Network abnormal behavior feature detection method and device, and computer readable storage medium

Abstract

The invention provides a network abnormal behavior feature detection method and device, and a computer readable storage medium. The network abnormal behavior feature detection method comprises the following steps: constructing an attention-based trajectory group anomaly detection model, constructing an abnormal behavior detection model, and constructing a normal and anomaly modeling model based on unsupervised learning; inputting the network behavior data of the networking device into the trajectory group anomaly detection model to obtain group trajectory preliminary anomaly detection data; inputting the group trajectory preliminary abnormal detection data into an abnormal behavior detection model to obtain non-abnormal behavior data in a data transmission process between the networked devices; and inputting the non-abnormal behavior data into the normal and abnormal modeling models to obtain network abnormal behavior feature data. According to the invention, the accuracy of network abnormal behavior detection between networked devices can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of satellite communications, and in particular to a network abnormal behavior feature detection method, a network abnormal behavior feature detection device, a computing device, a non-transitory computer-readable storage medium, a computer program product, and a chip system. Background Art

[0002] Group Anomaly Detection (GAD) is an important task in the fields of satellite communications, social networks, etc. The purpose of anomaly detection is to compare a certain behavior with the typical pattern to determine whether the behavior is abnormal.

[0003] In an IoT environment, there may be multiple interconnected networked devices. In such an interconnected environment, a faulty or damaged networked device may affect the operation of other networked devices, that is, the abnormal behavior exhibited by a networked device may spread to other devices in the IoT environment. Therefore, it is necessary to accurately identify the abnormal conditions of networked devices.

[0004] Currently, machine learning methods and deep learning methods can be used to detect abnormal network behavior of networked devices, but the existing abnormal behavior detection methods are not mature and have the problem of low detection accuracy. Summary of the invention

[0005] It would be advantageous to provide a mechanism that mitigates, alleviates or eliminates at least one of the problems discussed above.

[0006] In a first aspect, a method for detecting abnormal network behavior characteristics is provided. The method includes: constructing an attention-based trajectory group anomaly detection model, constructing an abnormal behavior detection model, and constructing a normality and abnormality modeling model based on unsupervised learning; inputting the network behavior data of networked devices into the trajectory group anomaly detection model to obtain preliminary abnormal group trajectory detection data; inputting the preliminary abnormal group trajectory detection data into the abnormal behavior detection model to obtain non-abnormal behavior data in the data transmission process between the networked devices; inputting the non-abnormal behavior data into the normality and abnormality modeling model to obtain network abnormal behavior characteristic data.

[0007] In a second aspect, a network abnormal behavior feature detection device is provided, which includes a device for executing the above-mentioned network abnormal behavior feature detection method.

[0008] In a third aspect, a computing device is provided, which includes: at least one processor; and at least one memory storing instructions, which, when executed individually or collectively by the at least one processor, enable the computing device to execute the above-mentioned network abnormal behavior feature detection method.

[0009] In a fourth aspect, a non-transitory computer-readable storage medium storing machine-executable instructions is provided. When the machine-executable instructions are executed individually or collectively by one or more processors of a machine, the machine executes the above-mentioned network abnormal behavior feature detection method.

[0010] In a fifth aspect, a computer program product comprising machine executable instructions is provided. When the machine executable instructions are executed individually or collectively by one or more processors of a machine, the machine executes the above-mentioned network abnormal behavior feature detection method.

[0011] In a sixth aspect, a chip system is provided, which includes a circuit system configured to execute the above-mentioned network abnormal behavior feature detection method.

[0012] It should be understood that the invention summary is not intended to identify the key or essential features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of some embodiments of the present disclosure in the accompanying drawings, in which: Figure 1 An exemplary flow chart of a method for detecting abnormal network behavior characteristics according to an embodiment of the present disclosure is shown; Figure 2 A schematic diagram of a network abnormal behavior feature detection model framework based on unsupervised learning according to some embodiments of the present disclosure is shown; Figure 3 A schematic diagram of an attention-based trajectory group anomaly detection model according to some embodiments of the present disclosure is shown; Figure 4 A schematic diagram of an abnormal behavior detection model according to some embodiments of the present disclosure is shown; Figure 5 A schematic diagram showing a model for modeling normality and abnormality in unsupervised anomaly detection according to some embodiments of the present disclosure; and Figure 6 A simplified block diagram of a device suitable for implementing the exemplary embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0014] The principle of the present disclosure will now be described with reference to some embodiments. It should be understood that the description of these embodiments is only for illustrative purposes, and helps those skilled in the art to understand and implement the present disclosure, without any limitation to the scope of the present disclosure. The disclosure described herein can be implemented in a manner different from that described below.

[0015] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0016] References in this disclosure to "one embodiment," "an embodiment," "an exemplary embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. In addition, when a particular feature, structure, or characteristic is described in conjunction with an exemplary embodiment, whether or not explicitly described, those skilled in the art will recognize that such feature, structure, or characteristic affects incorporation into other embodiments.

[0017] It should be understood that although the terms "first" and "second" etc. may be used to describe various elements herein, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the exemplary embodiments, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. The term "and / or" as used herein includes any and all combinations of one or more of the listed terms.

[0018] The terms used herein are only for describing specific embodiments, rather than for limiting exemplary embodiments. The singular forms "one", "an", and "the" used herein also include plural forms, unless the context clearly indicates otherwise. "A group of elements" or "element set" used herein is intended to include one or more elements. It should also be understood that the terms "include", "comprise", "have", "have", "include" and / or "include", when used herein, specify the presence of the features, elements and / or parts, etc., but do not exclude the presence or addition of one or more other features, elements, parts and / or combinations thereof.

[0019] As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) Hardware circuit implementation only (e.g., implementation only in analog and / or digital circuits) (b) a combination of hardware circuitry and software, such as (where applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware; and (ii) any part of a hardware processor (including a digital signal processor) with software, software and memory that work together to enable a device such as a mobile phone or server to perform various functions, and (c) A hardware circuit and / or processor, such as a microprocessor or portion of a microprocessor, that requires software (eg, firmware) to operate, but where software is not required for operation, the software may not be present.

[0020] This definition of circuitry applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term circuitry also includes an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also includes, for example, if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing network device.

[0021] The networked devices mentioned in this article can exchange data through a communication network. As used herein, the term "communication network" refers to a network that complies with any appropriate communication standard, such as long-term evolution (LTE), LTE-Advanced (LTE-A), wideband code division multiple access (WCDMA), high-speed packet access (HSPA), narrowband Internet of Things (NB-IOT), new radio (NR), non-terrestrial network (NTN), etc. In addition, the Internet of Things device can be a terminal device, a network device, etc. The communication between the terminal device and the network device in the communication network can be performed according to any appropriate generation of communication protocols, including but not limited to the first generation (1G), second generation (2G), 2.5G, 2.75G, third generation (3G), fourth generation (4G), 4.5G, fifth generation (5G), future sixth generation (6G) communication protocols, and / or any other protocols currently known or to be developed in the future. The embodiments of the present disclosure can be applied to satellite communication systems. Considering the rapid development in communication, there will certainly be future types of communication technologies and systems, and the present disclosure can be implemented with these technologies and systems. It should not be considered that the scope of the present disclosure is limited to the aforementioned system.

[0022] The terms "Internet of Things device" and "networked device" used in this article can be a node set on a satellite in a communication network, or a node set on the ground.

[0023] Networked devices on satellites may refer to base stations (BS) or access points (APs) as satellite payloads, such as NodeB (NodeB or NB), evolved NodeB (eNodeB or eNB), NR NB (also known as gNB), remote radio unit (RRU), radio head (RH), remote radio head (RRH), relay node. An example of a relay node may be an integrated access and backhaul (IAB) node. The distributed unit (DU) part of an IAB node may perform the functions of an "IoT device" and may therefore operate as a network device. In the following description, the terms "IoT device", "networked device" and "node" may be used interchangeably.

[0024] The networking device on the ground may refer to any terminal device capable of wireless communication. As an example and not limitation, the terminal device may also be referred to as a communication device, user equipment (UE), user station (SS), portable user station, mobile station (MS) or access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device such as a digital camera, a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a notebook embedded device (LEE), a laptop computer installation device (LME), a USB dongle, a smart device, a wireless user equipment (CPE), an Internet of Things (Lot) device, a watch or other wearable device, a head-mounted display (HMD), a vehicle, a drone, medical equipment and applications (e.g., remote surgery), industrial equipment and applications (e.g., robots and / or other wireless devices operating in the context of industrial and / or automated processing chains), consumer electronic devices, relay nodes, devices operating on commercial and / or industrial wireless networks, etc. The mobile terminal (MT) portion of the IAB node may perform the functions of a "terminal device" and may therefore operate as a terminal device.

[0025] Although the functions described herein may be performed in fixed and / or wireless network nodes in various exemplary embodiments, in other exemplary embodiments, the functions may be implemented in a user equipment device (such as a cellular phone, or a tablet computer, or a laptop computer, or a desktop computer, or a mobile Internet of Things device, or a fixed Internet of Things device). For example, the user equipment device may appropriately have the corresponding capabilities described in relation to fixed and / or wireless network nodes. The user equipment device may be a user device and / or a control device, such as a chipset or a processor, which is configured to control the user device when the user device is installed therein. Examples of these functions include boot server functions and / or home user servers, which may be implemented in a user equipment device by providing the user equipment device with software configured to cause the user equipment device to execute from the perspective of these functions / nodes.

[0026] The following first introduces the prior art related to the present disclosure, and the technical concepts adopted by the present disclosure to alleviate the technical problems existing in the prior art.

[0027] Group Anomaly Detection (GAD) is an important task in many disciplines and fields, such as social networks. In these fields, GAD is applicable to various types of group anomalies. Since group member instances can be represented arbitrarily, the GAD paradigm is also applicable to detecting abnormal sequences such as trajectories. The most advanced trajectory anomaly detection methods are recurrent neural networks such as LSTMs and GRUs (LSTM stands for Long Short-Term Memory network, GRU stands for Gated Recurrent Unit), but the potential of deep learning methods in group anomaly detection has rarely been studied. So far, the GAD task is more likely to be solved by generative topic models or support vector machine-based methods.

[0028] The purpose of anomaly detection is to identify patterns whose behavior is considered atypical compared to typical patterns. Different approaches can be tried to detect anomalies in IoT environments, such as traffic analysis, packet-level signatures, and semantic-based models. Machine learning has also emerged as a powerful technique for detecting anomalies by identifying irregular data patterns, such as support vector machines for identifying activity patterns, training network-level data with hidden Markov models to detect anomalies, outlier detection using K-NN (K-nearest neighbor) machine learning methods, and anomaly-based malware detection using naive Bayes and random forest machine learning algorithms.

[0029] Identifying the attributes involved in an anomaly can become a task in itself. For local outliers, these attributes include not only the outlier attributes, but also the attributes used to calculate the local context. This disclosure refers to this set of attributes as the relevant subspace. Nearest neighbor methods, such as KNN and LOF (Local Outlier Factor), mark an instance as an anomaly if it is far away from its nearest neighbor. KNN uses an absolute threshold for this, while LOF compares the distance to the typical distance between other neighbors. These methods implicitly identify relevant context (anything nearby constitutes context), but do not identify subspaces because the distance metric predetermines the relevance of each dimension. Subspace-based methods detect anomalies in multiple subspaces and aggregate the results into a final anomaly score.

[0030] Despite the progress in trajectory anomaly detection, deep generative models have only been involved in performing GAD on images in the form of adversarial autoencoders and variational autoencoders. Some studies provide different machine learning based algorithms to detect anomalous groups of multiple trajectories, but do not identify the detection of single anomalous trajectories (sequences of group members) as a group anomaly detection problem. However, most methods cannot guarantee that anomalous behavior only appears within short trajectory segments. For recurrent neural networks, and sometimes even LSTM and GRU, learning very long-term dependencies is challenging. Another challenge of deep learning based trajectory group anomaly detection is that due to the high availability of trajectory data, which is not uncommon, their labeling is quite weak or simply cannot overcome the non-real problem.

[0031] To address these challenges, this paper proposes the GADFormer model, which is referred to as the trajectory group anomaly detection model in the following text. This is a BERT (Bidirectional Encoder Representations from Transformers)-based architecture with transformer encoder blocks for attention-based group anomaly detection on trajectories.

[0032] In an IoT environment, there may be multiple interconnected networked devices. In such an interconnected environment, a faulty or damaged networked device may affect the operation of other networked devices, that is, the abnormal behavior exhibited by a networked device may propagate to other devices in the IoT environment. Current studies have identified different types of anomalies and proposed methods that may identify these anomalies. Most previous studies have considered: packet-level anomalies related to the network traffic generated by networked devices; state or behavior anomalies based on the analysis of the behavior of networked devices over time. However, previous studies have mainly focused on anomaly detection methods, but have not studied the following mechanisms: mitigating the impact of anomalies that propagate from one networked device to another, thereby affecting the state or behavior of multiple devices in the IoT environment; and enabling affected networked devices to recover from such propagated anomalies.

[0033] Therefore, this disclosure introduces a framework model IoT-AD, which is referred to as the abnormal behavior detection model below, to detect abnormal behaviors that occur during the connection process between interconnected networked devices, and eliminate abnormal behaviors that may exist during the model connection process, further improving the robustness of the network behavior anomaly detection system. By monitoring the data transmission process between devices, the framework can timely identify and eliminate potential abnormal behaviors during the connection process, ensuring the stability and reliability of the entire system.

[0034] Most anomaly detection systems attempt to model normal behavior and assume that anomalies deviate from normal behavior in various ways. However, there may also be patterns in anomalies. Ideally, an anomaly detection system can exploit patterns in both normal and abnormal behavior. Residual-based methods compute an anomaly score for an instance by taking the difference between the observed and predicted values ​​for each attribute (called the residual), dividing by the standard deviation of the attribute, and aggregating it into a single score. Obviously, the choice of the type of prediction model determines how well the anomaly detector can identify context and subspaces, and how interpretable they are. Residual-based methods strongly rely on the assumption that normal instances are characterized by their attributes being more predictable. However, it is entirely possible that many attributes are inherently unpredictable (e.g., coin tossing) or that some attributes are more predictable in anomaly cases than in normal cases, and residual methods may fail badly when their assumptions are violated. Therefore, as with residual-based methods, a set of predictors can be learned to find the relevant subspaces and contexts.

[0035] The embodiments of the present disclosure propose a network abnormal behavior feature detection solution, which can improve the accuracy of network abnormal behavior detection between networked devices and protect network security and data privacy. In the solution of the present disclosure: (1) The present disclosure constructs three models, namely: a) an attention-based trajectory group anomaly detection model (named in the present disclosure as: GADFormer), b) an abnormal behavior detection model (named in the present disclosure as: IoT-AD), and c) a normality and abnormality modeling model based on unsupervised learning (named in the present disclosure as: AD-MERCS). These three models can solve the limitation problem of requiring a large amount of labeled data in traditional supervised learning methods, reduce implementation costs, and improve the applicability of the algorithm. By using unsupervised learning methods, they can better adapt to the ever-changing and growing abnormal behaviors in the Internet environment, and can also automatically identify and report potential network security threats and abnormal behaviors.

[0036] (2) By analyzing network behavior data through GADFormer, group trajectories can be identified from preprocessed network behavior data and preliminary anomaly detection can be performed, thereby improving the accuracy and efficiency of anomaly detection. By introducing the attention mechanism, the model can pay more attention to the more influential parts of network behavior data, thereby improving the ability to detect abnormal behavior.

[0037] (3) IoT-AD is used to detect abnormal behaviors that occur during the connection process between interconnected networked devices, and to eliminate abnormal behaviors that may exist during the model connection process, further improving the robustness of the network behavior anomaly detection system. The overall model framework disclosed in this disclosure can timely identify and eliminate potential abnormal behaviors during the connection process by monitoring the data transmission process between devices, thereby ensuring the stability and reliability of the entire system.

[0038] The following will refer to Figure 1 The principles and implementations of the present disclosure are described in detail.

[0039] Figure 1 An exemplary flow chart 100 of a method for detecting abnormal network behavior characteristics according to an embodiment of the present disclosure is shown. Figure 1 As shown, the network abnormal behavior feature detection method of this embodiment includes the following steps: Step S110: constructing an attention-based trajectory group anomaly detection model, constructing an abnormal behavior detection model, and constructing a normality and abnormality modeling model based on unsupervised learning.

[0040] Step S120: inputting the network behavior data of the networked devices into the trajectory group anomaly detection model to obtain preliminary group trajectory anomaly detection data.

[0041] Step S130: Input the preliminary abnormality detection data of the group trajectory into the abnormal behavior detection model to obtain non-abnormal behavior data during the data transmission process between networked devices.

[0042] Step S140: Input the non-abnormal behavior data into the normality and abnormality modeling model to obtain network abnormal behavior feature data.

[0043] The network behavior data of the networked device disclosed in the present invention will be described first, and the above-mentioned steps S110 to S140 will be introduced later.

[0044] In some embodiments, before inputting the network behavior data of the networked device into the trajectory group anomaly detection model, the method further includes: Collecting network behavior raw data of networked devices. In some embodiments, the network behavior data includes: one or any combination of network traffic data, server log data, and application log data.

[0045] Preprocessing operations are performed on the original network behavior data to obtain network behavior data; wherein the preprocessing operations include: one or any combination of data cleaning, feature extraction, feature normalization, data dimensionality reduction and data partitioning.

[0046] Exemplarily, the above steps are equivalent to the data collection step and the data preprocessing step. Data collection step: Set up appropriate monitoring equipment or tools to collect raw data related to the target behavior. Ensure that the data collection process does not cause system performance problems and record key information. Data preprocessing step: Perform preprocessing operations on the collected network behavior data, extract useful features and reduce noise interference, and provide more accurate and reliable data for subsequent anomaly detection analysis.

[0047] The data collection process is described below.

[0048] Figure 2 A schematic diagram 200 of a network abnormal behavior feature detection model framework based on unsupervised learning according to some embodiments of the present disclosure is shown. Figure 2 As shown, illustratively, in the data collection step, set up appropriate monitoring equipment or tools to collect raw data related to the target behavior. Ensure that no system performance problems are caused during the data collection process, and record key information. When performing anomaly detection on Internet behavior, the following data can be collected. 1. Network traffic data: Collect traffic data of network devices (such as routers and switches). 2. Server log data: Collect log data generated by the server, including access logs, error logs, security logs, etc. 3. For Web applications or mobile applications, the corresponding application log data can be collected.

[0049] Set up appropriate configurations on the selected data source to capture and record network traffic data. Data collection can be accomplished using specially designed software or hardware tools such as Wireshark. This tool can capture incoming and outgoing network traffic by listening to a specified port or configuring a mirror port.

[0050] The following introduces the methods of data preprocessing.

[0051] Combination Figure 2 As shown, in some embodiments, data cleaning includes: filtering out data records related to abnormal network behavior from the original network behavior data, deduplicating duplicate records in the data records according to specific fields, processing missing values ​​in the data records by deletion, interpolation or filling methods, and obtaining cleaned network behavior data.

[0052] Feature extraction includes: calculating statistical information features based on the cleaned network behavior data, the statistical information features include one or any combination of mean, variance, maximum, minimum, kurtosis, and skewness; and / or, calculating statistical features based on the sliding window method and the cleaned network behavior data, the statistical features include the sliding window mean and the sliding window standard deviation; and / or, using a pre-trained machine learning model or a pre-trained deep learning model to model the cleaned network behavior data and extract high-level features.

[0053] Feature normalization includes: normalizing any of statistical information features, statistical features, and advanced features to obtain normalized features; wherein the normalization includes minimum and maximum normalization and standardization.

[0054] Data dimensionality reduction includes: using principal component analysis method PCA or linear discriminant analysis method LDA to reduce the dimensionality of original network behavior data to obtain network behavior data after dimensionality reduction.

[0055] Data partitioning includes: dividing network behavior data into training sets and test sets.

[0056] The above data preprocessing methods are explained below.

[0057] For example, the collected raw network behavior data may contain noise interference. The data preprocessing part processes the raw network behavior data to extract useful features and reduce noise interference, providing more accurate and reliable data for subsequent anomaly detection analysis. In order to reduce the impact of these interference factors on model training, data cleaning, feature extraction, feature normalization, data dimensionality reduction and data partitioning can be used to achieve this.

[0058] First, since the collected raw data may contain noise and errors, data cleaning is required to remove these interference items. This can be achieved by filtering out valid data records and excluding duplicate, missing or incomplete records. In the data cleaning process, the data must first be filtered, that is, records that meet specific conditions or are of interest are selected from the raw data. This can be determined based on business needs, such as only selecting data records related to abnormal network behavior. In the case of duplicate records, deduplication is required. Duplicate records may lead to misjudgment or inaccurate assessment of abnormal behavior, so deduplication can be performed based on specific fields (such as IP address, timestamp, etc.) to retain unique records.

[0059] Missing values ​​can also be processed during the cleaning process. Some fields may be missing in the original data, which may be caused by sensor failure, network interruption, etc. Missing values ​​can be processed by deletion, interpolation, or filling. Deletion means directly deleting records containing missing values; interpolation means inferring missing values ​​by using the rules of existing data; filling means filling missing positions with some default value or average value.

[0060] Next, meaningful features can be extracted from the cleaned data. Features should be able to accurately describe network traffic and have the ability to distinguish normal from abnormal behavior. When extracting features, a series of features can be calculated and generated based on different attributes or fields. For example, for each IP address or port number, some statistical information can be calculated as features. Common statistical information includes mean, variance, maximum, minimum, kurtosis, skewness, etc. These statistical information can reflect the distribution and changing trends of traffic, thus providing a way to describe network traffic behavior.

[0061] In addition to features based on statistical information, more features can be extracted using time series analysis methods. For example, various statistical features of traffic within the window can be calculated using sliding window technology, such as sliding window mean, sliding window standard deviation, etc. This can capture the dynamic changes and periodic patterns of traffic.

[0062] In addition, in the feature extraction process, you can also consider using models trained based on machine learning or deep learning algorithms to extract advanced features. These models can capture more complex network traffic behaviors by learning the intrinsic representation or feature mapping of the data. For example, you can use a convolutional neural network (CNN) or a recurrent neural network (RNN) to model network traffic data and extract features with high discrimination.

[0063] In order to avoid the impact of scale differences between different features, the extracted features can be normalized. Common methods include minimum-maximum normalization and standardization. In practical applications, the value ranges of different features may vary greatly, which may cause some features to have too much influence on the model and ignore other features. For example, in a housing price prediction problem, the value ranges of the two features of house area and house age may be 0-1000 square meters and 0-50 years respectively. If these two features are directly input into the model, the model may pay more attention to the area and ignore the age of the house. In order to solve this problem, the present disclosure can normalize the extracted features.

[0064] The two commonly used methods are Min-Max Normalization and Standardization. Min-Max Normalization scales the eigenvalues ​​to a specified range, usually between 0 and 1. The specific operation is to subtract the minimum value of each eigenvalue from the feature and divide it by the difference between the maximum and minimum values ​​of the feature. This ensures that all feature values ​​are between 0 and 1. Standardization converts the eigenvalues ​​into a distribution with a mean of 0 and a variance of 1. The specific operation is to subtract the mean of each eigenvalue from the feature and divide it by the standard deviation of the feature. This makes the mean of all features 0 and the variance 1, thereby eliminating the scale differences between different features.

[0065] In practical applications, we may face the problem of high-dimensional data sets, which will increase the computational cost and reduce the algorithm effect. Therefore, dimensionality reduction techniques can be used to reduce the data dimension. Commonly used dimensionality reduction methods include principal component analysis (PCA) and linear discriminant analysis (LDA), which can retain most of the original data information while reducing the data dimension.

[0066] Finally, the preprocessed dataset is divided into a training set and a test set. Cross-validation or random partitioning is usually used to ensure the accuracy of model evaluation. The training set is used for model training of unsupervised learning algorithms, while the test set is used to evaluate the performance of the model on unknown data.

[0067] The above steps S110 to S140 are described in detail below: Combination Figure 2 As shown, in step S110, an attention-based trajectory group anomaly detection model 11 is constructed, an abnormal behavior detection model 12 is constructed, and a normality and abnormality modeling model 13 based on unsupervised learning is constructed. Exemplarily, Figure 2Some of the steps shown in the figure will be described later in conjunction with other figures.

[0068] Exemplarily, the attention-based trajectory group anomaly detection model GADFormer constructed by the present disclosure is used to group the network behavior data with noise interference, perform abnormal behavior detection from the group trajectory sequence of each group, and complete the preliminary network abnormal behavior detection. The framework IoT-AD for detecting abnormalities between interconnected IoT model frameworks constructed by the present disclosure is used to input the network behavior data for preliminary abnormal detection output from the attention-based trajectory group anomaly detection model into the framework for detecting abnormalities between interconnected IoT model frameworks, detect abnormal behaviors that occur during the data transmission process between multiple model frameworks, and exclude abnormal behaviors that may occur during the model connection process, with the purpose of filtering the abnormal behavior data generated between models. The normality and abnormality modeling model AD-MERCS in unsupervised anomaly detection constructed by the present disclosure is used to remove the abnormal behavior data generated between models from the framework for detecting abnormalities between interconnected IoT model frameworks, and input it into the normality and abnormality modeling model in unsupervised anomaly detection, effectively utilizing the abnormal behavior patterns in normal behavior and deviation from normal behavior, and completely separating the abnormal data from the normal data to complete the final network abnormal behavior detection.

[0069] The following is a unified introduction to the attention-based trajectory group anomaly detection model 11 (GADFormer) disclosed in the present invention to facilitate understanding of the technical means described later.

[0070] Exemplarily, the preprocessed network behavior data is input into the attention-based trajectory group anomaly detection model, which groups the preprocessed data, performs abnormal behavior detection from the group trajectory sequence of each group, and completes preliminary network abnormal behavior detection.

[0071] Figure 3 A schematic diagram 300 of an attention-based trajectory group anomaly detection model according to some embodiments of the present disclosure is shown below. Figure 3 Describe the process of the attention-based trajectory group anomaly detection model, refer to Figure 3 , the disclosed solution includes the following parts: 1. Data input: Input the network behavior data without noise interference.

[0072] 2. BERT-based Transformer encoder model architecture: The input network behavior data is passed through the input embedding layer, position encoding layer and multi-head attention module for attention-based group anomaly detection.

[0073] 3. Attention anomaly scoring module: The network behavior data that has passed the attention group anomaly detection is weighted by the attention matrix to obtain matrix weighted data, and finally passes through the Transformer encoder layer to obtain the group trajectory anomaly detection data.

[0074] 4. Data output: Output network behavior data of preliminary anomaly detection.

[0075] The following describes in detail each step of the above process.

[0076] Here is the model architecture and loss target: Different from the GAD featurization and aggregation functions of existing deep generative models, the deep bidirectional GADFormer Ψ model used models the featurization and aggregation functions in the following way: (1) Characterization function of GADFormer Group Group members The bidirectional relationship between (trajectory point p or trajectory The representation of the paragraph s) is mapped to the attention-based feature map , represents the behavior of an individual group (individual trajectory path). This is achieved through the BERT encoder, which consists of layers for input embedding, position encoding, and multi-head self-attention blocks, and uses the group member embedding pe as input token.

[0077] (2) Aggregation functions of GADFormer Unlike normal groups Instead of approximating the distribution of , we use the distance metric d to calculate the probability of abnormal group behavior (abnormal trajectory path) This is achieved through a nonlinear custom task layer in the output block, which incorporates the group behavior characteristics Mapping to task-specific feature map representations .

[0078] (3) Then, a sigmoid function maps this representation to the probability of group abnormality ,in ∈ [0,0.5] represents the normal group, ∈ [0.5, 1] ​​represents abnormal groups (trajectories).

[0079] (4) Since group (trajectory) labels are rarely available, the loss objective of GADFormer is defined under unsupervised and semi-supervised learning settings, assuming that most dataset instances are normal. Therefore, the binary cross-entropy loss LBCE (Binary Cross-Entropy Loss) can be defined as the loss function. This loss function can be considered a suitable choice because the entropy As a measure of uncertainty, = 1, and when the model is very certain about the anomaly prediction = 0.

[0080] Since the normal groups (trajectories) account for the majority in the learning setting, we can ignore the minority of abnormal groups (trajectories) and give the probability of most normal groups Set fixed auxiliary target probability = 0, to ensure that the prediction is certain ( = 0). If the model is faced with a real group of anomalies, it will be even more uncertain about its decision, resulting in a probability close to = 0.5, resulting in a high entropy loss. For the real normal groups that the model has been trained on, the probability ≈ 0 results in low entropy loss.

[0081] Since in the setting, the model only targets groups within the normal range (probability ∈ [0, 0.5]) for abnormality prediction, where = 0 means that a group (trajectory) is not abnormal at all, so the abnormality of a group can be defined by the group anomaly score: (5) This formula (5) is used in the GADFormer method disclosed in the present invention.

[0082] Model training is explained here: Non-normal trajectories are rare by definition and relatively expensive to annotate because they require domain experts. To address this challenge, two different learning settings can be used: 1) unsupervised learning, which does not require any labels and assumes that the proportion of non-normal trajectories is low and has no significant impact during model training; 2) semi-supervised learning, which relies only on verified normal samples. These learning settings allow setting a fixed auxiliary target probability = 0, so the ground truth of the abnormal trajectories is not required during GADFormer training.

[0083] The following describes the training steps of the model. The input of the algorithm includes the trajectory dataset , grouped data sets , GADFormer model with initialization parameters And the loss objective function In addition, the algorithm parameters used are the dataset partitioning ratio for training, validation and testing, the model optimizer, the total number of epochs, the batch size bs, the learning rate η, the weight decay and the learning rate scheduler (with a patience parameter). The output of the algorithm is the model , which has the parameters that results in the lowest validation loss, and its GA score and related losses After the variables are initialized, the training needs to be repeated for a specified number of epochs or until the model converges. In each training epoch, a batch of groups (trajectories) needs to be passed to the model and its group anomaly probability is returned. , and use it to calculate the binary cross entropy loss L and the associated group anomaly score This is the same for the training set, validation set, and test set. The only difference during training is when calculating gradients and updating model weights. At the end of each training epoch, the validation loss The best model is retained along with its loss and GA score. Finally, the best model with associated loss and grouped anomaly score is returned as described in the output.

[0084] Here is the model algorithm interpretability: Deep learning models are often very complex, and their training often requires a deep understanding of their model architecture, loss function, preprocessing, and data distribution in order to make the right fine-tuning decisions. Deep learning models have many layers, blocks, and parameters.

[0085] In order to achieve higher model interpretability and address one of the main deep anomaly detection challenges mentioned, a Block Attention Anomaly Score (BAS) can be introduced for the GADFormer model used. This score represents group anomalies by the ratio of the weighted output of the block attention matrix to the average output of the Transformer encoder block layer. This allows to demonstrate two abilities of the Transformer encoder block layer: 1) to universally distinguish patterns of different groups (trajectories); 2) to distinguish between normal and anomalous groups (individual trajectories).

[0086] Since the attention matrix The cell contains and The scaled dot product of (two projected group embeddings projected from the input token pe) weights the importance of the bidirectional relationship between a pair of group members in different heads h, and focuses on the behavior pattern of the group (trajectory) through different perspectives (the trajectory path pattern in the context of individual trajectories in the GAD task), while it is combined with the third projected group member embedding The concatenated dot product provides an attention output matrix weighted by overall importance. , emphasizing the specific group m (individual trajectory task-related behavior of the task-related trajectory path segments.

[0087] The BAS of each group within each Transformer encoder block is calculated algorithmically. The required inputs to the algorithm are the group attention matrix and the Euclidean distance metric of the Transformer encoder block. Further parameters include the ratio of the top N abnormal groups, the block index b and the number of groups M.

[0088] For all attention matrices , calculate the average attention matrix of group m in head h And the average value ab of all groups. According to the given , use with The most dissimilar top N anomaly group attention matrices are used to calculate an average anomaly group attention matrix , in order to perform reliable distance calculations. Next, the group attention matrix Compared with the average value of the attention matrix of the normal group The distance between them and the average value of the attention matrix of the normal group Average value of attention matrix of abnormal group The distance between them is used to calculate the ratio between them, which represents the block attention anomaly score. .

[0089] Considering the following example of trajectory BAS in four GADFormer encoder block layers, the present disclosure can understand that the first few encoder block layers (0-2) cannot distinguish between normal and abnormal tracks, while in the last layer, the number of potential false positive scores decreases, indicating that the model is better able to extract features related to abnormal tracks. Within the layer, the trajectory BAS shows that the model cannot truly distinguish between normal and abnormal track scores at all levels, and cannot even distinguish the features of a single track in the normal track category.

[0090] In summary, BAS provides the present disclosure with a perspective on the Transformer encoder block layer and allows the present disclosure to reasonably adjust hyperparameters and model architecture to improve model performance.

[0091] refer to Figure 3As shown, in some embodiments, the trajectory group anomaly detection model 11 has a BERT-based Transformer encoder model architecture. The trajectory group anomaly detection model 11 includes: an input embedding layer, a position encoding layer, a multi-head attention module, an attention anomaly scoring module, and a Transformer encoder layer. Exemplarily, such a setting enables the model to efficiently capture complex features and temporal dependencies in trajectory data, significantly improving the accuracy and robustness of anomaly detection.

[0092] In step S120, the network behavior data of the networked devices is input into the trajectory group anomaly detection model to obtain preliminary group trajectory anomaly detection data. Exemplarily, such a setting can identify preliminary anomaly data in the group trajectory and provide key information for further anomaly analysis.

[0093] In some embodiments, the network behavior data of the networked devices is input into a trajectory group anomaly detection model to obtain preliminary group trajectory anomaly detection data, including: The network behavior data is processed in sequence using the input embedding layer, position encoding layer, and multi-head attention module to output attention group anomaly detection data.

[0094] The attention anomaly score module is used to perform attention matrix weighted calculation on the attention group anomaly detection data to obtain matrix weighted data.

[0095] The matrix-weighted data is processed using the Transformer encoder layer to obtain preliminary anomaly detection data for group trajectories.

[0096] Exemplarily, the above steps can efficiently and accurately identify abnormal behaviors in group trajectories.

[0097] In some embodiments, the trajectory group anomaly detection model uses the above-mentioned formula (2), formula (3), formula (4), and formula (5) to calculate the group trajectory preliminary anomaly detection data : (2) (3) (4) (5) in, Represents the trajectory of network behavior data; represents the characterization function; Indicates group behavior characteristics; Represents an aggregate function; Representation of task-specific feature maps; Represents the sigmoid function; Indicates the probability of group abnormality.

[0098] In some embodiments, the trajectory group anomaly detection model 11 is trained using an unsupervised learning method or a semi-supervised learning method; when training the trajectory group anomaly detection model, in each training epoch, the grouped trajectories of the network behavior data are batch-transmitted and the anomaly probability of the grouped trajectories is returned. ; According to the abnormal probability Calculate the binary cross entropy loss L and the group trajectory preliminary anomaly detection data .

[0099] Exemplarily, such a setting can effectively process the group trajectories of network behavior data in each training cycle and accurately return the abnormal probability of these group trajectories, which can further optimize the model to generate more accurate preliminary anomaly detection data of group trajectories.

[0100] The following first introduces the framework for detecting anomalies between interconnected IoT model frameworks (IoT-AD) disclosed in the present invention in a unified manner to facilitate understanding of the technical means described later.

[0101] The network behavior data of preliminary anomaly detection output from the attention-based trajectory group anomaly detection model is input into the framework for detecting anomalies between interconnected IoT model frameworks. Its function is to detect abnormal behaviors that occur during the data transmission process between multiple model frameworks and to exclude abnormal behaviors that may occur during the model connection process. The purpose is to filter the abnormal behavior data generated between models.

[0102] Figure 4 A schematic diagram 400 of an abnormal behavior detection model according to some embodiments of the present disclosure is shown below. Figure 4 Describe the process of the framework for detecting anomalies between interconnected IoT model frameworks (i.e., the abnormal behavior detection model 12), refer to Figure 4 , the disclosed solution includes the following parts: 1. Data input: Input network behavior data for preliminary anomaly detection.

[0103] 2. Model device monitoring: The network behavior data of the preliminary anomaly detection is monitored through the controller and other monitoring devices, and the data is tracked and collected to form data packets.

[0104] 3. Event identifier and model device status update: An event is a series of data packets exchanged between two or more IoT model devices with interdependent relationships in the network to prepare for packet-level anomaly detection.

[0105] 4. Packet-level anomaly detection: If a set of exchanged packets for a particular event does not match (or has no similar pattern) any previously generated event signature, then the event will be considered an anomaly at the packet level.

[0106] 5. Model device interaction verification: If no abnormality is found at the packet level, the controller will allow the event to execute. Otherwise, if an abnormality is found in the packet, the packet will be discarded.

[0107] 6. Data output: Output the data with package-level abnormal behavior removed between models.

[0108] The following describes each step of the above process in detail.

[0109] Model device monitoring is described here: In IoT-AD, a controller is an entity that performs a series of operations (e.g., anomaly detection at the packet level, model device interaction verification). To this end, an existing IoT model device framework with sufficient resources, a resource-rich WiFi router, or a smart center can act as a controller.

[0110] All model devices in an IoT environment are wirelessly connected to a controller, which is responsible for monitoring all model devices in the environment and collecting measurements or readings from these devices over time. Depending on the nature of the IoT model devices, the state information of the model devices can be updated to the controller periodically or when a state change occurs. For example, the temperature reading of a thermometer can be updated to the controller after a certain time interval. Another example is when an event occurs (such as a smart light bulb switch is turned on or off), the state of the light bulb will be updated to the controller.

[0111] In addition to monitoring the status of IoT model devices, the controller can also analyze the packets exchanged between model devices through the controller in chronological order. The controller monitors various L2-L4 packet headers, such as IP address, TCP / UDP (Transmission Control Protocol / User Datagram Protocol) port, packet length, and records the timestamp of each packet. The headers of the exchanged packets are used to identify the communication pattern between model devices and keep an event log for each model device.

[0112] The event identifier and model device status updates are described here: An event is a series of data packet exchanges between two or more IoT model devices in a local network that have interdependent relationships (e.g., a motion sensor can turn on a light bulb or even multiple light bulbs and sockets). When a model device communicates with a cloud server for a specific service, such as searching for firmware updates, sending device information, receiving control commands from a user application, etc., this communication can also be identified as an event.

[0113] The following describes how packets are exchanged between two networked devices in IoT-AD through a controller. First, a TCP connection is established between a model device and a controller. Then, the model device sends an event-related command to the controller (for example, a motion sensor detects motion in a room), and after the controller successfully receives the command, the TCP connection with the model device is closed, and the controller communicates with another model device through the same process. This command is triggered by an event of the first model device (for example, a motion sensor detects motion in a room, causing the lights in the room to activate). Although the length of the exchanged packets can be different, characteristics such as TCP flags, destination ports, and source ports may be common depending on the model device and event type. Each time a specific event occurs, the sequence of packets and their characteristics remain the same. Therefore, such a burst of packets can be used to detect that an event has occurred at a specific time.

[0114] The IoT-AD controller keeps a log file for each model device in chronological order of events. When an event is detected, the controller updates the log file of the device that generated the event and adds information related to the event. The controller stores logs related to event e at least until e and all events triggered by e are verified. After that, the logs of verified events can be archived on the remote cloud and can be deleted if the controller does not have enough resources.

[0115] It has been shown that each event has a unique packet exchange pattern that varies by model device and manufacturer, which can be used as a signature. This is because IoT model devices typically perform a limited number of operations (i.e., potential event space). In IoT-AD, packet signatures can be created based on tuples of different header fields. Specifically, the following features can be considered: source and destination port numbers, exchanged packet length, TCP flag type, time span of each event, and direction of the packet within that time span. Based on these features, IoT-AD generates packet signatures for various events.

[0116] Packet-level anomaly detection is explained here: If a set of exchanged packets for a particular event does not match (or have a similar pattern) any previously generated event signature, then the event is considered an anomaly at the packet level. Anomalies can occur for many reasons, such as device or sensor failures, and devices compromised by attackers.

[0117] IoT-AD uses a lightweight machine learning model running on the controller to detect anomalies at the packet level. The model is trained based on previously extracted event signatures. Since each IoT model device typically performs a specific set of operations over time, the potential event signatures of the available IoT model devices can be collected as part of the training dataset. Once the model training is complete, the controller uses the model to determine whether the incoming event is valid. If the incoming event is valid according to the model's prediction, the controller allows the event to proceed. Otherwise, the event is considered an anomaly and the controller terminates it.

[0118] Here is the model device interaction verification: If no anomalies are found at the packet level, the controller will allow the event to execute. The controller also logs information related to the event, such as the model device that triggered the event and which device's state was changed due to that specific event. The log of event-related information is used to verify the occurrence of events over time based on conditions defined by the user and / or each device vendor. Below are some examples of conditions.

[0119] An interaction between model devices can be defined as an event of one model device being triggered by another model device in the IoT environment. Likewise, the same event can be triggered by events of different model devices. For example, an event to turn on a smart light bulb can be triggered by a motion detector. The same light bulb can also be turned on by a light sensor. If the interaction between devices meets the conditions defined by the user or the vendor, then the interaction is considered valid, making the entire IoT environment function as expected. For example, a user can set a condition that if the room temperature detected by a smart temperature monitor exceeds a certain threshold, the monitor sends a command through the controller to turn on the air conditioner and fan. In this case, turning on the air conditioner and fan by the temperature monitor will be considered a valid interaction. However, if the temperature monitor attempts to turn on the light, it will be considered an invalid interaction (anomaly).

[0120] The controller creates and maintains a data structure called an interaction tree over time. These trees represent interconnected sequences of events triggered by measurements or readings from devices. The model device that starts the interaction is the root device of the tree. When the root model device generates a new measurement or reading, this triggers the creation of a new interaction tree. For Interaction Tree 1 for device A, two events are triggered on two different model devices (device B and device C). In addition, the event on device B further triggers events on model device D and model device E.

[0121] In order to record the interactions between model devices and the corresponding measurements of the root model device in a consistent manner, a key-value pair based log format can be introduced to map the information of each event to a unique key. The unique key is generated based on two different IDs. The first part of the key "X" is the sequence number of the root device measurement or reading (the sequence number is incremented for each new interaction tree), while "Y" is the sequence number of the specific event in the "X" interaction tree. It is chosen not to use timestamps as part of the unique key generation because time synchronization between networked devices is a challenge in itself.

[0122] In an IoT environment, each IoT model device may act as the root device of a different interaction tree. Each tree is dynamically generated when the root model device generates a new measurement or reading (for example, a temperature sensor may periodically capture a new reading every few seconds). IoT-AD uses automated rules and conditions (for example, defined by the user or device manufacturer) to validate interactions between devices. For example, a measurement or reading captured by device A triggers multiple events on other connected devices. In this example, an abnormal event occurs on device F, and IoT-AD detects the anomaly based on the automated rules and conditions. Subsequently, device F interacts with several other devices. Therefore, due to the abnormal event on device F, the states of devices G, H, and I are also affected.

[0123] Rollback is explained here: To mitigate the propagation effect of anomalies between model devices and help the affected model devices recover to the last known stable state, IoT-AD provides an automatic recovery mechanism called "rollback". The rollback process starts when an interaction anomaly is detected. At this point, the IoT-AD controller will use the corresponding interaction tree to identify the model devices affected due to this interaction anomaly. For example, an abnormal event on device F causes abnormal events on devices H, I, and G. IoT-AD creates a list of these model devices and analyzes the logs of these model devices to find out the last known stable state of each model device. For example, device F is triggered due to an abnormal interaction with model device A. Therefore, the last stable state of device F is "off trigger". Therefore, IoT-AD sends commands to the affected model devices to roll them back to the last known stable state (in this case, "off trigger" for device F). Finally, IoT-AD isolates the model device that caused the anomaly until the model device owner or administrator can troubleshoot.

[0124] The above mechanism essentially assumes that all interactions are legitimate until an anomaly is discovered. That is, while verifying such interactions, IoT-AD allows model devices to interact with each other (and potential anomalies are propagated between devices). If an anomaly is detected, the state of all affected model devices is rolled back. An alternative to this mechanism is to first verify each interaction that the device wishes to perform, and only if this interaction is valid, the device is allowed to interact with another device. In this case, since the model devices interact with each other only after each interaction has been verified, anomalies cannot propagate. However, verifying automation rules, especially when the number of IoT model devices increases and / or the rules become complex, may not occur immediately. To achieve this, it is basically necessary to stop the operation of the IoT environment until the interaction is verified.

[0125] In step S130, the preliminary abnormal detection data of the group trajectory is input into the abnormal behavior detection model to obtain the non-abnormal behavior data in the data transmission process between the networked devices. Exemplarily, such a setting can accurately screen out the normal (non-abnormal) behavior data in the data transmission process between the networked devices, providing a reliable basis for subsequent data analysis.

[0126] In some embodiments, the abnormal behavior detection model 12 has a networked device topology graph, which is a directed graph or an undirected graph, in which each node represents a networked device, and each edge represents a connection relationship between networked devices. Exemplarily, such a setting can comprehensively and accurately capture the interaction mode between networked devices, and provide a topological structure basis for detecting abnormal behavior.

[0127] Combination Figure 2As shown, in some embodiments, the preliminary abnormal detection data of the group trajectory is input into the abnormal behavior detection model 12 to obtain non-abnormal behavior data in the data transmission process between networked devices, including: Detect abnormal behavior data from preliminary anomaly detection data of group trajectories.

[0128] Filter out abnormal behavior data from the preliminary anomaly detection data of group trajectories.

[0129] The remaining data in the preliminary anomaly detection data of the group trajectory is regarded as non-abnormal behavior data.

[0130] Exemplarily, the above steps can accurately identify and filter out abnormal behavior data, and the retained data is non-abnormal behavior data, providing more reliable data for subsequent detection.

[0131] In some embodiments, detecting abnormal behavior data from preliminary abnormality detection data of group trajectories includes: Tracking collects group trajectory preliminary anomaly detection data and generates multiple data packets.

[0132] Multiple data packets are transmitted or exchanged between different networked devices to obtain multiple exchanged data packets.

[0133] In response to the exchanged data packet of the target event not matching the pre-generated event signature, it is determined that there is an abnormality at the data packet level in the target event, and the data of the exchanged data packet is used as abnormal behavior data.

[0134] For example, in actual applications, terminal devices can perform unidirectional or bidirectional data packet transmission or exchange with other networked devices (such as controllers, cloud servers, etc.) in a network environment. These data packets can contain information required to perform tasks, respond to events, and maintain system operations. The above steps can accurately identify data packet-level anomalies that do not meet expectations, and thus mark these data as abnormal behavior data. This process effectively improves the accuracy and efficiency of abnormal behavior detection.

[0135] In some embodiments, the characteristics of the event signature include: one or any combination of source port and destination port number, exchanged packet length, TCP flag type, time span of each event and transmission direction of the packet within the time span.

[0136] In some embodiments, after detecting abnormal behavior data from the preliminary abnormality detection data of the group trajectory, the method further includes: Abnormal networked devices corresponding to abnormal behavior data are identified based on an interaction tree; wherein the interaction tree includes a sequence of interconnected events triggered by measurements or readings of networked devices.

[0137] Roll back the status of abnormal network devices to the most recent stable state.

[0138] Isolate abnormal networked devices.

[0139] Exemplarily, the above steps can use the interaction tree to accurately identify the networked device that causes the anomaly, and by rolling back the device state to the most recent stable state and implementing isolation measures, effectively prevent the anomaly from spreading and ensure the stable operation of the Internet of Things system.

[0140] The following is a unified introduction to the normality and abnormality modeling model (AD-MERCS) in the unsupervised anomaly detection disclosed in the present invention, so as to facilitate the understanding of the technical means described later.

[0141] Exemplarily, the abnormal behavior data generated between models is removed from the output of the IoT-AD model and input into the normality and abnormality modeling model in the unsupervised anomaly detection, effectively utilizing the normal behavior and the abnormal behavior patterns that deviate from the normal behavior, completely separating the abnormal data from the normal data, and completing the final network abnormal behavior detection.

[0142] Figure 5 A schematic diagram 500 of a normality and abnormality modeling model in unsupervised anomaly detection according to some embodiments of the present disclosure is shown. Figure 5 Describe the process of modeling normality and anomaly in unsupervised anomaly detection 13, refer to Figure 5 , the disclosed solution includes the following parts: 1. Data input: Input the data after removing the abnormal behavior of the package level between models.

[0143] 2. MERCS model decision tree set: The input abnormal data is used to predict the target attributes through the decision tree.

[0144] 3. Density scoring mechanism: used to estimate the node density of the decision tree.

[0145] 4. AD-MERCS detects abnormal context mechanism: After classifying the input data through a set of decision trees, if a leaf node contains only abnormal instances, it can be reasonably considered that the conditions defining the leaf node define an abnormal context, and the abnormal context is identified to completely detect abnormal data.

[0146] 5. Data output: Output the data of completed detection.

[0147] The following describes each step of the above process in detail.

[0148] Formally, AD-MERCS solves the following problem: Given an M-dimensional dataset , where N instances , calculate the anomaly score for each instance xi Intuitively, δ should be higher for instances that are more likely to be considered anomalous in practice. In the following, this means instances that deviate from or meet some criteria for typical deviant instances. To explain how AD-MERCS works, we need to start with the basic MERCS approach and then describe the adjustments made.

[0149] The MERCS method is described here: Given a dataset D as described above, MERCS learns an ensemble of decision trees. For each attribute in the dataset, a tree is learned to predict the target attribute. The trees are learned in a standard top-down manner: attributes are selected one by one for splitting based on how informative they are about the target attribute, and the resulting tree represents a function from a subset of the available input attributes to the target attribute. Thus, for each tree , each corresponds to a subspace containing its input and target attributes , and the subspace is chosen so that the information in it can predict the target to the greatest extent; that is, the most powerful "pattern" is detected. Therefore, each leaf node in the decision tree can be used as a context (a set of similar instances) for anomaly detection: to determine whether a specific instance is abnormal, it can be compared with instances that share the leaf node, because instances within the leaf node are expected to follow the same pattern between the input and target attributes. MERCS will be described in detail next.

[0150] To use the MERCS model for anomaly detection, a decision tree can be used: Aggregate the normalized residuals produced by all predictions made for a given instance. However, this assumes that predictability and normality are equivalent, and as discussed previously there are two problems with this assumption. First, unpredictable but normal behavior (such as coin tossing) is incorrectly treated as anomaly. Second, predictable but abnormal behavior escapes detection because any predictable behavior will result in a low residual.

[0151] The following content mainly introduces the methods to solve these two problems, and the rest of the content will explain how they work: the following article introduces a density-based scoring mechanism that enables AD-MERCS to handle unpredictable behaviors; the following article also introduces the disclosure that ensures that AD-MERCS can identify abnormal behaviors as normative contexts as abnormal contexts.

[0152] MERCS with density estimation is illustrated here: The first task of this work is to introduce a density-based scoring mechanism in AD-MERCS. As mentioned earlier, residual-based methods are not suitable for all cases. For example, suppose a leaf contains instances with target values ​​1.52, 1.55, 1.57, and 2.81. The value 2.81 is an outlier, and in fact, if the mean of the leaf is used as the predicted value, this disclosure finds that the residual of 2.81 is larger than other values. In contrast, consider a leaf with values ​​1.4, 1.5, 1.6, 3.4, 3.5, 3.6. The mean value of this leaf is 2.5, but there are obviously two clusters here. If an instance with a value of 2.5 is sorted into this leaf, it can reasonably be considered an outlier (it does not fit the cluster), but its residual is zero. Obviously, the residual-based prediction method does not perform well here.

[0153] In AD-MERCS, each tree scores instances based on the probability density histogram of its target value (if the target is nominal) or some local probability density (if the target is numerical) instead of using residuals. Specifically, in each leaf, AD-MERCS estimates the density κ of the target attribute using Gaussian kernel density estimation and selects the kernel bandwidth using the method of a researcher.

[0154] Within a leaf, a lower κ value indicates a less likely target attribute value. However, there are two reasons why the present disclosure cannot directly use κ values ​​for anomaly detection. First, it is meaningless to distinguish high values ​​of κ: all of them represent "normal". Second, κ values ​​are not comparable between leaves: density is normalized by area rather than height, so their values ​​depend on the local range of the target variable. As a solution, the κ values ​​are converted to probability values ​​ω using the following formula (6): (6) Among them, the threshold is exceeded by ρ% of the instances in leaf node j. That is, (100-ρ)% of the lowest κ values ​​are linearly mapped to the interval [0, 1], and the rest are mapped to 1. The closer the ω value of an instance is to 0, the more likely it is an anomaly. The following illustrates the application of density-based scoring on a bimodal distribution of target values.

[0155] So far, the present disclosure has assumed that this probability estimation occurs in each leaf, however a more thorough analysis shows that there is room for further improvement. Decision trees can be used to find leaf nodes of low purity, but after the split, the purity of the child node may still exceed the purity of the parent node. This happens if the decrease in purity from a parent node to a child node is large enough to offset the increase in purity from the parent node to another child node. The pattern maintained in the parent node is actually stronger than the pattern maintained in the high-purity child node. Therefore, after learning the complete tree, if the purity of a leaf node lj is higher than one of its ancestors, the instance classified in the leaf node is scored using the probability function of lj's lowest purity ancestor. This ensures that the present disclosure always uses the best pattern to score a specific instance.

[0156] Using the above process, each tree in the ensemble assigns its own anomaly score to each instance. To aggregate these scores, the anomaly scores need to be Interpretation as probability , and aggregated using a noise-OR gate with suppression probability 1-γ: (7) Intuitively, using an OR gate means that if an instance looks abnormal in at least one subspace, it is considered abnormal. Suppression reduces the confidence of the disclosure in each individual estimate: a higher suppression probability (lower γ) requires more evidence from all combined subspaces before an instance is assigned a high anomaly score. This process produces an anomaly detector that can model non-functional dependencies in normal situations, but does not explicitly model anomalies. In the following, we will describe how AD-MERCS detects abnormal context (i.e., abnormal behavior is normal) and how this affects the anomaly score.

[0157] Here is the context of AD-MERCS detecting anomalies: To address the false assumption that anomalous behavior is necessarily unpredictable, our second step approach is to ensure that AD-MERCS can identify anomalous contexts. By doing so, AD-MERCS can also exploit patterns in anomalous behavior and detect more anomalies.

[0158] Assume for the moment that the disclosure knows which instances are anomalous. If a leaf node contains only anomalous instances, then it is reasonable to assume that the conditions defining the leaf node define an anomalous context; in fact, in supervised anomaly detection, a new instance is considered an anomaly if it is in such a leaf node. The disclosure expects AD-MERCS to have a similar ability, namely to mark an instance as anomalous simply because it belongs to an anomalous context.

[0159] Because AD-MERCS works in an unsupervised manner, but a single AD-MERCS model contains many trees, an iterative approach is possible. In the first iteration, we need to calculate for each training instance using the method explained above. Anomaly score . Based on these scores, the present disclosure can assign an outlier value to each context (i.e., leaf node) of each tree: a context with many high-scoring instances is more likely to be an abnormal context. Next, these context scores can be used to adjust the anomaly scores of individual instances: when an instance looks abnormal in a normal context or belongs to an abnormal context, its score is increased. Based on the new score, the context score is recalculated, and so on, until convergence or a stopping criterion is reached. The entire process does not require retraining of the ensemble, and the tree structure remains unchanged during the process.

[0160] Specifically, get the representation in the context A function of the degree of abnormality of any instance in After that, AD-MERCS uses the following update rules to update Value (for each instance in the training set )and Value (for each context ): (8) Values ​​are instances of a specific context An estimate of the degree of abnormality, taking into account the context The (current estimated) unusualness of the context and its own unusualness in that context. They are essentially 1 (if the context is unusual) and (if the context is normal). These estimates are aggregated into a global estimate , used to indicate The abnormality of is as described above. Then all examples in a context Values ​​are aggregated into a single value, use is essentially a noisy-and operation: when a context covers only the exception instance, treat it as an exception. and Parameters control the strength of the combined evidence.

[0161] The algorithm used outlines the overall process of the AD-MERCS method. It consists of three stages. First, all trees are learned and their leaf nodes are returned as contexts; next, for each leaf node, the density is estimated (using the leaf node itself or its ancestor with the lowest impurity); finally, an alternating calculation of instance scores and context scores is performed.

[0162] Model interpretability is illustrated here: Finally, AD-MERCS is not only able to detect anomalies, but also to explain them in a way that domain experts can understand. , AD-MERCS knows exactly which trees contributed and provides a concise description of how these trees reached that conclusion. Similarly, for each anomaly context, AD-MERCS immediately provides an interpretable description of the entire group. This greatly facilitates the process of extracting actionable knowledge from the anomaly detection process.

[0163] Specifically, if a tree T is given a single instance Assigned a higher value, then the instance is considered abnormal by the tree. It should be noted that this may be because It behaves abnormally in a normal context, or simply because it belongs to an abnormal context. This disclosure will discuss both cases.

[0164] First, if Belongs to a normal context , then it clearly violates the The explanation in this case consists of two parts: an interpretable description of node n, which can be obtained by traversing the tree; and Captured normal target values, and examples Second, if Belongs to an exception context , then the present disclosure actually only requires an interpretable description of this context as an explanation: in this case, the context description directly characterizes the anomaly.

[0165] So far, the present disclosure has completed the explanation of the data flow of the model required for network abnormal behavior data detection. Through the input and output of data of the above data model, network abnormal behavior data can be detected and removed to a large extent.

[0166] In step S140, the non-abnormal behavior data is input into the normality and abnormality modeling model to obtain the network abnormal behavior feature data. Exemplarily, such a setting can accurately identify the abnormal behavior feature data in the network, providing support for subsequent analysis or device isolation and disposal.

[0167] In some embodiments, non-abnormal behavior data is input into a normality and abnormality modeling model to obtain network abnormal behavior feature data, including: The target attribute of the non-abnormal behavior data is predicted according to a preset decision tree set to obtain the target attribute; wherein the decision tree set includes multiple decision trees.

[0168] The density of the target attribute of the leaf node of each decision tree is estimated according to the density scoring mechanism, and the anomaly score of the instance corresponding to the leaf node is calculated based on the density.

[0169] In response to the anomaly score being greater than or equal to a preset threshold, an anomaly context corresponding to the leaf node is identified, and the anomaly context is used as network abnormal behavior feature data.

[0170] Exemplarily, the anomaly score is calculated through the above process. When the score reaches or exceeds a preset threshold, the network abnormal behavior feature data can be accurately identified and output, which can improve the accuracy and efficiency of anomaly detection.

[0171] In some embodiments, the formula (8) mentioned above is used to calculate the abnormal score of the instance corresponding to the leaf node according to the density. : (8) in, represents the anomaly score; represents the first inhibition probability; represents the jth context; represents the i-th instance; Represents global estimation; noisy-or represents noise or gate aggregation operation; The parameter value representing the context; represents the second inhibition probability; represents the likelihood function, It can be obtained by density conversion.

[0172] In some embodiments, a Gaussian mixture model GMM or a kernel density estimation KDE is used to calculate the abnormality score of the instance corresponding to the leaf node according to the density. Exemplarily, such a setting can accurately evaluate the abnormality degree of the instance corresponding to the leaf node, and can improve the accuracy and adaptability of abnormality detection.

[0173] The technical concepts and technical effects of the present invention and corresponding technical means are summarized and explained here.

[0174] 1. Attention-based trajectory group anomaly detection model. The attention-based trajectory group anomaly detection model is a method for detecting abnormal trajectories in group behavior. The model identifies abnormal trajectories by focusing on the influence of each individual in the group.

[0175] The model first represents the trajectory data of each individual in the group as a spatiotemporal feature vector. These feature vectors include information such as the position, velocity, and acceleration of the individual at different time steps. Next, the model uses a self-attention mechanism to calculate the interaction weights between each individual and other individuals. The self-attention mechanism can capture the degree of contribution of each individual to the behavior of the entire group, that is, the attention weight. The model then adjusts the feature vector of each individual according to the calculated attention weight. In this way, individuals with higher attention weights have a greater impact on the behavior of the entire group, while individuals with lower attention weights have a smaller impact on the behavior of the entire group. Finally, the model uses an anomaly score function to evaluate the degree of abnormality of each trajectory. This function takes into account the differences between all individual feature vectors at each time step and combines the attention weight. Trajectories with high anomaly scores are considered abnormal trajectories.

[0176] The attention-based trajectory group anomaly detection model can effectively identify abnormal trajectories in group behavior. By focusing on the interaction weights between individuals, the model can capture the contribution of individuals to the entire group behavior and judge whether the trajectory is abnormal based on this. This method has broad application potential in analyzing and monitoring anomalies in group behavior.

[0177] 2. Framework for detecting anomalies between interconnected IoT model devices. The framework for detecting anomalies between interconnected IoT model devices is a method for monitoring and identifying behaviors between networked devices. The framework detects anomalies by analyzing information such as communication, interaction, and data flow between devices based on the interconnected relationship between devices.

[0178] First, the framework needs to build a device topology to represent the connection relationship between devices. This topology can be a directed or undirected graph, where each node represents a device and the edges represent the connection between devices. Next, the framework collects and records the communication data, interaction data, and data flow information between devices. This information can include sensor data, control commands, state changes, etc. between devices. The framework then uses machine learning or statistical methods to analyze and model the collected data. It can use clustering algorithms to identify normal behavior patterns and use them as reference models. After the normal behavior model is established, the framework monitors and analyzes real-time data. It compares the differences between real-time data and the reference model and calculates the anomaly score for each device. Finally, the framework determines whether each device is abnormal based on the set threshold or rules. If the anomaly score of a device exceeds the threshold or meets specific rules, it will be marked as an abnormal device.

[0179] The framework for detecting anomalies between interconnected IoT model devices can help monitor and identify abnormal behaviors in IoT environments. By analyzing information such as communication, interaction, and data flow between devices, it can promptly detect possible failures, attacks, or other abnormal situations and take appropriate measures to deal with them. This framework has important application value in improving the security and stability of IoT systems.

[0180] 3. Normality and Abnormality Modeling Framework in Unsupervised Anomaly Detection. The Normality and Abnormality Modeling Framework in Unsupervised Anomaly Detection is a method for identifying normal and abnormal samples in data. The framework is based on modeling the data and comparing the differences between the data sample and the model to determine whether it is an abnormality.

[0181] First, the framework needs to collect and prepare a large number of data samples. These data samples can be actual observations from different fields, or synthetic data generated from known distributions. Next, the framework will perform feature extraction and preprocessing on the collected data. This can include converting the raw data into feature representations that can be used for modeling, such as statistical features, spectral features, or other advanced features. Then, the framework uses a statistical model to describe the distribution of normal samples. Common methods include Gaussian Mixture Model (GMM), Kernel Density Estimation (KDE), or other probability distribution models. These models learn the distribution of normal samples based on training data. After normality modeling is completed, the framework uses the learned model to evaluate the degree of normality of new samples. It calculates the difference or degree of outlier between the new sample and the model and uses it as an anomaly score. Finally, the framework determines whether each sample is abnormal based on the set threshold or rule. If the anomaly score of a sample exceeds the threshold or meets a specific rule, it will be marked as an abnormal sample.

[0182] The normality and anomaly modeling framework in unsupervised anomaly detection can help identify anomalies in data without prior knowledge about the abnormal samples. By modeling normal samples and comparing them with new samples, the framework can effectively find data points that are inconsistent with the known distribution and thus identify potential anomalies. This approach has a wide range of applications in many fields, such as network security, financial risk management, and industrial fault detection.

[0183] The present disclosure also proposes a network abnormal behavior feature detection device, which includes one or more processors, and the one or more processors are configured to execute the network abnormal behavior feature detection method as mentioned above.

[0184] Figure 6A simplified block diagram of a device suitable for implementing an exemplary embodiment of the present disclosure is shown. Figure 6 As shown, the device 600 includes one or more processors 610 , one or more memories 620 coupled to the processors 610 , and one or more communication modules 640 coupled to the processors 610 .

[0185] The communication module 640 is used for two-way communication. The communication module 640 has at least one antenna to facilitate communication. The communication interface may represent any interface necessary for communicating with other network elements.

[0186] Processor 610 may be of any type suitable for the local technology network, and may include, as non-limiting examples, one or more of: a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 600 may have multiple processors, such as application specific integrated circuit chips, which are driven in time to a clock that synchronizes a master processor.

[0187] The memory 620 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 624, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disk (CD), digital video disk (DVD), and other magnetic and / or optical memories. Examples of volatile memories include, but are not limited to, random access memory (RAM) 622 and other volatile memories that do not persist during the duration of a power outage.

[0188] The computer program 630 includes computer executable instructions that are executed by the associated processor 610. The program 630 may be stored in the ROM 624. The processor 610 may perform any appropriate actions and processes by loading the program 630 into the RAM 622.

[0189] The embodiments of the present disclosure may be implemented by a program 630, so that the device 600 may execute the reference Figures 1 to 5 Any process of the disclosure discussed. The embodiments of the present disclosure may also be implemented by hardware or by a combination of software and hardware.

[0190] In some embodiments, the program 630 may be tangibly contained in a computer-readable medium, which may be contained in the device 600 (e.g., memory 620) or other storage devices accessible to the device 600. The device 600 may load the program 630 from the computer-readable medium to the RAM 622 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. The computer-readable medium has the program 630 stored thereon.

[0191] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer executable instructions, such as instructions included in a program module, which are executed in a device on a target real or virtual processor to perform the network abnormal behavior feature detection method as described above, such as the above reference Figure 1 The method 100 is described. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of program modules can be combined or separated between program modules as needed. Machine executable instructions for program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0192] The program code for executing the disclosed method can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing equipment so that when the program code is executed by the processor or controller, the function / operation specified in the flow chart and / or block diagram is realized. The program code can be executed completely on the machine as an independent software package, partially on the machine, partially on the machine, partially on a remote machine, partially on a remote machine, or all on a remote machine or server.

[0193] In the context of the present disclosure, computer program codes or related data may be carried by any appropriate carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer readable media, etc.

[0194] The computer readable medium may be a computer readable signal medium or a computer readable storage medium. The computer readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or apparatuses, or any suitable combination of the foregoing. More specific examples of computer readable storage media include an electrical connection having one or more conductors, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0195] In addition, although the operations are described in a specific order, this should not be understood as requiring the specific order or sequence shown to be performed, or performing all the operations shown, to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these details should not be interpreted as limitations on the scope of the present disclosure, but can be interpreted as descriptions of features specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0196] Although the disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0197] It should be fully understood that the use of personally identifiable information should be subject to privacy policies and practices generally recognized as meeting or exceeding industry or government requirements for maintaining user privacy. In particular, personally identifiable information data should be managed and processed to minimize the risk of inadvertent or unauthorized access or use, and the nature of authorized use should be clearly indicated to users.

Claims

1. A method for detecting abnormal network behavior characteristics, characterized in that: include: Construct an attention-based trajectory group anomaly detection model, construct an abnormal behavior detection model, and construct a normality and abnormality modeling model based on unsupervised learning; Inputting the network behavior data of the networked devices into the trajectory group anomaly detection model to obtain preliminary group trajectory anomaly detection data; Inputting the preliminary abnormality detection data of the group trajectory into the abnormal behavior detection model to obtain non-abnormal behavior data in the process of data transmission between the networked devices; The non-abnormal behavior data is input into the normality and abnormality modeling model to obtain network abnormal behavior feature data.

2. The method according to claim 1, characterized in that The trajectory group anomaly detection model has a BERT-based Transformer encoder model architecture, and the trajectory group anomaly detection model includes: an input embedding layer, a position encoding layer, a multi-head attention module, an attention anomaly scoring module, and a Transformer encoder layer; The step of inputting the network behavior data of the networked devices into the trajectory group anomaly detection model to obtain preliminary group trajectory anomaly detection data includes: Processing the network behavior data in sequence using the input embedding layer, the position encoding layer, and the multi-head attention module, and outputting attention group anomaly detection data; Using the attention anomaly scoring module to perform attention matrix weighted calculation on the attention group anomaly detection data to obtain matrix weighted data; The matrix weighted data is processed using the Transformer encoder layer to obtain the group trajectory preliminary anomaly detection data.

3. The method according to claim 1 or 2, characterized in that The trajectory group anomaly detection model is trained by unsupervised learning or semi-supervised learning. When training the trajectory group anomaly detection model, in each training epoch, the group trajectories of the network behavior data are batch-transmitted and the anomaly probability of the group trajectories is returned. ; According to the abnormal probability Compute the binary cross entropy loss L.

4. The method according to claim 1 or 2, characterized in that: The step of inputting the preliminary abnormality detection data of the group trajectory into the abnormal behavior detection model to obtain the non-abnormal behavior data in the data transmission process between the networked devices includes: detecting abnormal behavior data from the preliminary anomaly detection data of the group trajectory; Filtering out the abnormal behavior data in the preliminary abnormality detection data of the group trajectory; The remaining data in the preliminary abnormality detection data of the group trajectory is used as the non-abnormal behavior data.

5. The method according to claim 4, characterized in that Detecting abnormal behavior data from the preliminary abnormality detection data of the group trajectory includes: Tracking and collecting preliminary anomaly detection data of the group trajectory and generating multiple data packets; Transfer or exchange the plurality of data packets between different networked devices to obtain a plurality of exchanged data packets; In response to the exchange data packet of the target event not matching the pre-generated event signature, it is determined that the target event has a data packet-level anomaly, and the data of the exchange data packet is used as the abnormal behavior data.

6. The method according to claim 5, characterized in that The features of the event signature include: one or any combination of source port and destination port number, exchanged data packet length, TCP flag type, time span of each event and transmission direction of the data packet within the time span.

7. The method according to claim 4, characterized in that After detecting abnormal behavior data from the group trajectory preliminary abnormality detection data, the method further includes: Identifying an abnormal networked device corresponding to the abnormal behavior data according to an interaction tree; wherein the interaction tree includes an interconnected sequence of events triggered by measurements or readings of networked devices; Rolling back the state of the abnormal networked device to the most recent stable state; Isolate the abnormal networked device.

8. The method according to claim 1 or 2, characterized in that: The abnormal behavior detection model has a networked device topology graph, which is a directed graph or an undirected graph. Each node in the networked device topology graph represents a networked device, and each edge represents a connection relationship between the networked devices.

9. The method according to claim 1 or 2, characterized in that: The step of inputting the non-abnormal behavior data into the normality and abnormality modeling model to obtain network abnormal behavior feature data includes: Predicting target attributes of the non-abnormal behavior data according to a preset decision tree set to obtain target attributes; wherein the decision tree set includes multiple decision trees; Estimate the density of the target attribute of the leaf node of each decision tree according to the density scoring mechanism, and calculate the anomaly score of the instance corresponding to the leaf node according to the density; In response to the anomaly score being greater than or equal to a preset threshold, an anomaly context corresponding to the leaf node is identified as the network abnormal behavior feature data.

10. The method according to claim 9, characterized in that The anomaly score of the instance corresponding to the leaf node is calculated according to the density using the following formula: in, represents the anomaly score, represents the first inhibition probability; represents the jth context; represents the i-th instance; Represents global estimation; noisy-or represents noise or gate aggregation operation; The parameter value representing the context; represents the second inhibition probability; represents the likelihood function, It can be obtained according to the density conversion.

11. A network abnormal behavior feature detection device, characterized in that: The apparatus comprises means for performing the method of any one of claims 1-10.

12. A computing device, characterized in that: include: at least one processor; as well as At least one memory storing instructions thereon, which, when executed individually or collectively by the at least one processor, cause the computing device to perform the method according to any one of claims 1 to 10.

13. A non-transitory computer-readable storage medium storing machine-executable instructions, characterized in that: The machine executable instructions, when executed individually or collectively by one or more processors of a machine, cause the machine to perform the method of any one of claims 1 to 10.

14. A computer program product comprising machine executable instructions, characterized in that The machine executable instructions, when executed individually or collectively by one or more processors of a machine, cause the machine to perform the method of any one of claims 1 to 10.

15. A chip system, characterized in that: Comprising a circuit system configured to perform the method of any one of claims 1-10.

Images