Abnormal behavior detection method and device and storage medium

Abstract

Embodiments of the invention provide an abnormal behavior detection method and device, and a storage medium. The method comprises the steps of collecting a to-be-detected behavior set belonging to the same session in a preset time window; adding a tag to each behavior in the to-be-detected behavior set, and obtaining tag features of the to-be-detected behavior set according to the tags of all behaviors in the to-be-detected behavior set; according to a preset embedded feature extraction model, mapping the tag features of the to-be-detected behavior set into embedded features; and judging whether the to-be-detected behavior set is abnormal or not based on the embedded features of the to-be-detected behavior set and pre-acquired embedded features of a historical behavior set. According to the method, each behavior in the to-be-detected behavior set is represented in a natural language through a tag mode, tags of all behaviors in the to-be-detected behavior set are quantified into tag features and then mapped into embedded features, high interpretability is achieved, abnormal behavior recognition is carried out based on the embedded features, recognition accuracy can be improved, and false alarms are reduced.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer and network communication technology, and in particular, to an abnormal behavior detection method, device, and storage medium. Background Art

[0002] Abnormal behavior detection is an important function of the host intrusion detection system, which aims to discover unknown abnormal behaviors that deviate from the baseline. The host intrusion detection system can collect host data at various levels, including system calls, file creation, file reading and writing, command execution, network connections, etc.

[0003] Existing abnormal behavior detection solutions mainly rely on data such as execution command sequences, system call sequences, and process creation, and use statistical, machine learning, or deep learning methods to perform anomaly detection. However, existing abnormal behavior detection solutions have low accuracy and are prone to false positives. Summary of the invention

[0004] The embodiments of the present disclosure provide an abnormal behavior detection method, device, and storage medium to improve the accuracy of abnormal behavior detection and effectively avoid false alarms.

[0005] In a first aspect, an embodiment of the present disclosure provides an abnormal behavior detection method, comprising:

[0006] Collect a set of behaviors to be detected that belong to the same session within a preset time window;

[0007] Adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0008] According to a preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped into embedding features;

[0009] Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, it is determined whether the behavior set to be detected is abnormal.

[0010] In a second aspect, an embodiment of the present disclosure provides an abnormal behavior detection device, including:

[0011] A collection unit, used to collect a set of behaviors to be detected belonging to the same session within a preset time window;

[0012] A label processing unit, used to add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0013] A mapping unit, used for mapping the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0014] The anomaly identification unit is used to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance.

[0015] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: at least one processor and a memory;

[0016] The memory stores computer-executable instructions;

[0017] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect.

[0018] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect is implemented.

[0019] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including computer execution instructions. When a processor executes the computer execution instructions, it implements the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect.

[0020] The abnormal behavior detection method, device and storage medium provided by the embodiments of the present disclosure collect the set of behaviors to be detected that belong to the same session within a preset time window; add a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtain the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; map the label features of the set of behaviors to be detected to embedded features according to a preset embedded feature extraction model; and judge whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the previously acquired historical behavior set. The embodiments of the present disclosure use labels to represent each behavior in the set of behaviors to be detected in natural language, thereby enhancing the readability of the behavior data, and further quantifying the labels of all behaviors in the set of behaviors to be detected into label features, and then mapping them into embedded features, which fully describe the characteristics of the set of behaviors to be detected, have strong interpretability, and perform abnormal behavior recognition based on embedded features, which can improve recognition accuracy and reduce the occurrence of false alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0022] Figure 1 A diagram showing an example scenario of an abnormal behavior detection method provided by an embodiment of the present disclosure;

[0023] Figure 2 A flowchart of an abnormal behavior detection method provided by an embodiment of the present disclosure;

[0024] Figure 3 A flowchart of an abnormal behavior detection method provided by another embodiment of the present disclosure;

[0025] Figure 4 A schematic diagram of a tag feature distance provided by an embodiment of the present disclosure;

[0026] Figure 5 A flowchart of an abnormal behavior detection method provided by another embodiment of the present disclosure;

[0027] Figure 6 A schematic diagram of an embedded feature distance provided by an embodiment of the present disclosure;

[0028] Figure 7 A structural block diagram of an abnormal behavior detection device provided in an embodiment of the present disclosure;

[0029] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0031] Abnormal behavior detection is an important function of the host intrusion detection system, which aims to discover unknown abnormal behaviors that deviate from the baseline. The host intrusion detection system can collect host data at various levels, including system calls, file creation, file reading and writing, command execution, network connections, etc.

[0032] Existing abnormal behavior detection solutions mainly rely on data such as execution command sequences, system call sequences, and process creation, and use statistical, machine learning, or deep learning methods for anomaly detection.

[0033] Among them, the statistical-based solution will specifically count the historical frequency of a certain behavior or a combination of behaviors, and treat behaviors and behavior combinations with less frequent occurrence as abnormalities. The machine learning and deep learning-based solutions will first convert natural language data such as command sequences and process creation into feature vectors, and then perform clustering or classification, generally using unsupervised / self-supervised methods, for example:

[0034] The behavior data is clustered by clustering algorithms to obtain multiple category clusters. The category with more samples is the normal behavior category, and the category with fewer samples is the abnormal behavior category.

[0035] The behavior data is encoded and decoded through the autoencoder model, and the loss function is set to make the decoder output as close to the encoder input as possible. Because most of the behavior data collected in the real production network environment are normal behaviors, the autoencoder model has been more fully trained for encoding and decoding of normal behavior data, and the difference between the model decoder output and the encoder input is small; while there are fewer abnormal behaviors, the autoencoder model has not been fully trained for encoding and decoding of abnormal behavior data, and the difference between the model decoder output and the encoder input is large. Therefore, abnormal behaviors can be screened out by setting a threshold for the difference between the model input and output.

[0036] However, whether directly counting behavioral data or converting it into feature vectors for clustering or model training, there are many false positives caused by the complex host command or process sequence in real scenarios. For example, a rare command parameter or file path may be judged as abnormal behavior, but it is not abnormal behavior in fact. If the types of statistical data are strictly screened and limited (such as only counting limited system calls), it may result in the data being unable to fully describe and distinguish between massive and complex normal behaviors and unknown abnormal behaviors.

[0037] In order to improve the accuracy of abnormal behavior detection and effectively avoid false alarms, the present disclosure provides an abnormal behavior detection method, which collects a set of behaviors to be detected that belong to the same session within a preset time window; adds a label to each behavior in the set of behaviors to be detected, and obtains the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; maps the label features of the set of behaviors to be detected to embedded features according to a preset embedded feature extraction model; and determines whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the previously acquired historical behavior set. By using labels, each behavior in the set of behaviors to be detected is represented in natural language, which enhances the readability of the behavior data, and then quantifies the labels of all behaviors in the set of behaviors to be detected into label features, and then maps them into embedded features, which fully describes the characteristics of the set of behaviors to be detected, has strong interpretability, and performs abnormal behavior recognition based on embedded features, which can improve recognition accuracy and reduce the occurrence of false alarms. It can be applied to abnormal behavior detection of massive behavior data in real scenarios.

[0038] The abnormal behavior detection method disclosed in the present invention is applied to electronic devices such as servers, such as Figure 1 As shown, a set of behaviors to be detected belonging to the same session within a preset time window can be obtained, and then by adding labels, building label features, and extracting embedded features, it is finally determined whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the historical behavior set obtained in advance.

[0039] The abnormal behavior detection method disclosed in the present invention will be described in detail below in conjunction with specific embodiments.

[0040] refer to Figure 2 , Figure 2 This is a flow chart of an abnormal behavior detection method provided by an embodiment of the present disclosure. The method of this embodiment can be applied to electronic devices such as servers, and the abnormal behavior detection method includes:

[0041] S201: Collect a set of behaviors to be detected that belong to the same session within a preset time window.

[0042] In this embodiment, the behavior data of the target host can be collected in real time, for example, by using a host-based intrusion detection system (HIDS) or other detection systems to collect the behavior data of the target host in real time. Furthermore, considering that the behaviors in the same session have a certain correlation, especially in a session with intrusion behaviors, there are usually many other malicious behaviors. Therefore, the behavior data within a preset time window (such as 60 minutes) is selected from the behavior data of the same session of the same host to obtain a behavior set as the behavior set to be detected, and abnormal behavior detection is performed with the behavior set as the granularity.

[0043] In this embodiment, since systems such as host-based intrusion detection systems may simultaneously collect behaviors of multiple hosts and multiple sessions, behaviors can be screened based on host identifiers and session identifiers (Session_ID) and preset time windows to obtain a set of behaviors to be detected.

[0044] S202: Add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on labels of all behaviors in the set of behaviors to be detected.

[0045] In this embodiment, the types of different target fields in each behavior in the set of behaviors to be detected can be identified, and each type corresponds to a label. The different target fields include but are not limited to the program name field (such as the execve field), the source IP field, the destination IP field, the port field, the file path field, the file name field, etc., so that multiple labels for each behavior can be obtained, and the attribute information of the behavior can be characterized by multiple labels, and the behavior can be converted into a natural language representation, thereby enhancing the readability of the behavior data; and the labels of all behaviors in the set of behaviors to be detected can characterize the set of behaviors to be detected, and then based on the labels of all behaviors in the set of behaviors to be detected, the label features of the set of behaviors to be detected can be constructed. For example, the labels of all behaviors in the set of behaviors to be detected can be counted, and a feature vector can be constructed based on the statistical results as a label feature to characterize which labels the labels of all behaviors in the set of behaviors to be detected include and the number of times the included labels appear.

[0046] S203: Mapping the label features of the to-be-detected behavior set into embedded features according to a preset embedded feature extraction model.

[0047] In this embodiment, although the label features of the set of behaviors to be detected can distinguish abnormal behaviors from normal business behaviors, for a small number of normal business behaviors or special operation and maintenance behaviors, their label features may be close to the label features of abnormal behaviors, which may cause certain false alarms. Therefore, this embodiment considers further processing of the label features.

[0048] An embedding feature extraction model can be pre-trained, and the embedding feature extraction model can map the label features of any behavior set to embedding features. The input of the embedding feature extraction model can be the label features of any behavior set, and the output is the corresponding embedding features. Optionally, the embedding feature extraction model can use a deep neural network. For example, the embedding feature extraction model can use the encoder in the Transformer model, or other deep neural network models, which are not limited here. Through the embedding feature extraction model, it is possible to convert high-dimensional label features into dense and low-dimensional embedding features. The embedding features integrate a large amount of valuable information, have stronger expression capabilities, and can better reflect the characteristics of the corresponding behavior set, so as to facilitate the identification of whether there are abnormalities in the behavior set.

[0049] In this embodiment, after the label features of the behavior set to be detected are obtained, they can be input into an embedded feature extraction model. After being processed by the embedded feature extraction model, embedded features of the behavior set to be detected are obtained.

[0050] S204: Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, determine whether the behavior set to be detected has an abnormality.

[0051] In this embodiment, after the embedded features of the behavior set to be detected are obtained, it can be determined whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance, wherein the embedded features of the historical behavior set obtained in advance are also obtained by the same process as described above. Since the category of the historical behavior collection can be confirmed in advance, such as a normal behavior collection or an abnormal behavior collection, it can be determined whether the behavior set to be detected is abnormal by determining the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical behavior collection based on the embedded features of the historical behavior collection, or it can be determined whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior collection obtained in advance by using other methods.

[0052] Optionally, after confirming that the behavior set to be detected has an abnormality, an abnormality alarm may be issued, and labels of all behaviors in the behavior set to be detected may be given during the alarm to assist in determining what operations have been performed in the behavior set to be detected.

[0053] The abnormal behavior detection method of this embodiment collects a set of behaviors to be detected that belong to the same session within a preset time window; adds a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtains the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; maps the label features of the set of behaviors to be detected to embedded features according to a preset embedded feature extraction model; and determines whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the previously acquired historical behavior set. This embodiment uses labels to represent each behavior in the set of behaviors to be detected in natural language, which enhances the readability of the behavior data, and then quantifies the labels of all behaviors in the set of behaviors to be detected into label features, which are then mapped into embedded features, fully describing the characteristics of the set of behaviors to be detected, and has strong interpretability. Abnormal behavior recognition based on embedded features can improve recognition accuracy and reduce the occurrence of false alarms.

[0054] On the basis of any of the above embodiments, the step of adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected, may specifically include:

[0055] S2021. According to a preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, to obtain a label corresponding to each behavior;

[0056] S2022, obtaining the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0057] S2023: Construct a label feature of the to-be-detected behavior set according to the number of times each label in the preset label set appears.

[0058] In this embodiment, the preset tag set is a tag set obtained in advance, which includes alternative tags corresponding to different target fields (which can constitute a tag subset), and the different target fields include but are not limited to program name fields (such as execve fields), network-related fields such as: source IP field, destination IP field, port field, etc., file-related fields such as: file path field, file name field, etc., and each target field in each behavior in the set of behaviors to be detected can be labeled separately, and then the label corresponding to each behavior can be obtained. Among them, the label annotation can be realized by using a machine learning model (such as a neural network model such as a language model); the label annotation can also be realized by matching rules, which can be realized by writing scripts or streaming processing engines (such as Flink). Specifically, according to the preset matching rules, any target field of any behavior can be matched with the tag subset corresponding to the target field to determine the target tag corresponding to the target field; or some target fields (such as the program name field) are labeled using a machine learning model, and other target fields are labeled using matching rules.

[0059] As an example, the label subset of the program name field (execve field) may include but is not limited to: file transfer, backup compression, file management, disk management, disk maintenance, system settings, system management, text processing, network communication, device management, email and newsgroups, applications, package management, other common commands, code related, database, etc. When adding a label to the program name field (execve field) of any behavior, if the execve field is "find", add the label "file management"; if the execve field is "nginx", add the label "network communication"; if the execve field is "systemd", add the label "system management"; if the execve field is "nginx", add the label "network communication"; if the execve field is "systemd", add the label "system management"; if the execve field is "dpkg", add the label "package management"; if the execve field is "ffmpeg", add the label "application", and so on. Optionally, if the program name field (execve field) of any behavior includes a file path, the prefix path can be extracted.

[0060] The label subset of the source IP field may include but is not limited to: IPV6 source IP, intranet source IP, loopback source IP, external source IP, reserved source IP, etc. When adding a label to the source IP field of any behavior, if the source IP field is an intranet IP address, add the label "intranet source IP"; if the source IP field is an external IP address, add the label "external source IP"; if the source IP field is a loopback IP, add the label "loopback source IP"; if the source IP field is a reserved IP address, add the label "reserved source IP"; if the source IP field is an IPV6 address, add the label "IPV6 source IP", and so on.

[0061] The label subset of the destination IP field may include, but is not limited to: IPV6 destination IP, intranet destination IP, loopback destination IP, extranet destination IP, reserved destination IP, etc. When adding a label to the destination IP field of any behavior, if the destination IP field is an intranet IP address, add the label "intranet destination IP"; if the destination IP field is an extranet IP address, add the label "extranet destination IP"; if the destination IP field is a loopback IP, add the label "loopback destination IP"; if the destination IP field is a reserved IP address, add the label "reserved destination IP"; if the destination IP field is an IPV6 address, add the label "IPV6 destination IP", and so on.

[0062] The label subset of the source port field may include but is not limited to: well-known source port, registered source port, etc. When adding a label to the source port field of any behavior, if the source port field is a common well-known port number, add the label "well-known source port"; if the source port field is a registered port number, add the label "registered source port", and so on.

[0063] The label subset of the destination port field may include but is not limited to: well-known destination port, registered destination port, etc. When adding a label to the destination port field of any behavior, if the destination port field is a common well-known port number, add the label "well-known destination port"; if the destination port field is a registered port number, add the label "registered destination port", and so on.

[0064] The label subset of the file path field may include, but is not limited to: bin directory, dev directory, etc directory, home directory, lib directory, sbin directory, tmp directory, root directory, mnt directory, lost+found directory, proc directory, var directory, usr directory, opt directory, etc. When adding a label to the file path field of any behavior, if the path contains a bin directory, add the label "bin directory"; if the path contains a dev directory, add the label "dev directory"; if the path contains an etc directory, add the label "etc directory"; if the path contains a home directory, add the label "home directory"; if the path contains a home directory, add the label "home directory"; if the path contains a lib directory, add the label "lib directory"; if the path contains an sbin directory, add the label "sbin directory"; if the path contains a tmp directory, add the label "tmp directory"; if the path contains a root directory, add the label "root directory"; if the path contains an mnt directory, add the label "mnt directory"; if the path contains a lost+found directory, add the label "lost+found directory"; if the path contains a proc directory, add the label "proc directory"; if the path contains a var directory, add the label "var directory"; if the path contains a usr directory, add the label "usr directory"; if the path contains an opt directory, add the label "opt directory", and so on.

[0065] The label subset of the file name field may include but is not limited to: log file, py file, sh file, compressed file, web page file, configuration file, etc. When adding a label to the file name field of any behavior, if the file name contains log, add the label "log file"; if the file name suffix is ​​py, add the label "py file"; if the file name suffix is ​​sh, add the label "sh file"; if the file name suffix is ​​tar or tgz or zip, add the label "compressed file"; if the file name suffix contains php or htm or jsp or do, add the label "web page file"; if the file name contains conf, add the label "configuration file".

[0066] The above label setting is an example under the Linux operating system. If it is in the Windows operating system, corresponding modifications should be made.

[0067] Among them, there are many types of label subsets of program name fields, which can be learned based on historical behavior data. The labels corresponding to different program name fields can build label subsets of program name fields, or they can be called label knowledge bases, which include the mapping relationship between different program name fields and corresponding labels.

[0068] Optional, such as Figure 3 As shown, multiple historical behavior data can be obtained, and the program name field (execve field) in the historical behavior data can be extracted. If the program name field (execve field) includes a file path, the prefix path can be taken out. The above process of extracting the program name field (execve field) in the historical behavior data can be automatically implemented by writing code scripts, etc.; a preset language model is used to obtain the label corresponding to each program name field, and a label subset (label knowledge base) corresponding to the program name field is constructed. The preset language model can be any language model, such as ChatGPT, etc., as long as it performs well in the question and answer field of host security. A prompt word can be constructed, and the prompt word is used to send the learning task of the label subset of the program name field to the preset language model. For example, the prompt word is constructed as follows:

[0069] "Determine which of the following categories the Linux command / process 'execve' belongs to, Category list: File transfer, backup compression, file management, disk management, disk maintenance, system settings, system administration, text processing, network communication, device management, email and newsgroups, applications, package management, code related, database;

[0070] If it is not in the above categories, please summarize the category of the Linux command and give it. If you cannot answer, the category name is unknown.

[0071] Please also give a Chinese introduction to the command. If the specific circumstances of the command are unclear, please give possible speculations and indicate the uncertainty.

[0072] The answer should be in JSON format, where the 'class' field is the command category and the 'description' field is the command description. Do not answer any other information. "

[0073] Furthermore, the program name field in the historical behavior data is traversed, and the specific name of the program name field is replaced with the 'execve' in the prompt word, and then the prompt word is input into the preset language model, and the preset language model outputs the command category (that is, label) and detailed information (command introduction) of the program name field based on its own knowledge base, and stores them. Optionally, they can be stored in the form of Key-Value, where the Key is the execve field, for easy retrieval. For example:

[0074] 1. {'class':'File Management','description':'The `find` command is used to find files and directories in a specified directory. It provides many options to help you specify search criteria, such as name, size, permissions, type, etc. The `find` command also supports the use of regular expressions to match the names of files and directories. The `find` command is very powerful and can help you quickly locate specific files or directories. ',

[0075] 'execve':'find'}

[0076] 2. {'class':'Application','description':'`dash` is a shell program under Unix / Linux operating system, and is a lightweight version of Bourne shell. It is characterized by fast running speed, small memory usage, and concise code. `dash` is faster than other shells such as Bash when executing scripts, so it has certain advantages in startup speed and script execution speed. `dash` is usually used as the default / bin / sh interpreter, and is also used as one of the default shell interpreters of Linux distributions in some systems. ',

[0077] 'execve':'dash'}

[0078] Through the above process, it is possible to fully utilize the host security professional domain knowledge implicit in the language model and reduce the cost of manual labeling.

[0079] On the basis of the above embodiment, after obtaining the label corresponding to each behavior in the set of behaviors to be detected, the number of times each label in the preset label set appears in the label of each behavior in the set of behaviors to be detected can be obtained. If it does not appear, the number is recorded as 0. The label feature of the set of behaviors to be detected is further constructed based on the number of times each label in the preset label set appears. For example, the number of times each label in the preset label set appears is directly sorted according to the preset label order to obtain a first sequence (array), and the first sequence is directly used as the label feature of the set of behaviors to be detected.

[0080] In order to facilitate the processing of the embedded feature extraction model, the number of occurrences of each label can be quantified, that is, discretized, and the number of times can be mapped to a specific value through a preset mapping relationship. For example, the preset mapping relationship can be as follows:

[0081] Number of times a tag appears Quantized value 0 0 >＝1,<10 1 >＝10,<100 2 >＝100,<1000 3 >＝1000,<10000 4 >＝10000 5

[0082] Based on the preset mapping relationship, each value in the first sequence can be mapped to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0083] For example, taking the preset label set in the above example, it includes 50 labels, each label corresponds to a position, and records the number of times the label appears in the label of each behavior in the set of behaviors to be detected. It is initialized as a 50-bit array of all zeros. Assuming that the "file transfer" label appears 120 times in the labels of each behavior in the set of behaviors to be detected, the "intranet source IP" appears 10 times, and the "extranet destination IP" appears 10 times, then the second sequence is obtained, and the second sequence is used as the label feature (that is, the feature vector) of the set of behaviors to be detected, as follows: The number of times the label appears in the label of each behavior

[0084] [3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0].

[0085] Through the above quantization process, the label of each behavior in the set of behaviors to be detected can be reasonably and efficiently quantified.

[0086] Furthermore, although the label features of the set of behaviors to be detected can distinguish abnormal behaviors from normal business behaviors, for some small number of special business behaviors or special operation and maintenance behaviors, their label features may be close to the label features of abnormal behaviors, which will cause certain false positives. That is, in the feature space of label features, the distance between the label features of some small number of special business behaviors / special operation and maintenance behaviors and the label features of normal business behaviors is greater than the distance between the label features of abnormal behaviors and the label features of normal business behaviors. For example, Figure 4 As shown, for example:

[0087] The number of occurrences (first sequence) of each behavior in the label of a certain mining behavior (abnormal behavior) set is as follows:

[0088] [1,0,169,1,0,99,334,666,26,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,49,0,0,1,0,0,0,0,0];

[0089] The quantified label features are:

[0090] [1,0,3,1,0,2,3,3,2,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,2,0,0,1,0,0,0,0,0];

[0091] The label characteristics of another small number of normal business behaviors or special operation and maintenance behaviors are:

[0092] [0,0,3,2,0,1,3,3,2,0,0,0,0,0,0,0,0,1,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,3,0,0,0,0,3,0,0,1,0,0,0,0,0];

[0093] It can be seen that the label features of the mining behavior set are similar. To significantly distinguish the label features of the two behavior sets, it is necessary to give certain specific labels a greater weight. For example, the mining behavior set generally has file transfers, so a greater weight is configured for the label bit of file transfer, and different weights can also be configured for other different label bits. Manually setting the weights of different label bits is difficult to adapt to all situations. It is more appropriate to dynamically adjust the feature weights through the model.

[0094] In order to achieve the above purpose, embedded features can be extracted and an embedded feature extraction model can be trained.

[0095] Specifically, Figure 5 As shown, multiple historical behavior sets of different categories can be obtained, such as HIDS alarm data (including real red and blue confrontation data) in real business collected by the same host-type intrusion detection system, HIDS alarm data on the honeypot (including various mining, Trojan backdoor and other behaviors), normal business behavior data, etc. The above data are divided into the granularity of behavior sets, that is, the behavior data within a preset time window (such as 60 minutes) is selected from the behavior data of the same host and the same session (session) to obtain multiple historical behavior sets. The alarm type is used as the category of HIDS alarm data, and the specific business name is used as the category of real business behavior data. Then, the method in the above embodiment is used for multiple different categories of historical behavior sets to obtain the label features of each historical behavior set, and the label features of multiple historical behavior sets are used as training data. Further, the embedded feature extraction model is trained based on the training data.

[0096] First, we can build an initial embedding feature extraction model. The embedding feature extraction model can use the encoder in the Transformer model (of course, other deep neural networks can also be used), map the label features of each training data to embedding features, and perform back propagation on the embedding feature extraction model according to the embedding features corresponding to each training data and the triplet loss function, and adjust the model parameters of the embedding feature extraction model. The triplet loss loss is used to make the embedding features of the same category of training data similar, and the embedding features of normal business and abnormal behavior differ greatly. The triplet loss loss function expression is:

[0097] L=max(d(a,p)–d(a,n)+mergin,0)

[0098] Where d is the distance metric function, usually cosine distance or Euclidean distance; a is the anchor point, that is, the current sample selected from the training data set each time; p is the sample of the same category as the anchor point sample; n is the sample of a different category from the anchor point sample; mergin is a manually set hyperparameter with a default size of 1. The goal of minimizing L will make the feature distance d(a,p) between a and p close to 0, and the feature distance d(a,n) between a and n greater than d(a,p)+mergin. After training with this scheme, the deep neural network can convert label features into embedding features. In the feature space of the embedding features, the feature distance of some small number of special business / special operation and maintenance behaviors from normal business is smaller than the feature distance between abnormal behavior and normal business behavior, such as Figure 6 As shown, abnormal behavior can be distinguished.

[0099] In this embodiment, after obtaining the label features of the set of behaviors to be detected, they can be input into the embedded feature extraction model, and after being processed by the embedded feature extraction model, the embedded features of the set of behaviors to be detected are obtained. For example, the label features are:

[0100] [1,0,3,1,0,2,3,3,2,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,2,0,0,1,0,0,0,0,0];

[0101] After being processed by the embedding feature extraction model, the embedded features are:

[0102] [0.68,0,0.012,0.24...]

[0103] In an optional embodiment, judging whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance in S204 may specifically include:

[0104] For the embedded features of the behavior set to be detected, incremental clustering is performed based on the clustering results of the embedded features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0105] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0106] In this embodiment, multiple historical behavior sets can be collected in advance. For example, multiple historical behavior sets within a predetermined period of time in the past (the predetermined period of time can be determined based on the amount of data and resource conditions, for example, 1-7 days, etc.) can be collected, and the embedded features of each historical behavior collection can be obtained respectively using the method in the above embodiment, and clustering is performed according to the embedded features of each historical behavior collection. For example, a singlepass clustering algorithm or a DBSCAN clustering algorithm can be used to cluster the embedded features of each historical behavior collection, and the clustering results are used as basic categories, wherein the categories with sample numbers less than a preset sample number threshold in the clustering results are used as abnormal behavior categories, and the categories with sample numbers not less than the preset sample number threshold are used as normal behavior categories. After obtaining the embedded features of the behavior set to be detected, incremental clustering can be performed based on the clustering results of the embedded features of the historical behavior set, that is, continue to use the same clustering algorithm to determine whether the embedded features of the behavior set to be detected can be classified into any category in the above clustering results. If the embedded features of the behavior set to be detected are classified into the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0107] In another optional embodiment, judging whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance in S204 may specifically include:

[0108] Using an autoencoder model to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained by the embedded features of the set of historical behaviors;

[0109] Whether the set of behaviors to be detected is abnormal is determined according to an error between the output result and the embedded features of the set of behaviors to be detected.

[0110] In this embodiment, the autoencoder model (AutoEncoder) is an unsupervised neural network model that can learn the implicit features of the input data, which is called encoding, and can reconstruct the original input data using the learned new features, which is called decoding.

[0111] In this embodiment, multiple historical behavior sets can be collected in advance. For example, multiple historical behavior sets within a predetermined period of time in the past (the predetermined period of time can be determined based on the amount of data and resource conditions, for example, 1-7 days can be selected), and the method in the above embodiment can be used to obtain the embedded features of each historical behavior collection respectively. When training the autoencoder model based on the embedded features of multiple historical behavior collections, since the number of normal behavior collections is greater than the number of abnormal behavior collections, that is, the number of embedded features of normal behavior collections in the embedded features of multiple historical behavior collections is greater than the number of embedded features of abnormal behavior collections, the autoencoder model is fully trained for normal behavior during training, and the difference between the output result and the embedded features of the input normal behavior collection is small; however, since the number of embedded features of the abnormal behavior collection is small, the autoencoder model is not fully trained for abnormal behavior, and the difference between the output result and the embedded features of the input abnormal behavior collection is large.

[0112] After obtaining the embedded features of the behavior set to be detected, they are input into the trained autoencoder model for encoding and decoding. If the error between the output result and the embedded features of the behavior set to be detected is small and does not exceed the preset error threshold, the behavior set to be detected can be determined to be a normal behavior set; if the error between the output result and the embedded features of the behavior set to be detected is large and exceeds the preset error threshold, the behavior set to be detected can be determined to be an abnormal behavior set.

[0113] In another optional embodiment, the embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set. The historical abnormal behavior set may be an abnormal behavior set that has been manually confirmed (such as an intrusion behavior or other malicious behavior), or may be an abnormal behavior set determined by other methods. The embedded features of the historical abnormal behavior set may be used as index items. Accordingly, judging whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance in S204 may specifically include:

[0114] Obtain the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical abnormal behavior set; and determine whether the behavior set to be detected is abnormal based on the similarity.

[0115] In this embodiment, the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical abnormal behavior set can be calculated. If the similarity exceeds the preset similarity threshold, it means that the behavior set to be detected is very similar to the historical abnormal behavior set. It can be confirmed that there is an abnormality in the behavior set to be detected, and an alarm is issued, wherein the relevant information of the historical abnormal behavior set can also be given when the alarm is issued. In this embodiment, if there are multiple embedded features of historical abnormal behavior sets, and the embedded features of the historical abnormal behavior set are used as index items, the similarity between the embedded features of the behavior set to be detected and the embedded features of each historical abnormal behavior set can be calculated based on the index items, and it is determined whether the maximum similarity exceeds the preset similarity threshold. Optionally, the above process can be implemented using a streaming processing engine (such as flink). If the abnormal behavior set is a malicious behavior set (such as an intrusion behavior set or other malicious behavior set), the method of this embodiment can be used to determine whether the behavior set to be detected is a malicious behavior set.

[0116] In addition, it is also possible to trace back the historical behavior set over a period of time in the past, calculate the similarity between the embedded features of the historical behavior set and the embedded features of the historical abnormal behavior set, thereby realizing threat hunting and determining whether a behavior with a high degree of similarity to the historical abnormal behavior set has occurred over a period of time in the past.

[0117] It should be noted that the above optional embodiments can also be combined without conflict, and the judgment results of multiple embodiments can be integrated to finally confirm whether the set of behaviors to be detected has an abnormality, improve accuracy, and avoid false alarms.

[0118] Corresponding to the abnormal behavior detection method in the above embodiment, Figure 7 This is a structural block diagram of an abnormal behavior detection device provided by an embodiment of the present disclosure. For ease of explanation, only the parts related to the embodiment of the present disclosure are shown. Figure 7 The abnormal behavior detection device 700 includes: a collection unit 701, a label processing unit 702, a mapping unit 703 and an abnormality identification unit 704.

[0119] The collection unit 701 is used to collect a set of behaviors to be detected belonging to the same session within a preset time window;

[0120] The label processing unit 702 is used to add a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtain the label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected;

[0121] A mapping unit 703 is used to map the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0122] The anomaly identification unit 704 is used to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance.

[0123] In one or more embodiments of the present disclosure, when the label processing unit 702 adds a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior and obtains the label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected, it is used to:

[0124] According to a preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, so as to obtain a label corresponding to each behavior;

[0125] Obtain the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0126] The label features of the to-be-detected behavior set are constructed according to the number of times each label in the preset label set appears.

[0127] In one or more embodiments of the present disclosure, when constructing the label feature of the to-be-detected behavior set according to the number of occurrences of each label in the preset label set, the label processing unit 702 is used to:

[0128] Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence;

[0129] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0130] In one or more embodiments of the present disclosure, when judging whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired historical behavior set, the anomaly identification unit 704 is used to:

[0131] For the embedded features of the behavior set to be detected, incremental clustering is performed based on the clustering results of the embedded features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0132] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0133] In one or more embodiments of the present disclosure, when judging whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired historical behavior set, the anomaly identification unit 704 is used to:

[0134] Using an autoencoder model to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained by the embedded features of the set of historical behaviors;

[0135] Whether the set of behaviors to be detected is abnormal is determined according to an error between the output result and the embedded features of the set of behaviors to be detected.

[0136] In one or more embodiments of the present disclosure, the embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set; when the abnormality identification unit 704 determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, it is used to:

[0137] Obtaining the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0138] It is determined whether the set of behaviors to be detected is abnormal based on the similarity.

[0139] In one or more embodiments of the present disclosure, the preset label set includes label subsets corresponding to different target fields; accordingly, when the label processing unit 702 adds labels to multiple target fields in each behavior in the set of behaviors to be detected according to the preset label set, it is used to:

[0140] According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

[0141] In one or more embodiments of the present disclosure, the target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

[0142] In one or more embodiments of the present disclosure, the tag processing unit 702 is further configured to:

[0143] Acquire multiple pieces of historical behavior data, and extract a program name field from the historical behavior data;

[0144] A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

[0145] In one or more embodiments of the present disclosure, the embedded feature extraction model is trained through the following process:

[0146] Acquire multiple historical behavior sets of different categories, and obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data;

[0147] The training data is input into the embedded feature extraction model to obtain the embedded features corresponding to each of the training data; according to the embedded features corresponding to each of the training data and the triplet loss function, the embedded feature extraction model is back-propagated to adjust the model parameters of the embedded feature extraction model to finally obtain the trained embedded feature extraction model.

[0148] In one or more embodiments of the present disclosure, the embedded feature extraction model adopts an encoder in a Transformer model.

[0149] The abnormal behavior detection device provided in this embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0150] refer to Figure 8 , which shows a schematic diagram of the structure of an electronic device 800 suitable for implementing the embodiment of the present disclosure, and the electronic device 800 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Portable Android Devices, PADs), portable multimedia players (PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0151] like Figure 8As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 to a random access memory (RAM) 803. Various programs and data required for the operation of the electronic device 800 are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0152] Typically, the following devices may be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 809. The communication device 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 The electronic device 800 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0153] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0154] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0155] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0156] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0157] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0158] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0159] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0160] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0161] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0162] In a first aspect, according to one or more embodiments of the present disclosure, a method for detecting abnormal behavior is provided, comprising:

[0163] Collect a set of behaviors to be detected that belong to the same session within a preset time window;

[0164] Adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0165] According to a preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped into embedding features;

[0166] Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, it is determined whether the behavior set to be detected is abnormal.

[0167] According to one or more embodiments of the present disclosure, the step of adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected includes:

[0168] According to a preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, so as to obtain a label corresponding to each behavior;

[0169] Obtain the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0170] The label features of the to-be-detected behavior set are constructed according to the number of times each label in the preset label set appears.

[0171] According to one or more embodiments of the present disclosure, the step of constructing a label feature of the set of behaviors to be detected according to the number of times each label in the preset label set appears includes:

[0172] Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence;

[0173] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0174] According to one or more embodiments of the present disclosure, judging whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired historical behavior set includes:

[0175] For the embedded features of the behavior set to be detected, incremental clustering is performed based on the clustering results of the embedded features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0176] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0177] According to one or more embodiments of the present disclosure, judging whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired historical behavior set includes:

[0178] Using an autoencoder model to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained by the embedded features of the set of historical behaviors;

[0179] Whether the set of behaviors to be detected is abnormal is determined according to an error between the output result and the embedded features of the set of behaviors to be detected.

[0180] According to one or more embodiments of the present disclosure, the embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set; judging whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance includes:

[0181] Obtaining the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0182] It is determined whether the set of behaviors to be detected is abnormal based on the similarity.

[0183] According to one or more embodiments of the present disclosure, the preset label set includes label subsets corresponding to different target fields; accordingly, according to the preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, including:

[0184] According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

[0185] According to one or more embodiments of the present disclosure, the target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

[0186] According to one or more embodiments of the present disclosure, the method further includes:

[0187] Acquire multiple pieces of historical behavior data, and extract a program name field from the historical behavior data;

[0188] A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

[0189] According to one or more embodiments of the present disclosure, the embedded feature extraction model is trained through the following process:

[0190] Acquire multiple historical behavior sets of different categories, and obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data;

[0191] The training data is input into the embedded feature extraction model to obtain the embedded features corresponding to each of the training data; according to the embedded features corresponding to each of the training data and the triplet loss function, the embedded feature extraction model is back-propagated to adjust the model parameters of the embedded feature extraction model to finally obtain the trained embedded feature extraction model.

[0192] According to one or more embodiments of the present disclosure, the embedded feature extraction model adopts an encoder in a Transformer model.

[0193] In a second aspect, according to one or more embodiments of the present disclosure, there is provided an abnormal behavior detection device, including:

[0194] A collection unit, used to collect a set of behaviors to be detected belonging to the same session within a preset time window;

[0195] A label processing unit, used to add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0196] A mapping unit, used for mapping the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0197] The anomaly identification unit is used to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance.

[0198] According to one or more embodiments of the present disclosure, when the label processing unit adds a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtains the label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected, it is used to:

[0199] According to a preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, so as to obtain a label corresponding to each behavior;

[0200] Obtain the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0201] The label features of the to-be-detected behavior set are constructed according to the number of times each label in the preset label set appears.

[0202] According to one or more embodiments of the present disclosure, when constructing the label feature of the set of behaviors to be detected according to the number of occurrences of each label in the preset label set, the label processing unit is used to:

[0203] Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence;

[0204] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0205] According to one or more embodiments of the present disclosure, when the anomaly identification unit determines whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set, it is used to:

[0206] For the embedded features of the behavior set to be detected, incremental clustering is performed based on the clustering results of the embedded features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0207] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0208] According to one or more embodiments of the present disclosure, when the anomaly identification unit determines whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set, it is used to:

[0209] Using an autoencoder model to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained by the embedded features of the set of historical behaviors;

[0210] Whether the set of behaviors to be detected is abnormal is determined according to an error between the output result and the embedded features of the set of behaviors to be detected.

[0211] According to one or more embodiments of the present disclosure, the embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set; when the abnormality identification unit determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, it is used to:

[0212] Obtaining the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0213] It is determined whether the set of behaviors to be detected is abnormal based on the similarity.

[0214] According to one or more embodiments of the present disclosure, the preset label set includes label subsets corresponding to different target fields; accordingly, when the label processing unit adds labels to multiple target fields in each behavior in the set of behaviors to be detected according to the preset label set, it is used to:

[0215] According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

[0216] According to one or more embodiments of the present disclosure, the target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

[0217] According to one or more embodiments of the present disclosure, the label processing unit is further used for:

[0218] Acquire multiple pieces of historical behavior data, and extract a program name field from the historical behavior data;

[0219] A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

[0220] According to one or more embodiments of the present disclosure, the embedded feature extraction model is trained through the following process:

[0221] Acquire multiple historical behavior sets of different categories, and obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data;

[0222] The training data is input into the embedded feature extraction model to obtain the embedded features corresponding to each of the training data; according to the embedded features corresponding to each of the training data and the triplet loss function, the embedded feature extraction model is back-propagated to adjust the model parameters of the embedded feature extraction model to finally obtain the trained embedded feature extraction model.

[0223] According to one or more embodiments of the present disclosure, the embedded feature extraction model adopts an encoder in a Transformer model.

[0224] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0225] The memory stores computer-executable instructions;

[0226] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect.

[0227] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect is implemented.

[0228] In a fifth aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, comprising computer execution instructions. When a processor executes the computer execution instructions, the abnormal behavior detection method as described in the first aspect and various possible designs of the first aspect is implemented.

[0229] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0230] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0231] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A method for detecting abnormal behavior, characterized in that: include: Collect a set of behaviors to be detected that belong to the same session within a preset time window; Adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; According to a preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped into embedding features; Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, it is determined whether the behavior set to be detected is abnormal.

2. The method according to claim 1, characterized in that The step of adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected, includes: According to a preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, so as to obtain a label corresponding to each behavior; Obtain the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected; The label features of the to-be-detected behavior set are constructed according to the number of times each label in the preset label set appears.

3. The method according to claim 2, characterized in that The step of constructing the label features of the set of behaviors to be detected according to the number of times each label in the preset label set appears includes: Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence; Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

4. The method according to any one of claims 1 to 3, characterized in that: The determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the set of historical behaviors acquired in advance includes: For the embedded features of the behavior set to be detected, incremental clustering is performed based on the clustering results of the embedded features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold; If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

5. The method according to any one of claims 1 to 3, characterized in that: The determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the set of historical behaviors acquired in advance includes: Using an autoencoder model to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained by the embedded features of the set of historical behaviors; Whether the set of behaviors to be detected is abnormal is determined according to an error between the output result and the embedded features of the set of behaviors to be detected.

6. The method according to any one of claims 1 to 3, characterized in that: The embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set; judging whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance includes: Obtaining the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors; It is determined whether the set of behaviors to be detected is abnormal according to the similarity.

7. The method according to claim 2, characterized in that The preset label set includes label subsets corresponding to different target fields; accordingly, according to the preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, including: According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

8. The method according to claim 7, characterized in that The target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

9. The method according to claim 8, characterized in that The method further comprises: Acquire multiple pieces of historical behavior data, and extract a program name field from the historical behavior data; A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

10. The method according to claim 1, characterized in that The embedding feature extraction model is trained through the following process: Acquire multiple historical behavior sets of different categories, and obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data; The training data is input into the embedded feature extraction model to obtain the embedded features corresponding to each of the training data; according to the embedded features corresponding to each of the training data and the triplet loss function, the embedded feature extraction model is back-propagated to adjust the model parameters of the embedded feature extraction model to finally obtain the trained embedded feature extraction model.

11. The method according to claim 1 or 10, characterized in that: The embedding feature extraction model uses the encoder in the Transformer model.

12. An abnormal behavior detection device, characterized in that: include: A collection unit, used to collect a set of behaviors to be detected belonging to the same session within a preset time window; A label processing unit, used to add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; A mapping unit, used to map the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model; The anomaly identification unit is used to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance.

13. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 11 is implemented.

15. A computer program product, characterized in that The method comprises computer-executable instructions, and when a processor executes the computer-executable instructions, the method according to any one of claims 1 to 11 is implemented.

Images