Model-based anomaly detection methods, devices, and storage media for identifying business risks.

Abstract

This disclosure provides a model-based abnormal behavior detection method, device, and storage medium for identifying business risks. The method involves collecting a set of behaviors to be detected belonging to the same session within a preset time window; adding a label to each behavior in the set; obtaining label features of the set based on the labels of all behaviors in the set; mapping the label features of the set to embedded features to embedded features using a preset embedding feature extraction model; and determining whether the set of behaviors to be detected is abnormal based on the embedded features and the embedded features of pre-acquired historical behavior sets. By using labels to represent each behavior in the set of behaviors to be detected in natural language, and quantifying the labels of all behaviors in the set as label features and then mapping them to embedded features, the method offers strong interpretability. Abnormal behavior identification based on embedded features can improve identification accuracy and reduce false alarms.

Description

Technical Field

[0001] This disclosure relates to the field of computer and network communication technology, and in particular to a model-based abnormal behavior detection method, device, and storage medium for identifying business risks. Background Technology

[0002] Anomaly detection is a crucial function of host intrusion detection systems, designed to uncover unknown anomalous behaviors that deviate from the baseline. Host intrusion detection systems can collect host data at various levels, including system calls, file creation, file read / write, command execution, and network connections.

[0003] Existing anomaly detection schemes primarily rely on data such as command execution sequences, system call sequences, and process creation, employing statistical, machine learning, or deep learning methods for anomaly detection. However, these schemes suffer from low accuracy and are prone to false positives. Summary of the Invention

[0004] This disclosure provides a model-based abnormal behavior detection method, device, and storage medium for identifying business risks, thereby improving the accuracy of abnormal behavior detection and effectively avoiding false alarms.

[0005] In a first aspect, embodiments of this disclosure provide a model-based abnormal behavior detection method for identifying business risks, comprising:

[0006] Collect the set of behaviors to be detected that belong to the same session within a preset time window;

[0007] A label is added to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and the label features of the set of behaviors to be detected are obtained based on the labels of all behaviors in the set of behaviors to be detected.

[0008] According to the preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped to embedding features;

[0009] Based on the embedding features of the set of behaviors to be detected and the embedding features of the pre-acquired set of historical behaviors, it is determined whether the set of behaviors to be detected is abnormal.

[0010] Secondly, embodiments of this disclosure provide a model-based abnormal behavior detection device for identifying business risks, comprising:

[0011] The acquisition unit is used to acquire a set of behaviors to be detected that belong to the same session within a preset time window;

[0012] The tag processing unit is used to add tags to each behavior in the set of behaviors to be detected in order to identify the attribute information of each behavior, and to obtain the tag features of the set of behaviors to be detected based on the tags of all behaviors in the set of behaviors to be detected.

[0013] The mapping unit is used to map the label features of the set of behaviors to be detected into embedded features according to a preset embedding feature extraction model.

[0014] An anomaly identification unit is used to determine whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors.

[0015] Thirdly, embodiments of this disclosure provide an electronic device, including: at least one processor and a memory;

[0016] The memory stores computer-executed instructions;

[0017] The at least one processor executes the computer execution instructions stored in the memory, causing the at least one processor to perform the abnormal behavior detection method as described in the first aspect and various possible designs of the first aspect.

[0018] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect.

[0019] Fifthly, embodiments of this disclosure provide a computer program product, including computer execution instructions, which, when executed by a processor, implement the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect.

[0020] This disclosure provides a model-based abnormal behavior detection method, device, and storage medium for identifying business risks. The method involves collecting a set of behaviors to be detected belonging to the same session within a preset time window; adding tags to each behavior in the set to identify its attribute information; obtaining tag features of the set based on the tags of all behaviors; mapping the tag features of the set to embedded features to embedded features using a preset embedding feature extraction model; and determining whether the set of behaviors to be detected is abnormal based on the embedded features and the embedded features of pre-acquired historical behavior sets. This disclosure uses tags to represent each behavior in the set of behaviors to be detected in natural language, enhancing the readability of the behavior data. Furthermore, quantifying the tags of all behaviors in the set to be detected into tag features and then mapping them to embedded features fully describes the characteristics of the set of behaviors to be detected, providing strong interpretability. Abnormal behavior identification based on embedded features can improve identification accuracy and reduce false alarms. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A scenario example diagram illustrating an abnormal behavior detection method provided in an embodiment of this disclosure;

[0023] Figure 2 This is a schematic flowchart of an abnormal behavior detection method provided in an embodiment of the present disclosure;

[0024] Figure 3 This is a schematic flowchart of an abnormal behavior detection method provided in another embodiment of the present disclosure;

[0025] Figure 4 A schematic diagram illustrating the tag feature distance provided in an embodiment of this disclosure;

[0026] Figure 5 This is a schematic flowchart of an abnormal behavior detection method provided in another embodiment of the present disclosure;

[0027] Figure 6 A schematic diagram illustrating the embedding feature distance provided in an embodiment of this disclosure;

[0028] Figure 7 This is a structural block diagram of an abnormal behavior detection device provided in an embodiment of the present disclosure;

[0029] Figure 8 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0031] Anomaly detection is a crucial function of host intrusion detection systems, designed to uncover unknown anomalous behaviors that deviate from the baseline. Host intrusion detection systems can collect host data at various levels, including system calls, file creation, file read / write, command execution, and network connections.

[0032] Existing abnormal behavior detection schemes mainly rely on data such as execution command sequences, system call sequences, and process creation, and use statistical, machine learning, or deep learning methods for anomaly detection.

[0033] Statistical approaches specifically analyze the historical frequency of a particular behavior or combination of behaviors, identifying infrequent behaviors and combinations as anomalies. Machine learning and deep learning-based approaches first convert natural language data such as command sequences and process creation into feature vectors, then perform clustering or classification, typically using unsupervised / self-supervised methods.

[0034] The behavioral data is clustered using a clustering algorithm to obtain multiple category clusters. The category with more samples in the same category is the normal behavior category, and the category with fewer samples in the same category is the abnormal behavior category.

[0035] An autoencoder model encodes and decodes behavioral data, and a loss function is set to make the decoder's output as close as possible to the encoder's input. Because most behavioral data collected in real-world production environments consists of normal behavior, the autoencoder model is more thoroughly trained for encoding and decoding normal behavior data, resulting in a smaller difference between the model's decoder output and encoder input. However, abnormal behavior is less common, meaning the autoencoder model is not sufficiently trained for encoding and decoding abnormal behavior data, leading to a larger difference between the model's decoder output and encoder input. Therefore, abnormal behavior can be filtered out by setting a threshold for the difference between the model's input and output.

[0036] However, whether directly statistically analyzing behavioral data or converting it into feature vectors for clustering or model training, both methods face the problem of numerous false alarms due to the complexity of host commands or process sequences in real-world scenarios. For example, a rare command parameter or file path might be judged as abnormal behavior when it is not. If the types of statistical data are strictly filtered and limited (e.g., only a limited number of system calls are counted), the data may fail to adequately describe and distinguish between massive amounts of complex normal behavior and unknown abnormal behavior.

[0037] To improve the accuracy of abnormal behavior detection and effectively avoid false alarms, this disclosure provides an abnormal behavior detection method. The method involves collecting a set of behaviors to be detected belonging to the same session within a preset time window; adding a label to each behavior in the set and obtaining the label features of the set based on the labels of all behaviors; mapping the label features of the set to embedded features to embedded features using a preset embedding feature extraction model; and determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set and the embedded features of pre-acquired historical behavior sets. By using labels to represent each behavior in the set of behaviors to be detected in natural language, the readability of the behavior data is enhanced. Furthermore, quantifying the labels of all behaviors in the set of behaviors to be detected into label features, and then mapping them to embedded features, fully describes the characteristics of the set of behaviors to be detected, providing strong interpretability. Abnormal behavior identification based on embedded features can improve recognition accuracy and reduce false alarms, making it applicable to the detection of abnormal behavior in massive amounts of behavior data in real-world scenarios.

[0038] The abnormal behavior detection method disclosed herein is applied to electronic devices such as servers, for example... Figure 1 As shown, a set of behaviors to be detected belonging to the same session within a preset time window can be obtained. Then, by adding labels, constructing label features, and extracting embedding features, the set of behaviors to be detected can be judged to determine whether there are any abnormalities in the set of behaviors to be detected based on the embedding features of the set of behaviors to be detected and the embedding features of the pre-obtained set of historical behaviors.

[0039] The abnormal behavior detection method of this disclosure will be described in detail below with reference to specific embodiments.

[0040] refer to Figure 2 , Figure 2 This is a schematic flowchart of an abnormal behavior detection method according to an embodiment of the present disclosure. The method of this embodiment can be applied to electronic devices such as servers, and the abnormal behavior detection method includes:

[0041] S201. Collect the set of behaviors to be detected that belong to the same session within a preset time window.

[0042] In this embodiment, behavioral data of the target host can be collected in real time. For example, a Host-based Intrusion Detection System (HIDS) or other detection systems can be used to collect behavioral data of the target host in real time. Furthermore, considering that behaviors within the same session are often correlated, especially since multiple other malicious behaviors often exist within a session containing intrusion behavior, behavioral data within a preset time window (e.g., 60 minutes) is selected from the behavioral data of the same host and the same session to obtain a behavioral set, which serves as the set of behaviors to be detected. Abnormal behavior detection is performed at the granularity of the behavioral set.

[0043] In this embodiment, since host-based intrusion detection systems and other systems may collect the behavior of multiple hosts and multiple sessions simultaneously, behavior filtering can be performed based on host identifiers and session identifiers (Session_ID) and a preset time window to obtain a set of behaviors to be detected.

[0044] S202. Add a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtain the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected.

[0045] In this embodiment, the types of different target fields in each behavior of the set of behaviors to be detected can be identified. Each type corresponds to a label. Different target fields include, but are not limited to, program name fields (such as the execve field), source IP fields, destination IP fields, port fields, file path fields, file name fields, etc., thereby obtaining multiple labels for each behavior. This enables the attribute information of the behavior to be represented by multiple labels, converting the behavior into a natural language representation, which enhances the readability of the behavior data. The labels of all behaviors in the set of behaviors to be detected can represent the set of behaviors to be detected. Furthermore, based on the labels of all behaviors in the set of behaviors to be detected, label features of the set of behaviors to be detected can be constructed. For example, the labels of all behaviors in the set of behaviors to be detected can be statistically analyzed, and feature vectors can be constructed based on the statistical results as label features to represent which labels are included in the set of behaviors to be detected and the number of times each of the included labels appears.

[0046] S203. Based on the preset embedding feature extraction model, map the label features of the set of behaviors to be detected to embedding features.

[0047] In this embodiment, although the label features of the set of behaviors to be detected can distinguish between abnormal behaviors and normal business behaviors, for a small number of normal business behaviors or special operation and maintenance behaviors, there may be cases where their label features are very similar to those of abnormal behaviors, which may lead to false alarms. Therefore, this embodiment considers further processing of the label features.

[0048] An embedding feature extraction model can be pre-trained. This model can map the label features of any set of behaviors to embedding features. The input to the embedding feature extraction model can be the label features of any set of behaviors, and the output is the corresponding embedding feature. Optionally, the embedding feature extraction model can use a deep neural network, such as the encoder in the Transformer model, or other deep neural network models; no limitation is made here. Through the embedding feature extraction model, high-dimensional label features can be converted into dense, low-dimensional embedding features. Embedding features integrate a large amount of valuable information, have stronger expressive power, and can better reflect the characteristics of the corresponding set of behaviors, thus facilitating the identification of whether anomalies exist in the set of behaviors.

[0049] In this embodiment, after obtaining the label features of the set of behaviors to be detected, they can be input into the embedding feature extraction model. After processing by the embedding feature extraction model, the embedding features of the set of behaviors to be detected are obtained.

[0050] S204. Based on the embedding features of the set of behaviors to be detected and the embedding features of the historical behavior set obtained in advance, determine whether there is an anomaly in the set of behaviors to be detected.

[0051] In this embodiment, after obtaining the embedding features of the set of behaviors to be detected, it is possible to determine whether the set of behaviors to be detected is abnormal based on the embedding features of the set of behaviors to be detected and the embedding features of the pre-obtained historical behavior sets. The embedding features of the pre-obtained historical behavior sets are also obtained using the same process described above. Since the category of the historical behavior set can be determined in advance, such as a set of normal behaviors or a set of abnormal behaviors, it is possible to determine whether the set of behaviors to be detected is abnormal by judging the similarity between the embedding features of the set of behaviors to be detected and the embedding features of the historical behavior sets, based on the embedding features of the historical behavior sets. Alternatively, other methods can be used to determine whether the set of behaviors to be detected is abnormal based on the embedding features of the set of behaviors to be detected and the embedding features of the pre-obtained historical behavior sets.

[0052] Optionally, after confirming that there is an anomaly in the set of behaviors to be detected, an anomaly alarm can also be issued. When issuing an alarm, the labels of all behaviors in the set of behaviors to be detected can be given to help determine what kind of operation the set of behaviors to be detected has performed.

[0053] This embodiment of the abnormal behavior detection method involves collecting a set of behaviors to be detected belonging to the same session within a preset time window; adding a label to each behavior in the set to identify its attribute information; obtaining the label features of the set of behaviors based on the labels of all behaviors in the set; mapping the label features of the set of behaviors to embedded features using a preset embedding feature extraction model; and determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of a pre-acquired historical behavior set. This embodiment uses labels to represent each behavior in the set of behaviors to be detected in natural language, enhancing the readability of the behavior data. Furthermore, quantifying the labels of all behaviors in the set of behaviors to be detected into label features, and then mapping them to embedded features, fully describes the characteristics of the set of behaviors to be detected, providing strong interpretability. Abnormal behavior identification based on embedded features can improve identification accuracy and reduce false alarms.

[0054] Based on any of the above embodiments, S202, which involves adding a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtaining the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected, may specifically include:

[0055] S2021. According to the preset label set, add labels to multiple target fields in each behavior in the set of behaviors to be detected, and obtain the label corresponding to each behavior.

[0056] S2022. Obtain the number of times each label in the preset label set appears in the labels of each behavior in the set of behaviors to be detected;

[0057] S2023. Construct the label features of the set of behaviors to be detected based on the number of times each label appears in the preset label set.

[0058] In this embodiment, the preset tag set is a pre-obtained tag set, which includes candidate tags (which can form a tag subset) corresponding to different target fields. Different target fields include, but are not limited to, program name fields (such as the execve field), network-related fields such as source IP field, destination IP field, port field, etc., and file-related fields such as file path field, file name field, etc. For each target field in each behavior in the set of behaviors to be detected, a tag can be added separately to obtain the tag corresponding to each behavior. The tag annotation can be implemented using machine learning models (such as language models and other neural network models); or it can be implemented using matching rules. This can be achieved by writing scripts or using a streaming processing engine (such as Flink). Specifically, according to preset matching rules, any target field of any behavior can be matched with the tag subset corresponding to that target field to determine the target tag corresponding to that target field; or some target fields (such as the program name field) can be annotated using machine learning models, while other target fields can be annotated using matching rules.

[0059] As an example, the subset of tags for the program name field (execve field) may include, but is not limited to: file transfer, backup compression, file management, disk management, disk maintenance, system settings, system management, text processing, network communication, device management, email and newsgroups, applications, package management, other common commands, code-related, databases, etc. When adding tags to the program name field (execve field) for any behavior, if the execve field is "find", then the tag "file management" is added; if the execve field is "nginx", then the tag "network communication" is added; if the execve field is "systemd", then the tag "system management" is added; if the execve field is "nginx", then the tag "network communication" is added; if the execve field is "systemd", then the tag "system management" is added; if the execve field is "dpkg", then the tag "package management" is added; if the execve field is "ffmpeg", then the tag "application" is added, and so on. Optionally, if the program name field (execve field) of any action includes a file path, the prefix path can be extracted.

[0060] The subset of tags for the source IP field may include, but is not limited to: IPv6 source IP, internal network source IP, loopback source IP, external network source IP, reserved source IP, etc. When adding tags to the source IP field for any action, if the source IP field is an internal network IP address, add the tag "Internal Network Source IP"; if the source IP field is an external network IP address, add the tag "External Network Source IP"; if the source IP field is a loopback IP, add the tag "Loopback Source IP"; if the source IP field is a reserved IP address, add the tag "Reserved Source IP"; if the source IP field is an IPv6 address, add the tag "IPv6 Source IP", and so on.

[0061] The subset of tags for the Destination IP field may include, but is not limited to: IPv6 Destination IP, Internal Network Destination IP, Loopback Destination IP, External Network Destination IP, Reserved Destination IP, etc. When adding a tag to the Destination IP field for any action, if the Destination IP field is an internal network IP address, add the tag "Internal Network Destination IP"; if the Destination IP field is an external network IP address, add the tag "External Network Destination IP"; if the Destination IP field is a loopback IP, add the tag "Loopback Destination IP"; if the Destination IP field is a reserved IP address, add the tag "Reserved Destination IP"; if the Destination IP field is an IPv6 address, add the tag "IPv6 Destination IP", and so on.

[0062] The subset of tags for the source port field may include, but is not limited to: well-known source port, registered source port, etc. When adding tags to the source port field for any behavior, if the source port field is a common well-known port number, add the tag "well-known source port"; if the source port field is a registered port number, add the tag "registered source port", and so on.

[0063] The subset of tags for the destination port field may include, but is not limited to: well-known destination port, registered destination port, etc. When adding a tag to the destination port field for any action, if the destination port field is a common well-known port number, then add the tag "well-known destination port"; if the destination port field is a registered port number, then add the tag "registered destination port", and so on.

[0064] The subset of tags for the file path field may include, but is not limited to: bin directory, dev directory, etc directory, home directory, lib directory, sbin directory, tmp directory, root directory, mnt directory, lost+found directory, proc directory, var directory, usr directory, opt directory, etc. When adding tags to the file path field for any action, the following tags are added: "bin directory" if the path contains a bin directory; "dev directory" if the path contains a dev directory; "etc directory" if the path contains an etc directory; "home directory" if the path contains a home directory; "lib directory" if the path contains a lib directory; "sbin directory" if the path contains a sbin directory; "tmp directory" if the path contains a tmp directory; "root directory" if the path contains a root directory; "mnt directory" if the path contains a mnt directory; "lost+found directory" if the path contains a lost+found directory; "proc directory" if the path contains a proc directory; "var directory" if the path contains a var directory; "usr directory" if the path contains a usr directory; "opt directory" if the path contains an opt directory, and so on.

[0065] The subset of tags for the filename field may include, but is not limited to: log file, py file, sh file, compressed file, web page file, configuration file, etc. When adding tags to the filename field for any behavior, if the filename contains "log", then add the tag "log file"; if the filename suffix is ​​"py", then add the tag "py file"; if the filename suffix is ​​"sh", then add the tag "sh file"; if the filename suffix is ​​"tar", "tgz", or "zip", then add the tag "compressed file"; if the filename suffix contains "php", "htm", "jsp", or "do", then add the tag "web page file"; if the filename contains "conf", then add the tag "configuration file".

[0066] The above label settings are an example under the Linux operating system. If you are using the Windows operating system, you should make the corresponding modifications.

[0067] Among them, the tag subset of the program name field is diverse and can be learned based on historical behavior data. Different tags for different program name fields can be used to construct a tag subset of the program name field, or a tag knowledge base, which includes the mapping relationship between different program name fields and their corresponding tags.

[0068] Optional, such as Figure 3 As shown, multiple historical behavior data can be obtained, and the program name field (execve field) can be extracted from the historical behavior data. If the program name field (execve field) includes a file path, the prefix path can be extracted. The process of extracting the program name field (execve field) from the historical behavior data can be automated by writing code scripts, etc. A preset language model is used to obtain the tags corresponding to each program name field, and a subset of tags (tag knowledge base) corresponding to the program name field is constructed. The preset language model can be any language model, such as ChatGPT, which only needs to perform well in question-and-answer in the host security field. Prompt words can be constructed, and the learning task of the tag subset of the program name field is issued to the preset language model through the prompt words. For example, the prompt words are constructed as follows:

[0069] "Determine which of the following categories the Linux command / process 'execve' belongs to. Category list: File transfer, backup and compression, file management, disk management, disk maintenance, system settings, system administration, text processing, network communication, device management, email and newsgroups, applications, package management, code-related, database;"

[0070] If it is not in the above categories, please summarize and provide the category of the Linux command. If you cannot answer, the category name is unknown.

[0071] Please also provide a Chinese description of the command. If you are unsure about the specifics of the command, please provide possible speculations and indicate any uncertainty.

[0072] The response should be in JSON format, where the 'class' field indicates the command category and the 'description' field provides a description of the command. Do not provide any other information.

[0073] Furthermore, the program name field in the historical behavior data is traversed, and the specific name of the program name field is replaced with 'execve' in the prompt word. Then, the prompt word is input into a preset language model, which outputs the command category (i.e., tag) and detailed information (command description) for the program name field based on its own knowledge base, and stores them. Optionally, key-value storage can be used, where the key is the execve field for easy retrieval. For example:

[0074] 1. {'class': 'File Management', 'description': 'The `find` command is used to find files and directories in a specified directory. It provides many options to help you specify search criteria, such as name, size, permissions, type, etc. The `find` command also supports using regular expressions to match file and directory names. The `find` command is very powerful and can help you quickly locate specific files or directories.',

[0075] 'execve': 'find'}

[0076] 2. {'class': 'Application', 'description': '`dash` is a shell program for Unix / Linux operating systems, a lightweight version of the Bourne shell. Its characteristics include fast execution speed, low memory consumption, and concise code. `dash` executes scripts faster than other shells such as Bash, thus offering advantages in startup speed and script execution speed. `dash` is typically used as the default / bin / sh interpreter, and in some systems, it is also one of the default shell interpreters for Linux distributions.',

[0077] 'execve': 'dash'}

[0078] The above process allows for full utilization of the host security expertise implicit in the language model, reducing the cost of manual labeling.

[0079] Based on the above embodiments, after obtaining the label corresponding to each behavior in the set of behaviors to be detected, the number of times each label in the preset label set appears in the labels of each behavior in the set of behaviors to be detected can be obtained. If it does not appear, the number is recorded as 0. Further, the label features of the set of behaviors to be detected are constructed based on the number of times each label appears in the preset label set. For example, the number of times each label appears in the preset label set can be directly sorted according to the preset label order to obtain a first sequence (array). The first sequence is directly used as the label features of the set of behaviors to be detected.

[0080] To facilitate the processing of the embedded feature extraction model, the frequency of each label can be quantized, i.e., discretized. The frequency values ​​can be mapped to specific values ​​through a preset mapping relationship. For example, the preset mapping relationship can be as follows:

[0081]

[0082] Based on the preset mapping relationship, each value in the first sequence can be mapped to obtain the second sequence, which is then used as the label feature of the set of behaviors to be detected.

[0083] For example, taking the preset tag set in the example above, it includes 50 tags, each tag corresponding to a position. It records the number of times each tag appears in the tags of each behavior in the set of behaviors to be detected, initialized as a 50-bit array of all zeros. Assuming that the tag "file transfer" appears 120 times, "internal network source IP" appears 10 times, and "external network destination IP" appears 10 times in the tags of each behavior in the set of behaviors to be detected, then the second sequence is obtained. This second sequence is used as the tag feature (i.e., feature vector) of the set of behaviors to be detected, as follows: Number of occurrences of tags in each behavior.

[0084] [3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2 ...

[0085] Through the quantization process described above, the labels of each behavior in the set of behaviors to be detected can be quantified reasonably and efficiently.

[0086] Furthermore, considering that although the label features of the set of behaviors to be detected can distinguish between abnormal and normal business behaviors, for a small number of special business behaviors or special operational behaviors, their label features may be quite similar to those of abnormal behaviors, leading to false positives. That is, in the feature space of the label features, the distance between the label features of a small number of special business behaviors / special operational behaviors and those of normal business behaviors is greater than the distance between the label features of abnormal behaviors and those of normal business behaviors. Figure 4 As shown, for example:

[0087] The frequency of occurrence (first sequence) of each behavior in the labels of a certain mining behavior (abnormal behavior) set is as follows:

[0088] [1,0,169,1,0,99,334,666,26,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,49,0,0,1,0,0,0,0,0];

[0089] The quantized label features are:

[0090] [1,0,3,1,0,2,3,3,2,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,2,0,0,1,0,0,0,0,0];

[0091] The labeling characteristics of another small set of normal business behaviors or special operation and maintenance behaviors are:

[0092] [0,0,3,2,0,1,3,3,2,0,0,0,0,0,0,0,0,1,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,3,0,0,0,0,3,0,0,0,1,0,0,0,0,0];

[0093] It is evident that the label features are similar to those of the mining behavior set. To significantly distinguish the label features of these two behavior sets, it is necessary to assign greater weight to certain specific labels. For example, mining behavior sets generally involve file transfer, so a greater weight should be assigned to the label of file transfer. Different weights can also be assigned to other different label positions. However, manually setting the weight of different label positions is difficult to adapt to all situations, so it is more appropriate to dynamically adjust the feature weights through the model.

[0094] To achieve the above objectives, embedded features can be extracted, and an embedded feature extraction model can be trained.

[0095] Specifically, such as Figure 5 As shown, multiple sets of historical behaviors of different categories can be obtained, such as HIDS alarm data (including real red team / blue team adversarial data) collected by the same host-based intrusion detection system from real business operations, HIDS alarm data on honeypots (including various mining, Trojan backdoor, and other behaviors), and normal business behavior data. All of the above data are divided into behavior sets, that is, behavior data within a preset time window (e.g., 60 minutes) is selected from the behavior data of the same host and the same session to obtain multiple historical behavior sets. The alarm type is used as the category of the HIDS alarm data, and the specific business name is used as the category of the real business behavior data. Then, the label features of each historical behavior set are obtained using the method described in the above embodiment, and the label features of multiple historical behavior sets are used as training data. Furthermore, the embedding feature extraction model is trained based on the training data.

[0096] The initial embedding feature extraction model can be constructed first. This model can employ the encoder from the Transformer model (or other deep neural networks). The label features of each training data point are mapped to embedding features. Based on the embedding features corresponding to each training data point and the triplet loss function, backpropagation is performed on the embedding feature extraction model to adjust its parameters. The triplet loss function ensures that the embedding features of training data of the same category are similar, while the embedding features of normal business and abnormal behavior differ significantly. The triplet loss function expression is as follows:

[0097] L = max ( d (a , p) – d (a , n) + merge , 0)

[0098] Where d is the distance metric function, typically cosine distance or Euclidean distance; a is the anchor point, i.e., the current sample selected from the training dataset each time; p is a sample of the same class as the anchor sample; n is a sample of a different class than the anchor sample; and merge is a manually set hyperparameter with a default value of 1. Minimizing L aims to make the feature distance d(a,p) between a and p close to 0, and the feature distance d(a,n) between a and n greater than d(a,p) + merge. After training using this scheme, the deep neural network can convert label features into embedding features. In the feature space of the embedding features, the feature distance between certain special business / special operation and maintenance behaviors and normal business behaviors is smaller than the feature distance between abnormal behaviors and normal business behaviors, such as... Figure 6 As shown, this allows us to distinguish abnormal behavior.

[0099] In this embodiment, after obtaining the label features of the set of behaviors to be detected, they can be input into the embedding feature extraction model. After processing by the embedding feature extraction model, the embedding features of the set of behaviors to be detected are obtained. For example, the label features are:

[0100] [1,0,3,1,0,2,3,3,2,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,2,0,0,1,0,0,0,0,0];

[0101] After processing by the embedding feature extraction model, the embedded features are:

[0102] [0.68,0,0.012,0.24……]

[0103] In an optional embodiment, the determination of whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors, as described in S204, may specifically include:

[0104] For the embedding features of the set of behaviors to be detected, incremental clustering is performed based on the clustering results of the embedding features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedding features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold.

[0105] If the embedded features of the set of behaviors to be detected are added to the abnormal behavior category, or if the embedded features of the set of behaviors to be detected do not belong to any category, then it is determined that the set of behaviors to be detected is abnormal.

[0106] In this embodiment, multiple historical behavior sets can be collected in advance. For example, multiple historical behavior sets within a predetermined time period (the predetermined time period can be determined based on the amount of data and resource conditions, such as 1-7 days) can be collected. The embedding features of each historical behavior set are obtained using the method described in the above embodiment. Clustering is performed based on the embedding features of each historical behavior set. For example, the Singlepass clustering algorithm or the DBSCAN clustering algorithm can be used to cluster the embedding features of each historical behavior set. The clustering results are used as the basic categories. In the clustering results, categories with fewer than a preset sample number threshold are classified as abnormal behavior categories, and categories with more than or equal to the preset sample number threshold are classified as normal behavior categories. After obtaining the embedded features of the set of behaviors to be detected, incremental clustering can be performed based on the clustering results of the embedded features of the historical behavior sets. That is, the same clustering algorithm is used to determine whether the embedded features of the set of behaviors to be detected can be classified into any category in the above clustering results. If the embedded features of the set of behaviors to be detected are classified into the abnormal behavior category, or if the embedded features of the set of behaviors to be detected do not belong to any category, then it is determined that the set of behaviors to be detected is abnormal.

[0107] In another optional embodiment, the determination of whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors, as described in S204, may specifically include:

[0108] An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors.

[0109] Based on the error between the output result and the embedded features of the set of behaviors to be detected, it is determined whether the set of behaviors to be detected is abnormal.

[0110] In this embodiment, the autoencoder model is an unsupervised neural network model that can learn the implicit features of the input data, which is called encoding. At the same time, the original input data can be reconstructed using the learned new features, which is called decoding.

[0111] In this embodiment, multiple historical behavior sets can be pre-collected. For example, multiple historical behavior sets within a predetermined time period (the predetermined time period can be determined based on the amount of data and resource availability, such as 1-7 days) can be collected. The embedding features of each historical behavior set are obtained using the method described in the above embodiment. The autoencoder model is then trained based on the embedding features of multiple historical behavior sets. Since the number of normal behavior sets is greater than the number of abnormal behavior sets, that is, the number of embedding features of normal behavior sets is greater than the number of embedding features of abnormal behavior sets in the embedding features of multiple historical behavior sets, the autoencoder model is fully trained for normal behavior during training, and the difference between the output result and the embedding features of the input normal behavior sets is small. However, since the number of embedding features of abnormal behavior sets is smaller, the autoencoder model is not fully trained for abnormal behavior, and the difference between the output result and the embedding features of the input abnormal behavior sets is large.

[0112] After obtaining the embedded features of the set of behaviors to be detected, they are input into the trained autoencoder model for encoding and decoding. If the error between the output result and the embedded features of the set of behaviors to be detected is small and does not exceed the preset error threshold, the set of behaviors to be detected can be determined as a normal set of behaviors. If the error between the output result and the embedded features of the set of behaviors to be detected is large and exceeds the preset error threshold, the set of behaviors to be detected can be determined as an abnormal set of behaviors.

[0113] In another optional embodiment, the embedding features of the historical behavior set include the embedding features of at least one historical abnormal behavior set. The historical abnormal behavior set can be a set of abnormal behaviors that have been manually confirmed (e.g., intrusion behavior, or other malicious behavior), or it can be a set of abnormal behaviors determined by other methods. The embedding features of the historical abnormal behavior set can be used as index items. Correspondingly, the determination of whether the set of behaviors to be detected is abnormal based on the embedding features of the behavior set to be detected and the pre-acquired embedding features of the historical behavior set in step S204 can specifically include:

[0114] Obtain the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors; determine whether the set of behaviors to be detected is abnormal based on the similarity.

[0115] In this embodiment, the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors can be calculated. If the similarity exceeds a preset similarity threshold, it indicates that the set of behaviors to be detected is highly similar to the set of historical abnormal behaviors, and an alarm can be issued to confirm that the set of behaviors to be detected is abnormal. The alarm can also provide relevant information about the set of historical abnormal behaviors. In this embodiment, if there are multiple embedded features of historical abnormal behavior sets, and these embedded features are used as index terms, the similarity between the embedded features of the set of behaviors to be detected and the embedded features of each historical abnormal behavior set can be calculated based on the index terms. The maximum similarity can then be determined to be greater than the preset similarity threshold. Optionally, the above process can be implemented using a streaming engine (such as Flink). If the set of abnormal behaviors is a set of malicious behaviors (e.g., a set of intrusion behaviors, or other malicious behavior sets), the method in this embodiment can determine whether the set of behaviors to be detected is a set of malicious behaviors.

[0116] In addition, it can trace back to the set of historical behaviors over a period of time, calculate the similarity between the embedding features of the set of historical behaviors and the embedding features of the set of historical abnormal behaviors, thereby enabling threat hunting and determining whether behaviors with high similarity to the set of historical abnormal behaviors have occurred in the past period of time.

[0117] It should be noted that the above optional embodiments can also be combined without conflict, and the judgment results of multiple embodiments can be integrated to finally confirm whether there is an anomaly in the set of behaviors to be detected, thereby improving accuracy and avoiding false alarms.

[0118] Corresponding to the abnormal behavior detection method in the above embodiments, Figure 7 This is a structural block diagram of an abnormal behavior detection device provided in an embodiment of this disclosure. For ease of explanation, only the parts relevant to the embodiments of this disclosure are shown. (Refer to...) Figure 7 The abnormal behavior detection device 700 includes: a data acquisition unit 701, a tag processing unit 702, a mapping unit 703, and an anomaly recognition unit 704.

[0119] Among them, the acquisition unit 701 is used to acquire a set of behaviors to be detected that belong to the same session within a preset time window;

[0120] The tag processing unit 702 is used to add a tag to each behavior in the set of behaviors to be detected in order to identify the attribute information of each behavior, and to obtain the tag features of the set of behaviors to be detected based on the tags of all behaviors in the set of behaviors to be detected.

[0121] The mapping unit 703 is used to map the label features of the set of behaviors to be detected into embedded features according to a preset embedding feature extraction model.

[0122] The anomaly identification unit 704 is used to determine whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors.

[0123] In one or more embodiments of this disclosure, when the tag processing unit 702 adds a tag to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtains the tag features of the set of behaviors to be detected based on the tags of all behaviors in the set of behaviors to be detected, it is configured to:

[0124] Based on the preset label set, labels are added to multiple target fields of each behavior in the set of behaviors to be detected, so as to obtain the label corresponding to each behavior.

[0125] Obtain the number of times each tag in the preset tag set appears in the tags of each behavior in the set of behaviors to be detected;

[0126] The label features of the set of behaviors to be detected are constructed based on the number of times each label appears in the preset label set.

[0127] In one or more embodiments of this disclosure, when the tag processing unit 702 constructs the tag features of the set of behaviors to be detected based on the frequency of occurrence of each tag in the preset tag set, it is used to:

[0128] The frequency of each tag in the preset tag set is sorted according to the preset tag order to obtain the first sequence;

[0129] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as the label feature of the set of behaviors to be detected.

[0130] In one or more embodiments of this disclosure, when the anomaly identification unit 704 determines whether the set of behaviors to be detected is abnormal based on the embedding features of the set of behaviors to be detected and the embedding features of a pre-acquired set of historical behaviors, it is used to:

[0131] For the embedding features of the set of behaviors to be detected, incremental clustering is performed based on the clustering results of the embedding features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedding features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold.

[0132] If the embedded features of the set of behaviors to be detected are added to the abnormal behavior category, or if the embedded features of the set of behaviors to be detected do not belong to any category, then it is determined that the set of behaviors to be detected is abnormal.

[0133] In one or more embodiments of this disclosure, when the anomaly identification unit 704 determines whether the set of behaviors to be detected is abnormal based on the embedding features of the set of behaviors to be detected and the embedding features of a pre-acquired set of historical behaviors, it is used to:

[0134] An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors.

[0135] Based on the error between the output result and the embedded features of the set of behaviors to be detected, it is determined whether the set of behaviors to be detected is abnormal.

[0136] In one or more embodiments of this disclosure, the embedding features of the historical behavior set include the embedding features of at least one historical abnormal behavior set; when the anomaly identification unit 704 determines whether the behavior set to be detected is abnormal based on the embedding features of the behavior set to be detected and the pre-acquired embedding features of the historical behavior set, it is used to:

[0137] Obtain the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0138] The similarity score is used to determine whether the set of behaviors to be detected is abnormal.

[0139] In one or more embodiments of this disclosure, the preset tag set includes a subset of tags corresponding to different target fields; correspondingly, when the tag processing unit 702 adds tags to multiple target fields in each behavior in the set of behaviors to be detected according to the preset tag set, it is used to:

[0140] According to the preset matching rules, any target field of any behavior is matched with the tag subset corresponding to the target field to determine the target tag corresponding to the target field.

[0141] In one or more embodiments of this disclosure, the target field includes one or more of the following: program name field, source IP field, destination IP field, port field, file path field, and file name field.

[0142] In one or more embodiments of this disclosure, the tag processing unit 702 is further configured to:

[0143] Obtain multiple historical behavior data entries and extract the program name field from the historical behavior data;

[0144] The tags corresponding to each program name field are obtained using a pre-defined language model, and a subset of tags corresponding to the program name field is constructed.

[0145] In one or more embodiments of this disclosure, the embedding feature extraction model is trained through the following process:

[0146] Obtain multiple sets of historical behaviors of different categories, and obtain the label features of each set of historical behaviors. Use the label features of multiple sets of historical behaviors as training data.

[0147] The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. Based on the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is backpropagated to adjust the model parameters and finally obtain the trained embedding feature extraction model.

[0148] In one or more embodiments of this disclosure, the embedded feature extraction model employs an encoder from the Transformer model.

[0149] The abnormal behavior detection device provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again in this embodiment.

[0150] refer to Figure 8 The diagram illustrates a structural schematic of an electronic device 800 suitable for implementing embodiments of the present disclosure. The electronic device 800 can be a terminal device or a server. The terminal device can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, personal digital assistants (PDAs), portable Android devices (PADs), portable media players (PMPs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 8 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0151] like Figure 8As shown, the electronic device 800 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device 800. The processing unit 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0152] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows electronic device 800 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 An electronic device 800 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0153] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by a processing device 801, it performs the functions defined in the methods of embodiments of this disclosure.

[0154] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0155] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0156] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods shown in the above embodiments.

[0157] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0158] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0159] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a unit does not necessarily limit the unit itself; for example, the first acquisition unit can also be described as "a unit that acquires at least two Internet Protocol addresses".

[0160] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0161] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0162] In a first aspect, according to one or more embodiments of this disclosure, an abnormal behavior detection method is provided, comprising:

[0163] Collect the set of behaviors to be detected that belong to the same session within a preset time window;

[0164] A label is added to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and the label features of the set of behaviors to be detected are obtained based on the labels of all behaviors in the set of behaviors to be detected.

[0165] According to the preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped to embedding features;

[0166] Based on the embedding features of the set of behaviors to be detected and the embedding features of the pre-acquired set of historical behaviors, it is determined whether the set of behaviors to be detected is abnormal.

[0167] According to one or more embodiments of this disclosure, the step of adding a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtaining the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected, includes:

[0168] Based on the preset label set, labels are added to multiple target fields of each behavior in the set of behaviors to be detected, so as to obtain the label corresponding to each behavior.

[0169] Obtain the number of times each tag in the preset tag set appears in the tags of each behavior in the set of behaviors to be detected;

[0170] The label features of the set of behaviors to be detected are constructed based on the number of times each label appears in the preset label set.

[0171] According to one or more embodiments of this disclosure, constructing the label features of the set of behaviors to be detected based on the frequency of occurrence of each label in the preset label set includes:

[0172] The frequency of each tag in the preset tag set is sorted according to the preset tag order to obtain the first sequence;

[0173] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as the label feature of the set of behaviors to be detected.

[0174] According to one or more embodiments of this disclosure, determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of a pre-acquired set of historical behaviors includes:

[0175] For the embedding features of the set of behaviors to be detected, incremental clustering is performed based on the clustering results of the embedding features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedding features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold.

[0176] If the embedded features of the set of behaviors to be detected are added to the abnormal behavior category, or if the embedded features of the set of behaviors to be detected do not belong to any category, then it is determined that the set of behaviors to be detected is abnormal.

[0177] According to one or more embodiments of this disclosure, determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of a pre-acquired set of historical behaviors includes:

[0178] An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors.

[0179] Based on the error between the output result and the embedded features of the set of behaviors to be detected, it is determined whether the set of behaviors to be detected is abnormal.

[0180] According to one or more embodiments of this disclosure, the embedding features of the historical behavior set include the embedding features of at least one historical abnormal behavior set; the step of determining whether the behavior set to be detected is abnormal based on the embedding features of the behavior set to be detected and the pre-acquired embedding features of the historical behavior set includes:

[0181] Obtain the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0182] The similarity score is used to determine whether the set of behaviors to be detected is abnormal.

[0183] According to one or more embodiments of this disclosure, the preset label set includes a subset of labels corresponding to different target fields; correspondingly, the step of adding labels to multiple target fields in each behavior in the set of behaviors to be detected according to the preset label set includes:

[0184] According to the preset matching rules, any target field of any behavior is matched with the tag subset corresponding to the target field to determine the target tag corresponding to the target field.

[0185] According to one or more embodiments of this disclosure, the target field includes one or more of the following: program name field, source IP field, destination IP field, port field, file path field, and file name field.

[0186] According to one or more embodiments of this disclosure, the method further includes:

[0187] Obtain multiple historical behavior data entries and extract the program name field from the historical behavior data;

[0188] The tags corresponding to each program name field are obtained using a pre-defined language model, and a subset of tags corresponding to the program name field is constructed.

[0189] According to one or more embodiments of this disclosure, the embedding feature extraction model is trained through the following process:

[0190] Obtain multiple sets of historical behaviors of different categories, and obtain the label features of each set of historical behaviors. Use the label features of multiple sets of historical behaviors as training data.

[0191] The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. Based on the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is backpropagated to adjust the model parameters and finally obtain the trained embedding feature extraction model.

[0192] According to one or more embodiments of this disclosure, the embedded feature extraction model employs an encoder in the Transformer model.

[0193] Secondly, according to one or more embodiments of this disclosure, an abnormal behavior detection device is provided, comprising:

[0194] The acquisition unit is used to acquire a set of behaviors to be detected that belong to the same session within a preset time window;

[0195] The tag processing unit is used to add tags to each behavior in the set of behaviors to be detected in order to identify the attribute information of each behavior, and to obtain the tag features of the set of behaviors to be detected based on the tags of all behaviors in the set of behaviors to be detected.

[0196] The mapping unit is used to map the label features of the set of behaviors to be detected into embedded features according to a preset embedding feature extraction model.

[0197] An anomaly identification unit is used to determine whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors.

[0198] According to one or more embodiments of this disclosure, when the tag processing unit adds a tag to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtains the tag features of the set of behaviors to be detected based on the tags of all behaviors in the set of behaviors to be detected, it is configured to:

[0199] Based on the preset label set, labels are added to multiple target fields of each behavior in the set of behaviors to be detected, so as to obtain the label corresponding to each behavior.

[0200] Obtain the number of times each tag in the preset tag set appears in the tags of each behavior in the set of behaviors to be detected;

[0201] The label features of the set of behaviors to be detected are constructed based on the number of times each label appears in the preset label set.

[0202] According to one or more embodiments of this disclosure, when the tag processing unit constructs the tag features of the set of behaviors to be detected based on the frequency of occurrence of each tag in the preset tag set, it is configured to:

[0203] The frequency of each tag in the preset tag set is sorted according to the preset tag order to obtain the first sequence;

[0204] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as the label feature of the set of behaviors to be detected.

[0205] According to one or more embodiments of this disclosure, when the anomaly identification unit determines whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of a pre-acquired set of historical behaviors, it is configured to:

[0206] For the embedding features of the set of behaviors to be detected, incremental clustering is performed based on the clustering results of the embedding features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedding features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold.

[0207] If the embedded features of the set of behaviors to be detected are added to the abnormal behavior category, or if the embedded features of the set of behaviors to be detected do not belong to any category, then it is determined that the set of behaviors to be detected is abnormal.

[0208] According to one or more embodiments of this disclosure, when the anomaly identification unit determines whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of a pre-acquired set of historical behaviors, it is configured to:

[0209] An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors.

[0210] Based on the error between the output result and the embedded features of the set of behaviors to be detected, it is determined whether the set of behaviors to be detected is abnormal.

[0211] According to one or more embodiments of this disclosure, the embedding features of the historical behavior set include the embedding features of at least one historical abnormal behavior set; when the anomaly identification unit determines whether the behavior set to be detected is abnormal based on the embedding features of the behavior set to be detected and the pre-acquired embedding features of the historical behavior set, it is configured to:

[0212] Obtain the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0213] The similarity score is used to determine whether the set of behaviors to be detected is abnormal.

[0214] According to one or more embodiments of this disclosure, the preset tag set includes a subset of tags corresponding to different target fields; correspondingly, when the tag processing unit adds tags to multiple target fields in each behavior of the set of behaviors to be detected according to the preset tag set, it is used to:

[0215] According to the preset matching rules, any target field of any behavior is matched with the tag subset corresponding to the target field to determine the target tag corresponding to the target field.

[0216] According to one or more embodiments of this disclosure, the target field includes one or more of the following: program name field, source IP field, destination IP field, port field, file path field, and file name field.

[0217] According to one or more embodiments of this disclosure, the tag processing unit is further configured to:

[0218] Obtain multiple historical behavior data entries and extract the program name field from the historical behavior data;

[0219] The tags corresponding to each program name field are obtained using a pre-defined language model, and a subset of tags corresponding to the program name field is constructed.

[0220] According to one or more embodiments of this disclosure, the embedding feature extraction model is trained through the following process:

[0221] Obtain multiple sets of historical behaviors of different categories, and obtain the label features of each set of historical behaviors. Use the label features of multiple sets of historical behaviors as training data.

[0222] The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. Based on the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is backpropagated to adjust the model parameters and finally obtain the trained embedding feature extraction model.

[0223] According to one or more embodiments of this disclosure, the embedded feature extraction model employs an encoder in the Transformer model.

[0224] Thirdly, according to one or more embodiments of the present disclosure, an electronic device is provided, comprising: at least one processor and a memory;

[0225] The memory stores computer-executed instructions;

[0226] The at least one processor executes the computer execution instructions stored in the memory, causing the at least one processor to perform the abnormal behavior detection method as described in the first aspect and various possible designs of the first aspect.

[0227] Fourthly, according to one or more embodiments of this disclosure, a computer-readable storage medium is provided, wherein computer-executable instructions are stored therein, and when a processor executes the computer-executable instructions, the abnormal behavior detection method described in the first aspect and various possible designs of the first aspect is implemented.

[0228] Fifthly, according to one or more embodiments of this disclosure, a computer program product is provided, including computer execution instructions that, when executed by a processor, implement the abnormal behavior detection method as described in the first aspect and various possible designs of the first aspect.

[0229] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0230] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0231] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A model-based abnormal behavior detection method for identifying business risks, characterized in that, include: Collect host data belonging to the same session within a preset time window to form a set of behaviors to be detected. The host data includes at least one of system calls, file creation, file reading and writing, command execution, and network connection. Each behavior in the set of behaviors to be detected is labeled to identify the attribute information of each behavior, and the label features of the set of behaviors to be detected are obtained according to the labels of all behaviors in the set of behaviors to be detected. The label features are a second sequence, which is obtained by mapping each value in the first sequence according to a preset mapping relationship. The first sequence is obtained by sorting the number of times each label in the preset label set appears in the labels of each behavior in the set of behaviors to be detected according to the preset label order. According to the preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped to embedding features; Based on the embedding features of the set of behaviors to be detected and the embedding features of the pre-acquired set of historical behaviors, it is determined whether the set of behaviors to be detected is abnormal. The embedding features of the set of historical behaviors include the embedding features of at least one set of historical abnormal behaviors. The step of determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors includes: Obtain the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors; The similarity score is used to determine whether the set of behaviors to be detected is abnormal.

2. The method according to claim 1, characterized in that, The step of adding a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtaining the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected, includes: Based on the preset label set, labels are added to multiple target fields of each behavior in the set of behaviors to be detected, so as to obtain the label corresponding to each behavior. Obtain the number of times each tag in the preset tag set appears in the tags of each behavior in the set of behaviors to be detected; The label features of the set of behaviors to be detected are constructed based on the number of times each label appears in the preset label set.

3. The method according to any one of claims 1-2, characterized in that, The step of determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors further includes: For the embedding features of the set of behaviors to be detected, incremental clustering is performed based on the clustering results of the embedding features of the historical behavior set using a preset clustering model; wherein the clustering results of the embedding features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold. If the embedded features of the set of behaviors to be detected are added to the abnormal behavior category, or if the embedded features of the set of behaviors to be detected do not belong to any category, then it is determined that the set of behaviors to be detected is abnormal.

4. The method according to any one of claims 1-2, characterized in that, The step of determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the pre-acquired set of historical behaviors further includes: An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors. Based on the error between the output result and the embedded features of the set of behaviors to be detected, it is determined whether the set of behaviors to be detected is abnormal.

5. The method according to claim 2, characterized in that, The preset label set includes a subset of labels corresponding to different target fields; correspondingly, the step of adding labels to multiple target fields in each behavior in the set of behaviors to be detected according to the preset label set includes: According to the preset matching rules, any target field of any behavior is matched with the tag subset corresponding to the target field to determine the target tag corresponding to the target field.

6. The method according to claim 5, characterized in that, The target fields include one or more of the following: program name field, source IP field, destination IP field, port field, file path field, and file name field.

7. The method according to claim 6, characterized in that, The method further includes: Obtain multiple historical behavior data entries and extract the program name field from the historical behavior data; The tags corresponding to each program name field are obtained using a pre-defined language model, and a subset of tags corresponding to the program name field is constructed.

8. The method according to claim 1, characterized in that, The embedded feature extraction model is trained through the following process: Obtain multiple sets of historical behaviors of different categories, and obtain the label features of each set of historical behaviors. Use the label features of multiple sets of historical behaviors as training data. The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. Based on the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is backpropagated to adjust the model parameters and finally obtain the trained embedding feature extraction model.

9. The method according to claim 1 or 8, characterized in that, The embedded feature extraction model uses the encoder in the Transformer model.

10. A model-based abnormal behavior detection device for identifying business risks, characterized in that, include: The acquisition unit is used to acquire host data belonging to the same session within a preset time window to form a set of behaviors to be detected. The host data includes at least one of system calls, file creation, file reading and writing, command execution, and network connection. A tag processing unit is used to add tags to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and to obtain the tag features of the set of behaviors to be detected based on the tags of all behaviors in the set of behaviors to be detected. The tag features are a second sequence, which is obtained by mapping each value in the first sequence according to a preset mapping relationship. The first sequence is obtained by sorting the number of times each tag in the preset tag set appears in the tags of each behavior in the set of behaviors to be detected according to the preset tag order. The mapping unit is used to map the label features of the set of behaviors to be detected into embedded features according to a preset embedding feature extraction model. An anomaly identification unit is used to determine whether the set of behaviors to be detected is abnormal based on the embedding features of the set of behaviors to be detected and the embedding features of a pre-acquired set of historical behaviors. The embedding features of the set of historical behaviors include the embedding features of at least one set of historical abnormal behaviors. The anomaly identification unit is specifically used to obtain the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors; and to determine whether the set of behaviors to be detected is abnormal based on the similarity.

11. An electronic device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method as described in any one of claims 1-9.

13. A computer program product, characterized in that, Includes computer execution instructions, which, when executed by a processor, implement the method as described in any one of claims 1-9.

Images