Threat sensing method and system based on signaling characteristics and abnormal behavior detection

Abstract

The invention provides a threat perception method and system based on signaling characteristics and abnormal behavior detection, and the method comprises the steps: inputting each sensor sequence into a sequence correlation graph construction module, and obtaining a sequence correlation graph; inputting the observation value of the performance sensor into a time correlation graph construction module to obtain a time correlation graph; carrying out feature fusion on graph structure data in the sequence correlation graph and the time correlation graph respectively, and outputting a plurality of new nodes respectively; expanding and splicing the plurality of new nodes and an original time sequence to obtain a new time sequence; and carrying out model updating through the prediction model and the reconstruction model, and finally obtaining a threat perception model. According to the method, the maximum mutual information coefficient is used for measuring sequence correlation and time correlation, a sequence correlation graph and a time correlation graph are constructed, two parallel graph attention networks are used for fusing sequence features and time features respectively, feature complementation is achieved, and therefore the purpose of improving the anomaly detection performance is achieved.

Description

Technical Field

[0001] The present invention belongs to the technical field of communication network protection, and specifically relates to a threat perception method based on signaling characteristics and abnormal behavior detection. Background Art

[0002] At present, many methods for describing abnormal behaviors of IMS networks have been proposed internationally, among which the most representative ones are: database-based intrusion prediction and intrusion prediction based on intrusion planning model. The database-based intrusion prediction method forms a network behavior database based on observation and statistics, and discovers the laws of intrusion behaviors from it to provide a basis for prediction. The intrusion prediction method based on intrusion planning model is to find the correlation between intrusion steps to provide a basis for prediction. If it is not fully utilized, there is a hidden danger of missing threats. Summary of the invention

[0003] In response to the above technical problems, the present invention selects multiple service performance indicators as monitoring objects, uses multi-dimensional service performance time series as source data of the anomaly detection model, and applies professional knowledge in the fields of NF, NF service, signaling business process, etc. to time series correlation measurement to achieve the purpose of core network function anomaly detection.

[0004] The first aspect of the present invention provides: a threat perception method based on signaling features and abnormal behavior detection, comprising:

[0005] Input each sensor sequence into a sequence correlation graph building module to obtain a sequence correlation graph;

[0006] Inputting the observed values ​​of the performance sensor into a time correlation graph building module to obtain a time correlation graph;

[0007] The graph structure data in the sequence correlation graph and the time correlation graph are respectively outputted as a plurality of new nodes by feature fusion;

[0008] Expand and splice the new nodes with the original time series to obtain a new time series;

[0009] The model is updated through prediction model and reconstruction model, and finally the threat perception model is obtained.

[0010] The second aspect of the present invention provides: a threat perception system based on signaling characteristics and abnormal behavior detection, characterized in that the system includes at least one processor; and a memory storing instructions, which, when executed by at least one processor, implements the steps of the method according to the second aspect of the present invention.

[0011] The third aspect of the present invention provides: a computer-readable storage medium having a computer program / instruction stored thereon, characterized in that the computer program / instruction implements the steps of the above method when executed by a processor.

[0012] The fourth aspect of the present invention provides: a computer program product, comprising a computer program / instruction, characterized in that the computer program / instruction implements the steps of the above method when executed by a processor.

[0013] A fifth aspect of the present invention provides: a network system, comprising: a first server and a second server, wherein the first server or the second server is capable of executing the steps of the above method.

[0014] The beneficial effect of the present invention is that: in view of the advantages of prediction and reconstruction models in time series anomaly detection, a DMIXGU (Deep Mix Gated Unit) prediction model and a MIXGU-VAE (MixGated Unit-Var Mixed Gate Unit-Variational Autoencoder) reconstruction model are designed for anomaly detection, and the two models are combined, wherein the sequence correlation and time correlation are measured by the maximum mutual information coefficient, and the sequence correlation graph and the time correlation graph are constructed based on the Topk correlation, and two parallel graph attention networks are used to fuse the sequence features and the time features respectively, so as to realize feature complementarity and thus achieve the purpose of improving the anomaly detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Process of the embodiment of the present invention Figure 1 ;

[0016] Figure 2 Process of the embodiment of the present invention Figure 2 ;

[0017] Figure 3 Figure 1. Data processing diagram of the embodiment of the present invention (a) original time series, (b) normalized time series;

[0018] Figure 4 A heat map of sequence correlation according to an embodiment of the present invention;

[0019] Figure 5 Time correlation heat map of the embodiment of the present invention;

[0020] Figure 6 A time-dependent line graph of an embodiment of the present invention;

[0021] Figure 7 A schematic diagram of the MIXGU structure of an embodiment of the present invention;

[0022] Figure 8 Schematic diagram of the DMIXGU structure of an embodiment of the present invention;

[0023] Fig. 9 Schematic diagram of the MIXGU-VAE structure of an embodiment of the present invention;

[0024] Fig.10 Schematic diagram of the LSTM-VAE structure of an embodiment of the present invention;

[0025] Fig.11 Schematic diagram of the system structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following examples further illustrate the content of the present invention, but should not be construed as limiting the present invention. Without departing from the spirit and substance of the present invention, modifications or substitutions made to the methods, steps or conditions of the present invention all fall within the scope of the present invention.

[0027] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0028] Based on the model in the existing technology, an end-to-end model is proposed for the IMS network anomaly problem, which includes four sub-modules: time series data aggregation and preprocessing, graph construction, feature fusion, and joint optimization, involving the entire anomaly detection process.

[0029] The data aggregation and preprocessing module mainly aggregates source data and unifies data dimensions to provide the necessary foundation for the detection model based on deep learning technology. When the core network is running, a large amount of logs and signaling traffic containing rich information such as time, service, and identity will be generated. The essence of the service performance sensor is a series of counters. Multidimensional time series can be generated from the above data by matching and associating, which serves as the input for data standardization (such as z-score standardization) and correlation measurement in preprocessing.

[0030] IMS network service performance sensors are of various types, which together describe the historical and current service status of NFs. A sequence correlation measurement method based on multi-source information is proposed. This method takes each sensor sequence as the research object and measures the correlation of the sequence from three dimensions: gene, meta-behavior, and macro-behavior, in order to provide the optimal input for feature fusion based on the graph attention mechanism. By analyzing the relationship between performance sensors, the core network NF identity information and service interaction information can be applied to anomaly detection, and the negative impact of redundant information can be eliminated.

[0031] Although the core network directly serves physical communication terminals, these terminals are controlled or set by users and show similar rules to users, such as more use during the day and less use at night, and similarities every day. Therefore, the value at a certain moment in the time series has a certain correlation with the values ​​at certain moments.

[0032] In some embodiments of the present invention, Figure 1-2 As shown:

[0033] A threat perception method based on signaling features and abnormal behavior detection, comprising:

[0034] Input each sensor sequence into a sequence correlation graph building module to obtain a sequence correlation graph;

[0035] Inputting the observed values ​​of the performance sensor into a time correlation graph building module to obtain a time correlation graph;

[0036] The graph structure data in the sequence correlation graph and the time correlation graph are respectively outputted as a plurality of new nodes by feature fusion;

[0037] Expand and splice the new nodes with the original time series to obtain a new time series;

[0038] The model is updated through prediction model and reconstruction model, and finally the threat perception model is obtained.

[0039] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that: the step of inputting each sensor sequence into the sequence correlation diagram construction module and obtaining the sequence correlation diagram includes:

[0040] Abstracting each sensor sequence into a sequence node, wherein the value of the sensor sequence is the sequence attribute value of the sequence node;

[0041] Multidimensional time series are mapped into a set of sequence nodes and a set of sequence attribute values;

[0042] A sequence correlation graph operation is performed according to the sequence node set and the sequence attribute value set to obtain a sequence correlation graph.

[0043] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that the observed value of the performance sensor is input into the time correlation diagram construction module, and obtaining the time correlation diagram includes:

[0044] Abstracting a time series composed of the observation values ​​of all the performance sensors at a certain observation time as a time node, and using the observation values ​​of the performance sensors as the time attribute vector of the time node;

[0045] Mapping a multidimensional time series of several observation moments into a set of time nodes, corresponding to the observation values ​​of the performance sensor forming a set of time attributes;

[0046] A time correlation graph operation is performed according to the time node set and the time attribute set to obtain a time correlation graph.

[0047] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that:

[0048] The prediction model is configured to:

[0049] Inputting the time series into a number of time learning layers, wherein the time learning layers include a number of time learning units, to obtain time dependencies of the time series;

[0050] The time dependencies of the time series are input into a fully connected layer to perform time series fusion and obtain a time series prediction value.

[0051] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that: the reconstruction model is configured as:

[0052] The new time series is input into the variational autoencoder for encoding, processed by the first linear unit, decoded by the decoder, and then processed by the second linear unit to obtain the reconstruction probability.

[0053] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that:

[0054] The model is updated through the prediction model and reconstruction model, and finally the threat perception model is obtained, including:

[0055] A joint anomaly score is defined according to the predicted value obtained by the prediction model and the reconstruction probability obtained by the reconstruction model, and the weight of the prediction model and the reconstruction model is balanced by the joint anomaly score;

[0056] When the overall efficiency of the prediction model and the reconstruction model reaches the overall efficiency threshold of anomaly detection, the model is output to obtain a threat perception model.

[0057] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that:

[0058] The log and signaling traffic data generated during the operation of the core network are input into the data aggregation and preprocessing module to aggregate the source data, unify the data dimension, and obtain the initial data;

[0059] The initial data are matched and associated to generate a multidimensional time series, and the multidimensional time series is used as an input for data standardization and correlation measurement in preprocessing.

[0060] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that:

[0061] The graph structure data in the sequence correlation graph and the time correlation graph are respectively fused by features to output a number of new nodes, including:

[0062] According to the graph structure data of the sequence correlation graph, the neighbor node information is fused through the graph attention layer to output a new sequence node.

[0063] In some embodiments of the present invention, Figure 1 As shown, the difference from the above embodiment is that the graph structure data in the sequence correlation graph and the time correlation graph are respectively fused by features to output several new nodes, including:

[0064] The time-correlation graph structure data of the time-correlation graph is taken as input, and the neighbor time node information is fused through the graph attention layer to output a new time node.

[0065] In some embodiments of the present invention, Fig.11 As shown, the difference from the above embodiment is that: a threat perception system based on signaling characteristics and abnormal behavior detection, the system includes at least one processor; and a memory, which stores instructions, when the instructions are executed by at least one processor, the steps of the above method are implemented

[0066] In these embodiments:

[0067] There are strict standards for signaling transmission and protocol field generation between various network element entities in the IMS network, and there are also strict procedures for services such as user registration, call control, and user authentication. By studying the changes that occur after the registration request message passes through the P-CSCF, it can be found that for the normal registration process, the processing of the SIP message by the P-CSCF when receiving the Register message is fixed.

[0068] After further analysis, it can be concluded that the legal communication process in the IMS network has a fixed form. The modifications made by each entity in the network to the relevant parameters and content of the message according to the type of message processed and the function it completes are also fixed. The signaling messages and their parameters in the legal communication process also have relevant specifications.

[0069] Therefore, the present invention intends to analyze the communication process of the IMS network and related protocols, statistically summarize the specifications of signaling messages in the communication process and the possible processing of messages by each entity, extract normal signaling features, and combine parameter association detection, identity association matching detection, cross-entity association detection and other methods to detect abnormal signaling events in the IMS network, and solve security threats such as distorted signaling, unauthorized access, and process disruption attacks.

[0070] The manifestation of abnormal behavior in IMS network is roughly the same as that in existing IP network. Users mainly initiate session messages through SIP protocol. Although abnormal user behavior cannot be detected from the perspective of signaling legitimacy and integrity,

[0071] However, the normal behavior of users in the network has certain specifications, and the signaling messages sent and received in the normal session process are fixed.

[0072] Therefore, it is planned to combine the existing IP network methods such as anomaly detection technology based on statistical analysis to extract and model the normal characteristics of existing IMS network users, analyze the shortcomings and disadvantages of the existing detection methods, combine them with the characteristics of the IMS network itself, and apply them to the IMS network to propose a new IMS network anomaly detection technology.

[0073] The present invention proposes a core network function anomaly detection model based on multi-dimensional service performance time series.

[0074] First, multiple service performance indicators are selected as monitoring objects, and multi-dimensional service performance time series are used as source data for the anomaly detection model;

[0075] The second is to apply professional knowledge in the fields of NF, NF services, and signaling business processes to time series correlation measurement.

[0076] Aiming at the fact that the existing time series anomaly detection model does not fully utilize the correlation between multi-dimensional sequences, a feature fusion method based on graph attention is proposed.

[0077] This method measures the sequence correlation and time correlation with the maximum mutual information coefficient, constructs the sequence correlation graph and time correlation graph based on Topk correlation, and uses two parallel graph attention networks to fuse the sequence features and time features respectively to achieve feature complementarity.

[0078] In view of the advantages of prediction and reconstruction models in time series anomaly detection, the DMIXGU prediction model and the MIXGU-VAE reconstruction model are designed for anomaly detection respectively, and the dual models are jointly optimized to jointly improve the anomaly detection performance.

[0079] MIXGU (Mix Gated Unit) is a novel gate unit structure based on recurrent neural network (RNN), which aims to improve the prediction performance of non-stationary multivariate time series (NSMTS).

[0080] VAE is a variant of AE that can simulate the potential distribution of observations and generate new data by introducing a set of potential random variables. The VAE model architecture is as follows: Fig.10 shown.

[0081] An end-to-end model proposed for IMS network anomaly problems includes four sub-modules: time series data aggregation and preprocessing, graph construction, feature fusion, and joint optimization, covering the entire anomaly detection process.

[0082] First, if Figure 3 As shown in the figure, the model needs to perform data aggregation and preprocessing. The data aggregation and preprocessing module mainly aggregates source data and unifies data dimensions for the detection model based on deep learning technology, providing the necessary foundation. When the core network is running, a large amount of logs and signaling traffic containing rich information such as time, service, and identity will be generated. The essence of the service performance sensor is a series of counters. Multidimensional time series can be generated from the above data by matching and associating, which serves as the input for data standardization and correlation measurement in preprocessing.

[0083] Then the graph is constructed, such as Figure 4 , 5 As shown in Figure 6, the types of IMS network service performance sensors are diverse, and they jointly describe the historical and current service status of NFs. A sequence correlation measurement method based on multi-source information is proposed. This method takes each sensor sequence as the research object and measures the correlation of the sequence from three dimensions: gene, meta-behavior, and macro-behavior, in order to provide the best input for feature fusion based on the graph attention mechanism. By analyzing the relationship between performance sensors, the core network NF identity information and service interaction information can be applied to anomaly detection, and the negative impact of redundant information can be eliminated.

[0084] Although the core network directly serves physical communication terminals, these terminals are controlled or set by users and show similar rules to users, such as more use during the day and less use at night, and similarities every day. Therefore, the value at a certain moment in the time series has a certain correlation with the values ​​at certain moments.

[0085] Then, feature fusion is performed. The present invention uses a feature fusion method based on graph attention. This method constructs sequence correlation graph and time correlation graph based on Topk correlation, and adopts a parallel graph attention network to respectively aggregate sequence correlation pattern features and time correlation pattern features to achieve feature fusion, thereby providing a stronger input for distinguishing normal from abnormal for the detection model based on joint optimization.

[0086] Before the fusion process begins, the sequence correlation graph is constructed: When the sequence correlation graph is constructed, the sequence S i Abstract as node v in the graph i , sequence S i The value of node v i The attribute value f i , then the multidimensional time series S can be mapped to a node set V S =(v1,v2,...,v K ), attribute set F S =(f1,f2,...,f K ),f i =S i .

[0087] For sequence S i , is the row vector corresponding to it in the correlation matrix, and After the correlation values ​​are sorted in descending order, the first k S The sequence corresponding to the value is S i There is a point to S i The edges of , as shown in formula (I), thus obtaining the sequence correlation graph G S .

[0088] G S =(V S ,E S )

[0089]

[0090] At the same time, before the fusion process starts, build a time-related graph:

[0091] When the time correlation graph is constructed, t i Observed values ​​of all performance sensors at the moment The sequence composed of nodes is abstracted as node v i , The value of node v i The attribute vector Then the multidimensional time series S of L observation moments can be mapped to the node set V T =(v1,v2,...,v L ), attribute collection For sequence is the row vector corresponding to it in the correlation matrix, and After the correlation values ​​are sorted in descending order, the first k T The sequence corresponding to the value There is a direction between The edges of , as shown in formula (II), thus obtaining the time-dependent graph G T :

[0092] G T =(V T ,E T )

[0093]

[0094] After graph construction, we obtain the sequence graph structure data D S =(G S ,F S ), time-dependent graph structure data D T =(G T ,F T ), D S and D T As the input of the parallel GAT network, through the GAT network graph attention layer, feature fusion is achieved to obtain new time series data as the input of the detection model.

[0095] The parallel GAT network, a parallel implementation of the Graph Attention Networks (GAT), mainly utilizes the efficiency and parallelizability of the attention mechanism. It is a neural network based on a graph structure, which uses the attention mechanism to assign different weights to each node in the graph to capture the relationship and feature information between nodes. Unlike traditional graph convolutional networks (GCNs), GAT does not require a global understanding of the graph structure, nor does it require expensive matrix operations such as inversion. This makes GAT more efficient when processing large-scale graph data.

[0096] After the sequence correlation graph is successfully constructed, the feature fusion based on the sequence correlation is used to construct the sequence correlation graph structure data D S As input, the neighbor node information is fused through the graph attention layer, and the new node foups is output. The nodes of the sequence correlation graph are abstractions of service performance sensors. The neighbor nodes after Topk correlation screening have strong correlation features with their identity, service, signaling business, etc. The process of feature fusion is also the process of normal and abnormal behavior transmission. Both normal and abnormal modes have been enhanced, and the corresponding distinguishability is greater, which is conducive to prediction and reconstruction of models for analysis and detection.

[0097] After the time correlation graph is successfully constructed, the feature fusion based on time correlation is used to construct the time correlation graph structure data DT As input, the neighbor node information is fused through the graph attention layer to output a new node foupT. The nodes of the time-related graph are the abstractions of all sensor observations at a certain moment. The neighbor nodes after Topk correlation screening have similar periodicity or time regularity. Through feature fusion, the features of nodes with periodicity or similar time regularity are enhanced, which increases the distinguishability of normal and abnormal, and provides better input for prediction and reconstruction models than original data.

[0098] Among them, "Topk" can be used in steps such as model evaluation, feature selection, or data preprocessing. For example, in a classification task, the top k most representative features can be selected to train the model.

[0099] After the above feature fusion, two new sequences foups and foupT are obtained respectively, which also characterize the NF service performance status of the core network. Therefore, it is considered to expand and splice the original time series to obtain a new time series f=finps+foupT+foups, that is, three sensors with different feature sources are derived from one performance sensor. By analyzing the time series that fuses multi-source features, the anomaly detection performance is improved.

[0100] After feature fusion, optimization is performed, such as Figure 1 As shown in the figure, inspired by the idea of ​​joint optimization, a joint optimization method based on prediction and reconstruction is proposed. The DMIXGU (Deep Mix Gated Unit) prediction model and the MIXGU-VAE (MixGated Unit-Var) reconstruction model are designed. The parameters of the two models are updated simultaneously during the training process. The loss function is defined as the sum of the two optimization objectives, that is, L = L pre +L rec , L pre is the loss function of the prediction model, L rec To reconstruct the loss function of the model, the training goal of the model is to minimize L.

[0101] DMIXGU (Deep Mix Gated Unit) prediction model:

[0102] DMIXGU combines several MIXGU layers and a fully connected layer to achieve multi-dimensional time series prediction. The model architecture is as follows Figure 8 As shown in Figure 2, the MIXGU layer is used to learn the temporal dependencies of time series (e.g. Figure 7 ), the fully connected layer is used to output the time series prediction value.

[0103] Among them, Adjustment Module is the adjustment module.

[0104] GRU (Gate Recurrent Unit) is a variant of Recurrent Neural Network (RNN), which aims to solve the gradient vanishing problem in standard RNN, so as to more effectively capture the semantic associations between long sequences. Its structure is similar to LSTM (Long-Short Term Memory), but it is more concise and has fewer parameters, so it is more efficient in many cases.

[0105] MGU, in the field of neural networks, especially recurrent neural networks (RNN) and their variants, is designed as a gated unit with a simpler structure but can significantly improve training efficiency. Compared with LSTM (Long Short-Term Memory Network) and GRU (Gated Recurrent Unit), MGU is more streamlined in structure, but still retains the gating mechanism to control the flow of information, thereby effectively alleviating the gradient disappearance problem.

[0106] MIXGU-VAE (Mix Gated Unit-Var) reconstruction model, such as Figure 8 As shown:

[0107] Among them: Encoder, encoder; Decoder, decoder;

[0108] Compared with the autoencoder, the advantage of the variational autoencoder is that it provides a probability metric instead of the reconstruction error as an abnormal score, called the reconstruction probability. The probability is more principled and objective than the reconstruction error, and does not require a model-specific threshold to judge anomalies. Inspired by the LSTM-VAE model, a MIXGU-VAE model is designed, which uses the better-performing MIXGU to replace the LSTM to obtain better reconstruction performance.

[0109] LSTM (Long Short-Term Memory) is a special recurrent neural network (RNN) that can capture long-term dependencies when processing sequence data while avoiding the gradient vanishing or gradient exploding problems that traditional RNNs may encounter. LSTM achieves this function by introducing a memory cell and three control gates (input gate, output gate, and forget gate).

[0110] Corresponding to the joint optimization, each timestamp produces two inference results, one is the predicted value obtained by the prediction model The second is the reconstruction probability P = {p1, p2, ..., p 3K}, p i The calculation method is shown in formula (III).

[0111] Based on the predicted value and reconstruction probability, a joint anomaly score is defined. The joint anomaly score balances the advantages of the prediction and reconstruction models and improves the overall efficiency of anomaly detection.

[0112] Joint anomaly score, first calculate an anomaly score s for each network function performance sensor nf , as shown in formula (IV). is the predicted MAPE (Mean Absolute Percentage Error), which indicates the degree of deviation between the predicted value and the actual value; (1-p i ) is the probability that the data at the detection moment cannot be reconstructed, that is, the degree of abnormality of the data, m is the number of performance sensors corresponding to each NF; λ is a hyperparameter that combines the prediction-based error and the reconstruction-based probability and is selected through grid search.

[0113]

[0114] Each NF provides multiple services and has multiple corresponding performance sensors deployed. Therefore, the final anomaly score of the NF is obtained by aggregating the scores of all performance sensors of each network function. nf If it is greater than the threshold, it is considered abnormal at the current moment. In this study, the maximum abnormal score of each NF during the training process is selected as the threshold.

[0115] The technical effects of the present invention are multifaceted. In view of the advantages of prediction and reconstruction models in time series anomaly detection, a DMIXGU (Deep Mix Gated Unit) prediction model and a MIXGU-VAE (MixGated Unit-Var Mixed Gate Unit-Variational Autoencoder) reconstruction model are designed for anomaly detection, and the two models are combined. The maximum mutual information coefficient is used to measure the sequence correlation and time correlation, and the sequence correlation graph and time correlation graph are constructed based on the Topk correlation. Two parallel graph attention networks are used to fuse the sequence features and the time features respectively to achieve feature complementarity, thereby achieving the purpose of improving the anomaly detection performance.

[0116] The embodiments and functional operations of the subject matter described in this specification may be implemented in: digital electronic circuitry, tangibly implemented computer software or firmware, computer hardware, including the structures disclosed in this specification and their structural equivalents, or a combination of more than one of the above. The embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on one or more tangible non-transitory program carriers, for execution by a data processing device or to control the operation of a data processing device.

[0117] Alternatively or additionally, the program instructions may be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical, or electromagnetic signal, which is generated to encode information for transmission to an appropriate receiver device for execution by a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of the above devices.

[0118] A computer program (which may also be referred to or described as a program, software, software application, module, software module, script or code) may be written in any form of programming language, including compiled or interpreted languages ​​or declarative or procedural languages, and the computer program may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program may be stored in a portion of a file that stores other programs or data, for example, one or more scripts stored in the following: in a markup language document; in a single file dedicated to a related program; or in multiple collaborative files, for example, files storing one or more modules, subroutines or code portions. A computer program may be deployed to execute on one or more computers, the computers being located in one place or distributed to multiple locations and interconnected by a communication network.

[0119] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0120] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0121] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments described herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A threat perception method based on signaling features and abnormal behavior detection, characterized in that: include: Input each sensor sequence into a sequence correlation graph building module to obtain a sequence correlation graph; Inputting the observed values ​​of the performance sensor into a time correlation graph building module to obtain a time correlation graph; The graph structure data in the sequence correlation graph and the time correlation graph are respectively outputted as a plurality of new nodes by feature fusion; Expand and splice the new nodes with the original time series to obtain a new time series; The model is updated through prediction model and reconstruction model, and finally the threat perception model is obtained.

2. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The step of inputting each sensor sequence into a sequence correlation diagram construction module to obtain a sequence correlation diagram comprises: Abstracting each sensor sequence into a sequence node, wherein the value of the sensor sequence is the sequence attribute value of the sequence node; Multidimensional time series are mapped into a set of sequence nodes and a set of sequence attribute values; A sequence correlation graph operation is performed according to the sequence node set and the sequence attribute value set to obtain a sequence correlation graph.

3. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The observed values ​​of the performance sensors are input into the time correlation graph building module to obtain the time correlation graph including: Abstracting a time series composed of the observation values ​​of all the performance sensors at a certain observation time as a time node, and using the observation values ​​of the performance sensors as the time attribute vector of the time node; Mapping a multidimensional time series of several observation moments into a set of time nodes, corresponding to the observation values ​​of the performance sensor forming a set of time attributes; A time correlation graph operation is performed according to the time node set and the time attribute set to obtain a time correlation graph.

4. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The prediction model is configured to: Inputting the time series into a number of time learning layers, wherein the time learning layers include a number of time learning units, to obtain time dependencies of the time series; The time dependencies of the time series are input into a fully connected layer to perform time series fusion and obtain a time series prediction value.

5. The threat perception method based on signaling features and abnormal behavior detection according to claim 4 is characterized in that: The reconstruction model is configured as: The new time series is input into the variational autoencoder for encoding, processed by the first linear unit, decoded by the decoder, and then processed by the second linear unit to obtain the reconstruction probability.

6. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The model is updated through the prediction model and reconstruction model, and finally the threat perception model is obtained, including: A joint anomaly score is defined according to the predicted value obtained by the prediction model and the reconstruction probability obtained by the reconstruction model, and the weight of the prediction model and the reconstruction model is balanced by the joint anomaly score; When the overall efficiency of the prediction model and the reconstruction model reaches the overall efficiency threshold of anomaly detection, the model is output to obtain a threat perception model.

7. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The log and signaling traffic data generated during the operation of the core network are input into the data aggregation and preprocessing module to aggregate the source data, unify the data dimension, and obtain the initial data; The initial data are matched and associated to generate a multidimensional time series, and the multidimensional time series is used as an input for data standardization and correlation measurement in preprocessing.

8. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The graph structure data in the sequence correlation graph and the time correlation graph are respectively fused by features to output a number of new nodes, including: According to the graph structure data of the sequence correlation graph, the neighbor node information is fused through the graph attention layer to output a new sequence node.

9. The threat perception method based on signaling features and abnormal behavior detection according to claim 1 is characterized in that: The graph structure data in the sequence correlation graph and the time correlation graph are respectively fused by features to output a number of new nodes, including: The time-correlation graph structure data of the time-correlation graph is taken as input, and the neighbor time node information is fused through the graph attention layer to output a new time node.

10. A threat perception system based on signaling features and abnormal behavior detection, characterized in that: The system comprises at least one processor; and a memory storing instructions, which, when executed by the at least one processor, implement the steps of the method according to any one of claims 1 to 9.

Images