiments of the present invention generally model it as a binary classification problem. The input of the model is the semantic security super attribute of each login log, and the output is the probability of determining whether the login is abnormal. The ideal classifier can maximize the separation interval between the abnormal class and the normal class in the feature space.

[0329] Considering the nonlinear and high-dimensional characteristics of the login data, this scheme selects support vector machine (SVM) and random forest as the basic classifier. Both have good performance in the field of anomaly detection.

[0330] For SVM, the basic idea is to find a hyperplane in the sample space so that the interval between abnormal points and normal points on both sides of the hyperplane is maximized. Formally, the SVM classifier f(x) is defined as:

[0331]

[0332] Among them, x i is the feature vector of the i-th training sample, yi∈-1, 1 is the corresponding binary label, a i is the Lagrange multiplier, b is the bias term, K(x i , x) is a kernel function, which is used to implicitly map the original features to a high-dimensional space.

[0333] The training process of SVM is to solve the following optimization problem:

[0334]

[0335] sty i (w·φ(x i )+b)≥1-ξ i ,ξ i ≥0

[0336] Among them, w is the normal vector of the classification hyperplane, C is the penalty factor, which weighs the classification interval and misclassification tolerance, (x) is the feature after being implied by the kernel function, ξ i It is a slack variable that allows a small number of samples to be misclassified.

[0337] This problem can be solved by optimization algorithms such as SMO and gradient descent, and finally the model parameters a and b are obtained. Substituting the feature vector of the training sample with non-zero a into the decision function of abnormal login detection, we can get:

[0338]

[0339] If f(x)=1, the login event x is judged as abnormal, otherwise it is judged as normal.

[0340] In comparison, random forests evaluate the abnormality of login events from different perspectives by integrating multiple decision trees. When training each tree, a bootstrap subset is first self-sampled from the total sample, and then a classification tree is recursively generated in the feature subspace of the subset. The category of the sample that falls on the leaf node is determined by the majority vote of the node. The average of the judgment results of a single decision tree is the overall classification result of the random forest:

[0341]

[0342] Among them, T is the total number of decision trees, f i (x) is the classification result of the i-th decision tree for event x. If F(x)>0.5, x is judged as an abnormal login.

[0343] Random forest enhances the diversity of single decision trees through bootstrap sampling and random selection of attributes, and corrects the overfitting problem that is prone to occur in anomaly detection to a certain extent. At the same time, random forest can give an importance measure for each attribute, which is convenient for explaining the semantic root cause of the anomaly. For example, if the "number of failed logins" attribute has the highest importance, it indicates that blasting may be the main anomaly mode.

[0344] In practice, both SVM and random forest have many hyperparameters that need to be tuned, such as C and Y for SVM and T and maximum tree depth for random forest. Automatic parameter tuning methods such as grid search and random search can be used to compare candidate parameter combinations on the validation set to select the parameters with the best F1-Score or AUC. Information leakage should be prevented when tuning parameters, that is, the parameter tuning data and test data should be strictly isolated.

[0345] In addition, the data distribution of anomaly detection tasks often evolves dynamically. Hackers' methods are constantly changing, and user behavior habits may also change. Therefore, it is necessary to regularly retrain the detection model with newly collected login data to capture new abnormal patterns in a timely manner. The online serving model should also continuously monitor performance indicators and trigger an alarm when the accuracy drops below the threshold, prompting the security operation team to iterate the model.

[0346] C6: inputting the semantic security super attribute into the trained SVM model or random forest model to perform abnormal behavior recognition;

[0347] The trained and optimized classification model is deployed to the production environment, so that it can capture the massive login events generated by the business system in real time and automatically identify the abnormal behaviors contained therein.

[0348] When new login behaviors are generated in the online business system, the security log management system (such as SIEM) will collect relevant original logs in real time and transmit them to the data analysis platform. Through a series of parsing, filtering, and enrichment, the platform converts the original log stream into a standardized login event stream, and counts the semantic security super-attributes of each event in real time, such as the number of logins and failure rate within the IP / device / time window, which represents the degree to which the login behavior deviates from the user's historical pattern.

[0349] Next, the real-time computing engine (such as Flink, Storm) pulls the latest login event from the message queue, encodes the semantic super-attribute according to the model input format, and calls the trained abnormal login detection model (SVM or random forest) to predict the abnormal probability of each login behavior in real time. When predicting, the classifier matches the behavior pattern of the login event with the abnormal features it has learned. The higher the score, the greater the suspicion of abnormality.

[0350] For random forests, the formula for calculating anomaly probability is:

[0351]

[0352] Among them, T is the total number of decision trees, Ni(x) is the number of abnormal samples in the leaf nodes of the i-th decision tree, and Li(x) is the total number of samples in the leaf nodes. Intuitively, P(x) is to slide the event x along the decision path of T decision trees. If the leaf node it falls into is highly abnormal, then x will show an abnormal tendency as a whole.

[0353] For SVM, the calculation of abnormal probability requires the use of methods such as Platt Scaling to convert the hard decision output by the classifier into soft probability:

[0354]

[0355] Among them, f(x) is the discriminant function of SVM, A and B are Sigmoid calibration parameters, which can be fitted by maximum likelihood estimation. Intuitively, the larger the absolute value of f(x), the farther the event x is from the classification hyperplane, and the higher the probability of being classified as an anomaly.

[0356] Finally, the anomaly detection engine outputs the original information, semantic super attributes, and anomaly probability of the login event and stores them persistently for subsequent security operations such as visualization, alarm notification, and event investigation. Abnormal events are usually included in the SOAR (Security Orchestration Automated Response) workflow to trigger automatic or manual threat hunting and trace the source of the event.

[0357] S4: Based on the data access and transmission logs, assess the risk of data leakage and generate a risk report;

[0358] S4.1: Construct Bayesian network model;

[0359] A causal reasoning model is constructed using a Bayesian network to characterize the dependency of various security elements in data access and transmission scenarios from the perspective of a probability graph, providing a global perspective for the assessment of data leakage risks.

[0360] A Bayesian network is a probabilistic directed acyclic graph model, where nodes represent random variables and edges represent conditional dependencies between variables. If there is a directed edge from variable X to Y, then X is called the parent node of Y. Each node has a conditional probability table (CPT), which describes the probability of the node taking various values ​​under different parent node values. Using the joint probability distribution formula, a Bayesian network can be expressed as:

[0361]

[0362] Among them, Xi is the i-th node, representing a safety factor, and Pa(Xi) is the set of parent nodes of Xi. This formula reflects the important property of Bayesian network: local Markov property, that is, each variable depends only on its parent node and is conditionally independent of its non-descendant nodes.

[0363] In data access and transmission scenarios, typical security factors that affect data leakage risks include:

[0364] User attributes: identity, role, department, etc.

[0365] Data attributes: data type, sensitivity, owner, etc.;

[0366] Environmental attributes: time, location, network, etc.;

[0367] Operation attributes: access, copy, export, etc.;

[0368] Communication properties: protocol, encryption method, sender and receiver, etc.

[0369] Therefore, the corresponding Bayesian network can be designed as Figure 4 , the Bayesian network describes the factors affecting data leakage risk and their causal relationships from five dimensions: user, data, environment, operation, and communication. For example, the sensitivity of data (C) is affected by both user identity (A) and department (B); the operation type (D) determines the communication protocol (E) and data volume (I) used; the geographic location of the destination IP (H) and the data volume (I) jointly determine the final leakage risk level (J).

[0370] In Bayesian networks, the values ​​of variables are usually discrete. For continuous variables (such as data volume), they need to be discretized through binning, clustering and other methods. The granularity of discretization must be balanced between information loss and computational efficiency. The number of states for each variable must also be controlled within a reasonable range. Too many states will cause the CPT to be too sparse.

[0371] In addition, attention should be paid to the scalability of the Bayesian network. When introducing new security elements, the graph structure should be able to be flexibly adjusted, and parameter learning should be able to be incrementally updated. A structured and modular modeling approach should be adopted to facilitate future modification and reuse.

[0372] S4.2: Training the Bayesian network model using historical data;

[0373] By utilizing massive data access and transmission logs collected in real environments, the parameters in the Bayesian network are learned in a data-driven way to characterize the joint distribution of various security factors, thereby making more reliable inferences about data leakage risks in unknown scenarios.

[0374] Relying on security management products and network monitoring tools, enterprises can collect a large amount of user data behavior logs, including user profile, access object, time and place, operation type, network protocol, data volume, etc. These data can be mapped to the state variables of each node in the Bayesian network.

[0375] Formally, assume that m data records D = {D1, D 2, ...,D m}, where each Di={D i1 ,...,D in} represents a data access or transmission behavior, D ij represents the observed value of the jth node in the Bayesian network. The training process of the Bayesian network is to estimate the conditional probability table (CPT) of each node in the graph, that is, P(D ij |Pa(D ij )).

[0376] Commonly used Bayesian network parameter learning methods are:

[0377] 1) Maximum Likelihood Estimation (MLE).

[0378] 2) Bayesian estimation.

[0379] 3) Expectation-Maximization (EM).

[0380] It should be noted that the above methods all assume that the training data is independent and identically distributed. In data access logs, there are often dependencies between users and time, and time series models such as LSTM and CRF need to be used to model them.

[0381] In addition, hackers may actively forge access logs, causing parameter estimation bias. Therefore, before using real logs, they need to be denoised to remove known malicious accesses. Anomaly detection can be achieved using expert rules or unsupervised learning methods.

[0382] Finally, the Bayesian network should be incrementally trained regularly using newly collected access logs. When the distribution difference between the new log sample and the current model exceeds the threshold, the online update of the parameters is triggered to ensure that the risk assessment is synchronized with the latest behavior pattern.

[0383] S4.3: Input the data access and transmission logs into the Bayesian network model, evaluate the data leakage risk, identify potential risk points and abnormal behaviors, and generate a risk report;

[0384] This step uses the trained and optimized Bayesian network model to conduct a comprehensive multi-factor analysis of real-time data access and transmission behaviors, automatically discover high-risk operations and abnormal events, and assist security managers in taking targeted defense and investigation measures.

[0385] When new data access and transmission behaviors occur in the enterprise network, the behavior logs will be collected in real time and transmitted to the Bayesian network model. The model parses the log information into specific values ​​of each security element, such as <user identity = Zhang San, data type = source code, operation type = download, data volume = 100MB>, etc.

[0386] Next, the Bayesian network reasoning algorithm (such as exact reasoning and approximate reasoning) is used to calculate the posterior probability of data leakage risk under the conditions of these factor values:

[0387] P (risk level | user identity, data type, operation type, data volume, ...)

[0388] The reasoning process uses conditional probability links to substitute the values ​​of each node into the joint distribution formula to obtain the marginal distribution of the "risk level" node. This distribution describes the possibility of data leakage risk in the current security context.

[0389] To intuitively characterize the risk, the posterior probability can be mapped to the preset risk level, for example:

[0390] Table 2

[0391] Posterior probability Risk Level [0,0.3) Low risk [0.3,0.7) Medium risk [0.7,1.0] High risk

[0392] For high-risk behaviors whose posterior probability exceeds the warning threshold (such as 0.7), the system automatically triggers an alarm, generates a risk event report, and notifies security operations personnel to intervene in the analysis. The report usually contains elements such as the time, location, person, object, and behavior of the risk event, which are used to restore the scene of the event.

[0393] In specific risk assessment and anomaly location, the Bayesian network reasoning mechanism can provide strong support:

[0394] 1) Causal analysis. Using the causal dependency of the Bayesian network, we can trace back to multiple causes of risk. For example, the key factors that cause high risk may be the user's sensitive identity, the high confidentiality of the data, and the abnormal type of operation, which can provide a direction for subsequent security reinforcement.

[0395] 2) Hypothesis prediction. Based on the Bayesian network, the benefits of security control measures can be quantitatively evaluated. For example, assuming that the cross-domain transmission of highly sensitive data is restricted, the effect of control can be predicted by setting the evidence variable (i.e. locking the "protocol type" to the intranet protocol) and observing the change in the posterior probability of risk.

[0396] 3) Anomaly detection. In the Bayesian network scenario, unsupervised behavior anomaly detection can be achieved. Intuitively, if a security factor takes a value that rarely appears under the configuration of its parent node, the suspiciousness of the behavior will surge. The accumulation of such "low-probability" events will make the risk posterior probability of the behavior far exceed that of similar behaviors, making it an anomaly.

[0397] While generating data leakage risk reports, early warnings should also be issued for high-risk behaviors and related events to drive security operation processes such as incident investigation and violation tracing. New threat patterns discovered during the investigation can be fed back into the Bayesian network to achieve iterative optimization of human-machine collaboration.

[0398] In another embodiment, in addition to using the Bayesian network method, an advanced persistent threat (APT) detection model can also be used to perform data leakage risk assessment and detection. Specifically, steps A1-A5:

[0399] A1: Use a self-supervised sequence learning algorithm to build an advanced persistent threat APT detection model, where the APT detection model is a Transformer, BERT or LSTM model;

[0400] In A1, the paradigm of self-supervised sequence learning is adopted, and cutting-edge deep learning models such as Transformer and BERT are used to build a threat situation center for APT detection, so as to improve the system's ability to resist complex and persistent attacks through data-driven means.

[0401] APT (Advanced Persistent Threat) is a type of highly targeted and concealed network attack. APT attackers usually go through long-term lurking and complex infiltration to eventually steal key data or destroy core assets. Due to the highly customized methods, traditional rule-based and statistical detection methods are difficult to detect APT traces.

[0402] In order to capture the clues of APT from massive network behavior logs, it is necessary to deeply mine the hidden association patterns in multi-dimensional heterogeneous data. This solution draws on the latest progress in the field of natural language processing, equates network behavior sequences with word sequences, uses language models to learn the contextual semantics of behaviors, and builds a cognitive radar for APT detection.

[0403] Specifically, the embodiment of the present invention preferably uses the Transformer, BERT and other models with leading performance in the current NLP field as the basic architecture for APT detection:

[0404] 1) Transformer. This model uses a self-attention mechanism to encode the contextual relevance of the input sequence through three vectors: Query, Key, and Value. Its advantages are:

[0405] The loop structure in models such as RNN is abandoned to achieve parallel computing, which greatly improves the training efficiency;

[0406] Multi-head attention is used to characterize context from different semantic subspaces and capture richer sequence features;

[0407] Position encoding is introduced to explicitly model the temporal relationship of sequences and highlight the influence of order.

[0408] Transformer is good at modeling long-range dependencies and is particularly suitable for characterizing multi-hop behavioral relationships in APT attack chains.

[0409] 2) BERT. Based on Transformer, BERT innovatively proposed two self-supervised pre-training tasks: Masked Language Model and Next Sentence Prediction:

[0410] MLM randomly masks some words in the input sequence, and trains the model to predict the masked content based on the context;

[0411] NSP randomly samples sentence pairs and trains the model to determine whether two sentences are adjacent in the original text.

[0412] By pre-training on a huge amount of unlabeled corpus, BERT can learn the universal semantic representation of language. Then, by fine-tuning on small sample data of downstream tasks, it can achieve SOTA performance in multiple categories of tasks.

[0413] In addition to Transformer, classic sequence models such as LSTM and GRU can also be used to build APT detection engines. Compared with Transformer, the characteristics of these models are:

[0414] Adopting the gating mechanism, the contribution of historical information to the current decision is adaptively adjusted to update the hidden layer state;

[0415] Memory Cells are used to retain long-term memory and depict the progressive relationship between behaviors with a large span;

[0416] Bidirectional coding sequence integrates forward and reverse contexts to enhance the understanding of sequence semantics.

[0417] These mechanisms also help to discover the causal relationships and penetration patterns of APT attacks in the time dimension.

[0418] In specific applications, the matching of model performance and scenarios must also be considered. For example, if the APT attack chain shows significant stages, and the behaviors of each stage are very different, then Transformer may be more suitable; if the APT attack is mainly low-speed, covert, and continuous penetration, and each step is closely linked, then the remote memory mechanism of LSTM may be more effective. It is necessary to be guided by data and experience and balance modeling capabilities and computing efficiency.

[0419] In addition, APT detection also requires the introduction of domain knowledge to customize and optimize the above-mentioned general sequence model. This includes: introducing network protocols, system assets and other types of embedding to capture semantic information of different dimensions; incorporating time decay, abnormal penalty and other mechanisms into attention calculations in view of the multi-stage and hidden characteristics of APT; using a small number of known APT events to design adversarial samples and strengthen the generalization ability of the model from an adversarial perspective.

[0420] A2: Obtain historical system behavior data, which includes normal behavior and known APT attack behavior data;

[0421] This step builds a comprehensive and targeted threat situation knowledge base by aggregating historical operation logs from all nodes and levels of the network, which is used to train and evaluate APT detection models.

[0422] The key to tracing the source of APT attacks is to screen out clues related to known attacks from massive operation and maintenance data. This requires the embodiments of the present invention to collect behavior logs generated by various systems, devices, and application services in the enterprise intranet environment as widely as possible, and analyze them from a global perspective to identify suspicious behavior patterns.

[0423] First, we need to collect system logs covering the entire network, especially abnormal behaviors related to each link of the APT attack chain, including:

[0424] Connection logs of border gateways and firewalls: record all cross-network communications, which helps detect intrusion attempts by external attackers;

[0425] DNS and Web proxy access logs: record external behaviors such as domain name resolution and Web requests, and can reveal activities such as C&C channels and malicious downloads;

[0426] Authentication audit logs of bastion hosts and VPNs: record all users' remote access and can be used to review account compromise, privilege escalation, and other processes;

[0427] Mail gateway and instant messaging transmission logs: record the outflow of all files and can locate the data leakage paths of social workers and internal personnel;

[0428] Operation logs for terminal security and host monitoring: records abnormal behaviors of all processes and accounts, and can trace processes such as lateral penetration.

[0429] Secondly, we need to comprehensively sort out the data of known APT attack activities and extract typical IOCs (malicious indicators) from real cases to identify intrusion behaviors in each link. Common IOCs include:

[0430] Known C&C server domain name / IP: Communicate with it, highly suspected to be remote control activity;

[0431] Specific URL path and file name: When accessed, malicious payloads may be downloaded;

[0432] Abnormal process and service names: Imitation is often used to disguise itself and evade monitoring;

[0433] Suspicious scripts and command parameters: Executing them usually means intrusion attempts such as file traversal and privilege escalation;

[0434] Abnormal access to sensitive assets and core accounts: This access is likely to mean confidential data leakage, internal personnel rebellion, etc.

[0435] These known attack IOCs can be used to automatically generate simulated attack traffic and enrich training samples for anomaly detection. Experience in attack and defense confrontations shows that the success of APTs often stems from their anti-monitoring capabilities. Abusing normal commands and disguising daily behaviors are their usual tricks. Relying solely on known IOCs for detection and killing is often insufficient.

[0436] Therefore, in addition to collecting explicit known attack logs, it is also necessary to retain the historical data of each system and network segment under normal conditions as much as possible, and use it as a reference benchmark after denoising and sampling. Only by referring to the normal baseline can we more sensitively detect unknown anomalies lurking in it. Large-scale normal samples can also reduce overfitting of a small number of attack samples and improve the model's generalization ability to deal with new variants.

[0437] Finally, when summarizing cross-network and cross-system behavior logs, we must do a good job of pre-processing such as data cleaning, formatting, and time alignment to prepare for subsequent feature fusion. For the captured APT attack traffic, we must also conduct a manual review and mark the behavior links at each stage to guide the causal inference of the detection algorithm.

[0438] It is foreseeable that with the continuous evolution of APT attacks, the determination of abnormal behavior will be a dynamic game process. The embodiments of the present invention need to continuously expand the attack and defense knowledge base and enrich the detection model with newly discovered TTPs (tactics, techniques, and processes) to cope with changes. This requires the continuous collaboration of security analysts, data scientists, and domain experts.

[0439] A3: Use context-aware anomaly detection methods to obtain context information from historical system behavior data, and embed the context information and behavior sequence to form a context feature vector. The context information includes user identity, access time, geographic location, and operation type.

[0440] A3 fully exploits multi-dimensional contextual semantics to characterize the environmental background when network behaviors occur, and assists the sequence model in understanding the abnormality of behaviors from a more comprehensive perspective.

[0441] Abnormal behavior is not "black or white", but often presents "moderate abnormality". In other words, the degree of abnormality of behavior depends not only on the behavior itself, but also on the role attributes of the subject of the behavior and the complex environment of the behavior in time and space. For example, for a sensitive operation, if it is completed by an administrator during working hours, it may be routine maintenance, but if it is attempted by an outsourced person on a weekend, it is very likely to mean unauthorized infiltration.

[0442] Therefore, comprehensive modeling of behavioral anomalies requires starting from the representation of behavior and the context of behavior. Simply relying on behavioral sequence modeling can easily lead to isolated and one-sided judgments. Behaviors must be embedded in specific contexts to make decisions that are more in line with human intuition and reasonable. This is the core idea of ​​context-aware anomaly detection that has emerged in recent years.

[0443] In order to capture the contextual semantics in the APT detection scenario, this solution focuses on the following types of contextual elements:

[0444] 1) User portrait. Describe the identity and background of the person who initiated the operation and reveal the abnormality of the "person". Mainly includes:

[0445] User attributes: name, role, rank, department, etc., reflecting the authority boundaries of the operator;

[0446] Behavioral preferences: commonly used equipment, resident areas, and usual time periods, etc., reflecting the operator's behavioral baseline;

[0447] Abnormal history: historical warning records, violation penalties, etc., reflecting the operator's credit accumulation.

[0448] These features help to promptly detect behaviors such as unauthorized operations.

[0449] 2) Temporal context. Describe the time background of the operation and reveal the abnormality of "time". Mainly includes:

[0450] Time window: date, week, hour, etc., reflecting the natural time attributes of the operation;

[0451] Logical time periods: working days, holidays, shifts, etc., combined with corporate systems to reflect the compliance of operations;

[0452] Trend characteristics: behavior density and periodicity in units of minutes, hours, and days, reflecting the macro laws of operations.

[0453] These features can keenly perceive suspicious behavior patterns such as unannounced visits at dawn and holiday shifts.

[0454] 3) Spatial context. Describe the geographical background where the operation takes place and reveal the abnormality of "ground". Mainly includes:

[0455] Absolute location: geographical coordinates of the operation source IP, the operator to which it belongs, etc.

[0456] Relative location: the physical and logical distance between the operation source and the accessed asset;

[0457] Attributes: country, region, organization, etc. where the IP address is located.

[0458] These characteristics can directly reflect geopolitical risks such as remote small countries and rival high ground.

[0459] 4) Knowledge graph. Combined with business semantics, it depicts the asset value of the operation object and the relationship network of the operator, revealing the sensitivity of the "matter". It mainly includes:

[0460] Asset tags: document classification, core code, executive emails, etc., reflecting the importance of the operation object;

[0461] Risk labels: outbound, printing, leakage, etc., reflecting the degree of danger of the operation;

[0462] Relationship network: relatives, colleagues, friends, etc., reflecting the social connections of the operator.

[0463] By integrating asset value and relationship network, the comprehensive sensitivity of each operation can be calculated, directly targeting the key assets and key individuals of the APT.

[0464] In summary, context awareness is a modeling approach that "empowers knowledge with data", which can significantly improve the accuracy and interpretability of traditional anomaly detection. In terms of technical implementation, the following aspects need to be considered:

[0465] 1) Automatic extraction of contextual features. Using regular matching, named entity recognition and other algorithms, various contextual attributes are extracted from structured data such as network architecture, operation and maintenance processes, and employee rosters, and event tracing technology is used to restore the spatiotemporal background of operational behaviors.

[0466] 2) Semantic embedding of contextual features. The extracted discrete or continuous contextual attributes need to be further mapped into low-dimensional dense vectors through representation learning techniques such as Word2Vec and Node2Vec to characterize the semantic similarity between different contexts.

[0467] 3) Dynamic fusion of contextual features. According to the specific network behavior sequence, the associated user, time, location and other context vectors are dynamically spliced ​​to form context-enhanced behavior features, which are used to feed the downstream sequence anomaly detection model.

[0468] A4: Using the context feature vector to train the APT detection model so that the APT detection model learns system behavior sequence embedding and understands normal and abnormal behavior patterns;

[0469] In the training phase (A4), the goal of the embodiment of the present invention is to give the APT detection model a threat intuition. To develop this intuition, the model needs to "personally experience" normal and abnormal behavior patterns from massive historical data and understand the essential differences between the two.

[0470] First, the historical network behavior data is converted into a unified sequence representation. Taking atomic events of different dimensions such as process, file, network, login, etc. as basic units, they are sorted by timestamp to form a heterogeneous behavior flow that reflects the overall picture of the system.

[0471] Then, context information is introduced to embed atomic behavior events into specific scene semantics. Using representation learning techniques such as word embedding, context elements such as process name, file path, source IP, destination port, and user name are mapped into dense vectors. They are then concatenated with the embedding of the corresponding behavior to form a context-enhanced behavior vector sequence. This fusion of semantics and behavior can help the model see the ins and outs of an event and make a more comprehensive judgment on the degree of abnormality of the event.

[0472] Next, the context-enhanced behavior sequence is input into the APT detection model to start the training journey. Taking Transformer as an example, the model continuously focuses, combines, and transforms the behavior sequence through the self-attention mechanism, "tastes" the cause and effect from different angles, and finally forms an "understanding" of the operating rules of the entire system. Technically, through tasks such as masked language modeling (MLM), the model can learn the internal associations of the sequence and infer its context from the hidden behavior. The process of model learning is also the process of summarizing normal / abnormal behavior patterns from the data.

[0473] After sufficient training, the APT detection model will grasp the inherent patterns of continuity, periodicity, and correlation of events in the system under normal conditions, and can also keenly capture abnormalities when intrusions occur: such as suspicious logins near midnight and unauthorized access to core assets. By feeding unknown behavior sequences into the trained model, its normal or abnormal nature can be immediately determined.

[0474] The formation of this confrontational intuition is inseparable from the massive accumulation of data and the continuous expansion of scenarios. It is necessary to regularly gather the latest attack and defense logs, expand new behavioral dimensions and contextual semantics, use incremental rolling training, and continuously iterate the detection model to synchronize it with the evolution of attack methods.

[0475] A5: Input the data access and transmission logs into the APT detection model, evaluate the data leakage risk in real time, identify potential APT attack behaviors, and generate a risk report.

[0476] At runtime (A5), the real-time log stream undergoes the same serialization and context fusion processing as the training phase, and is converted into a "model language" and sent to the detection engine. At this point, the previous massive training is equivalent to equipping the model with a pair of eyes that can see through threats, and the slightest trace of intrusion is no longer hidden. Combined with the detection results, the system can trigger different levels of alarms to assist analysts in conducting security operations such as investigation and tracing.

[0477] Furthermore, APT detection results can be directly connected to the SOAR orchestration platform, and through the automatic recommendation and issuance of security policies, business continuity assurance can be automated and standardized. For example, after identifying Webshell intrusion behavior, the implanted server can be automatically isolated, firewall rules can be adjusted to block C2 communication, key files can be backed up to prevent tampering, and operation and maintenance personnel can be reminded to repair vulnerabilities in a timely manner. This not only improves operational efficiency, but also minimizes the potential impact of the incident.

[0478] In addition, in one embodiment, the APT detection model can be a large language model LLM based on the transformer architecture. Then A5 specifically includes:

[0479] A5.1: fine-tune the LLM using the context feature vector;

[0480] By utilizing context vectors rich in scene knowledge, the pre-trained large language model is fine-tuned in a targeted manner to enable it to quickly adapt to the task semantics of APT detection and form a domain-customized "security brain".

[0481] Large Language Model is a major breakthrough in the current NLP field. Compared with traditional representations such as bag of words and word vectors, LLM can learn the deep semantics and complex structure of language, and has amazing understanding and generation capabilities. Introducing LLM into the field of network security is expected to achieve behavior description, knowledge management, and attack and defense confrontation based on natural language.

[0482] LLM, represented by OpenAI's GPT and Google's BERT, has mastered general knowledge of language through self-supervised pre-training on massive corpora. This includes vocabulary, grammar, pragmatics, logic, common sense and other levels. However, in the face of specific application scenarios, LLM needs to be fine-tuned and injected with domain knowledge to truly exert its power.

[0483] Specifically for APT detection, the core of fine-tuning LLM is to present the contextual semantics of network behavior to the language model and guide it to learn the internal logic of attack and defense confrontation. This requires:

[0484] 1) The network behavior context vector extracted from A3 is fused with the original input embedding of LLM. Common fusion strategies include concatenation, attention weighting, gating mechanism, etc., which are used to balance general semantics and scene semantics.

[0485] 2) In each Transformer layer of LLM, the query, key, value of self-attention are interactively calculated with the context vector to dynamically adjust the semantic representation of the token.

[0486] 3) In the objective function of LLM, a new regularization term is introduced to constrain the consistency between the context vector and the original semantic vector to avoid domain overfitting.

[0487] 4) Design targeted fine-tuning tasks based on a small amount of known APT corpus, such as security incident reports, traceability analysis documents, etc. Use natural language processing to process APT description text, predict the attack stage it belongs to, and assist LLM in understanding the causal logic in the attack chain.

[0488] After fine-tuning, LLM will form semantic understanding capabilities in the APT field. By inputting a natural language description of network behavior, LLM can analyze the hidden attack intentions, technical details, target assets, and reveal the reasons behind suspicious behaviors.

[0489] For example, if an employee logs into the production server through a Webshell at 3 a.m. and downloads a large amount of business data, ordinary LLM may not be able to detect the security risk, but the fine-tuned LLM can keenly capture the key information:

[0490] "3:00 AM": abnormal time, belonging to the "covert execution" technique in APT;

[0491] "Webshell": tool anomalies, often introduced by vulnerabilities such as file upload and SQL injection, belonging to the "initial access" stage in APT;

[0492] "Employees": their identities are sensitive, and internal personnel have a deep understanding of the target, making it easier to break through the defense line;

[0493] "Downloading business data": This operation is sensitive and means data leakage, which is often the ultimate goal of APT.

[0494] By reasoning from these clues, the fine-tuned LLM can restore that this is most likely a data theft incident initiated by an "insider", and there may be APT subversion and manipulation behind it.

[0495] A5.2: Convert the data access and transmission logs into natural language descriptions;

[0496] Converting structured and formatted network logs into natural language form to facilitate LLM to understand behavioral semantics is the key to applying LLM for APT detection.

[0497] Traditional APT detection often directly performs statistical modeling based on structured log events. However, network logs are highly heterogeneous, and log templates of different systems and protocols vary greatly. Extracting structured behavioral features requires specialized parsing logic and mapping rules, which have poor portability and generalization capabilities.

[0498] Natural language provides a unified representation for heterogeneous logs. Using natural language to describe network behavior is like summarizing the experience of operation and maintenance engineers, giving logs rich context and causal relationships, making it easier for LLM to "understand" behavior from a higher semantic level and perceive anomalies.

[0499] The conversion of logs to natural language requires overcoming two major challenges:

[0500] 1) Log field extraction. The original network logs are often mixed with a lot of metadata (such as date, host name, process number, etc.), and regular expressions are needed to accurately extract the semantic information of each field and filter out redundant elements.

[0501] 2) Field-to-language mapping. Different fields carry different semantic roles (such as subject, predicate, object, adverbial, etc.), and a mapping template needs to be designed to organize the fields into coherent sentences according to their roles.

[0502] Common system logs and their natural language descriptions are as follows:

[0503] Authentication Log:

[0504] Original log: `Mar 12 06:13:21 vpn sshd

[9183] : Failed password for rootfrom 1.2.3.4 port 1066 ssh2`

[0505] Language description: `On March 12th at 6:13 AM, a failed SSH password attempt for the root account was detected from IP address 1.2.3.4 on port 1066.`

[0506] Network connection logs:

[0507] Original log: `2022-04-15 10:32:18 drop udp 192.168.1.100 / 3245->8.8.8.8 / 53len 146`

[0508] Language description: `On April 15th, 2022 at 10:32 AM, an outgoing UDP connection from the internal host 192.168.1.100 on port 3245 to an external DNS server8.8.8.8 on port 53 was blocked. The dropped packet size was 146 bytes.`

[0509] It can be seen that compared with the original log, the language description uses the subject-predicate-object sentence structure to clearly explain the subject, object, time, place and other elements of the event, revealing the logical relationship between the event elements, which facilitates LLM to perform semantic reasoning.

[0510] To achieve automatic conversion from log to language, you need:

[0511] 1) For different types of network logs (such as SSH, HTTP, DNS, etc.), customize the regular template for extracting fields and mark key fields with named capture groups.

[0512] 2) Manually define the mapping rules from log types to language templates, fill the sentence slots with field names, and assemble them into a complete event description.

[0513] 3) A large number of log samples and their corresponding language descriptions are used to form a parallel corpus, train natural language generation models such as Seq2Seq and T5, and automatically learn the conversion rules from logs to language.

[0514] In practice, due to the limitation of the comprehensiveness of the mapping rules summarized by engineers, it is difficult for the pure rule-based approach to cover all log patterns. Therefore, a more feasible approach is to use a small number of seed rules to assist large-scale corpus learning. That is, first use the rules to bootstrap the language description of a small number of logs, and then use it to expand the training samples and learn more log description generation strategies. At the same time, security experts can score and provide feedback on the generated language descriptions to continuously improve the accuracy and readability of the language descriptions.

[0515] The languageization of logs enables APT detection to directly utilize the latest achievements of natural language processing, simplifying the complex and making the specialized accessible, greatly reducing the complexity of detection in heterogeneous log environments. However, we should also be careful to avoid the loss of detailed information of the event due to overly abstract and brief language descriptions. An effective way is to retain the key fields of the event as semantic slots to facilitate subsequent retrieval and tracing, while giving the fields the necessary context to facilitate LLM perception and understanding. This requires seeking a balance between information redundancy and information completeness.

[0516] A5.3: Using the fine-tuned LLM to perform semantic understanding on the natural language description and identify potential APT attack behavior characteristics;

[0517] The fine-tuned LLM is used to "read and understand" the language description of network behavior, discover suspicious patterns hidden in it from a semantic level, and assist in APT threat discovery.

[0518] After fine-tuning A5.1, LLM has initially acquired language knowledge in the field of network security. This includes:

[0519] Lexical knowledge: This refers to the professional vocabulary in the security field, such as "SQL injection", "DDoS", "password blasting", etc., which can identify suspicious tools, vulnerabilities, assets and other elements that appear in the incident.

[0520] Semantic knowledge: the inherent logical relationship of security events, such as "vulnerability exploitation->remote control", "information collection->target assets", etc., which can perceive the ins and outs of the event.

[0521] Pragmatic knowledge: that is, tactical thinking of attack and defense, such as "bait documents", "traffic obfuscation", "certificate theft", etc., to understand the attacker's intentions and psychology.

[0522] World knowledge: that is, the objective laws of security threats, such as "logging in outside of working days" and "database not encrypted", which reflect the abnormality of the incident.

[0523] Take "an employee logged into the production server through a Webshell at 3 a.m. and downloaded a large amount of business data" as an example. Enter this statement, and the fine-tuned LLM will:

[0524] 1) Extract the key information of the sentence and convert it into an event element graph:

[0525] Person: An employee

[0526] Time: 3 a.m.

[0527] Via: Webshell

[0528] Behavior: Login

[0529] Target: Production Server

[0530] Assets: Business Data

[0531] 2) Contextual connections between inference elements:

[0532] An insider (an employee) can use a known backdoor (Webshell) to circumvent identity authentication and invade sensitive targets (production servers), which means that the threat has penetrated deep into the intranet.

[0533] Webshells that trigger intrusions are usually introduced by file uploads and vulnerability exploits, reflecting the weakness of Web application protection.

[0534] The intrusion occurred at an unusual time in the early morning and directly accessed sensitive business data, which shows that they were well prepared and had a clear goal, and there was probably an organized plan behind it.

[0535] 3) Match known APT attack patterns stored in LLM:

[0536] Attacker Identity: Insider

[0537] Initial access: Webshell

[0538] Execution: Late night hours

[0539] Lateral Movement: Production Servers

[0540] Purpose: Data theft

[0541] Finally, LLM outputs the matching degree between the event and the known APT pattern, such as the probability of an APT attack belonging to "insider + Webshell" is 0.8. At the same time, it gives a high confidence judgment basis, such as the identity of the insider, abnormal attack time, sensitive data leakage, etc.

[0542] It can be seen that LLM "understands" the explicit semantics in the event description (such as a certain employee, business data), combined with the acquired implicit knowledge (such as late night time represents abnormality), and unearths the potential APT characteristics of the incident, just like a virtual threat hunter examining and analyzing the case.

[0543] This intelligent "situational awareness" based on a large language model can significantly reduce the cognitive load of security analysts. Compared with reading lengthy alarm logs, natural language event descriptions are more intuitive and vivid, which helps to diverge thinking and draw inferences. LLM's semantic reasoning ability can find those understated abnormal details as early as possible to avoid major threats from passing by. The rich knowledge stored in LLM also provides a broader perspective for threat analysis, which helps to accurately portray attack methods and attack stages.

[0544] In the future, LLM can further enable the automation of APT detection processes: screening high-risk events based on confidence thresholds to form threat warnings; combining knowledge graphs to correlate multiple events and trace the attack chain; customizing question-and-answer paradigms for different business scenarios to assist security operations. LLM transforms "experience + knowledge" into codable cognitive intelligence, opening up new ways to deal with complex APTs.

[0545] A5.4: Use the language generation capability of LLM to automatically generate risk reports for APT attack incidents;

[0546] By utilizing the natural language generation (NLG) capability of LLM, the results of APT event analysis are output as a highly readable and comprehensive security report, which helps decision makers to intuitively understand the APT situation facing the current network and take targeted defense measures.

[0547] The traditional APT incident handling process relies heavily on manual operations. Security analysts need to manually collect the original alerts from various systems, organize troubleshooting ideas, and write analysis reports. This process is time-consuming and laborious, and is limited by the personal experience of analysts, so the quality of the reports varies.

[0548] LLM provides a new idea for automatically generating APT risk reports. After fine-tuning security knowledge, LLM has the ability to convert structured event information into natural language descriptions. On this basis, with the advantages of LLM in text generation and content organization, end-to-end automation from logs to reports can be achieved.

[0549] Specifically, automatically generating APT risk reports requires the following key technologies:

[0550] 1) Content planning. Based on the report template in the security field, design a report outline with clear structure and logical structure, and clarify the theme and key points to be included in each chapter, such as "incident summary", "attack analysis", "impact assessment", "countermeasures", etc. Embed the report outline into the text generation prompt of LLM to guide the model to organize the report structure.

[0551] 2) Extract key information. The key features of the APT incident analyzed in A5.3, such as attackers, attack time, attack methods, target assets, etc., are extracted as summary information according to their importance in the report. Incorporate prompts in the prompt, such as "The key features of this APT attack include: {% for feature in event feature %} {{feature}}, {% endfor %}".

[0552] 3) Context awareness. Use semantic associations identified in event analysis to maintain contextual coherence when generating reports. For example, when describing "lateral movement", use "initial access" as the background; when describing "data theft", echo the sensitive information in "reconnaissance"; when summarizing "countermeasures", take into account the weaknesses of "vulnerability exploitation".

[0553] 4) Knowledge fusion. The security knowledge used in the event analysis, such as MITRE ATT&CK, CVE, etc., is automatically introduced into the report in the form of annotations and references. This enriches the knowledge breadth of the report and improves the credibility of the analysis. For example, "This attack used the mimikatz tool, which belongs to the 'Credential Dumping' technology (T1003) in MITRE ATT&CK."

[0554] 5) Readability optimization. LLM uses its ability to understand grammar, vocabulary, and semantics to generate fluent, professional, and concise report expressions. For difficult-to-understand professional terms, simple annotations are automatically generated. For obscure long sentences, they are automatically converted into catchy short sentences. The readability of the report is improved, making it easier for managers with non-technical backgrounds to quickly grasp the key points.

[0555] The following is an example of how an APT incident risk report is generated:

[0556] enter:

[0557] Event Features:

[0558] Attacker identity: Internal employee

[0559] Attack time: 2023-04-15 3:00 am

[0560] Attack vector: Webshell on employee computers

[0561] Attack target: Business production server

[0562] Attack method: Use Webshell to log in to the server and download business data

[0563] Impact assessment: 1,000 pieces of data leaked, direct economic loss of 100,000 yuan

[0564] Prompt:

[0565] Please generate a risk analysis report based on the following characteristics of APT events:

[0566] Attack Summary:

[0567] The key features of this APT attack include: {% for feature in event feature %} {{feature}}, {% end for %}

[0568] In summary, this incident was a data theft attack launched by ___ against ___, which caused serious impact on ___.

[0569] Attack Analysis:

[0570] 1. Initial access: The attacker sneaked into the intranet through ___ path at ___ time. This reflects a weakness in ___.

[0571] 2. Lateral movement: The attacker used the high privileges of ___ to access key business assets such as ___, reflecting ___.

[0572] 3. Data leakage: The attacker eventually stole ___ data, caused ___ losses, and exposed ___ and other problems.

[0573] Countermeasures:

[0574] To prevent this type of APT attack from happening again, it is recommended to ___. At the same time, ___. In the future, ___ is also needed.

[0575] Output:

[0576] APT incident risk analysis report

[0577] Attack Summary:

[0578] The key features of this APT attack include: an internal employee acting as the attacker, the attack time being 3 a.m. on April 15, 2023, using the Webshell on the employee's computer as the attack path, targeting the business production server, and using the attack method of infiltrating the server and downloading business data, resulting in the leakage of 1,000 data items and direct economic losses of 100,000 yuan.

[0579] In summary, this incident was a data theft attack launched by an insider against the company's core business system, causing serious data leakage and economic losses.

[0580] Attack Analysis:

[0581] 1. Initial access: The attacker sneaked into the intranet late at night through the Webshell pre-installed on the employee's computer. This reflects the company's weaknesses in employee terminal management and Webshell protection.

[0582] 2. Lateral movement: Attackers used the high privileges of Webshell to directly access key business assets such as business production servers, reflecting the insufficient isolation of the company's network boundaries and the lack of in-depth defense of the intranet.

[0583] 3. Data leakage: The attackers eventually stole 1,000 pieces of business data, causing direct economic losses of 100,000 yuan, exposing the company's unclear data classification and improper access control.

[0584] Countermeasures:

[0585] In order to prevent such APT attacks launched by "insiders" from happening again, it is recommended that companies conduct employee security awareness training as soon as possible to improve the confidentiality awareness and sense of responsibility of internal employees. At the same time, use technologies such as situational awareness and endpoint detection to promptly detect suspicious internal behaviors.

[0586] In addition, we need to improve the network security architecture, strictly implement network partitioning and isolation, and reduce cross-border access from office networks to production networks. For core business systems, we should establish a mandatory access control mechanism, refine data asset classification, minimize user permissions, and effectively curb unauthorized access to sensitive data.

[0587] In the future, the company will need to increase investment in information security, improve management systems, upgrade protection technologies, optimize operational processes, build a comprehensive, integrated security protection and supervision system, maintain network security operations, and safeguard its business.

[0588] It can be seen that LLM automatically sorted out the analysis ideas based on the given event characteristics, refined the key elements such as the time, place, people, and methods of the attack, analyzed the weak links exposed by the attack, evaluated the harm caused by the attack, and gave pertinent suggestions on targeted protection measures.

[0589] The report has clear logic and professional and popular language, which helps enterprise managers systematically understand the current status of APT risks and scientifically formulate security management strategies. This shows LLM's strong ability in knowledge extraction and viewpoint exposition.

[0590] A5.5: The LLM extracts key information from the generated report, including attackers, attack methods, and target assets, and constructs an APT attack knowledge graph;

[0591] A5.6: Use knowledge graphs for reasoning and association analysis to discover potential APT attack chains and attacker teams

[0592] LLM is used to extract entity and relationship information from security reports, automatically organize them into a knowledge graph that describes APT attack elements, intuitively depict the overall picture of the attack event, and lay the foundation for attack tracing and threat association.

[0593] Knowledge graph is a structured knowledge representation method based on graphs, which consists of nodes (representing entities) and edges (representing relationships). Organizing knowledge into graphs can vividly display the semantic connections between entities, making it easier to use graph theory algorithms to analyze the relevance, association, influence, etc. of entities and to discover the patterns hidden behind the entities.

[0594] At present, the construction of knowledge graphs in security incident analysis mainly relies on manual extraction of key information from reports, continuous accumulation and iteration. This method is time-consuming and inefficient, and the extracted information is usually coarse-grained, making it difficult to accurately describe the details of APT attacks.

[0595] LLM opens up a new path for the automated and intelligent construction of APT knowledge graphs. Based on the semantic understanding capabilities accumulated in event analysis and report generation, LLM can accurately capture key information in report texts and map it to entities and relationships in the graph.

[0596] Specifically, automatically building an APT knowledge graph from security reports requires the following key technologies:

[0597] 1) Named Entity Recognition (NER). LLM uses its advantages in entity extraction to identify important security factors from reports, such as attackers, attack targets, attack methods, attack tools, etc. Taking "internal employees use Webshell to invade production servers" as an example, LLM can identify:

[0598] Attacker: Internal employee

[0599] Attack tool: Webshell

[0600] Attack target: production server

[0601] Named entity recognition allows key information in the report to be extracted in a structured manner, laying the entity foundation for building a knowledge graph.

[0602] 2) Relationship extraction. On the basis of entity recognition, further analyze the dependency relationship of entities in the sentence and locate the semantic connection between entities. Common entity relationships include:

[0603] "Internal staff using Webshell" corresponds to "Attacker-Use-Attack Tool"

[0604] "Webshell intrusion into production server" corresponds to "attack tool-penetration-attack target"

[0605] LLM can use its understanding of security corpus to accurately capture the above-mentioned connections between entities in the report, extract them into edges in the knowledge graph, and build a semantic bridge between entities.

[0606] 3) Entity disambiguation. Due to different reporting writing habits, the same entity may have multiple references, such as "employee computer" and "employee terminal". Entities referring to the same thing need to be normalized to a standard form in the knowledge base through entity linking technology. For example, APT can be linked to the team name in MITRE ATT&CK, and malware can be linked to the standard ID in the CVE vulnerability library.

[0607] 4) Knowledge fusion. The APT knowledge graph generated by LLM should be integrated with the existing security knowledge base to establish semantic mapping. For example, the malware in the graph should be connected with the threat situation platform such as MISP, and the attacker should be associated with the phishing website situation database to achieve the integration of multi-source heterogeneous situations and expand the background knowledge of this APT incident.

[0608] 5) Graph visualization. In order to intuitively present the panoramic view of the elements of APT attacks, it is necessary to visually encode the importance of graph nodes and the strength of association between nodes. Commonly used methods include adjusting the size of nodes according to their degree, betweenness, and PageRank value, clustering nodes that frequently co-occur, and designing view switching in dimensions such as "attack stage", "purpose", and "method".

[0609] The following is a brief example of building an APT knowledge graph based on MITRE ATT&CK:

[0610] enter:

[0611] APT incident risk analysis report (fragment) ...

[0613] 1. Initial access: The attacker sneaked into the intranet late at night through the Webshell pre-installed on the employee's computer. This reflects the company's weaknesses in employee terminal management and Webshell protection.

[0614] 2. Lateral movement: The attacker used the high privileges of Webshell to directly access key business assets such as business production servers, reflecting the insufficient isolation of the company's network boundaries and the lack of in-depth defense of the intranet.

[0615] 3. Data leakage: The attackers eventually stole 1,000 pieces of business data, causing direct economic losses of 100,000 yuan, exposing the company's unclear data classification and improper access control. ...

[0617] MITRE ATT&CK Knowledge Base (fragment) ...

[0619] TA0001: Initial access

[0620] T1505.003:Web Shell

[0621] TA0008: Lateral Movement

[0622] TA0010: Data leakage ...

[0624] Output:

[0625] APT attack knowledge graph

[0626] ```mermaid

[0627] graph LR

[0628] Employee Computers ("Employee Computers")

[0629] Webshell(("Webshell"))

[0630] Production Server ("Production Server")

[0631] Business Data ("Business Data")

[0632] Internal Employees ("Internal Employees")

[0633] Internal employee--attacker-->employee computer

[0634] Internal staff--use-->Webshell

[0635] Webshell--implanted-->employee computer

[0636] Webshell--Infiltration-->Production Server

[0637] Production server--storage-->business data

[0638] Internal employees--stealing-->business data

[0639] Initial Access ("Initial Access") - Classification --> T1505.003 ("Web Shell")

[0640] Lateral Movement - Category --> TA0008 (Lateral Movement)

[0641] Data Exfiltration ("Exfiltration") -- Category --> TA0010 ("Data Exfiltration")

[0642] ```

[0643] This map directly depicts the key elements of this APT attack: internal employees used Webshells on employees' computers to invade production servers and eventually steal business data. At the same time, these elements are mapped to tactics (such as initial access, lateral movement) and techniques (such as Web Shell) in the MITRE ATT&CK knowledge base, so that the analysis of this incident can draw on the experience of other APT cases.

[0644] The disclosed embodiment also provides a data security analysis method for generating an intelligent data security workstation, such as Figure 5 The structure diagram of a data security analysis intelligent computing data security workstation in an embodiment of the present disclosure is shown in FIG. Figure 5 As shown, the data security analysis intelligent computing data security workstation 50 may include:

[0645] An acquisition module 51 is used to acquire data from different data sources, including user operation logs, data access and transmission logs;

[0646] A sensitive data marking module 52, used to classify and grade the data and mark sensitive data based on a preset rule base and a machine learning model;

[0647] An abnormal behavior identification module 53 is used to analyze user behavior patterns based on the user operation logs and identify abnormal behaviors;

[0648] The data leakage risk assessment module 54 is used to assess the data leakage risk and generate a risk report based on the data access and transmission logs.

[0649] The present disclosure also provides a computer intelligent data security workstation suitable for implementing a data security analysis method, wherein the computer intelligent data security workstation includes a central processing unit (CPU), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage part to a random access memory (RAM), such as executing the method described in the above embodiment. Various programs and data required for the operation of the intelligent data security workstation are also stored in the RAM. The CPU, ROM, and RAM are connected to each other via a bus. The input / output (I / O) interface is also connected to the bus.

[0650] The following components are connected to the I / O interface: an input part including a keyboard, a mouse, etc.; an output part including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part including a hard disk, etc.; and a communication part including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication part performs communication processing via a network such as the Internet. The drive 310 is also connected to the I / O interface as needed. Removable media, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., are installed on the drive as needed so that the computer program read therefrom is installed into the storage part as needed.

[0651] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), various functions defined in the intelligent data security workstation of the present application are executed.

[0652] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an intelligent data security workstation, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0653] In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction-executing intelligent data security workstation, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in combination with an instruction-executing intelligent data security workstation, device or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0654] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the intelligent data security workstation, method and computer program product according to various embodiments of the present application. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based intelligent data security workstation that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0655] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0656] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the above-mentioned various optional implementations.

[0657] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0658] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0659] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0660] Although the embodiments of the present disclosure are disclosed as above, the present invention is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the scope defined by the claims.

Claims

1. A data security analysis method, characterized in that: include: The intelligent computing data security workstation obtains data from different data sources, including user operation logs, data access and transmission logs; Based on a preset rule base and machine learning model, the data is classified and graded, and sensitive data is marked; Analyze user behavior patterns based on the user operation logs to identify abnormal behaviors; Based on the data access and transmission logs, the risk of data leakage is assessed and a risk report is generated.

2. The method according to claim 1, characterized in that: Based on the preset rule base and machine learning model, the data is classified and graded, and sensitive data is marked, including: Using natural language processing (NLP) technology to extract text information from the data; Extracting keywords from the text information by using term frequency-inverse document frequency (TF-IDF) technology; Constructing a preset rule library, wherein the preset rule library includes sensitive information types, keyword matching rules, and regular expression rules; Constructing an SVM model, and training the SVM model using the training data set of the preset rule base; The SVM model is used to classify and grade the keywords in the text information, and different categories of sensitive data are marked.

3. The method according to claim 1, characterized in that: Based on the preset rule base and machine learning model, the data is classified and graded, and sensitive data is marked, including: Using natural language processing (NLP) technology to extract text information from the data; Constructing a preset rule library, wherein the preset rule library includes sensitive information types, keyword matching rules, and regular expression rules; Constructing a support vector machine (SVM) model, and training the SVM model using the training data set of the preset rule base; Extracting feature vectors from the text information; Perform mean centering processing on the feature vectors: calculate the mean of each feature vector, and subtract the corresponding mean from the mean to eliminate the offset between features; Performing feature sparse processing on the feature vector after mean centering processing: using L1 regularization technology, setting feature values ​​in the feature vector that are lower than a preset threshold to zero to reduce feature redundancy; The features after mean centering and feature sparsification are input into the SVM model to mark sensitive data of different categories.

4. The method according to claim 2 or 3, characterized in that: Analyze user behavior patterns based on the user operation logs and identify abnormal behaviors, including: Deploy a user behavior analysis UEBA system in the intelligent computing data security workstation to obtain the user operation log from the data; Constructing a random forest model, training the random forest model, and establishing a baseline of normal user behavior; The user operation log is input into the trained random forest model to identify the user's abnormal behavior pattern.

5. The method according to claim 2 or 3, characterized in that: The method according to claim 1, characterized in that analyzing user behavior patterns based on the user operation logs and identifying abnormal behaviors comprises: Obtaining the user operation log; Define the semantic security super attributes of the user operation log, including login time, login IP address, and device information used; Generate simulated abnormal login attack patterns, including login attempts during non-working hours, login attempts from IP addresses in different regions, and / or login attempts using different devices; Mixing the simulated abnormal login attack mode and normal login behavior mode to form a training data set; Constructing an SVM model or a random forest model, and inputting the training data set into the SVM model or the random forest model; The semantic security super attribute is input into the trained SVM model or random forest model to perform abnormal behavior recognition.

6. The method according to claim 1, characterized in that Based on the data access and transmission logs, assess the risk of data leakage and generate a risk report, including: Construct Bayesian network models; Using historical data to train the Bayesian network model; The data access and transmission logs are input into the Bayesian network model to evaluate data leakage risks, identify potential risk points and abnormal behaviors, and generate risk reports.

7. The method according to claim 1, characterized in that Based on the data access and transmission logs, assess the risk of data leakage and generate a risk report, including: Using a self-supervised sequence learning algorithm to build an advanced persistent threat APT detection model, wherein the APT detection model is a Transformer, BERT or LSTM model; Acquire historical system behavior data, wherein the historical system behavior data includes normal behavior and known APT attack behavior data; Using a context-aware anomaly detection method, context information in historical system behavior data is obtained, and the context information is embedded and combined with the behavior sequence to form a context feature vector, wherein the context information includes user identity, access time, geographic location, and operation type; Using the context feature vector to train the APT detection model so that the APT detection model learns system behavior sequence embedding and understands normal and abnormal behavior patterns; The data access and transmission logs are input into the APT detection model to evaluate data leakage risks in real time, identify potential APT attack behaviors, and generate risk reports.

8. The method according to claim 7, characterized in that The APT detection model is a Transformer-based pre-trained large language model LLM, and the APT detection model is trained using the context feature vector, including: Fine-tuning the LLM using the context feature vector; The data access and transmission logs are input into the APT detection model to assess data leakage risks in real time, identify potential APT attack behaviors, and generate risk reports, including: converting the data access and transmission logs into natural language descriptions; Using the fine-tuned LLM to perform semantic understanding on the natural language description to identify potential APT attack behavior characteristics; LLM's language generation capabilities are used to automatically generate risk reports for APT attack incidents.

9. The method according to claim 8, characterized in that The method further comprises: The LLM extracts key information from the generated reports, including attackers, attack methods, and target assets, and constructs an APT attack knowledge graph; Use knowledge graphs for reasoning and association analysis to discover potential APT attack chains and attacker teams.

10. An intelligent computing data security workstation, characterized in that: include: An acquisition module, used to acquire data from different data sources, including user operation logs, data access and transmission logs; A sensitive data labeling module, used to classify and grade the data and label sensitive data based on a preset rule base and a machine learning model; An abnormal behavior identification module, used to analyze user behavior patterns based on the user operation logs and identify abnormal behaviors; The data leakage risk assessment module is used to assess the data leakage risk and generate a risk report based on the data access and transmission logs.

Images