Trust risk assessment method and system based on user joint behavior collaborative analysis

Abstract

The invention relates to the technical field of network security, in particular to a trust risk assessment method and system based on user joint behavior collaborative analysis, and the method comprises the steps: collecting target user terminal behavior data and network behavior data, and carrying out the preprocessing of the data; inputting the terminal behavior data and the network behavior data into a trust risk assessment model, and carrying out real-time detection on the activity dynamic state of the target user from two dimensions of the network behavior and the terminal behavior; wherein the trust risk assessment model comprises a machine learning model used for detecting abnormal operation behaviors of the user terminal and a deep learning model used for detecting malicious network behaviors of the user; the machine learning model and the deep learning model are used for cooperatively detecting user activities from two dimensions of network behaviors and terminal behaviors, and an alarm is given for abnormal behaviors when behavior abnormity is detected from any dimension of the user. According to the invention, multi-dimensional continuous security detection and malicious threat alarm can be realized, and the security and stability of a network system are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a trust risk assessment method and system based on collaborative analysis of user joint behavior. Background Art

[0002] As the global digitalization process continues to deepen, technologies such as mobile Internet, Internet of Things, cloud computing, big data and edge computing are developing rapidly, and my country's informatization work has made remarkable achievements. Government departments, financial institutions, enterprises and institutions are increasingly dependent on digital information systems, personnel access methods are becoming more complex, network boundaries are gradually blurring, and the complexity of network threats is gradually increasing. Network security issues are facing severe challenges. As a dynamic and unpredictable part of the system, user behavior is reflected in entities such as applications and hosts. Therefore, by continuously monitoring the behavior of users and entities and building a behavioral baseline, it is possible to identify their abnormal behavior, detect and evaluate threats in a timely manner, and achieve security protection of data resources.

[0003] Trust risk assessment is based on trust model and risk management research, integrated with security strategy and risk analysis, to assess the impact of entity behavior trust on information systems within the scope of assessment. Information security risk assessment is defined as a process of scientifically assessing the security attributes of information systems and the confidentiality, integrity and availability of information transmitted, processed and stored by them based on relevant information security technologies and management standards. With the continuous improvement of enterprise information levels, all enterprises have basically deployed systems to record internal activities of the enterprise to facilitate information search and management, but there are some insiders who can obtain sensitive information of the company, which has become the most influential and most damaging security risk. In this context, the use of trust risk assessment technology to identify security risks and solve information security problems has been widely recognized and applied. Through accurate and timely trust risk assessment, accurate judgments and decisions can be made on the security status of information systems.

[0004] User behavior analysis aims to explain all user behaviors in the system in detail, so as to effectively and accurately distinguish the normal and abnormal states of user behavior patterns and realize trust risk assessment. With the development of new communication technologies and services, the number of Internet devices, network users, services and applications continues to increase. The changes in user behavior characteristics when using devices can reflect user habits. Therefore, it is of great significance for access control to use continuous detection of user behavior patterns to conduct trust risk assessment. In information systems, in order to more effectively detect abnormal network behavior and identify security issues in a timely and accurate manner, a user model based on behavior analysis is constructed, and dynamic real-time monitoring is performed using technologies such as deep learning. User behavior is compared with its historical model, and abnormal behavior is judged by the degree of deviation of the model. At the same time, since different users may have great differences in a certain type of behavior, only analyzing the user behavior of this specific type cannot effectively realize user behavior analysis. Summary of the invention

[0005] To this end, the present invention provides a trust risk assessment method and system based on collaborative analysis of user joint behavior to solve the problems of low security protection capability, difficulty in preventing internal threat attacks, and poor stability of system user behavior prediction in the current intensive shared network environment.

[0006] According to the design scheme provided by the present invention, on the one hand, a trust risk assessment method based on collaborative analysis of user joint behavior is provided, comprising:

[0007] Collect the target user's terminal behavior data and network behavior data and pre-process the data, wherein the terminal behavior data is human behavior feature data characterizing the user's terminal operation, and the network behavior data is data characterizing the user's network activity traces;

[0008] The pre-processed terminal behavior data and network behavior data are input into the pre-trained trust risk assessment model, and the trust risk assessment model is used to perform real-time detection of the target user's activity dynamics from two dimensions: network behavior and terminal behavior.

[0009] Among them, the trust risk assessment model includes a machine learning model for detecting abnormal operation behavior of user terminals and a deep learning model for detecting malicious network behavior of users. The machine learning model and the deep learning model are used to collaboratively detect user activities from two dimensions: network behavior and terminal behavior, and an alarm is issued for abnormal behavior when abnormal behavior is detected in any dimension of the user.

[0010] As a trust risk assessment method based on collaborative analysis of user joint behaviors of the present invention, further, the terminal behavior data is user keystroke behavior collection data, and the user keystroke behavior collection data includes: single-key duration, double-key flight time, multi-key flight time, keystroke pressure characteristics and editing characteristics.

[0011] As a trust risk assessment method based on collaborative analysis of user joint behaviors of the present invention, further, the network behavior data includes network traffic behavior log data and network access behavior logs.

[0012] As a trust risk assessment method based on collaborative analysis of user joint behaviors of the present invention, further, the machine learning model uses a KNN algorithm model to judge abnormal operation behaviors of user terminals through cluster analysis.

[0013] As the trust risk assessment method based on collaborative analysis of user joint behavior of the present invention, further, the process of detecting abnormal operation behavior of user terminals by using a machine learning model includes:

[0014] Compare the target user terminal behavior data features with the sample terminal behavior data features with behavior annotation labels, and extract the K data that are most similar to the target user terminal behavior data from the sample terminal behavior data based on the Manhattan distance;

[0015] The number of occurrences of each behavior label in k pieces of data is obtained, and the behavior label type of the target user terminal is obtained based on the number of occurrences of each behavior label using a large number judgment.

[0016] As a trust risk assessment method based on collaborative analysis of user joint behavior of the present invention, further, the deep learning model includes: a ConvLSTM model for extracting user network behavior characteristics, network behavior sequences and role characteristics and an MLP model for performing multi-judgment prediction on user network behavior characteristics, network behavior sequences and role characteristics, and the ConvLSTM model adopts an architecture consisting of an encoding network and a prediction network, and the MLP model adopts a multi-layer perceptron mechanism.

[0017] As a trust risk assessment method based on collaborative analysis of user joint behaviors of the present invention, further, a process of detecting malicious network behaviors of users using a deep learning model comprises:

[0018] Extracting behavior features, behavior sequences and role features from the target user's network behavior data;

[0019] The deviation between the behavior characteristics, behavior sequences and role characteristics and the corresponding characteristics in the normal network behavior is calculated. When the deviation is greater than the preset threshold, it is determined that the target user has malicious network behavior. The normal network behavior is the network behavior label obtained by training the model using sample data.

[0020] In another aspect, the present invention further provides a trust risk assessment system based on collaborative analysis of user joint behavior, comprising: a data collection module and a prediction and assessment module, wherein:

[0021] A data collection module is used to collect terminal behavior data and network behavior data of target users and pre-process the data. The terminal behavior data is human behavior feature data representing user operations on the terminal, and the network behavior data is data representing traces of user network activities;

[0022] The prediction and evaluation module is used to input the pre-processed terminal behavior data and network behavior data into the pre-trained trust risk evaluation model, and use the trust risk evaluation model to perform real-time detection of the target user's activity dynamics from the two dimensions of network behavior and terminal behavior;

[0023] Among them, the trust risk assessment model includes a machine learning model for detecting abnormal operation behavior of user terminals and a deep learning model for detecting malicious network behavior of users. The machine learning model and the deep learning model are used to collaboratively detect user activities from two dimensions: network behavior and terminal behavior, and an alarm is issued for abnormal behavior when abnormal behavior is detected in any dimension of the user.

[0024] Beneficial effects of the present invention:

[0025] The present invention performs collaborative analysis and prediction from two dimensions: user network behavior and terminal behavior, and constructs a user joint behavior model from multiple dimensions, avoiding the shortcomings of single behavior type analysis, and providing a comprehensive and effective behavior baseline for trust risk assessment; and uses ConvLSTM and MLP deep learning algorithms and KNN machine learning algorithms to achieve real-time monitoring in the full time and space context, so as to collaboratively analyze and evaluate the deviation between user network behavior and terminal behavior, identify potential security threats and abnormal situations, and realize multi-dimensional continuous security detection and malicious threat alarm within the system, which can provide strong supplementary support for protecting system security and ensuring event management, and can also judge the risk prediction trend of the system, greatly improving the security and stability of the network system. The threat detection capability of the model is optimized and evaluated through experiments. The results show that the terminal behavior prediction can reach an evaluation accuracy of more than 94%, and the network behavior prediction can reach an evaluation accuracy of more than 96%, which can provide strong supplementary support for protecting system security and ensuring event management, and has good application prospects in the fields of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a schematic diagram of the trust risk assessment process based on collaborative analysis of user joint behaviors in an embodiment;

[0027] Figure 2This is a schematic diagram of the principle framework of the trust risk assessment algorithm in the embodiment;

[0028] Figure 3 This is a schematic diagram of the user network behavior analysis architecture in the embodiment;

[0029] Figure 4 This is an example of the terminal behavior prediction algorithm process in the embodiment;

[0030] Figure 5 This is a schematic diagram of the model evaluation verification loss value in the embodiment;

[0031] Figure 6 Schematic diagram of the ROC curve comparison between the embodiment and the baseline model. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0033] In order to reduce the threat of internal attacks on enterprises and improve the security protection capability of network security systems, the embodiments of the present invention refer to Figure 1 As shown, a trust risk assessment method based on collaborative analysis of user joint behavior is provided, comprising:

[0034] S101, collecting terminal behavior data and network behavior data of a target user and preprocessing the data, wherein the terminal behavior data is human behavior feature data characterizing the user's terminal operation, and the network behavior data is data characterizing the user's network activity traces;

[0035] S102, inputting the pre-processed terminal behavior data and network behavior data into a pre-trained trust risk assessment model, and using the trust risk assessment model to perform real-time detection of target user activity dynamics from two dimensions: network behavior and terminal behavior;

[0036] Among them, the trust risk assessment model includes a machine learning model for detecting abnormal operation behavior of user terminals and a deep learning model for detecting malicious network behavior of users. The machine learning model and the deep learning model are used to collaboratively detect user activities from two dimensions: network behavior and terminal behavior, and an alarm is issued for abnormal behavior when abnormal behavior is detected in any dimension of the user.

[0037] Specifically, Figure 2As shown in the figure, we start from two perspectives: taking the most common terminal behavior, keyboard tapping, as an example, we collect data on the user's keyboard tapping behavior, use the KNN machine learning algorithm, adopt clustering analysis technology, and continuously train the model to form a model that can more accurately judge the user's abnormal operation behavior, collect user behavior data at regular intervals, and realize real-time monitoring; collect and analyze the user's network traffic behavior logs and access behavior logs in the system, and use ConvLSTM, MLP and other learning algorithms as feature extraction for the deep learning model to train the data set and build a prediction model for malicious network behavior, so as to dynamically evaluate the user behavior and collect data in real time to realize prediction and alarm.

[0038] The process of detecting malicious network behavior of users can be designed to include:

[0039] Extracting behavior features, behavior sequences and role features from the target user's network behavior data;

[0040] The deviation between the behavior characteristics, behavior sequences and role characteristics and the corresponding characteristics in the normal network behavior is calculated. When the deviation is greater than the preset threshold, it is determined that the target user has malicious network behavior. The normal network behavior is the network behavior label obtained by training the model using sample data.

[0041] like Figure 3 As shown, the user network behavior analysis part is a complete system including a data center layer, an algorithm analysis layer and a scenario application layer. In the embodiment of this case, it can focus on users and entities, drive behavior analysis with deep learning, and perform anomaly detection in the context of all time and space, so as to discover malicious behaviors and malicious users. It has the advantages of discovering the unknown, improving risk visibility, reducing costs and improving energy efficiency. It supports traditional engines while also supporting baseline analysis and artificial intelligence engines.

[0042] In the embodiment of this case, the user network behavior analysis can specifically adopt the two algorithms of ConvLSTM and MLP. The good data screening ability of ConvLSTM is used to select key network behavior data and record them. At the same time, combined with the multi-layer perception ability of the MLP algorithm, the analysis data comes from the CERT internal threat data set containing classification information such as user attribute metadata. Taking advantage of the ability of ConvLSTM to handle long sequences well, the daily behavior of internal personnel is comprehensively modeled from behavioral characteristics, behavioral sequences, and role characteristics in order to gain a deep understanding of the user's behavior pattern. Finally, the deviation between each behavior and normal behavior is calculated. When the user has abnormal behavior, his actual behavior will obviously deviate from the predicted value. The MLP diversified feature judgment method is used to make a comprehensive decision, thus realizing the continuous identity authentication of users in the system and the prediction of authentication risk trends.

[0043] ConvLSTM is an improved version of the LSTM network. It uses convolutional layers to replace the full connection between the LSTM network input and hidden states and each gate structure. This design allows ConvLSTM to capture the temporal correlation characteristics of spatiotemporal sequence data while also taking into account the impact of spatial correlation. Therefore, ConvLSTM can more effectively understand context and relevance when processing sequence data. In addition, the ConvLSTM network can not only extract temporal features, but also effectively extract spatial features through convolution operations, making it more suitable for processing spatiotemporal data.

[0044] The calculation process of ConvLSTM is as follows:

[0045]

[0046] Among them, in this embodiment, the following parameters are used: W xf , W hf , W cf is the weight of the forget gate; W xi , W hi , W ci is the weight of the input gate; W xc , W hc is the weight of the unit state; W xo , W ho , W co is the weight of the output gate; tanh is the corresponding activation function; It is called the Hadamard product, which means the result of multiplying corresponding elements of the matrix; * means convolution. i, f, and o are all three-dimensional tensors, and their last two dimensions represent the spatial information of rows and columns. In this embodiment, ConvLSTM can be used as a model for processing feature vectors in a two-dimensional grid, and it can predict the features of the central grid based on the features of the surrounding points in the grid. It can be seen that ConvLSTM can capture spatial features by performing convolution operations in multidimensional data. It also has the characteristics of LSTM networks and can effectively obtain time features at different time steps.

[0047] Input to ConvLSTM Cell Output Hidden state Door t , f t , o t They are all three-dimensional tensors (the other two dimensions are spatial information, rows and columns). For different activities, different features can be selected to understand the daily behavior characteristics of users, and CNN is used to extract some potential connections between the features of different activities.

[0048] ConvLSTM is an extension of the traditional LSTM, changing the connection between the input and each gate, so that it changes from a feedforward connection to a convolutional connection, and the operation between states is also changed from a traditional full connection to a convolution operation. ConvLSTM can be used as an independent module in a more complex network structure. For processing spatiotemporal sequence problems, the architecture used in this embodiment includes an encoding network and a prediction network:

[0049] The encoding-forecasting structure uses a very traditional structured LSTM, and the network is composed of several ConvLSTM layers stacked together. Continuous trust risk assessment uses LSTM training to learn normal action sequences and predict the action sequence of the next state based on history. The deviation between the actual action sequence and the prediction is an indicator of anomaly detection. For example, the user's operation is represented as {logon, web, web, web, drive connect, drive disconnect,..., email, log out}, which is input into the LSTM. The two-layer LSTM is expanded. Each LSTM unit in the first layer has an input x i , each unit in the second layer has an input h 1,i , and has two outputs, the hidden state h and the cell output c, which are input into the LSTM cell of the next state. 1,i and c j,i is the hidden state output and cell output of the LSTM unit in layer j at time i. i is the action sequence of one day, and N is the number of days used to predict the action sequence of the next state. Specifically, the model consists of two LSTM layers with 100 units and 160 units respectively, each LSTM layer is followed by a "tanh" activation layer, a dense layer with 37 units, and a "relu" activation layer. In this embodiment of the case, the two layers of LSTM can be combined as an encoding network, and its initial state and cell output are predicted through the network. Since the predicted target in the embodiment of the present case has the same dimension as the input data, in the prediction network, all possible states (hidden layer states) can be concatenated, and then thrown into a 1*1 convolutional layer to generate the final prediction. The encodingLSTM compresses the entire input sequence into a hidden layer state tensor, and then the forecatsingLSTM expands the hidden layer state to give the final prediction result:

[0050]

[0051] This model is a concatenation of multiple LSTMs, so it has strong representation for predicting complex dynamic systems.

[0052] Multilayer Perceptron (MLP) is a fully connected feedforward neural network model. Its structure mimics the construction and function of biological neural networks and is usually used to solve nonlinear problems. MLP is a computational model consisting of many nodes (neurons) and the connections between them. Each node performs a specific function, which is called an excitation function or activation function. The weight difference between two nodes is regarded as the weighted value of the signal, and these weights together construct the memory of the MLP. The output of the network is mainly determined by its connection method, weights, and the setting of the excitation function. At the same time, the network is usually a simulation of a specific function or a display of a certain logical strategy.

[0053] The multilayer perceptron consists of an input layer, an output layer, and a hidden layer, which are fully connected. The input layer consists of simple input neurons, each of which is connected to at least one hidden layer artificial neuron. The hidden layer can contain one or more layers of neurons, and the variables it represents usually do not appear directly in the input and output training data.

[0054] In the hidden layer of a multilayer perceptron (MLP), artificial neurons with nonlinear activation functions are usually used. The role of these functions is to transform the input of the neuron into output, thereby introducing nonlinear characteristics. Common nonlinear activation functions include sigmoid function, tanh function and relu function.

[0055] Suppose the input layer is vector x, then the output of the hidden layer is σ(W1x+b1), W1 is the weight (also called the connection coefficient), b1 is the bias, the function σ is the commonly used sigmoid function or tanh function, and the hidden layer to the output layer can be regarded as a multi-category logistic regression relationship, that is, softmax regression, so the output of the output layer is softmax(W2h+b2), and h represents the output of the hidden layer σ(W1x+b1).

[0056] -enter

[0057] -Hidden Layer

[0058] - Output layer

[0059] h=σ(W1x+b1)

[0060]

[0061] y=softmax(o)

[0062] Combine the results of multiple deep learning models using MLP to achieve good anomaly detection. MLP is trained using historical data to understand the associations between these features. Then, it is judged whether there is abnormal behavior based on deviations such as action sequence, action characteristics, and character characteristics, which are similar to performing classification tasks.

[0063] The process of detecting abnormal operation behavior of a user terminal may be designed to include:

[0064] Compare the target user terminal behavior data features with the sample terminal behavior data features with behavior annotation labels, and extract the K data that are most similar to the target user terminal behavior data from the sample terminal behavior data based on the Manhattan distance;

[0065] The number of occurrences of each behavior label in k pieces of data is obtained, and the behavior label type of the target user terminal is obtained based on the number of occurrences of each behavior label using a large number judgment.

[0066] Biometric authentication technology is divided into two methods: biometric authentication through physical and behavioral characteristics of the human body. Keystroke behavior is one of the behavioral characteristics of the human body. Keystroke-based authentication methods have the significant characteristics of low collection cost and high authentication transparency. Keystroke collection cost is low, data is highly accessible and can be directly integrated into the authentication process, reducing user intervention in authentication methods, thereby enhancing the transparency of the authentication process and providing a basis for implicit authentication. Specific research has shown that everyone's behavior in front of the computer is unique, and keystroke behavior uses information such as the pressure and time of the user's keystrokes when typing on the keyboard to analyze the user's personal identity, realizing a new type of authentication method.

[0067] Common keystroke features include single-key duration, double-key flight time, multi-key flight time, keystroke pressure features, and editing features. The user terminal behavior analysis part uses the time features generated by keystrokes. The data is based on the flight time and dwell time of keystrokes as a continuous verification method for user behavior. The KNN algorithm is used to collect, train, and predict user keystroke behavior data, and finally a keystroke behavior prediction model based on the KNN algorithm is constructed. According to the characteristics of network users' keystroke behavior, in the embodiment of this case, the data collected from the web page can be saved in the database based on the key flight time and dwell time, such as Figure 4As shown, in order to extract valuable numerical information about keyboard input patterns, data preprocessing is performed on the analysis records, which are processed into lists of flight time (the time a key is pressed) and dwell time (the time between key presses). The two lists are compared using Manhattan distance, and the KNN algorithm is used to select a suitable k value. In order to further expand the algorithm, multiple methods are adopted to improve the accuracy, such as using IP addresses, user agents, or the time of visiting websites, expanding the distance and weighting, which significantly improves the accuracy.

[0068] KNN (K-Nearest Neighbor) algorithm, also known as K nearest neighbor classification algorithm, is a classification technology in the field of supervised learning. It searches for k similar samples of a sample in the feature space and determines the category of the sample through the classification information of these samples. The basic idea of ​​this method is that in the feature space, if most of the k nearest samples (that is, the closest samples in the feature space) around a sample belong to the same category, then this sample should also belong to this category.

[0069] The execution steps of the KNN algorithm are to first create a training data set, and when a new input instance appears, find the K instances closest to the instance from this training data set. If most of the K samples belong to a specific category, then the new output sample will also be classified into that category.

[0070] Input: training data set T = {(x1,y1),(x2,y2),…,(x N ,y N )}

[0071] Among them, x i is the feature vector of the instance, y i is the category of the instance, i=1,2,…,N

[0072] Output: class y to which instance x belongs

[0073] In the neighborhood N k In (x), the category y of the sample point x is determined according to the majority decision principle. Specifically, the category of y should be determined according to the following formula:

[0074]

[0075] In the formula, I is the indicator function, that is, y i =c j When I is 1, otherwise, I is 0

[0076] The key points of the K-nearest neighbor algorithm are to select the appropriate k value, the distance metric and the classification decision criterion. Selecting different k values ​​will have a significant impact on the results of the KNN algorithm. Different k values ​​may cause the test points to be classified into different categories. A decrease in k indicates that the complexity of the model has increased, and it is more likely to be disturbed by the noise of the training data, thereby causing overfitting. An increase in k indicates that the complexity of the model has increased, which may make the boundaries of various categories unclear, making it possible for the nearest classifier to incorrectly divide the experimental samples. In practical applications, a suitable k value can be selected by parameter optimization methods, such as using cross-validation, in which a subset of the training data is used to evaluate the classification error rate of different parameters.

[0077] In terms of distance measurement, the sum of the projection distances generated by the line segments formed by fixed rectangular coordinates in Euclidean space is calculated, which is also known as Manhattan Distance. Its calculation method is similar to the first power representation of Euclidean distance, and the basic calculation formula is as follows:

[0078]

[0079] The classification decision rule is based on the principle of "the minority obeys the majority, and one point counts as one vote", that is, the label category with the largest number is the label category of the sample point x.

[0080] Furthermore, based on the above method, an embodiment of the present invention also provides a trust risk assessment system based on collaborative analysis of user joint behavior, comprising: a data collection module and a prediction and assessment module, wherein:

[0081] A data collection module is used to collect terminal behavior data and network behavior data of target users and pre-process the data. The terminal behavior data is human behavior feature data representing user operations on the terminal, and the network behavior data is data representing traces of user network activities;

[0082] The prediction and evaluation module is used to input the pre-processed terminal behavior data and network behavior data into the pre-trained trust risk evaluation model, and use the trust risk evaluation model to perform real-time detection of the target user's activity dynamics from the two dimensions of network behavior and terminal behavior;

[0083] Among them, the trust risk assessment model includes a machine learning model for detecting abnormal operation behavior of user terminals and a deep learning model for detecting malicious network behavior of users. The machine learning model and the deep learning model are used to collaboratively detect user activities from two dimensions: network behavior and terminal behavior, and an alarm is issued for abnormal behavior when abnormal behavior is detected in any dimension of the user.

[0084] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0085] The experiment was conducted on the CERT internal threat dataset (including login, device, email, web page and other behavioral data) containing classified information such as user attribute metadata. The feature dataset obtained has 462 items, and the data is divided into a training set (80%) and a test set (20%). A deep learning algorithm is used to model the behavior of users and entities in the network, and long short-term memory (LSTM) and convolutional LSTM (ConvLSTM) are used to monitor, analyze and evaluate the behavioral deviations between users and entities in real time. MLP is used to make comprehensive decisions on the deviations of multiple features, and then determine normal or abnormal behavior.

[0086] In order to conduct continuous trust assessment of user terminal behavior, a data set based on flight time and dwell time of keystrokes is used, with a total of approximately 29,200 records. The data structure of each record is 'user_typing_data' ('time', 'user_id', 'input0', 'IP', 'browser'), and the data is divided into a training set (73%) and a test set (27%). A machine learning algorithm model is established, using the KNN classification algorithm and the feature space nearest sample classification target method, which has a very wide adaptability and can classify and learn to predict user keystroke behavior.

[0087] The software and hardware environment of the experiment is as follows: the operating system is Win11 64-bit, the CPU is 11th Gen Intel(R) Core(TM) i7-11800H@2.30GHz 2.30GHz, the memory size is 16GB, the Python version is 3.63-64-bit, the numpy version is 1.16.4, the tensorflow version is 1.8.0, the keras version is 2.2.2, and the sklearn version is 0.19.1.

[0088] 1. Comparison of terminal behavior models

[0089] The flight time and dwell time features of the button pressed by the user in the user keystroke behavior dataset are extracted as feature data. At the same time, the performance of the constructed KNN model is tested using three evaluation indicators: FRR, FAR, and Acc. The performance is compared with the SVM, LR, and CGU models. The performance of the user behavior model is determined based on the model accuracy, false acceptance rate, and false recognition rate. The experimental results of each model are shown in Table 1:

[0090] Table 1 Performance comparison of models based on keystroke behavior

[0091]

[0092] A comprehensive comparison of the four models shows that the KNN model built based on the terminal behavior dataset performs best, with a terminal behavior prediction accuracy of 86%. According to the purpose of the model implementation, the size of the FAR and FRR error rate values ​​is of great significance to the model performance. The error rate values ​​of the KNN model are relatively low, and choosing to use this model can better achieve the purpose of system environment security protection.

[0093] The training results were tested, and the accuracy results were analyzed and calculated to optimize the algorithm. The accuracy of the KNN algorithm when k=5 is shown in Pre-Accuracy in Table 2. The effect of one run after using parameter expansion and weighted improvement of accuracy is shown in the figure below. The statistical results after improvement are shown in Post-Accuracy in Table 2. Comparing the accuracy before and after the improvement, it can be seen that the accuracy has been improved:

[0094] Table 2 Accuracy statistics of multiple tests

[0095]

[0096] 2. Network behavior feature sequence results and comprehensive decision analysis

[0097] The user network behavior prediction uses the weighted deviation degree WDD to calculate the deviation between the real feature and the prediction. The square error is linearly weighted according to a weight. The calculation process is: Among them, V is the set of all features in the real features, y is a single feature belonging to V, is the same feature as y, but is a predicted feature, and w is a value specially designed based on feature y. In the process of training ConvLSTM and attention control system, high-quality sample data is selected to enable the model to understand and grasp the behavioral characteristics of ordinary users.

[0098] In the experiment, the training method of ConvLSTM is based on a five-day cycle, in which the characteristics of four days are applied to the prediction of the fifth day. Comparing and adjusting the actual data of the fifth day with the prediction results of ConvLSTM is an important task in the training process. Figure 5 As shown, the deviation increases significantly after 200 days, which corresponds to the actual situation, indicating that the model network has a strong learning behavior ability.

[0099] By analyzing the action sequence, static features, and role features, we can confirm the error between the actual situation and the expected situation of the network behavior model. According to the parameters such as Acc, AUC index of ROC curve, TPR and FPR, we can evaluate the performance of the user's network behavior model.

[0100] According to the model.evaluate method of Keras, which has a built-in evaluation indicator, the accuracy of the model is directly obtained, and the calculation result is acc = 0.9696969696969697; the number of normal samples Num_norma in the test data set is 177, and the number of abnormal samples Num_anomalous is 21; the number of correctly predicted normal samples Drn is 176, and the number of correctly predicted abnormal samples Dra is 16. By comparing the predicted labels and the true labels and calculating the number of matching samples, the prediction accuracy of the custom model is 0.9696969696969697.

[0101] The confusion matrix is ​​generated after a threshold is determined. Using different thresholds, multiple groups of (FPR, TPR) points can be obtained. The model makes comprehensive decisions to generate ROC curve points, which are connected in sequence to form the ROC curve. The ROC curves of the network behavior analysis case TEST and the baseline Baseline are shown in the figure below. Figure 6 As shown in the figure, the two trajectories are similar, but the area under the ROC curve of TEST is 0.964, which is better than the Baseline. The experimental results are compared in Table 3, indicating that TEST has achieved good results in accuracy and AUC scores:

[0102] Table 3 Comparison of experimental results of this case and the baseline model

[0103]

[0104] The above data show that this solution can, to a certain extent, conduct a good trust risk assessment of user behavior. The terminal behavior prediction can achieve an assessment accuracy rate of more than 94%, and the network behavior prediction can achieve an assessment accuracy rate of more than 96%, which can provide strong supplementary support for protecting system security and ensuring event management.

[0105] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0106] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0107] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0108] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0109] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A trust risk assessment method based on collaborative analysis of user joint behavior, characterized in that: Include: Collect the target user's terminal behavior data and network behavior data and pre-process the data, wherein the terminal behavior data is human behavior feature data characterizing the user's terminal operation, and the network behavior data is data characterizing the user's network activity traces; The pre-processed terminal behavior data and network behavior data are input into the pre-trained trust risk assessment model, and the trust risk assessment model is used to perform real-time detection of the target user's activity dynamics from two dimensions: network behavior and terminal behavior. Among them, the trust risk assessment model includes a machine learning model for detecting abnormal operation behavior of user terminals and a deep learning model for detecting malicious network behavior of users. The machine learning model and the deep learning model are used to collaboratively detect user activities from two dimensions: network behavior and terminal behavior, and an alarm is issued for abnormal behavior when abnormal behavior is detected in any dimension of the user.

2. The trust risk assessment method based on collaborative analysis of user joint behavior according to claim 1 is characterized in that: The terminal behavior data is user keystroke behavior collection data, and the user keystroke behavior collection data includes: single-key duration, double-key flight time, multi-key flight time, keystroke pressure characteristics and editing characteristics.

3. The trust risk assessment method based on collaborative analysis of user joint behavior according to claim 1 is characterized in that: The network behavior data includes network traffic behavior log data and network access behavior log data.

4. The trust risk assessment method based on collaborative analysis of user joint behavior according to claim 1 is characterized in that: The machine learning model uses the KNN algorithm model to determine abnormal operation behavior of the user terminal through cluster analysis.

5. The trust risk assessment method based on collaborative analysis of user joint behavior according to claim 1 or 4, characterized in that: The process of using machine learning models to detect abnormal operation behaviors of user terminals includes: Compare the target user terminal behavior data features with the sample terminal behavior data features with behavior annotation labels, and extract the K data that are most similar to the target user terminal behavior data from the sample terminal behavior data based on the Manhattan distance; The number of occurrences of each behavior label in k pieces of data is obtained, and the behavior label type of the target user terminal is obtained based on the number of occurrences of each behavior label using a large number judgment.

6. The trust risk assessment method based on collaborative analysis of user joint behavior according to claim 1 is characterized in that: The deep learning model includes: a ConvLSTM model for extracting user network behavior characteristics, network behavior sequences and role characteristics and an MLP model for performing multi-judgment prediction on user network behavior characteristics, network behavior sequences and role characteristics, and the ConvLSTM model adopts an architecture consisting of an encoding network and a prediction network, and the MLP model adopts a multi-layer perceptron mechanism.

7. The trust risk assessment method based on collaborative analysis of user joint behavior according to claim 1 or 6, characterized in that: The process of using deep learning models to detect malicious network behavior of users includes: Extracting behavior features, behavior sequences and role features from the target user's network behavior data; The deviation between the behavior characteristics, behavior sequences and role characteristics and the corresponding characteristics in the normal network behavior is calculated. When the deviation is greater than the preset threshold, it is determined that the target user has malicious network behavior. The normal network behavior is the network behavior label obtained by training the model using sample data.

8. A trust risk assessment system based on collaborative analysis of user joint behavior, characterized in that: Contains: data collection module and prediction evaluation module, among which, A data collection module is used to collect terminal behavior data and network behavior data of target users and pre-process the data. The terminal behavior data is human behavior feature data representing user operations on the terminal, and the network behavior data is data representing traces of user network activities; The prediction and evaluation module is used to input the pre-processed terminal behavior data and network behavior data into the pre-trained trust risk evaluation model, and use the trust risk evaluation model to perform real-time detection of the target user's activity dynamics from two dimensions: network behavior and terminal behavior; Among them, the trust risk assessment model includes a machine learning model for detecting abnormal operation behavior of user terminals and a deep learning model for detecting malicious network behavior of users. The machine learning model and the deep learning model are used to collaboratively detect user activities from two dimensions: network behavior and terminal behavior, and an alarm is issued for abnormal behavior when abnormal behavior is detected in any dimension of the user.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images