Similar network behavior user identification method based on unsupervised variational auto-encoder

Abstract

The invention discloses a similar network behavior user identification method based on an unsupervised variational auto-encoder, and relates to the technical field of network security, the method is based on super-large-scale network communication metadata, utilizes an unsupervised variational auto-encoder model to learn user network behavior deep rule features from massive user network traffic metadata, and obtains the user network behavior deep rule features from the user network traffic metadata. Abstracting the network behavior of the user representation into a high-dimensional vector representation of an essential behavior mode, and finally identifying the user by using the similarity between vectors. The method specifically comprises the steps of network flow meta-datamation, network behavior statistical feature extraction, behavior feature imaging processing, deep learning model training, deep feature extraction and similar behavior user identification.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for identifying users with similar network behaviors based on an unsupervised variational autoencoder algorithm. Background Art

[0002] In recent years, with the rapid development of computer communication technology and the increasing popularity of the Internet, Internet users are growing at an alarming rate. According to the 53rd China-Europe Internet Development Statistical Report released by the China Internet Network Information Center (CNNIC), as of December 2023, the number of Internet users in my country has reached 1.092 billion. While the vigorous development of the Internet has greatly facilitated people's social life, various malicious behaviors such as software extortion, illegal speech, data theft, and network attacks have emerged in an endless stream. Malicious users are hidden in the compliance behaviors of massive users, which has brought huge challenges to cyberspace security and governance. Network user identification is one of the keys to cyberspace security governance. Regarding the problem of network user identification, previous work can be roughly divided into two categories. One is to directly calculate the similarity between user portrait feature vectors, and the other is to train models through machine learning methods to identify users. Similarity comparison requires a lot of manual participation, and the profiling is based on expert experience, and the extracted features often cannot represent the essential behavior of users. Secondly, no matter which machine learning or deep learning algorithm is used, it relies on labeled training data sets, which cannot meet the needs of a periodically iteratively updated and sufficiently rich and balanced training data set. In addition, the accuracy of the model trained based on a small-scale sample set in an experimental environment is difficult to guarantee in a real network environment. Finally, when facing network users of different types, there is still a lack of a more universal identification method.

[0003] With the continuous popularization of the Internet, the number of network users has increased dramatically, resulting in explosive growth in network traffic. Taking a medium-sized city as an example, the network traffic has reached tens of Tbps. User behavior is mixed in the massive network traffic and is difficult to distinguish. Among the existing network user identification technologies, one is to directly calculate the similarity between user portrait feature vectors, and the other is to train the model through machine learning methods to identify users. The above technical solutions often have many limitations. The method based on machine learning models often has significant effects on laboratory data, but the effect is still unknown when facing the real network environment; the vector similarity method based on user portraits requires a lot of manual participation and feature extraction based on expert experience. The extracted feature vectors often cannot represent the essential behavior of network users. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method for identifying users with similar network behaviors based on an unsupervised variational autoencoder algorithm in response to the shortcomings of the background technology; learning the regular characteristics of user network behavior from ultra-large-scale network communication metadata, then performing high-dimensional abstraction on the network behavior patterns of user representations, and finally identifying users by utilizing the similarity between vectors.

[0005] The present invention adopts the following technical solutions to solve the above technical problems:

[0006] A method for identifying users with similar network behaviors based on unsupervised variational autoencoders is based on ultra-large-scale network communication metadata and uses an unsupervised variational autoencoder model to learn the deep regular characteristics of user network behaviors from massive user network traffic metadata, and then abstract the user's apparent network behavior into a high-dimensional vector representation of the essential behavior pattern. Finally, the user is identified by using the similarity between vectors. Specifically, it includes network traffic metadata, network behavior statistical feature extraction, behavior feature imaging processing, deep learning model training, deep feature extraction, and similar behavior user identification.

[0007] As a further preferred solution of the method for identifying users with similar network behaviors based on unsupervised variational autoencoders of the present invention, network traffic metadata is converted into metadata. The specific operation steps are as follows:

[0008] The collected message data is merged into communication session metadata. Each session communication flow is represented as follows:

[0009] Flow i (sip i ,dip i ,spt i ,dpt i ,transprtl i ,appprtl i ,stime i ,etime i ,upkts i ,ubytes i ,dpkts i ,dbytes i )

[0010] Among them, the ith session connection is defined as Flow i , abbreviated as f i , according to the above labels, they correspond one by one to: (source IP, destination IP, source port, destination port, transport layer protocol, application layer protocol, start time, end time, number of upstream packets, number of upstream bytes, number of downstream packets, number of downstream bytes) of the i-th session traffic.

[0011] As a further preferred solution of the method for identifying users with similar network behaviors based on unsupervised variational autoencoders of the present invention, network behavior statistical feature extraction, the specific operation steps are as follows:

[0012] Based on the communication metadata, a sliding window with the same size as the step size is used to perform time series processing on the communication metadata, and the sliding window is denoted as w;

[0013] In view of the complex and redundant network behaviors of network users, the sliding window is used as the basic description unit, and the statistical features within the basic unit are calculated as the primary expression of the user's network behavior; For user j in the kth time window (u j ,w k ) is expressed as:

[0014]

[0015] Among them, c1, c2, c3, …, c n is a statistical feature extracted based on communication metadata; in order to describe the user's network behavior as comprehensively as possible, 42-dimensional features are designed from the aspects of size, quantity, duration and entropy value; let user u j In w k The intranet session collection is The characteristic calculation formula is expressed as:

[0016] ① Communication frequency:

[0017] ②Contact time:

[0018] ③Average contact time:

[0019] ④~⑥ The contact frequency of less than 60 seconds, more than 300 seconds, and between 60 and 300 seconds:

[0020]

[0021] ⑦ Standard deviation of contact time:

[0022] ⑧Number of uplink packets:

[0023] ⑨Number of downlink packets:

[0024] ⑩Number of uplink bytes:

[0025] Number of downstream bytes:

[0026] Average number of bytes in uplink packets:

[0027] Average number of bytes of downlink packets:

[0028] Maximum number of bytes in upstream: c 14 (u j ,w k )=max(ubytes i )

[0029] Maximum number of bytes for downstream: c 15 (u j ,w k )=max(dbytes i )

[0030] Standard deviation of upstream bytes:

[0031] Downlink byte standard deviation:

[0032] The communication frequencies with uplink byte count equal to 0, the communication frequencies with uplink byte count between 0 and 1M, the communication frequencies with uplink byte count between 1 and 10M, and the communication frequencies with uplink byte count greater than 10M:

[0033]

[0034] The communication frequencies with downlink byte count equal to 0, the communication frequencies with downlink byte count between 0 and 1M, the communication frequencies with downlink byte count between 1 and 10M, and the communication frequencies with downlink byte count greater than 10M:

[0035]

[0036] Frequency of communication per unit time:

[0037] Source IP number: c 27 (u j ,w k )=|set(sip i )|

[0038] Destination IP number: c 28 (u j ,wk )=|set(dip i )|

[0039] The communication frequency when the source port is a regular port:

[0040] The communication frequency when the destination port is a regular port:

[0041] Frequency of calls with destination IP belonging to overseas:

[0042] The contact time when the destination IP belongs to overseas:

[0043] Number of uplink bytes with destination IP belonging to overseas:

[0044] Number of downlink bytes with destination IP belonging to overseas:

[0045] The application layer is the ssh protocol and the communication frequency is:

[0046] The application layer is the ssh protocol, which is the communication time:

[0047] The communication time corresponding to the maximum uplink byte: c 37 (u j ,w k )=(etime i -stime i )×A(max(ubytes i ))

[0048] The communication time corresponding to the maximum downlink byte: c 38 (u j ,w k )=(etime i -stime i )×A(max(dbytes i ))

[0049] Source IP entropy value: c 39 (u j ,w k )=-∑P(sipi )×log(2,P(sip i ))

[0050] Destination IP entropy value: c 40 (u j ,w k )=-∑P(sip i )×log(2,P(dip i ))

[0051] Destination port entropy value: c 41 (u j ,w k )=-∑P(dpt i )×log(2,P(dpt i ))

[0052] Application layer protocol entropy value: c 42 (u j ,w k )=-∑P(appprtl i )×log(2,P(appprtl i ))

[0053] In the above formula, A(x) is an indicator function, which has a value of 1 when the corresponding condition is met, and 0 otherwise; P(sip t )、P(dip t )、P(dpt t )、P(appprtl t ) are respectively represented as k In the specified user u j Under, any sip in the source IP set, destination IP set, destination port set, and application layer protocol set i 、dip i 、dpt i 、appprtl i The probability of occurrence is expressed through entropy value to show the orderly characteristics of user online behavior.

[0054] As a further preferred solution of the method for identifying users with similar network behaviors based on unsupervised variational autoencoders of the present invention, the behavior characteristics are processed in an image format, and the specific operation steps are as follows:

[0055] Let the sliding window sequence be {w1,w2,w3,…,w k ,…,w n-1 ,w n}, for any user u j , if in w kIf there is network activity in the memory, calculate its c1~c 42 dimensional feature vector, otherwise, it is complemented with a zero vector; the feature vectors in each window are spliced ​​vertically to form a unified n×42-dimensional matrix primary representation for use in the training and application of deep learning models; drawing on the idea of ​​image recognition, the user primary representation matrix is ​​converted into a value in the range of 0 to 255 in a normalized manner, and the corresponding grayscale image is generated according to the brightness relationship. The normalization formula is expressed as:

[0056]

[0057] Among them, max(c i ) and min(c i ) represent the samples u j The maximum and minimum values ​​of the i-th feature, represents the value of the i-th feature in window k, Represents the new value after conversion.

[0058] As a further preferred solution of the method for identifying users with similar network behaviors based on unsupervised variational autoencoders of the present invention, the specific operation steps of deep learning model training are as follows:

[0059] The core of the variational autoencoder model based on the convolutional neural network CNN is to assume that the real observation data follows a certain implicit distribution, and then generate samples similar to the input data by probabilistically modeling the implicit representation of the observation data; considering the difficulty of obtaining labeled samples, from the perspective of unsupervised learning, a large number of network users {u1,u2,u3,…,u m On the sample set, a variational autoencoder model is constructed using a convolutional network. The data is learned with the goal of minimizing the sum of the model reconstruction loss and the KL divergence regularization term to capture the essential characteristics of the data.

[0060] The variational autoencoder used is composed of two parts: encoder and decoder; the encoder consists of 3 convolutional layers and 2 fully connected layers. Each convolution layer uses 128, 64 and 32 filters respectively, the convolution kernel size is [3,3], and the moving step size is 1; each convolution layer is followed by a maximum pooling layer of size [2,2] to reduce the spatial dimension of the feature map; each convolution layer uses ReLU as the activation function; after all convolutional layer operations are completed, the Flatten operation is used to compress and flatten the output feature map into a one-dimensional shape, and then two fully connected layers are used to estimate the mean and variance of the latent variable Z, and then the encoder output is generated according to the distribution of Z. ; The decoder is the inverse of the encoder and consists of 3 reverse convolutional layers and 2 fully connected layers. The output of the encoder is used as the input of the decoder. After 1 fully connected layer and Reshape operation, the input is converted to the output size of the third convolution layer of the encoder, followed by 3 layers of deconvolution. Each deconvolution layer uses 32, 64, and 128 filters respectively, the convolution kernel size is [3,3], and the moving step is 1; each deconvolution layer is followed by an upsampling operation of size [2,2] to increase the spatial dimension of the feature map; after the deconvolution operation is completed, a fully connected layer and Reshape operation are used to output a grayscale image of the same size as the encoder input sample.

[0061] As a further preferred solution of the method for identifying users with similar network behaviors based on unsupervised variational autoencoders of the present invention, deep feature extraction, the specific operation steps are as follows:

[0062] The encoder part of the pre-trained variational autoencoder model is used to encode the user's n×42-dimensional primary representation as input, abstract the deep features of the user's network behavior, and simplify it into a 1024-dimensional vector form.

[0063] As a further preferred solution of the method for identifying users with similar network behaviors based on unsupervised variational autoencoders of the present invention, the specific operation steps of identifying users with similar network behaviors are as follows: m}, based on the 1024-dimensional vector representation, the cosine similarity method is used to identify the user u i Users with similar network behaviors are expressed as:

[0064]

[0065] S(u i ,u j ) value is between -1 and 1. The larger the value, the better. i ,u j) The more similar the network behaviors are, the greater the difference is; taking 0.9 as the recognition threshold, when the cosine similarity is greater than or equal to 0.85, users with similar behaviors are identified and recommended.

[0066] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects:

[0067] 1. The present invention provides a method for identifying users with similar network behaviors based on an unsupervised variational autoencoder algorithm. The method is based on large-scale network traffic metadata, uses convolutional neural networks as basic units to construct a variational autoencoder model as a high-dimensional space feature extractor, and calculates the similarity between different users based on cosine similarity to achieve identification of users with similar network behaviors;

[0068] 2. The present invention does not require in-depth analysis of traffic messages, but extracts relevant traffic behavior statistical features based on communication metadata to form a primary representation of the user's network behavior, which speeds up efficiency and has a certain degree of real-time performance;

[0069] 3. The present invention adopts an unsupervised variational autoencoder model and performs training on samples of global network users, which overcomes the pain point that supervised learning samples are difficult to obtain. The extracted features are closer to the essence of user network behavior, and can perform unified adjacent representation conversion for different types of network users, which is more universal.

[0070] 4. The present invention is based on the analysis of communication metadata to identify network users from the perspective of similar behavior patterns, avoiding the influence of the unidentifiability of encrypted traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0072] Figure 1 It is the overall technical framework of the similar network behavior user identification method based on unsupervised variational autoencoder of the present invention. DETAILED DESCRIPTION

[0073] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings:

[0074] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The present invention is described in detail below according to the drawings and preferred embodiments, and the purpose and effect of the present invention will become clearer. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0075] In the context of strengthening cyberspace security governance, in order to solve the problem of network user identification, based on ultra-large-scale network communication metadata, an unsupervised variational autoencoder model is used to learn the deep regular characteristics of user network behavior from massive user network traffic metadata, and then the user's apparent network behavior is abstracted into a high-dimensional vector representation of the essential behavior pattern. Finally, the user is identified by the similarity between vectors to achieve the purpose of this patent; the method described in this patent includes 6 steps: network traffic metadata, network behavior statistical feature extraction, behavior feature image processing, deep learning model training, deep feature extraction, and similar behavior user identification. The specific operation steps are as follows:

[0076] 1. Metadata of network traffic:

[0077] The collected message data is merged into communication session metadata. We represent each session communication flow as follows:

[0078] Flow i (sip i ,dip i ,spt i ,dpt i ,transprtl i ,appprtl i ,stime i ,etime i ,upkts i ,ubytes i ,dpkts i ,dbytes i )

[0079] For the i-th session connection, we define it as Flow i , abbreviated as f i , according to the above labels, they correspond one by one to: (source IP, destination IP, source port, destination port, transport layer protocol, application layer protocol, start time, end time, number of upstream packets, number of upstream bytes, number of downstream packets, number of downstream bytes) of the i-th session traffic.

[0080] 2. Extraction of statistical features of network behavior: Based on the communication metadata, a sliding window with the same size and step size is used to perform time-series processing on the communication metadata. The sliding window is denoted as w. In view of the complex and redundant network behaviors of network users, the sliding window is used as the basic description unit, and the statistical features within the basic unit are calculated as the primary expression of the user's network behavior. For user j in the kth time window (u j ,w k ) is expressed as:

[0081]

[0082] Among them, c1, c2, c3, …, c n is a statistical feature extracted based on communication metadata. In this patent, in order to describe the user's network behavior as comprehensively as possible, 42-dimensional features are designed from the aspects of size, quantity, duration, and entropy value. Let user u j In w k The intranet session collection is The characteristic calculation formula is expressed as:

[0083] ① Communication frequency:

[0084] ②Contact time:

[0085] ③Average contact time:

[0086] ④~⑥ The contact frequency of less than 60 seconds, more than 300 seconds, and between 60 and 300 seconds:

[0087]

[0088] ⑦ Standard deviation of contact time:

[0089] ⑧Number of uplink packets:

[0090] ⑨Number of downlink packets:

[0091] ⑩Number of uplink bytes:

[0092] Number of downstream bytes:

[0093] Average number of bytes in uplink packets:

[0094] Average number of bytes of downlink packets:

[0095] Maximum number of bytes in upstream: c 14 (u j ,w k )=max(ubytes i )

[0096] Maximum number of bytes for downstream: c 15 (u j ,w k )=max(dbytes i )

[0097] Standard deviation of upstream bytes:

[0098] Downlink byte standard deviation:

[0099] The communication frequencies with uplink byte count equal to 0, the communication frequencies with uplink byte count between 0 and 1M, the communication frequencies with uplink byte count between 1 and 10M, and the communication frequencies with uplink byte count greater than 10M:

[0100]

[0101] The communication frequencies with downlink byte count equal to 0, the communication frequencies with downlink byte count between 0 and 1M, the communication frequencies with downlink byte count between 1 and 10M, and the communication frequencies with downlink byte count greater than 10M:

[0102]

[0103] Frequency of communication per unit time:

[0104] Source IP number: c 27 (u j ,w k )=|set(sip i )|

[0105] Destination IP number: c 28 (u j ,w k )=|set(dip i )|

[0106] The communication frequency when the source port is a regular port:

[0107] The communication frequency when the destination port is a regular port:

[0108] Frequency of calls with destination IP belonging to overseas:

[0109] The contact time when the destination IP belongs to overseas:

[0110] Number of uplink bytes with destination IP belonging to overseas:

[0111] Number of downlink bytes with destination IP belonging to overseas:

[0112] The application layer is the ssh protocol and the communication frequency is:

[0113] The application layer is the ssh protocol, which is the communication time: The communication time corresponding to the maximum uplink byte: c 37 (u j ,w k )=(etime i -stime i )×A(max(ubytes i ))

[0114] The communication time corresponding to the maximum downlink byte: c 38 (u j ,w k )=(etime i -stime i )×A(max(dbytes i ))

[0115] Source IP entropy value: c 39 (u j ,w k )=-∑P(sip i )×log(2,P(sip i ))

[0116] Destination IP entropy value: c 40 (uj ,w k )=-∑P(dip i )×log(2,P(dip i ))

[0117] Destination port entropy value: c 41 (u j ,w k )=-∑P(dpt i )×log(2,P(dpt i ))

[0118] Application layer protocol entropy value: c 42 (u j ,w k )=-∑P(appprtl i )×log(2,P(appprtl i )).

[0119] In the above formula, A(x) is an indicator function, which has a value of 1 when the corresponding condition is met, and 0 otherwise; P(sip t )、P(dip t )、P(dpt t )、P(appprtl i ) are respectively represented as k In the specified user u j Under, any sip in the source IP set, destination IP set, destination port set, and application layer protocol set i 、dip i 、dpt i 、appprtl i The probability of occurrence is expressed through entropy value to show the orderly characteristics of user online behavior.

[0120] 3. Behavior feature visualization processing: Let the sliding window sequence be {w1,w2,w3,…,w k ,…,w n-1 ,w n}, for any user u j , if in w k If there is network activity in the memory, calculate its c1~c 42 dimensional feature vector, otherwise, it is complemented with a zero vector. The feature vectors in each window are spliced ​​vertically to form a unified n×42-dimensional matrix primary representation for use in the training and application of deep learning models. Drawing on the idea of ​​image recognition, the user's primary representation matrix is ​​converted into a value in the range of 0 to 255 in a normalized manner, and the corresponding grayscale image is generated based on the brightness relationship. The normalization formula is expressed as:

[0121]

[0122] Among them, max(c i ) and min(c i ) represent the samples u j The maximum and minimum values ​​of the i-th feature, represents the value of the i-th feature in window k, Represents the new value after conversion.

[0123] 4. Deep learning model training: The core of the variational autoencoder model based on the convolutional neural network (CNN) is to assume that the real observation data follows a certain implicit distribution, and then generate samples similar to the input data by probabilistically modeling the implicit representation of the observation data. Considering the difficulty of obtaining labeled samples, from the perspective of unsupervised learning, the global massive network users {u1,u2,u3,…,u m}On the sample set, a variational autoencoder model is constructed using a convolutional network. The data is learned with the goal of minimizing the model reconstruction loss and the KL divergence regularization term to achieve the purpose of capturing the essential characteristics of the data. The variational autoencoder used in this patent consists of two parts: encoder and decoder. The encoder consists of 3 convolutional layers and 2 fully connected layers. Each convolution layer uses 128, 64 and 32 filters respectively. The convolution kernel size is [3,3] and the moving step size is 1. Each convolution layer is followed by a maximum pooling layer of size [2,2] to reduce the spatial dimension of the feature map. ReLU is used as the activation function for each convolution layer. After all convolutional layer operations are completed, the Flatten operation is used to compress and flatten the output feature map into a one-dimensional shape. Subsequently, two fully connected layers are used to estimate the mean and variance of the latent variable Z, and then the encoder output of 1024-dimensional vector is generated according to the distribution of Z. The decoder is the inverse of the encoder, consisting of 3 inverse convolution layers and 2 fully connected layers. The output of the encoder is used as the input of the decoder. After 1 fully connected layer and Reshape operation, the input is converted to the size of the third convolution output of the encoder, followed by 3 layers of deconvolution. Each deconvolution layer uses 32, 64, and 128 filters, the convolution kernel size is [3,3], and the moving step is 1. Each deconvolution layer is followed by an upsampling operation of size [2,2] to increase the spatial dimension of the feature map. After the deconvolution operation is completed, a fully connected layer and Reshape operation are used to output a grayscale image of the same size as the encoder input sample.

[0124] 5. Deep feature extraction: The encoder part of the pre-trained variational autoencoder model is used to encode the user's n×42-dimensional primary representation as input, abstract the deep features of the user's network behavior, and simplify the representation into a 1024-dimensional vector.

[0125] 6. Identification of users with similar behaviors: Identify the users of the entire network {u1,u2,u3,…,u m}, based on the 1024-dimensional vector representation, the cosine similarity method is used to identify the user u i Users with similar network behaviors are expressed as:

[0126]

[0127] S(u i ,u j ) value is between -1 and 1. The larger the value, the better. i ,u j ) The more similar the network behaviors are, the greater the difference is. Taking 0.9 as the identification threshold, when the cosine similarity is greater than or equal to 0.85, users with similar behaviors are identified and recommended.

[0128] The specific implementation of this patent will be further described in detail below in conjunction with the accompanying drawings, and this patent will be explained with actual operating examples to better understand and reproduce the patent method. Figure 1 The overall framework process of the similar network behavior user identification method based on unsupervised variational autoencoder is as follows: first, the global traffic data is aggregated and merged into communication metadata containing five tuples and related attributes; based on the metadata, the traffic of each user is processed in time series using a sliding window, and in each window, the complex and redundant traffic is extracted using statistical analysis methods to form a primary unified representation; the behavior features are mapped from 0 to 255 and converted into grayscale images with a channel of 1; a variational autoencoder model with convolutional neural network as the basic unit is constructed and unsupervised training is performed using grayscale image data to learn the deep regular characteristics of network behavior; the encoder capability of the variational autoencoder model is used to abstract a deeper vector representation based on the primary representation of the user, and then the cosine similarity is used to measure the similarity between any users to achieve the purpose of identifying users with similar network behaviors. Based on the communication metadata of global users for seven days, the effect is verified on five network behavior user data sets such as scanning, DDoS, and botnets. The accuracy of identifying users with similar behaviors is about 93%, and the average recall rate is about 60%.

[0129] Those skilled in the art can understand that the above are only preferred examples of the invention and are not intended to limit the invention. Although the invention is described in detail with reference to the above examples, those skilled in the art can still modify the technical solutions recorded in the above examples or replace some of the technical features with equivalents. Any modification, equivalent replacement, etc. made within the spirit and principle of the invention should be included in the protection scope of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0130] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying users with similar network behaviors based on unsupervised variational autoencoders, characterized by: Based on ultra-large-scale network communication metadata, an unsupervised variational autoencoder model is used to learn the deep regular features of user network behavior from massive user network traffic metadata, and then the user's apparent network behavior is abstracted into a high-dimensional vector representation of the essential behavior pattern. Finally, the user is identified by the similarity between vectors. Specifically, it includes network traffic metadata, network behavior statistical feature extraction, behavior feature visualization processing, deep learning model training, deep feature extraction, and similar behavior user identification.

2. According to claim 1, a similar network behavior user identification method based on unsupervised variational autoencoder is characterized by: Metadata of network traffic. The specific steps are as follows: The collected message data is merged into communication session metadata. Each session communication flow is represented as follows: Flow i (sip i ,dip i ,spt i ,dpt i ,transprtl i ,appprtl i ,stime i ,etime i ,upkts i ,ubytes i ,dpkts i ,dbytes i ) Among them, the i-th session connection is defined as Fl0w i , abbreviated as fi, correspond one by one to: (source IP, destination IP, source port, destination port, transport layer protocol, application layer protocol, start time, end time, number of uplink packets, number of uplink bytes, number of downlink packets, number of downlink bytes) of the i-th session traffic.

3. The method for identifying users with similar network behaviors based on unsupervised variational autoencoders according to claim 1, characterized in that: Extract statistical features of network behavior. The specific steps are as follows: Based on the communication metadata, a sliding window with the same size as the step size is used to perform time series processing on the communication metadata, and the sliding window is denoted as w; In view of the complex and redundant network behaviors of network users, the sliding window is used as the basic description unit, and the statistical features within the basic unit are calculated as the primary expression of the user's network behavior; For user j in the kth time window (u j , w k ) is expressed as: Among them, c1, c2, c3, …, c n is a statistical feature extracted based on communication metadata; in order to describe the user's network behavior as comprehensively as possible, 42-dimensional features are designed from the aspects of size, quantity, duration and entropy value; let user u j In w k The intranet session collection is The characteristic calculation formula is expressed as: ① Communication frequency: ②Contact time: ③Average contact time: ④~⑥ The contact frequency of less than 60 seconds, more than 300 seconds, and between 60 and 300 seconds: ⑦ Standard deviation of contact time: ⑧Number of uplink packets: ⑨Number of downlink packets: ⑩Number of uplink bytes: Number of downstream bytes: Average number of bytes of uplink packets: Average number of bytes of downlink packets: Maximum number of bytes in upstream: c 14 (u j , w k )=max(ubytes i ) Maximum number of bytes for downstream transmission: c 15 (u j , w k )=max(dbytes i ) Standard deviation of upstream bytes: Downlink byte standard deviation: The communication frequencies with uplink byte count equal to 0, the communication frequencies with uplink byte count between 0 and 1M, the communication frequencies with uplink byte count between 1 and 10M, and the communication frequencies with uplink byte count greater than 10M: The communication frequencies with downlink byte count equal to 0, the communication frequencies with downlink byte count between 0 and 1M, the communication frequencies with downlink byte count between 1 and 10M, and the communication frequencies with downlink byte count greater than 10M: Frequency of communication per unit time: Source IP number: c 27 (u j , w k )=|set(sip i )| Destination IP number: c 28 (u j , w k )=|set(dip i )| The communication frequency when the source port is a regular port: The communication frequency when the destination port is a regular port: Frequency of calls with destination IP belonging to overseas: The contact time when the destination IP belongs to overseas: Number of uplink bytes with destination IP belonging to overseas: Number of downlink bytes with destination IP belonging to overseas: The application layer is the SSH protocol, which is the communication frequency: The application layer is the ssh protocol, which is the communication time: The communication time corresponding to the maximum uplink byte: c 37 (u j , w k )=(etime i -stime i )×A(max(ubytes i )) The communication time corresponding to the maximum downlink byte: c 38 (u j , w k )=(etime i -stime i )×A(max(dbytes i )) Source IP entropy value: c 39 (u j , w k )=-∑P(sip i )×log(2,P(sip i )) Destination IP entropy value: c 40 (u j , w k )=-∑P(dip i )×log(2,P(dip i )) Destination port entropy value: c 41 (u j , w k )=-∑P(dpt i )×log(2,P(dpt i )) Application layer protocol entropy value: c 42 (u j , w k )=-∑P(appprtl i )×log(2,P(appprtl i )) In the above formula, A(x) is an indicator function, which has a value of 1 when the corresponding condition is met, and 0 otherwise; P(sip t )、P(dip t )、P(dpt t )、P(appprtl t ) are respectively represented as k In the specified user u j Under, any sip in the source IP set, destination IP set, destination port set, and application layer protocol set i 、dip i 、dpt i 、appprtl i The probability of occurrence is expressed through entropy value to show the orderly characteristics of user online behavior.

4. The method for identifying users with similar network behaviors based on unsupervised variational autoencoders according to claim 1, characterized in that: Behavior feature visualization processing, the specific steps are as follows: The sliding window sequence is recorded as {w1, w2, w3, ..., w k ,…,w n-1 , w n }, for any user u j , if in w k If there is network activity in the memory, calculate its c1~c 42 dimensional feature vector, otherwise, it is complemented with a zero vector; the feature vectors in each window are spliced ​​vertically to form a unified n×42-dimensional matrix primary representation for use in the training and application of deep learning models; drawing on the idea of ​​image recognition, the user primary representation matrix is ​​converted into a value in the range of 0 to 255 in a normalized manner, and the corresponding grayscale image is generated according to the brightness relationship. The normalization formula is expressed as: Among them, max(c i ) and min(c i ) represent the samples u j The maximum and minimum values ​​of the i-th feature, represents the value of the i-th feature in window k, Represents the new value after conversion.

5. The method for identifying users with similar network behaviors based on unsupervised variational autoencoders according to claim 1, characterized in that: Deep learning model training, the specific steps are as follows: The core of the variational autoencoder model based on the convolutional neural network (CNN) is to assume that the real observation data follows a certain implicit distribution, and to generate samples similar to the input data by probabilistically modeling the implicit representation of the observation data. Considering the difficulty of obtaining labeled samples, from the perspective of unsupervised learning, the global massive network users {u1, u2, u3, ..., u m On the sample set, a variational autoencoder model is constructed using a convolutional network. The data is learned with the goal of minimizing the sum of the model reconstruction loss and the KL divergence regularization term to capture the essential characteristics of the data. The variational autoencoder used is composed of two parts: encoder and decoder. The encoder consists of three convolutional layers and two fully connected layers. Each convolution layer uses 128, 64 and 32 filters respectively. The convolution kernel size is [3, 3] and the moving step size is 1. Each convolution layer is followed by a maximum pooling layer of size [2, 2] to reduce the spatial dimension of the feature map. Each convolution layer uses ReLU as the activation function. After all convolutional layer operations are completed, the Flatten operation is used to compress and flatten the output feature map into a one-dimensional shape. Subsequently, two fully connected layers are used to estimate the mean and variance of the latent variable Z, and then the encoder output is generated according to the distribution of Z to generate a 1024-dimensional vector. The decoder is the inverse of the encoder and consists of three reverse convolutional layers and two fully connected layers. The output of the encoder is used as the input of the decoder. After one fully connected layer and a Reshape operation, the input is converted to the output size of the third convolution layer of the encoder, followed by three layers of deconvolution. Each layer of deconvolution uses 32, 64, and 128 filters, respectively, with a convolution kernel size of [3, 3] and a moving step of 1; each layer of deconvolution is followed by an upsampling operation of size [2, 2] to increase the spatial dimension of the feature map; after the deconvolution operation is completed, one fully connected layer and a Reshape operation are used to output a grayscale image of the same size as the encoder input sample.

6. The method for identifying users with similar network behaviors based on unsupervised variational autoencoders according to claim 1, characterized in that: Deep feature extraction, the specific steps are as follows: The encoder part of the pre-trained variational autoencoder model is used to encode the user's n×42-dimensional primary representation as input, abstract the deep features of the user's network behavior, and simplify it into a 1024-dimensional vector form.

7. The method for identifying users with similar network behaviors based on unsupervised variational autoencoders according to claim 1, characterized in that: Identify users with similar behaviors. The specific steps are as follows: m }, based on the 1024-dimensional vector representation, the cosine similarity method is used to identify the user u i Users with similar network behaviors are expressed as: S(u i ,u j ) value is between -1 and 1. The larger the value, the better. i ,u j ) The more similar the network behaviors are, the greater the difference is; taking 0.9 as the recognition threshold, when the cosine similarity is greater than or equal to 0.85, the users are identified and recommended as having similar behaviors.

Images