Abnormal behavior detection method and device, equipment, medium and product

Abstract

The invention discloses an abnormal behavior detection method and device, equipment, a medium and a product, and is applied to the field of data security. According to the method, under the condition that a first actual behavior is determined to be an abnormal behavior, a corresponding first sliding window is determined based on a next second actual behavior. And then, inputting a second behavior sequence segment in the first sliding window into a pre-constructed reconstruction network to perform anomaly detection, and under the condition that the second behavior sequence segment is abnormal, sliding the first sliding window backwards for a behavior on the historical behavior sequence, and returning to the reconstruction detection step until the second behavior sequence segment is normal. According to the scheme, the abnormal behavior after the first actual behavior is efficiently found out by reconstructing the network, the actual abnormal part can be accurately positioned from the whole historical behavior sequence, and the hidden abnormal behavior can be detected by processing the second behavior sequence segment and having rich context and semantic information.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to a method, device, equipment, medium and product for detecting abnormal behavior. Background Art

[0002] In recent years, database technology has developed rapidly, and various types of data can now be efficiently processed and managed through databases. At the same time, databases have been applied to more and more fields, and both academic and commercial fields regard them as powerful tools. However, as more important data is stored in databases, attacks on databases are becoming more and more intense, so the detection of abnormal database behavior has become a current research hotspot.

[0003] At present, anomaly detection is mainly performed based on statistical methods. When certain data is frequently accessed and exceeds the threshold, it is determined that abnormal behavior exists. However, the granularity of this abnormal behavior determination standard is coarse, and it can only regard the entire behavior sequence as normal or abnormal, but cannot locate the specific behavior. Summary of the invention

[0004] The embodiments of the present application provide a method, device, equipment, medium and product for detecting abnormal behavior, which can accurately locate abnormal behavior.

[0005] On the one hand, an embodiment of the present application provides a method for detecting abnormal behavior, including:

[0006] Acquire a historical behavior sequence of accessing a target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and the behaviors in the first behavior sequence segment are all normal behaviors;

[0007] In the case where it is determined that the first actual behavior is an abnormal behavior, obtaining the next actual behavior of the first actual behavior to obtain a second actual behavior;

[0008] According to the second actual behavior, a corresponding first sliding window is determined; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and subsequent N consecutive behaviors; N is a positive integer;

[0009] Inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection;

[0010] In the case where the second behavior sequence segment is an abnormal behavior sequence segment, sliding the first sliding window backward by one behavior on the historical behavior sequence to obtain an updated first sliding window, and returning to the step of inputting the second behavior sequence segment in the first sliding window into the pre-constructed reconstruction network for abnormality detection until the second behavior sequence segment is a normal behavior sequence segment;

[0011] The behavior between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence is determined as an abnormal behavior.

[0012] On the other hand, the step of inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection includes:

[0013] Inputting the second behavior sequence segment into the reconstruction network to obtain a reconstructed behavior sequence segment;

[0014] determining a reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment;

[0015] When the reconstruction error value is greater than a reconstruction threshold, the second behavior sequence segment is determined to be an abnormal behavior sequence segment.

[0016] On the other hand, after obtaining the historical behavior sequence of accessing the target database, the method further includes:

[0017] Performing sentence vectorization on each behavior in the historical behavior sequence to obtain a vectorized representation;

[0018] The step of inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection includes:

[0019] Inputting the vectorized representation corresponding to each behavior in the second behavior sequence segment into the reconstruction network for anomaly detection;

[0020] The step of inputting the first behavior sequence segment into a pre-trained behavior prediction time series model, predicting the next behavior of the first behavior sequence segment, and obtaining a first predicted behavior includes:

[0021] The vectorized representation corresponding to each behavior in the first behavior sequence segment is input into a pre-trained behavior prediction time series model to obtain the first predicted behavior.

[0022] On the other hand, the performing of sentence vectorization on each behavior in the historical behavior sequence to obtain a vectorized representation includes:

[0023] Convert each word in each action statement in the historical action sequence into a word vector;

[0024] Determining the term frequency and inverse document frequency of each of the words;

[0025] Determining a target weight value for each of the words based on the word frequency and the inverse document frequency;

[0026] Based on the word vector and the target weight value, a corresponding vectorized representation is determined.

[0027] On the other hand, determining the corresponding vectorized representation based on the word vector and the target weight value includes:

[0028] For each of the words, multiply the word vector by the target weight value corresponding to the word to obtain a target vector;

[0029] The target vectors are weighted averaged to obtain a vectorized representation.

[0030] On the other hand, before inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection, the method further includes:

[0031] Get a sample of normal behavior sequences;

[0032] Extracting characteristic information of the normal behavior sequence sample;

[0033] Based on the feature information, the reconstruction network is trained.

[0034] On the other hand, in the case where the first actual behavior is determined to be an abnormal behavior, before obtaining the next actual behavior of the first actual behavior and obtaining the second actual behavior, the method further includes:

[0035] Inputting the first behavior sequence segment into a pre-trained behavior prediction time series model, predicting the next behavior of the first behavior sequence segment, and obtaining a first predicted behavior;

[0036] Acquire a collection of all possible next behaviors of the first behavior sequence segment; the collection of behaviors includes the first actual behavior;

[0037] Respectively obtaining similarities between the first predicted behavior and each behavior in the behavior collection;

[0038] sorting the behaviors in the behavior collection based on the order of similarity with the first predicted behavior from greatest to least;

[0039] In the case where the first actual behavior does not belong to the first M behaviors in the sorting, it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition; M is a positive integer;

[0040] When the similarity between the first predicted behavior and the first actual behavior does not satisfy the similarity condition, the first actual behavior is determined to be an abnormal behavior.

[0041] On the other hand, before inputting the first behavior sequence segment into a pre-trained behavior prediction time series model and predicting the next behavior of the first behavior sequence segment to obtain a first predicted behavior, the method further includes:

[0042] Constructing an initial behavior prediction time series model;

[0043] Acquire a training sample; the training sample includes a behavior sequence segment sample and the next third actual behavior of the behavior sequence segment sample;

[0044] Inputting the behavior sequence segment sample into the initial behavior prediction time series model, predicting the next behavior of the behavior sequence segment sample, and obtaining a second predicted behavior;

[0045] determining a loss function value between the second predicted behavior and the third actual behavior;

[0046] When the loss function value does not satisfy the iteration stop condition, the parameters of the initial behavior prediction time series model are adjusted, the training sample is updated, and the step of inputting the behavior sequence segment sample into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample to obtain a second predicted behavior is returned;

[0047] When the loss function value satisfies the iteration stopping condition, the initial behavior prediction time series model is determined as the behavior prediction time series model.

[0048] On the other hand, an embodiment of the present application provides a device for detecting abnormal behavior, the device comprising:

[0049] A first acquisition module is used to acquire a historical behavior sequence for accessing a target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and the behaviors in the first behavior sequence segment are all normal behaviors;

[0050] A second acquisition module is used to acquire the next actual behavior of the first actual behavior to obtain a second actual behavior when the first actual behavior is determined to be an abnormal behavior;

[0051] A first determining module is used to determine a corresponding first sliding window according to the second actual behavior; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and subsequent N consecutive behaviors; N is a positive integer;

[0052] An input module, used for inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection;

[0053] a sliding module, configured to, when the second behavior sequence segment is an abnormal behavior sequence segment, slide the first sliding window backward by one behavior on the historical behavior sequence to obtain an updated first sliding window, and return to the step of inputting the second behavior sequence segment in the first sliding window into a pre-constructed reconstruction network for abnormality detection until the second behavior sequence segment is a normal behavior sequence segment;

[0054] The second determination module is used to determine the behavior between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence as abnormal behavior.

[0055] In yet another aspect, an embodiment of the present application provides a device for detecting abnormal behavior, the device comprising: a processor and a memory storing computer program instructions;

[0056] When the processor executes the computer program instructions, the abnormal behavior detection method described above is implemented.

[0057] On the other hand, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the abnormal behavior detection method described above is implemented.

[0058] On the other hand, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the abnormal behavior detection method as described above.

[0059] The embodiment of the present application provides a method for detecting abnormal behavior. First, a historical behavior sequence of accessing a target database is obtained. When the first actual behavior is determined to be an abnormal behavior, the corresponding first sliding window is determined based on the next second actual behavior. Then, the second behavior sequence segment in the first sliding window is input into a pre-constructed reconstruction network for anomaly detection. When the second behavior sequence segment is abnormal, the first sliding window is slid backward one behavior on the historical behavior sequence, and returned to the reconstruction network for anomaly detection until the second behavior sequence segment is normal. It can be seen that after determining the abnormal first actual behavior, this scheme analyzes the second behavior sequence segment through the reconstruction network. The sequence segment has rich context and semantic information, and can efficiently detect hidden abnormal behaviors, thereby accurately locating the actual abnormal part from the entire historical behavior sequence. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0061] Figure 1 A schematic diagram showing a flow chart of a method for detecting abnormal behavior provided by an embodiment of the present application;

[0062] Figure 2 A schematic diagram of a specific abnormal behavior detection process provided by an embodiment of the present application is shown;

[0063] Figure 3 A schematic diagram of a detection process based on a sliding window and a reconstructed network algorithm provided by an embodiment of the present application is shown;

[0064] Figure 4 A flowchart of behavior statement vectorization provided in an embodiment of the present application;

[0065] Figure 5 This is the architecture diagram of the fine-grained detection system for hidden abnormal behavior in databases;

[0066] Figure 6 A schematic diagram showing the structure of an abnormal behavior detection device provided in an embodiment of the present application is shown;

[0067] Figure 7 A schematic diagram of the hardware structure of an abnormal behavior detection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0068] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0069] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "include..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0070] The granularity of the judgment criteria of traditional solutions is coarse. When an anomaly is detected, the entire behavior sequence is considered abnormal, and the single behavior statement where the anomaly occurs cannot be determined. However, most behaviors in long sequence logs are normal, and only a few behaviors are abnormal. The current anomaly detection judgment method is difficult to accurately locate specific abnormal behaviors, which affects the anomaly report and the analysis of the cause of the anomaly. In addition, because the traditional solution handles the behavior statement improperly and only analyzes a single behavior, it is difficult to detect hidden abnormal access behaviors.

[0071] In order to solve the problems of the traditional solution, the embodiments of the present application provide a method, device, equipment, medium and product for detecting abnormal behavior. The following first introduces the abnormal behavior detection method provided by the embodiments of the present application. Figure 1 FIG. 1 is a flow chart showing a method for detecting abnormal behavior provided by an embodiment of the present application. Figure 1 As shown, the method includes the following steps: S101 to S107.

[0072] S101: Acquire a historical behavior sequence of accessing a target database.

[0073] The purpose of this application is to detect abnormal access behaviors to the database and realize the security protection of important data in the database. Therefore, after the behavior against the database occurs, the embodiment of this application will detect the entire behavior sequence. Therefore, it is necessary to first obtain the historical behavior sequence of accessing the target database, and the historical behavior sequence includes the first behavior sequence segment and the first actual behavior. The first actual behavior is the next actual behavior of the first behavior sequence segment, and the behaviors in the first behavior sequence segment are all normal behaviors.

[0074] S102: When it is determined that the first actual behavior is an abnormal behavior, the next actual behavior of the first actual behavior is obtained to obtain a second actual behavior.

[0075] It can be seen that this step needs to determine whether the first actual behavior is an abnormal behavior. The specific determination method is not limited here and is selected according to the actual situation. As mentioned above, the behaviors in the first behavior sequence segment are all normal behaviors. Therefore, the first behavior sequence segment can be used to determine whether the first actual behavior is abnormal.

[0076] In this embodiment, the first behavior sequence segment is generally of fixed length, and the next behavior of the first behavior sequence segment can be predicted based on each normal behavior in the first behavior sequence segment to obtain a first predicted behavior. Then, based on the similarity between the first predicted behavior and the first actual behavior, it is determined whether the first actual behavior is abnormal.

[0077] If the first actual behavior is abnormal, and because the first behavior sequence is all normal behavior, then within a certain range, the first actual behavior is the first abnormal behavior. Abnormal behaviors often occur continuously, so the next actual behavior of the first actual behavior (i.e., the second actual behavior) can be analyzed to determine this continuous abnormal behavior.

[0078] S103: Determine a corresponding first sliding window according to the second actual behavior.

[0079] As mentioned above, the first predicted behavior can be obtained based on each normal behavior in the first behavior sequence segment, and then the first actual behavior can be judged whether it is abnormal based on the similarity between the first predicted behavior and the first actual behavior. However, because the first actual behavior is abnormal, that is, there is an abnormal behavior before the second actual behavior, it is difficult to predict, and it is impossible to judge whether the second actual behavior is abnormal by comparing the similarity between the actual behavior and the predicted behavior.

[0080] Because it is impossible to use a scheme of comparing similarities to determine whether the behaviors after the first actual behavior are abnormal, this embodiment proposes a scheme of reconstructing and analyzing the sequence segment, which can determine whether there are abnormal behaviors in the sequence segment, thereby finding the behaviors that are abnormal after the abnormal first actual behavior.

[0081] The first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and N consecutive behaviors thereafter; N is a positive integer, and the specific size is set according to actual needs.

[0082] S104: Input the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection.

[0083] The present application adopts a scheme of reconstructing and analyzing the second behavior sequence segment, so as to quickly and accurately determine whether there is an anomaly in the second behavior sequence segment in the first sliding window. The first sliding window is generally of fixed length, and the second behavior sequence segment is inside. When the first sliding window slides, the second behavior sequence segment inside will change accordingly. Each time the second behavior sequence segment is slid, it is necessary to input the second behavior sequence segment into the pre-built reconstruction network for anomaly detection.

[0084] Generally, the reconstruction network is trained based on normal behavior statements. After the second behavior sequence segment is input, the reconstruction network will generate a reconstructed behavior sequence segment and calculate the reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment. When the reconstruction error value is greater than the set reconstruction threshold, the second behavior sequence segment can be judged to be abnormal.

[0085] The reconstruction error value refers to the difference between the original data and the data after some processing (such as compression, dimensionality reduction or reconstruction). This difference can be measured by calculating the similarity or distance between the two, and is usually used to evaluate the performance of data processing algorithms. The smaller the reconstruction error value, the smaller the difference between the processed data (reconstructed behavior sequence segment) and the original data (second behavior sequence segment).

[0086] S105: Determine whether the second behavior sequence segment is an abnormal behavior sequence segment, if so, proceed to S106, if not, proceed to S107.

[0087] In the above S103, it is mentioned that the corresponding first sliding window is determined according to the second actual behavior, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and the subsequent N consecutive behaviors. That is, the first second behavior sequence segment is obtained at this time, and the second behavior sequence segment of this time is first input into the pre-constructed reconstruction network for anomaly detection to determine whether the second behavior sequence segment of this time is an abnormal behavior sequence segment.

[0088] S106: Slide the first sliding window backward by one behavior on the historical behavior sequence to obtain an updated first sliding window, and return to S104.

[0089] If the second behavior sequence segment is an abnormal behavior sequence segment, the first sliding window is slid backward by one behavior on the historical behavior sequence to obtain an updated first sliding window, that is, a new second behavior sequence segment. Then, the process returns to S104, and the new second behavior sequence segment is input into the reconstruction network again for anomaly detection to determine whether the second behavior sequence segment is an abnormal behavior sequence segment. If the second behavior sequence segment is still an abnormal behavior sequence segment, the above steps are repeated.

[0090] S107: Determine the behavior between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence as an abnormal behavior.

[0091] If the second behavior sequence segment is a normal behavior sequence segment, it indicates that each abnormal behavior adjacent to the first actual behavior has been found, and there is no need to continue the reconstruction detection.

[0092] Finally, the behaviors between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence are determined as abnormal behaviors. It should be noted that these abnormal behaviors do not include the behaviors in the first behavior sequence segment and the second behavior sequence segment.

[0093] The embodiment of the present application proposes a method for detecting abnormal database access behavior based on a sliding window and a reconstruction network algorithm, which improves the detection accuracy of abnormal database behavior, realizes fine-grained detection, and can better realize accurate discovery and real-time detection of abnormal database behavior.

[0094] The embodiment of the present application provides a method for detecting abnormal behavior. First, a historical behavior sequence of accessing a target database is obtained. When the first actual behavior is determined to be an abnormal behavior, the corresponding first sliding window is determined based on the next second actual behavior. Then, the second behavior sequence segment in the first sliding window is input into a pre-constructed reconstruction network for anomaly detection. When the second behavior sequence segment is abnormal, the first sliding window is slid backward one behavior on the historical behavior sequence, and returned to the reconstruction network for anomaly detection until the second behavior sequence segment is normal. It can be seen that after determining the abnormal first actual behavior, this scheme analyzes the second behavior sequence segment through the reconstruction network. The sequence segment has rich context and semantic information, and can efficiently detect hidden abnormal behaviors, thereby accurately locating the actual abnormal part from the entire historical behavior sequence.

[0095] In practical applications, the second behavior sequence segment in the first sliding window needs to be input into the pre-built reconstruction network for anomaly detection. Before this, the reconstruction network needs to be built first. The reconstruction network can be trained by the following method: first obtain normal behavior sequence samples, then extract feature information of normal behavior sequence samples; finally, train the reconstruction network based on these feature information.

[0096] Through the above scheme, the reconstruction network can learn the characteristics of normal behavior sequence samples, so as to determine which behavior sequences belong to abnormal behavior sequences. The reconstruction network is specifically used to reconstruct the input second behavior sequence segment to obtain a reconstructed behavior sequence segment; because the reconstruction network is constructed based on normal behavior sequence samples, if the second behavior sequence segment is a normal behavior sequence segment, the reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment will be smaller.

[0097] The embodiment of the present application trains the reconstruction network through the feature information of normal behavior sequence samples, ensuring that the reconstruction network can obtain a larger reconstruction error value when an abnormal behavior sequence is input, thereby accurately judging whether the target behavior sequence is an abnormal behavior sequence.

[0098] The above embodiment constructs a reconstruction network based on normal behavior sequence samples, so that the reconstruction network can distinguish normal behavior sequences from abnormal behavior sequences. Then, the second behavior sequence segment in the first sliding window is input into the pre-constructed reconstruction network for abnormality detection, which specifically includes:

[0099] The second behavior sequence segment is input into the reconstruction network to obtain the reconstructed behavior sequence segment, and then the reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment is determined. When the reconstruction error value is not greater than the reconstruction threshold, the second behavior sequence segment is determined to be a normal behavior sequence segment; when the reconstruction error value is greater than the reconstruction threshold, the second behavior sequence segment is determined to be an abnormal behavior sequence segment. The specific size of the reconstruction threshold here is set according to the actual situation.

[0100] The embodiment of the present application calculates the reconstruction error value between the input target behavior sequence and the reconstructed output behavior sequence through the reconstruction network. According to the size of the reconstruction error value, it is possible to accurately determine whether the target behavior sequence is an abnormal behavior sequence.

[0101] In the above embodiments, it is mentioned that there are processes such as training a prediction timing network, training a reconstruction network, predicting the next behavior through the prediction timing network, and detecting anomalies in the behavior sequence through the reconstruction network. In these processes, it is necessary to first obtain and use the behavior statement; to facilitate the use of subsequent behavior statements, the behavior statement can be converted into a vector.

[0102] Therefore, after obtaining the historical behavior sequence of accessing the target database, the embodiment of the present application performs statement vectorization on each behavior in the historical behavior sequence to obtain a vectorized representation.

[0103] Correspondingly, the second behavior sequence segment in the first sliding window is input into the pre-constructed reconstruction network for anomaly detection, specifically including: inputting the vectorized representation corresponding to each behavior in the second behavior sequence segment into the reconstruction network for anomaly detection. And the first behavior sequence segment is input into the pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment to obtain the first predicted behavior, specifically including: inputting the vectorized representation corresponding to each behavior in the first behavior sequence segment into the pre-trained behavior prediction time series model to obtain the first predicted behavior.

[0104] In the embodiment of the present application, before inputting the behavior sequence into the prediction time series model and reconstructing the network, each behavior is first vectorized to facilitate subsequent processing.

[0105] This embodiment provides a specific vectorization method to perform sentence vectorization on each behavior in the historical behavior sequence to obtain a vectorized representation. The specific process includes: converting each word in each behavior sentence in the historical behavior sequence into a word vector; then determining the term frequency (TF) and inverse document frequency (IDF value) of each word; based on TF and IDF, determining the target weight value (i.e. TF-IDF value) of each word; based on the word vector and TF-IDF value, determining the corresponding vectorized representation.

[0106] Words can be extracted by extracting behavior sentence templates, and the extracted words are put into the Word2Vec model for training, and finally the word vector of each word is obtained from the trained Word2Vec model.

[0107] The embodiment of the present application proposes a specific vectorization scheme, which extracts words from behavioral statements, converts the words into word vectors in combination with context information, and determines the target weight value through word frequency and inverse document frequency, and then quickly and accurately obtains a vectorized representation based on the word vector and the target weight value.

[0108] In practical applications, when determining the corresponding vectorized representation based on the word vector and the target weight value, the word vector can be multiplied by the target weight value of the corresponding word for each word to obtain the target vector; finally, the target vector is weighted averaged to obtain the vectorized representation.

[0109] The embodiment of the present application uses weighted averaging to obtain a vectorized representation with rich contextual information, thereby improving the accuracy of anomaly detection and being able to detect hidden abnormal behaviors.

[0110] Figure 2 FIG. 2 shows a schematic diagram of a specific abnormal behavior detection process provided by an embodiment of the present application. Figure 2As shown, a specific implementation process is proposed, in which the database access log is input into the preprocessing model 201, and then vectorized by Word2Vec technology and TF-IDF technology after being mapped to the template. Then, the prediction time series model and the reconstruction network are constructed and trained to obtain the anomaly detection model 202. The model training and the actual detection process of abnormal behavior specifically include steps 1 to 13, steps 1 to 8 are the model construction and training process, and steps 9 to 13 are the actual detection process of abnormal behavior.

[0111] Step 1: Data collection: Collect normal behavior sequences in the database offline to form a normal behavior sequence set, which can be used as training samples and normal behavior sequence samples in the above embodiments.

[0112] Step 2: Data preprocessing: After obtaining the normal behavior sequence, the data set is cleaned and noise removed through feature engineering technology to finally generate a training data set.

[0113] Step 3: Extracting behavior statement templates: For the training data set, each behavior statement is processed through a data cleaning tool (such as the Drain tool) to remove the variable parameters in the behavior statement. Finally, each behavior statement is converted into a template, which is composed of multiple words. In this embodiment of the application, each template is set to map a key value separately. For example, the template "delete from mac where mac=$1" corresponds to k 1 .

[0114] Step 4: Train the word vector model: Put the extracted words into the Word2Vec model for training, and finally obtain the word vector of each word from the trained Word2Vec model.

[0115] Step 5: Calculate the TF-IDF value of each word: Each line of the template is regarded as an article, and the TF-IDF value of each word is calculated.

[0116] Step 6: Behavior statement vectorization: Convert each word in a behavior statement into a word vector, calculate the TF-IDF value of each word, and multiply the word vector of each word by its TF-IDF value. Finally, perform weighted average on these processed vectors to obtain the vectorized representation of each behavior statement.

[0117] Step 7: Prediction time series model training: After converting each behavior statement in the training data set into a corresponding vectorized representation, it is input into the BiLSTM (Directional Long Short-Term Memory) prediction time series model for training. The BiLSTM time series model predicts the next behavior by learning the characteristics of the normal behavior sequence in the training data set. The model will adjust the parameters of the prediction model based on the loss function value generated by its own predicted behavior and the actual behavior, thereby improving the prediction accuracy of the model.

[0118] Step 8: Reconstruction network training: Input the vectorized representation corresponding to each behavior statement in the training data set into the reconstruction network for training. The reconstruction network that has learned the characteristics of normal behavior sequences should calculate a reconstruction error value for normal behavior sequences that is much smaller than the reconstruction error value for abnormal behavior sequences, so that it can be determined which behavior sequences belong to abnormal behavior sequences.

[0119] Step 9: Deploy the model online: After training the detection model (including the prediction time series model and the reconstruction network), deploy the detection model in the online service center to perform online real-time intrusion detection.

[0120] Step 10: Request preprocessing: Use the data preprocessing operations and statement vectorization operations in steps 2 to 6 to process the historical behavior sequence.

[0121] Step 11: Sliding window algorithm to detect abnormal behavior: After the BiLSTM prediction time series model training is completed, anomaly detection will be performed in a sliding window manner, that is, according to the behavior sequence vector (A 1 ...A n ), predict the next behavior and generate the vector K of the first predicted behavior n+1 If the first predicted behavior vector K n+1 With the first actual behavior vector A n+1 If the similarity of does not meet the similarity condition, the first actual behavior is considered to be an abnormal behavior, and the process goes to step 12; otherwise, the second sliding window is slid back by one unit (A 2 ...A n+1 ), and execute step 11 again.

[0122] Step 12: Reconstruct the network to locate the abnormal behavior interval: When abnormal behavior A is detected in step 11 n When A n+1 At the beginning, the reconstruction network anomaly detection is performed on the first sliding window of length L. If the second line is a sequence segment (A n+1 ...A n+L) and the reconstruction error value between the reconstructed behavior sequence segment is higher than the reconstruction threshold, it is considered that there is abnormal behavior in the second behavior sequence segment, and the first sliding window is slid back by one unit, and the reconstruction detection of the new second behavior sequence segment is continued until (A n+m ...A n+m+L ) is lower than the reconstruction threshold, then it is considered that (A n+m ...A n+m+L ) are all normal behaviors, that is, the final judgment (A n ...A n+m-1 ) is the abnormal behavior sequence, so as to accurately locate the abnormal behavior interval.

[0123] Step 13: Continue with the sliding window algorithm anomaly detection: After locating the abnormal behavior interval by reconstructing the network, continue from behavior A n+m Start executing step 11 to detect abnormal behavior.

[0124] In the specific implementation, during the offline model training phase, we first use data collection tools to collect the normal access behavior logs of all databases, and finally generate a training data set of normal database behavior. Let the training data set be D.

[0125] Then, feature engineering technology is used to perform data cleaning and other operations on the training data set. After that, the word vector Word2Vec technology and TF-IDF technology are combined to generate a vectorized representation corresponding to each behavior.

[0126] Specifically, we first extract the behavior statements in each line of database behavior logs through the log preprocessing tool Drain, and extract the variable parameters of each behavior statement. Finally, each behavior statement corresponds to a corresponding template key. Then, we use the NLTK tool to extract the words of each behavior statement, and then put these words into the Word2Vec model for training. Finally, we can obtain the word vector of each word from the trained Word2Vec model. The operation of vectorizing the words in the template is shown in formula (1).

[0127]

[0128] Among them, w represents the word, v represents the word vector of each word, and m is the number of words.

[0129] In addition, in order to obtain the weight and frequency of occurrence of words in a behavior in all behaviors, TF-IDF is used to obtain the frequency value of each word. The calculation formula of TF-IDF is shown in formula (2), where tfidf i，j Represents word frequency tf i,j and inverted text word frequency idfi,j The product of , i represents a word, and j represents the j-th behavior vector long text.

[0130] tfidf i,j =tf i,j ×idf i,j (2)

[0131] Finally, the word vector corresponding to each word in the template and its TF-IDF value are multiplied and finally accumulated to obtain the corresponding vector representation of each behavior statement template. The specific formula is shown in formula (3).

[0132]

[0133] Among them, V represents the vectorized representation corresponding to each behavior statement template, w i Represents the TF-IDF value of each word, v i Word vector representation representing each word.

[0134] Figure 3 FIG. 1 shows a schematic diagram of a detection process based on a sliding window and a network reconstruction algorithm provided by an embodiment of the present application. Figure 3 As shown, first obtain multiple behavior statements (i.e., labels L1 to Ln) and input them into the behavior statement vectorization module 301 to obtain multiple behavior vector sequences, which are then spliced ​​through the long short-term memory network (LSTM) block and then through the vector splicing module 302. The abnormal behavior sequence segments are located by sequentially passing through the encoder 303, the hidden space 304, and the decoder 305.

[0135] It can be seen that after obtaining the final training sample set, the BiLSTM prediction time series model in the sliding window algorithm is used to transform the behavior vector sequence (A 1 ...A n ) is input into the model for training, so that the prediction time series model can learn the behavior sequence information of normal behavior. The details are shown in formula (4).

[0136] O n =BiLSTM(A 1 ,A 2 ,...,A n ) (4)

[0137] Among them, O n Represents the output of the model after inputting a normal behavior vector sequence, which represents the predicted next behavior. The output is represented as a vector.

[0138] Furthermore, the same training sample set can be input into the reconstruction network model for training.2 The behavior vector sequence (B 1 ...B n ), input into the reconstruction network model for training, so that the reconstruction network model can learn the behavior sequence information of normal behavior and minimize the reconstruction error value of the normal behavior sequence vector. The encoder and decoder are usually implemented using a neural network structure. This method selects a long short-term memory network (LSTM) neural network as an autoencoder, so that the reconstruction network model can better learn the normal behavior feature representation of the behavior sequence data. The specific example is shown in formula (5).

[0139]

[0140] In the above formula, B represents the vector sequence input to the autoencoder. F(·) represents the encoder function, g(·) represents the decoder function, Z represents the encoder output vector, and B' represents the decoder output. The goal of the autoencoder is to make the input of the normal behavior sequence as close to its output as possible (the reconstruction error value is as small as possible), and to make the difference between the input and output of the abnormal behavior sequence (the reconstruction error value) as large as possible.

[0141] During the offline model training phase, the detection model is trained using an abnormal behavior detection method based on a sliding window and reconstruction network algorithm, and then deployed in the online service center through a deployment tool for real-time detection.

[0142] After the system obtains the database access behavior log, it uses the operations from step 2 to step 6 to obtain the vectorized representation of each behavior. Figure 4 A flowchart of a behavior statement vectorization provided in an embodiment of the present application; Figure 4 As shown, the behavior sequence is input into a single extraction module 401, and then the word segmentation and weight calculation are respectively implemented through the Word2Vec module 402 and the TF-IDF technology 403, and finally the vectorized representation of the behavior sentence is obtained.

[0143] After the behavior is vectorized, the vector sequence is input into the detection model. The sliding window algorithm module in the detection model first determines the abnormal behavior, then locates the abnormal behavior interval through the reconstruction network algorithm, and finally determines all the abnormal behaviors. The details are shown in formula (6).

[0144]

[0145] Where D i Represents the data set, A i represents the preprocessed behavior log, V i represents the log vector, O iRepresents the output of BiLSTM. If it is abnormal, it is input to the autoencoder to detect the abnormal sequence, and finally outputs the abnormal sequence A n ,A n+1 ,...A m .

[0146] In a specific implementation, it is necessary to determine whether the first actual behavior is an abnormal behavior. The specific determination method is not limited, and a solution can be selected according to the actual situation. The embodiment of the present application provides a specific determination solution.

[0147] As mentioned above, the acquired historical behavior sequence includes the first behavior sequence segment and the first actual behavior. The behaviors in the first behavior sequence segment before the first actual behavior are all normal behaviors. Therefore, when the first actual behavior is determined to be an abnormal behavior, the next actual behavior of the first actual behavior is obtained. Before obtaining the second actual behavior, the first behavior sequence segment is first input into the pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment and obtain the first predicted behavior. Then, when the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition, the first actual behavior is determined to be an abnormal behavior.

[0148] The similarity condition is not limited here and can be determined according to actual conditions. For example, the similarity between the first predicted behavior and the first actual behavior can be calculated, and then it is determined whether the similarity is greater than a similarity threshold. If not, it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition.

[0149] The embodiment of the present application predicts the next behavior through the first behavior sequence segment, and then compares the predicted first predicted behavior with the first actual behavior. When the similarity does not meet the similarity condition, it is determined that the first actual behavior is abnormal. In this way, it can be quickly determined whether the first actual behavior is abnormal.

[0150] The embodiment of the present application provides another specific scheme for the similarity condition, first obtaining a collection of all possible behaviors of the next time of the first behavior sequence segment; the behavior collection includes the first actual behavior. Then, the similarity between the first predicted behavior and each behavior in the behavior collection is obtained respectively; and the behaviors in the behavior collection are sorted in descending order based on the similarity with the first predicted behavior. In the case where the first actual behavior does not belong to the first M behaviors in the sorting, it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition.

[0151] Here, M is a positive integer, and its specific size can be set according to the actual situation. If the similarity of the first actual behavior ranks high in the behavior collection, it indicates that the first actual behavior is similar enough to the first predicted behavior, and it is determined that the similarity between the first predicted behavior and the first actual behavior meets the similarity condition. If the similarity of the first actual behavior ranks low in the behavior collection, it indicates that the similarity between the first actual behavior and the first predicted behavior is low, and it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition.

[0152] The embodiment of the present application sorts all possible behaviors for the next time based on the similarity with the first predicted behavior, and then determines whether the actual behavior is ranked high, thereby quickly determining whether the actual behavior is similar enough to the first predicted behavior.

[0153] As mentioned above, the first behavior sequence segment is input into a pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment to obtain a first predicted behavior; before this, it is necessary to first build and train a prediction time series model, and the embodiment of the present application provides a specific solution.

[0154] First, the initial behavior prediction time series model is constructed, and then training samples are obtained; the training samples include behavior sequence segment samples and the next third actual behavior of the behavior sequence segment samples. Next, the behavior sequence segment samples are input into the initial behavior prediction time series model, the next behavior of the behavior sequence segment samples is predicted, the second predicted behavior is obtained, and the loss function value between the second predicted behavior and the third actual behavior is determined.

[0155] When the above loss function value does not meet the iteration stop condition, the parameters of the initial behavior prediction time series model are adjusted, the training samples are updated, and the behavior sequence segment sample is input into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample to obtain the second predicted behavior. That is, when the loss function value does not meet the iteration stop condition, the iteration is repeated to adjust the parameters of the model, thereby improving the prediction accuracy of the model.

[0156] When the loss function value satisfies the iteration stopping condition, the initial behavior prediction time series model is determined as the behavior prediction time series model.

[0157] The specific content of the above iteration stopping condition is determined according to the actual situation, and it can be that the loss function value tends to be unchanged.

[0158] The embodiment of the present application trains a prediction time series model based on training samples, and adjusts model parameters through continuous iteration, so that the prediction time series model can accurately predict the first prediction behavior based on the historical behavior sequence.

[0159] The present application embodiment provides a fine-grained detection system for abnormal and hidden behaviors of a database, which is used to implement the above method. Figure 5 The following is the architecture diagram of the fine-grained detection system for hidden abnormal behavior in databases. Figure 5 As shown, the detection system architecture 501 includes an interface layer, a business logic layer, and a data support layer.

[0160] The interface layer includes an application programming interface (API) interface 502. The business logic layer includes a training phase and a detection phase. The modules involved in the training phase include a data preprocessing module 503, a feature vectorization module 504, and a model training module 505. The modules involved in the detection phase include a feature processing module 506, an anomaly detection module 507, and an interval positioning module 508. The data support layer includes a database 509 and a real-time acquisition module 510. The following is an explanation of some functional modules:

[0161] API interface 502 is a functional module that provides interface calls between modules within the system;

[0162] The data preprocessing module 503 is a functional module that obtains normal behavior logs from the database 509, performs data cleaning and behavior statement vectorization on the log data set, and realizes data training usable;

[0163] The model training module 505 is a functional module that implements the abnormal covert behavior detection method of the database 509 based on the sliding window and reconstruction network algorithm, and provides functions such as model training;

[0164] The feature vectorization module 504 is a functional module for performing feature vectorization on the collected database 509 access behavior statements;

[0165] The anomaly detection module 507 is a functional module that uses an anomaly detection model to perform inference calculations on the vectorized database 509 access behavior statements and detect anomalies.

[0166] The principles and features of the embodiments of the present application are described below in conjunction with the accompanying drawings. The examples given are only used to explain the scheme of the present application and are not used to limit the scope of the present application.

[0167] This embodiment discloses a method for detecting abnormal behavior, which can be implemented based on the above detection system architecture 501. The system includes 9 functional modules, including an API interface 502, a data preprocessing module 503, a feature vectorization module 504, a model training module 505, a feature processing module 506, an anomaly detection module 507, an interval positioning module 508, a database and a real-time acquisition module 510. The steps of the method are as follows:

[0168] Step 20: Acquisition and processing of training data. During the offline training phase, the system uses the calling interface to obtain the set D of all normal behavior statement log sequences in the database, and then sends the set to the data processing module. After receiving the data, the data processing module performs vectorization operations on the behavior sequence, and finally obtains a long text vector V, which is sent to the sliding window module; as shown in formula (7).

[0169]

[0170] Step 21: Offline training of sliding window model. After the sliding window module receives the input sample V, it can set the length of the second sliding window to L, and input the input samples into the BiLSTM prediction time series model one by one in order in units of sliding windows to learn the normal behavior sequence; as shown in formula (8).

[0171]

[0172] where x i Represents a vectorized action statement. n represents the output after the sliding window module, that is, the next behavior after the predicted behavior sequence. If the actual next behavior is not similar to the output, it is judged as abnormal. The similarity judgment method used is cosine similarity, as shown in formula (9).

[0173]

[0174] Step 22: Reconstruct the network model for offline training. The same training data is sent to the reconstructed network model for offline training. The window size L is set, and the normal sample vector in the window is reconstructed so that the model can reconstruct with a smaller error value when facing normal behavior and a larger error value when facing abnormal behavior. Finally, by setting a reconstruction threshold, the model can identify whether this behavior sequence segment is normal; as shown in formula (10).

[0175]

[0176] The calculation of the reconstruction error value can be achieved using the cross entropy loss function.

[0177] Step 23: Abnormal behavior detection. After the model training is completed, fine-grained abnormal behavior detection can be started. First, the collected data is sent to the feature processing module 506 for data vectorization, and finally a vectorized representation of the behavior is obtained. The vector sequence is input into the anomaly detection module 507, and the abnormal behavior is first detected by the sliding window module, and then the abnormal behavior is accurately located by the reconstruction network module, and finally the abnormal behavior interval is generated.

[0178] The specific process of the embodiment of the present application is described below with reference to examples:

[0179] Assuming that there are N databases, each of which records behavior logs, the specific implementation process is as follows:

[0180] The specific steps of obtaining and processing training data in step 20 are as follows:

[0181] Step 20.1: During the offline training phase, the data processing module uses the database read call interface provided by the API interface 502 module to read all normal behavior sequences of the database, and then performs data cleaning and other operations on the original data to obtain a usable data set D. Table 1 shows an example of the collected normal behavior sequences of the database.

[0182] Table 1. Example of normal behavior sequence

[0183]

[0184] Step 20.2: After cleaning the original data, the feature vectorization module 504 inputs the words in each action sentence into the Word2Vec model and trains it as a bag of words. Finally, the trained Word2Vec model will give each word W i Provide a unique word vector representation w i Then calculate the TF-IDF value of each word and multiply it by the word vector of each word to get the final representation v of the word vector. i Then, the vectors of each word in the action sentence are weighted averaged to obtain a vectorized representation V of the action sentence. i .

[0185] The specific steps of hidden abnormal behavior detection model training in step 21 are as follows:

[0186] Step 21.1: After receiving the vectorized data, the sliding window module sets the sliding window size L and inputs the input samples into the BiLSTM one by one in order in units of sliding windows to learn the normal behavior sequence;

[0187] Step 21.2: The same training data is sent to the reconstruction network model for offline training. The window size L is set, and the normal sample vector in the window is reconstructed so that the model can reconstruct with a small error when facing normal behavior and a large error when facing abnormal behavior. Finally, by setting a threshold Q, the model can identify whether this behavior interval is normal.

[0188] The specific steps of anomaly detection in step 22 are as follows:

[0189] Step 22.1: The data preprocessing module 503 in the detection model first preprocesses the read data D to generate output A, and then calls the feature processing module 506 to semantically vectorize the behavior statement to generate a vector V.

[0190] Step 22.2: After the behavior statement is converted into a semantic vector V, it is input into the sliding window module to detect hidden abnormal behaviors, and finally determine the abnormal behavior sequence number i, which is input into the reconstruction network module;

[0191] Step 22.3: The abnormal behavior sequence number i is input to the reconstruction network module, the window size L is set, and the vector sequence {V i ,V i+1 ,...,V i+L-1} is reconstructed, and the behavior sequences in the window are judged to be normal behaviors according to whether the reconstructed loss value exceeds the reconstruction threshold Q. If there are abnormal behaviors, continue sliding to judge; if they are all normal behaviors, determine the abnormal behavior interval {V i ,V i+1 ,...,V m Then return to step 22.1 and re-detect abnormal behaviors starting from sequence number m until all behaviors are detected.

[0192] The embodiment of the present application proposes a fine-grained detection method for hidden abnormal behavior of a database based on a sliding window and a reconstruction network. On the basis of the sliding window model, a reconstruction network is introduced to perform fine-grained abnormal behavior detection, which can accurately locate specific abnormal behaviors in long behavior sequences.

[0193] In order to solve the above technical problems, the present application also provides a device for detecting abnormal behavior. Figure 6 FIG. 1 is a schematic diagram showing the structure of an abnormal behavior detection device provided in an embodiment of the present application. Figure 6 As shown, the device includes the following modules:

[0194] The first acquisition module 601 is used to acquire a historical behavior sequence for accessing a target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and the behaviors in the first behavior sequence segment are all normal behaviors;

[0195] The second acquisition module 602 is used to acquire the next actual behavior of the first actual behavior to obtain the second actual behavior when the first actual behavior is determined to be an abnormal behavior;

[0196] A first determination module 603 is used to determine a corresponding first sliding window according to the second actual behavior; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and subsequent N consecutive behaviors; N is a positive integer;

[0197] An input module 604 is used to input the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection;

[0198] The sliding module 605 is used to slide the first sliding window backward by one behavior on the historical behavior sequence when the second behavior sequence segment is an abnormal behavior sequence segment, obtain an updated first sliding window, and trigger the input module 604 until the second behavior sequence segment is a normal behavior sequence segment;

[0199] The second determination module 606 is used to determine the behavior between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence as an abnormal behavior.

[0200] In some embodiments, the input module 604 is specifically configured to:

[0201] Inputting the second behavior sequence segment into the reconstruction network to obtain a reconstructed behavior sequence segment;

[0202] determining a reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment;

[0203] When the reconstruction error value is greater than the reconstruction threshold, the second behavior sequence segment is determined to be an abnormal behavior sequence segment.

[0204] In some embodiments, the abnormal behavior detection device further includes:

[0205] A vectorization module is used to vectorize the statements of each behavior in the historical behavior sequence after obtaining the historical behavior sequence of accessing the target database to obtain a vectorized representation;

[0206] An input module 604 is specifically used to input the vectorized representation corresponding to each behavior in the second behavior sequence segment into the reconstruction network for anomaly detection;

[0207] The first prediction module is specifically used to input the vectorized representation corresponding to each behavior in the first behavior sequence segment into a pre-trained behavior prediction time series model to obtain a first predicted behavior.

[0208] In some embodiments, the vectorization module is specifically configured to:

[0209] Convert each word in each action statement in the historical action sequence into a word vector;

[0210] Determine the term frequency and inverse document frequency of each word;

[0211] Determine the target weight value of each word based on word frequency and inverse document frequency;

[0212] Based on the word vector and the target weight value, the corresponding vectorized representation is determined.

[0213] In some embodiments, the vectorization module is specifically used to: for each word, multiply the word vector by the target weight value of the corresponding word to obtain a target vector;

[0214] The target vector is weighted averaged to obtain a vectorized representation.

[0215] In some embodiments, the abnormal behavior detection device further includes:

[0216] A third acquisition module is used to acquire a normal behavior sequence sample before inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection;

[0217] An extraction module is used to extract feature information of normal behavior sequence samples;

[0218] The first building module is used to train the reconstruction network based on feature information.

[0219] In some embodiments, the abnormal behavior detection device further includes:

[0220] A first prediction module is used to obtain the next actual behavior of the first actual behavior when the first actual behavior is determined to be an abnormal behavior, and before obtaining the second actual behavior, input the first behavior sequence segment into a pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment to obtain a first predicted behavior;

[0221] The second building module is used to build an initial behavior prediction time series model;

[0222] A fourth acquisition module is used to acquire training samples; the training samples include a behavior sequence segment sample and the next third actual behavior of the behavior sequence segment sample;

[0223] The second prediction module is used to input the behavior sequence segment sample into the initial behavior prediction time series model, predict the next behavior of the behavior sequence segment sample, and obtain a second predicted behavior;

[0224] A third determination module, used to determine a loss function value between the second predicted behavior and the third actual behavior;

[0225] An adjustment module, used for adjusting the parameters of the initial behavior prediction time series model and updating the training samples when the loss function value does not meet the iteration stop condition, and returning to the step of inputting the behavior sequence segment sample into the initial behavior prediction time series model, predicting the next behavior of the behavior sequence segment sample, and obtaining a second predicted behavior;

[0226] A fourth determination module is used to determine the initial behavior prediction time series model as the behavior prediction time series model when the loss function value satisfies the iteration stop condition;

[0227] The fifth determination module is used to determine that the first actual behavior is an abnormal behavior when the similarity between the first predicted behavior and the first actual behavior does not satisfy a similarity condition.

[0228] In some embodiments, the abnormal behavior detection device further includes:

[0229] A fifth acquisition module, configured to acquire a collection of all possible behaviors of the first behavior sequence segment next time before determining that the first actual behavior is an abnormal behavior when the similarity between the first predicted behavior and the first actual behavior does not satisfy a similarity condition; the collection of behaviors includes the first actual behavior;

[0230] A sixth acquisition module, used to respectively acquire the similarity between the first predicted behavior and each behavior in the behavior collection;

[0231] A sorting module, used to sort the behaviors in the behavior collection in descending order based on similarity with the first predicted behavior;

[0232] The sixth determination module is used to determine that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition when the first actual behavior does not belong to the first M behaviors in the sorting; M is a positive integer.

[0233] The device provided in the embodiment of the present application is the same as the method in the above embodiment, so both have the same embodiments and beneficial effects, which will not be repeated here.

[0234] Figure 7 FIG. 1 is a schematic diagram showing the hardware structure of an abnormal behavior detection device provided in an embodiment of the present application. Figure 7 As shown, the abnormal behavior detection device may include a processor 701 and a memory 702 storing computer program instructions.

[0235] Specifically, the processor 701 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0236] The memory 702 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 702 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 702 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 702 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 702 is a non-volatile solid-state memory.

[0237] The memory 702 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, in general, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0238] The processor 701 implements any abnormal behavior detection method in the above embodiments by reading and executing computer program instructions stored in the memory 702 .

[0239] In one example, the abnormal behavior detection device may further include a communication interface 703 and a bus 704. The processor 701, the memory 702, and the communication interface 703 are connected via the bus 704 and communicate with each other.

[0240] The communication interface 703 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0241] Bus 704 includes hardware, software or both, and the parts of the detection equipment of abnormal behavior are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 704 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0242] In addition, in combination with the abnormal behavior detection method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any abnormal behavior detection method in the above embodiment is implemented.

[0243] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed, implements any one of the abnormal behavior detection methods in the above embodiments.

[0244] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0245] The functional blocks shown in the block diagram above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0246] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0247] The above reference is made to the flowchart and / or block diagram of a detection method, device, equipment, medium and product of abnormal behavior according to an embodiment of the present disclosure, and describes various aspects of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0248] The above contents are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application.

Claims

1. A method for detecting abnormal behavior, characterized in that: include: Acquire a historical behavior sequence of accessing a target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and the behaviors in the first behavior sequence segment are all normal behaviors; In the case where it is determined that the first actual behavior is an abnormal behavior, obtaining the next actual behavior of the first actual behavior to obtain a second actual behavior; Determining a corresponding first sliding window according to the second actual behavior; The first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and N consecutive behaviors thereafter; N is a positive integer; Inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection; In the case where the second behavior sequence segment is an abnormal behavior sequence segment, sliding the first sliding window backward by one behavior on the historical behavior sequence to obtain an updated first sliding window, and returning to the step of inputting the second behavior sequence segment in the first sliding window into the pre-constructed reconstruction network for abnormality detection until the second behavior sequence segment is a normal behavior sequence segment; The behavior between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence is determined as an abnormal behavior.

2. The abnormal behavior detection method according to claim 1, characterized in that: The step of inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection includes: Inputting the second behavior sequence segment into the reconstruction network to obtain a reconstructed behavior sequence segment; determining a reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment; When the reconstruction error value is greater than a reconstruction threshold, the second behavior sequence segment is determined to be an abnormal behavior sequence segment.

3. The abnormal behavior detection method according to claim 1, characterized in that: After acquiring the historical behavior sequence of accessing the target database, the method further includes: Performing sentence vectorization on each behavior in the historical behavior sequence to obtain a vectorized representation; The step of inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection includes: Inputting the vectorized representation corresponding to each behavior in the second behavior sequence segment into the reconstruction network for anomaly detection; The step of inputting the first behavior sequence segment into a pre-trained behavior prediction time series model, predicting the next behavior of the first behavior sequence segment, and obtaining a first predicted behavior includes: The vectorized representation corresponding to each behavior in the first behavior sequence segment is input into a pre-trained behavior prediction time series model to obtain the first predicted behavior.

4. The abnormal behavior detection method according to claim 3, characterized in that: The performing sentence vectorization on each behavior in the historical behavior sequence to obtain a vectorized representation includes: Convert each word in each action statement in the historical action sequence into a word vector; Determining the term frequency and inverse document frequency of each of the words; Determining a target weight value for each of the words based on the word frequency and the inverse document frequency; Based on the word vector and the target weight value, a corresponding vectorized representation is determined.

5. The abnormal behavior detection method according to claim 4, characterized in that: The determining a corresponding vectorized representation based on the word vector and the target weight value includes: For each of the words, multiply the word vector by the target weight value corresponding to the word to obtain a target vector; The target vectors are weighted averaged to obtain a vectorized representation.

6. The abnormal behavior detection method according to any one of claims 1 to 5, characterized in that: Before inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection, the method further includes: Get normal behavior sequence samples; Extracting characteristic information of the normal behavior sequence sample; Based on the feature information, the reconstruction network is trained.

7. The abnormal behavior detection method according to claim 1, characterized in that: In the case where the first actual behavior is determined to be an abnormal behavior, before obtaining the next actual behavior of the first actual behavior and obtaining the second actual behavior, the method further includes: Inputting the first behavior sequence segment into a pre-trained behavior prediction time series model, predicting the next behavior of the first behavior sequence segment, and obtaining a first predicted behavior; Acquire a collection of all possible next behaviors of the first behavior sequence segment; the collection of behaviors includes the first actual behavior; Respectively obtaining similarities between the first predicted behavior and each behavior in the behavior collection; sorting the behaviors in the behavior collection based on the order of similarity with the first predicted behavior from greatest to least; In the case where the first actual behavior does not belong to the first M behaviors in the sorting, it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition; M is a positive integer; When the similarity between the first predicted behavior and the first actual behavior does not satisfy the similarity condition, the first actual behavior is determined to be an abnormal behavior.

8. The abnormal behavior detection method according to claim 7, characterized in that: Before inputting the first behavior sequence segment into a pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment to obtain a first predicted behavior, the method further includes: Constructing an initial behavior prediction time series model; Acquire a training sample; the training sample includes a behavior sequence segment sample and the next third actual behavior of the behavior sequence segment sample; Inputting the behavior sequence segment sample into the initial behavior prediction time series model, predicting the next behavior of the behavior sequence segment sample, and obtaining a second predicted behavior; determining a loss function value between the second predicted behavior and the third actual behavior; When the loss function value does not satisfy the iteration stop condition, the parameters of the initial behavior prediction time series model are adjusted, the training sample is updated, and the step of inputting the behavior sequence segment sample into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample to obtain a second predicted behavior is returned; When the loss function value satisfies the iteration stop condition, the initial behavior prediction time series model is determined as the behavior prediction time series model.

9. A device for detecting abnormal behavior, characterized in that: The device comprises: A first acquisition module is used to acquire a historical behavior sequence for accessing a target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and the behaviors in the first behavior sequence segment are all normal behaviors; A second acquisition module is used to acquire the next actual behavior of the first actual behavior to obtain a second actual behavior when the first actual behavior is determined to be an abnormal behavior; A first determining module is used to determine a corresponding first sliding window according to the second actual behavior; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and subsequent N consecutive behaviors; N is a positive integer; An input module, used for inputting the second behavior sequence segment in the first sliding window into a pre-built reconstruction network for anomaly detection; a sliding module, configured to, when the second behavior sequence segment is an abnormal behavior sequence segment, slide the first sliding window backward by one behavior on the historical behavior sequence to obtain an updated first sliding window, and return to the step of inputting the second behavior sequence segment in the first sliding window into a pre-constructed reconstruction network for abnormality detection until the second behavior sequence segment is a normal behavior sequence segment; The second determination module is used to determine the behavior between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence as abnormal behavior.

10. An abnormal behavior detection device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the abnormal behavior detection method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the abnormal behavior detection method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the abnormal behavior detection method as described in any one of claims 1 to 8.

Images