An abnormal behavior detection method, device, equipment, medium and product

Abstract

The application discloses a method, device, equipment, medium and product for detecting abnormal behavior, and applies to the field of data security. In the case that the first actual behavior is determined as an abnormal behavior, the first sliding window corresponding to the next second actual behavior is determined. Then, the second behavior sequence segment in the first sliding window is input into the pre-constructed reconstruction network for abnormal detection. In the case that the second behavior sequence segment is abnormal, the first sliding window is slid backward by one behavior on the historical behavior sequence, and the above reconstruction detection step is returned until the second behavior sequence segment is normal. Through the reconstruction network, the abnormal behavior existing after the first actual behavior is efficiently found out, the part actually existing the abnormality can be accurately positioned from the whole historical behavior sequence, and through the processing on the second behavior sequence segment, the rich context and semantic information are possessed, and the hidden abnormal behavior can be detected.

Description

Technical Field

[0001] This application belongs to the field of data security, and in particular relates to a method, apparatus, equipment, medium and product for detecting abnormal behavior. Background Technology

[0002] In recent years, database technology has developed rapidly, enabling efficient processing and management of various types of data. Simultaneously, databases are being applied to an increasing number of fields, with both academic and commercial sectors using them as powerful tools. However, as more and more important data is stored in databases, attacks surrounding them have intensified, making the detection of abnormal database behavior a current research hotspot.

[0003] Currently, anomaly detection is mainly performed using statistical methods. When certain data is accessed frequently and exceeds a threshold, abnormal behavior is identified. However, this anomaly detection standard is coarse-grained, only able to classify the entire behavior sequence as normal or abnormal, but unable to pinpoint the specific behavior. Summary of the Invention

[0004] This application provides a method, apparatus, device, medium, and product for detecting abnormal behavior, which can accurately locate abnormal behavior.

[0005] On one hand, embodiments of this application provide a method for detecting abnormal behavior, including:

[0006] Obtain the historical behavior sequence of accessing the target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and all behaviors in the first behavior sequence segment are normal behaviors;

[0007] If the first actual behavior is determined to be an abnormal behavior, the next actual behavior of the first actual behavior is obtained to obtain the second actual behavior;

[0008] Based on the second actual behavior, a corresponding first sliding window is determined; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and N consecutive behaviors thereafter; N is a positive integer;

[0009] The second row of the sequence segment in the first sliding window is input into the pre-built reconstruction network for anomaly detection;

[0010] If the second behavior sequence segment is an abnormal behavior sequence segment, slide the first sliding window one behavior backward on the historical behavior sequence to obtain the updated first sliding window, and return to the step of inputting the second behavior sequence segment in the first sliding window into the pre-built reconstruction network for anomaly detection, until the second behavior sequence segment is a normal behavior sequence segment;

[0011] Behaviors located between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence are identified as abnormal behaviors.

[0012] On the other hand, the step of inputting the second row of sequence segments in the first sliding window into the pre-constructed reconstruction network for anomaly detection includes:

[0013] The second action sequence segment is input into the reconstruction network to obtain the reconstruction action sequence segment;

[0014] Determine the reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment;

[0015] If the reconstruction error value is greater than the reconstruction threshold, the second behavior sequence segment is determined to be an abnormal behavior sequence segment.

[0016] On the other hand, after obtaining the historical behavior sequence of accessing the target database, the method further includes:

[0017] Each behavior in the historical behavior sequence is vectorized into a statement to obtain a vectorized representation;

[0018] The step of inputting the second row of the sequence segment in the first sliding window into the pre-constructed reconstruction network for anomaly detection includes:

[0019] The vectorized representations corresponding to each behavior in the second behavior sequence segment are input into the reconstructed network for anomaly detection.

[0020] The step of inputting the first behavior sequence segment into a pre-trained behavior prediction time-series model to predict the next behavior of the first behavior sequence segment and obtain the first predicted behavior includes:

[0021] The vectorized representations corresponding to each behavior in the first behavior sequence segment are input into a pre-trained behavior prediction time series model to obtain the first predicted behavior.

[0022] On the other hand, the step of vectorizing each behavior in the historical behavior sequence to obtain a vectorized representation includes:

[0023] Convert each word in each action statement in the historical action sequence into a word vector;

[0024] Determine the word frequency and reverse document frequency of each of the aforementioned words;

[0025] Based on the word frequency and the inverse document frequency, determine the target weight value of each word;

[0026] Based on the word vectors and the target weight values, the corresponding vectorized representations are determined.

[0027] On the other hand, determining the corresponding vectorized representation based on the word vectors and the target weight value includes:

[0028] For each of the aforementioned words, the word vector is multiplied by the target weight value corresponding to the word to obtain the target vector;

[0029] The target vector is weighted and averaged to obtain a vectorized representation.

[0030] On the other hand, before inputting the second row sequence segment from the first sliding window into the pre-constructed reconstruction network for anomaly detection, the method further includes:

[0031] Obtain normal behavior sequence samples;

[0032] Extract feature information from the normal behavior sequence samples;

[0033] The reconstructed network is trained based on the aforementioned feature information.

[0034] On the other hand, before obtaining the next actual behavior of the first actual behavior and thus the second actual behavior when the first actual behavior is determined to be an abnormal behavior, the method further includes:

[0035] The first behavior sequence segment is input into a pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment, thus obtaining the first predicted behavior.

[0036] Obtain the set of all possible actions for the next occurrence of the first action sequence segment; the set of actions includes the first actual action.

[0037] The similarity between the first predicted behavior and each behavior in the behavior set is obtained respectively;

[0038] Based on the order of similarity to the first predicted behavior from largest to smallest, the behaviors in the behavior set are sorted.

[0039] If the first actual behavior does not belong to the first M behaviors in the ranking, it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition; M is a positive integer.

[0040] If the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition, the first actual behavior is determined to be an abnormal behavior.

[0041] On the other hand, before predicting the next behavior of the first behavior sequence segment and obtaining the first predicted behavior in the pre-trained behavior prediction time-series model, the method further includes:

[0042] Construct an initial behavior prediction time series model;

[0043] Obtain training samples; the training samples include behavior sequence segment samples and the next third actual behavior of the behavior sequence segment samples;

[0044] The behavior sequence segment sample is input into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample, thus obtaining the second predicted behavior;

[0045] Determine the loss function value between the second predicted behavior and the third actual behavior;

[0046] If the loss function value does not meet the iteration stopping condition, adjust the parameters of the initial behavior prediction time series model, update the training samples, and return to the step of inputting the behavior sequence segment sample into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample and obtain the second predicted behavior.

[0047] If the loss function value satisfies the iteration stopping condition, the initial behavior prediction time series model is determined as the behavior prediction time series model.

[0048] Furthermore, embodiments of this application provide an anomalous behavior detection device, the device comprising:

[0049] The first acquisition module is used to acquire a historical behavior sequence of accessing the target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and all behaviors in the first behavior sequence segment are normal behaviors;

[0050] The second acquisition module is used to acquire the next actual behavior of the first actual behavior when it is determined that the first actual behavior is an abnormal behavior, so as to obtain the second actual behavior.

[0051] The first determining module is used to determine the corresponding first sliding window based on the second actual behavior; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and N consecutive behaviors thereafter; N is a positive integer;

[0052] The input module is used to input the second row of sequence segments in the first sliding window into the pre-constructed reconstruction network for anomaly detection;

[0053] The sliding module is used to slide the first sliding window one behavior backward on the historical behavior sequence when the second behavior sequence segment is an abnormal behavior sequence segment, to obtain an updated first sliding window, and return to the step of inputting the second behavior sequence segment in the first sliding window into the pre-built reconstruction network for anomaly detection, until the second behavior sequence segment is a normal behavior sequence segment;

[0054] The second determining module is used to determine the behavior in the historical behavior sequence that is located between the first behavior sequence segment and the normal second behavior sequence segment as abnormal behavior.

[0055] In another aspect, embodiments of this application provide an abnormal behavior detection device, the device comprising: a processor and a memory storing computer program instructions;

[0056] The processor implements the abnormal behavior detection method described above when executing the computer program instructions.

[0057] In another aspect, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the abnormal behavior detection method described above.

[0058] In another aspect, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the abnormal behavior described above, a detection method.

[0059] This application provides a method for detecting abnormal behavior. First, it acquires a historical behavior sequence of accessing a target database. If the first actual behavior is determined to be abnormal, a corresponding first sliding window is determined based on the next second actual behavior. Then, the second behavior sequence segment within the first sliding window is input into a pre-constructed reconstruction network for anomaly detection. If the second behavior sequence segment is abnormal, the first sliding window slides one behavior backward on the historical behavior sequence and returns to the reconstruction network for anomaly detection until the second behavior sequence segment is normal. Therefore, this solution, after identifying the abnormal first actual behavior, analyzes the second behavior sequence segment through a reconstruction network. The sequence segment possesses rich contextual and semantic information, enabling efficient detection of hidden abnormal behavior and accurately locating the actually abnormal part from the entire historical behavior sequence. Attached Figure Description

[0060] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 A flowchart illustrating an abnormal behavior detection method provided in one embodiment of this application is shown.

[0062] Figure 2 This illustration shows a schematic diagram of a specific abnormal behavior detection process provided in one embodiment of this application;

[0063] Figure 3 A schematic diagram of a detection process based on a sliding window and reconstruction network algorithm provided in one embodiment of this application is shown;

[0064] Figure 4 A flowchart illustrating the vectorization of behavioral statements provided in this application embodiment;

[0065] Figure 5 This is an architecture diagram of a fine-grained detection system for hidden abnormal behavior in databases.

[0066] Figure 6 A schematic diagram of the structure of the abnormal behavior detection device provided in an embodiment of this application is shown;

[0067] Figure 7 A schematic diagram of the hardware structure of the abnormal behavior detection device provided in an embodiment of this application is shown. Detailed Implementation

[0068] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0069] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0070] Traditional anomaly detection methods use coarse-grained criteria, treating the entire sequence of behaviors as abnormal when an anomaly is detected, rather than identifying the specific individual statement that caused the anomaly. However, most behaviors in long-sequence logs are normal, with only a few exhibiting anomalies. Current anomaly detection methods struggle to pinpoint specific abnormal behaviors, impacting anomaly reporting and cause analysis. Furthermore, the inappropriate handling of behavioral statements and the focus on analyzing only individual behaviors in traditional methods make it difficult to detect subtle abnormal access behaviors.

[0071] To address the problems of traditional solutions, embodiments of this application provide a method, apparatus, device, medium, and product for detecting abnormal behavior. The method for detecting abnormal behavior provided in this application will be described first. Figure 1 A flowchart illustrating an abnormal behavior detection method according to an embodiment of this application is shown. Figure 1 As shown, the method includes the following steps: S101 to S107.

[0072] S101: Obtain the historical sequence of access to the target database.

[0073] The purpose of this application is to detect abnormal access behavior to a database and achieve security protection for important data in the database. Therefore, after an action is taken to access the database, this application embodiment will detect the entire action sequence. Therefore, it is necessary to first obtain the historical action sequence of accessing the target database. The historical action sequence includes a first action sequence segment and a first actual action. The first actual action is the next actual action after the first action sequence segment. All actions in the first action sequence segment are normal actions.

[0074] S102: If the first actual behavior is determined to be an abnormal behavior, obtain the next actual behavior of the first actual behavior to obtain the second actual behavior.

[0075] As can be seen, this step requires determining whether the first actual behavior is abnormal. The specific method of determination is not limited here; it can be chosen based on the actual situation. As mentioned above, all behaviors in the first behavior sequence are normal; therefore, the first behavior sequence can be used to determine whether the first actual behavior is abnormal.

[0076] In this embodiment, the first behavior sequence segment is generally of fixed length. Based on the normal behaviors in the first behavior sequence segment, the next behavior of the first behavior sequence segment can be predicted to obtain the first predicted behavior. Then, the similarity between the first predicted behavior and the first actual behavior is used to determine whether the first actual behavior is abnormal.

[0077] If the first actual behavior is abnormal, and since the sequence of behaviors in the first behavior is all normal, then within a certain range, the first actual behavior is the first instance of abnormal behavior. Since abnormal behaviors often occur consecutively, analysis can begin with the next actual behavior after the first actual behavior (i.e., the second actual behavior) to identify this continuous sequence of abnormal behaviors.

[0078] S103: Determine the corresponding first sliding window based on the second actual behavior.

[0079] As mentioned above, the first predicted behavior can be obtained based on the normal behaviors in the first behavior sequence segment, and then the similarity between the first predicted behavior and the first actual behavior can be used to determine whether the first actual behavior is abnormal. However, because the first actual behavior is abnormal, that is, there is an abnormal behavior before the second actual behavior, it is difficult to predict, and therefore it is impossible to determine whether the second actual behavior is abnormal by comparing the similarity between the actual behavior and the predicted behavior.

[0080] Since it is impossible to use a similarity comparison scheme to determine whether the subsequent behaviors after the first actual behavior are abnormal, this embodiment proposes a scheme to reconstruct and analyze the sequence segment, which can determine whether there are abnormal behaviors in the sequence segment, thereby finding the abnormal behaviors after the abnormal first actual behavior.

[0081] The first sliding window mentioned above includes a second row sequence segment. The second row sequence segment in the first sliding window corresponding to the second actual row includes the second actual row and N consecutive rows thereafter; N is a positive integer, and its specific size is set according to actual needs.

[0082] S104: Input the second row of the sequence segment in the first sliding window into the pre-built reconstruction network for anomaly detection.

[0083] This application employs a scheme of reconstructing and analyzing the second-row sequence segment to quickly and accurately determine whether there are anomalies in the second-row sequence segment within the first sliding window. The first sliding window is generally of fixed length, containing the second-row sequence segment. As the first sliding window slides, the second-row sequence segment inside changes accordingly. Each slide requires inputting the required second-row sequence segment into a pre-constructed reconstruction network for anomaly detection.

[0084] Generally, the reconstruction network is trained based on normal behavioral statements. After the second behavioral sequence segment is input, the reconstruction network will generate a reconstructed behavioral sequence segment and calculate the reconstruction error value between the second behavioral sequence segment and the reconstructed behavioral sequence segment. If the reconstruction error value is greater than the set reconstruction threshold, the second behavioral sequence segment can be determined to be abnormal.

[0085] Reconstruction error refers to the degree of difference between the original data and the data after some processing (such as compression, dimensionality reduction, or reconstruction). This difference can be measured by calculating the similarity or distance between the two, and is often used to evaluate the performance of data processing algorithms. The smaller the reconstruction error value, the smaller the difference between the processed data (reconstructed behavioral sequence segment) and the original data (second behavioral sequence segment).

[0086] S105: Determine whether the second behavior sequence segment is an abnormal behavior sequence segment. If yes, proceed to S106; otherwise, proceed to S107.

[0087] As mentioned in S103 above, a corresponding first sliding window is determined based on the second actual action. The second action sequence segment within the first sliding window corresponding to the second actual action includes the second actual action and the subsequent N consecutive actions. That is, the first second action sequence segment is obtained at this point. This second action sequence segment is then input into the pre-constructed reconstruction network for anomaly detection to determine whether the current second action sequence segment is an anomalous action sequence segment.

[0088] S106: Slide the first sliding window one action backward on the historical action sequence to obtain the updated first sliding window, and return to S104.

[0089] If the second behavior sequence segment is an anomalous behavior sequence segment, the first sliding window is moved one behavior backward on the historical behavior sequence to obtain an updated first sliding window, which is a new second behavior sequence segment. Then, return to S104 and input the new second behavior sequence segment into the reconstruction network again for anomaly detection to determine whether the current second behavior sequence segment is an anomalous behavior sequence segment. If the second behavior sequence segment is still an anomalous behavior sequence segment, repeat the above steps.

[0090] S107: Identify behaviors in the historical behavior sequence that are located between the first behavior sequence segment and the normal second behavior sequence segment as abnormal behaviors.

[0091] If the second behavior sequence segment is a normal behavior sequence segment, it indicates that the abnormal behaviors adjacent to the first actual behavior have been identified, and there is no need to continue reconstruction detection.

[0092] Finally, behaviors located between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence are identified as anomalous behaviors. It is important to note that these anomalous behaviors do not include those within the first or second behavior sequence segments.

[0093] This application proposes a method for detecting abnormal database access behavior based on a sliding window and reconstruction network algorithm. This method improves the detection accuracy of abnormal database behavior, achieves fine-grained detection, and can better realize the accurate discovery and real-time detection of abnormal database behavior.

[0094] This application provides a method for detecting abnormal behavior. First, it acquires a historical behavior sequence of accessing a target database. If the first actual behavior is determined to be abnormal, a corresponding first sliding window is determined based on the next second actual behavior. Then, the second behavior sequence segment within the first sliding window is input into a pre-constructed reconstruction network for anomaly detection. If the second behavior sequence segment is abnormal, the first sliding window slides one behavior backward on the historical behavior sequence and returns to the reconstruction network for anomaly detection until the second behavior sequence segment is normal. Therefore, this solution, after identifying the abnormal first actual behavior, analyzes the second behavior sequence segment through a reconstruction network. The sequence segment possesses rich contextual and semantic information, enabling efficient detection of hidden abnormal behavior and accurately locating the actually abnormal part from the entire historical behavior sequence.

[0095] In practical applications, the second row of the sequence segment in the first sliding window needs to be input into a pre-built reconstruction network for anomaly detection. Before this, the reconstruction network needs to be built. Specifically, the reconstruction network can be trained using the following method: first, obtain normal behavior sequence samples, then extract the feature information of the normal behavior sequence samples; finally, train the reconstruction network based on these feature information.

[0096] The above scheme enables the reconstruction network to learn the features of normal behavior sequence samples, thereby determining which behavior sequences belong to abnormal behavior sequences. Specifically, the reconstruction network is used to reconstruct the input second behavior sequence segment, thus obtaining the reconstructed behavior sequence segment. Because the reconstruction network is built based on normal behavior sequence samples, if the second behavior sequence segment is a normal behavior sequence segment, the reconstruction error between the second behavior sequence segment and the reconstructed behavior sequence segment will be relatively small.

[0097] This application embodiment trains the reconstruction network with feature information of normal behavior sequence samples, ensuring that the reconstruction network can obtain a large reconstruction error value when inputting abnormal behavior sequences, thereby accurately determining whether the target behavior sequence is an abnormal behavior sequence.

[0098] The above embodiments construct a reconstructed network based on normal behavior sequence samples, enabling the reconstructed network to distinguish between normal and abnormal behavior sequences. The second behavior sequence segment in the first sliding window is then input into the pre-constructed reconstructed network for anomaly detection, specifically including:

[0099] The second-line sequence segment is input into the reconstruction network to obtain the reconstructed behavior sequence segment. Then, the reconstruction error value between the second-line sequence segment and the reconstructed behavior sequence segment is determined. If the reconstruction error value is not greater than the reconstruction threshold, the second-line sequence segment is determined to be a normal behavior sequence segment; if the reconstruction error value is greater than the reconstruction threshold, the second-line sequence segment is determined to be an abnormal behavior sequence segment. The specific size of the reconstruction threshold is set according to the actual situation.

[0100] This application embodiment calculates the reconstruction error value between the input target behavior sequence and the reconstructed output behavior sequence by reconstructing the network. By measuring the magnitude of the reconstruction error value, it is possible to accurately determine whether the target behavior sequence is an abnormal behavior sequence.

[0101] The above embodiments mention the need to train a prediction time-series network, train a reconstruction network, predict the next behavior through the prediction time-series network, and detect anomalies in the behavior sequence through the reconstruction network. In all these processes, it is necessary to first obtain and use the behavior statements. To facilitate the subsequent use of the behavior statements, the behavior statements can be converted into a vector.

[0102] Therefore, in this embodiment of the application, after obtaining the historical behavior sequence of accessing the target database, each behavior in the historical behavior sequence is vectorized into a statement to obtain a vectorized representation.

[0103] Correspondingly, the second action sequence segment in the first sliding window is input into a pre-constructed reconstruction network for anomaly detection. Specifically, this includes: inputting the vectorized representations corresponding to each action in the second action sequence segment into the reconstruction network for anomaly detection. Additionally, the first action sequence segment is input into a pre-trained action prediction time-series model to predict the next action of the first action sequence segment, thus obtaining the first predicted action. This specifically includes: inputting the vectorized representations corresponding to each action in the first action sequence segment into the pre-trained action prediction time-series model to obtain the first predicted action.

[0104] In this embodiment of the application, each behavior is vectorized before being input into the prediction time series model and the reconstruction network, which facilitates subsequent processing.

[0105] This embodiment provides a specific vectorization method to vectorize each action in a historical action sequence into a vectorized representation. The specific process includes: converting each word in each action statement of the historical action sequence into a word vector; then determining the term frequency (TF) and inverse document frequency (IDF) of each word; determining the target weight value (i.e., TF-IDF value) of each word based on TF and IDF; and determining the corresponding vectorized representation based on the word vector and TF-IDF value.

[0106] Words can be extracted by extracting behavioral statement templates, and the extracted words can be fed into the Word2Vec model for training. Finally, the word vector of each word can be obtained from the trained Word2Vec model.

[0107] This application proposes a specific vectorization scheme, which extracts words from behavioral statements, combines them with contextual information, converts the words into word vectors, determines the target weight value through word frequency and inverse document frequency, and then obtains a vectorized representation quickly and accurately based on the word vectors and the target weight value.

[0108] In practical applications, when determining the corresponding vectorized representation based on word vectors and target weight values, for each word, the word vector can be multiplied by the target weight value of the corresponding word to obtain the target vector; finally, the target vectors are weighted and averaged to obtain the vectorized representation.

[0109] The embodiments of this application use a weighted average method to make the resulting vectorized representation have rich contextual information, thereby improving the accuracy of anomaly detection and enabling the detection of hidden abnormal behaviors.

[0110] Figure 2 A schematic diagram illustrating a specific abnormal behavior detection process provided in one embodiment of this application is shown. For example... Figure 2As shown, a specific implementation process is proposed. Database access logs are input into the preprocessing model 201, mapped to templates, and then vectorized using Word2Vec and TF-IDF techniques. Then, the prediction time-series model and the reconstruction network are constructed and trained to obtain the anomaly detection model 202. The model training and actual detection of abnormal behavior specifically include steps 1 to 13, where steps 1 to 8 are the model construction and training process, and steps 9 to 13 are the actual detection process of abnormal behavior.

[0111] Step 1: Data Collection: Collect normal behavior sequences from the database offline to form a set of normal behavior sequences. This set can be used as training samples and normal behavior sequence samples in the above embodiments.

[0112] Step 2: Data preprocessing: After obtaining the normal behavior sequence, the dataset is cleaned and noise is removed using feature engineering techniques to finally generate the training dataset.

[0113] Step 3: Extract Behavioral Statement Templates: For the training dataset, each behavioral statement is cleaned using a data cleaning tool (such as Drain) to remove variable parameters. Ultimately, each behavioral statement is converted into a template, which consists of multiple words. In this embodiment, each template is mapped to a single Key value. For example, the template "delete from mac where mac=$1" corresponds to k1.

[0114] Step 4: Train the word vector model: Feed the extracted words into the Word2Vec model for training, and finally obtain the word vector of each word from the trained Word2Vec model.

[0115] Step 5: Calculate the TF-IDF value of each word: Treat each line of the template as an article and calculate the TF-IDF value of each word.

[0116] Step 6: Action Statement Vectorization: Convert each word in an action statement into a word vector and calculate the TF-IDF value of each word. Multiply each word vector by its TF-IDF value. Finally, perform a weighted average of these processed vectors to obtain the vectorized representation of each action statement.

[0117] Step 7: Predictive Temporal Model Training: After converting each action statement in the training dataset into its corresponding vectorized representation, the vectorized representation is input into a Bidirectional Long Short-Term Memory (BiLSTM) predictive temporal model for training. The BiLSTM temporal model learns the features of normal action sequences in the training dataset to predict the next action. The model adjusts its parameters based on the loss function values ​​generated by comparing its predicted and actual actions, thereby improving the model's prediction accuracy.

[0118] Step 8: Reconstructing the Network Training: Input the vectorized representation of each action statement in the training dataset into the reconstruction network for training. The reconstruction network, having learned the features of normal behavior sequences, should have a reconstruction error value for normal behavior sequences that is significantly smaller than the reconstruction error value for abnormal behavior sequences, thus enabling the identification of which behavior sequences belong to abnormal behavior sequences.

[0119] Step 9: Online Model Deployment: After training the detection model (including the prediction time series model and the reconstructed network), deploy the detection model in the online service center for real-time online intrusion detection.

[0120] Step 10: Request preprocessing: Process the historical behavior sequence using the data preprocessing operations and statement vectorization operations from Steps 2 to 6.

[0121] Step 11: Sliding Window Algorithm for Anomaly Detection: After the BiLSTM prediction time series model is trained, anomaly detection will be performed using a sliding window method, that is, based on the behavior sequence vector (A1...A) within the second sliding window. n Predict the next action and generate the vector K for the first predicted action. n+1 If the first predicted behavior vector K n+1 With the first actual behavior vector A n+1 If the similarity does not meet the similarity condition, the first actual behavior is considered abnormal, and step 12 is performed; otherwise, the second sliding window is moved backward by one unit (A2...A). n+1 Then, repeat step 11.

[0122] Step 12: Reconstruct the network to locate abnormal behavior range: When abnormal behavior A is detected in step 11... n Then from A n+1 Begin by performing anomaly detection on the reconstructed network using a first sliding window of length L. If the second row is a sequence segment (A... n+1 ...A n+LIf the reconstruction error between the first and second behavior sequence segments exceeds the reconstruction threshold, then an abnormal behavior is considered to exist in the second behavior sequence segment. The first sliding window is then moved backward by one unit, and reconstruction detection continues for the new second behavior sequence segment until (A) n+m ...A n+m+L If the reconstruction error value corresponding to (A) is lower than the reconstruction threshold, then (A) is considered to be... n+m ...A n+m+L All of these are considered normal behaviors, meaning the final judgment (A) is as follows: n ...A n+m-1 This is a sequence of abnormal behaviors, which allows for precise location of the abnormal behavior range.

[0123] Step 13: Continue with the sliding window algorithm for anomaly detection: After reconstructing the network to locate the abnormal behavior range, continue from behavior A. n+m Begin executing step 11 to detect abnormal behavior.

[0124] In practice, during the offline model training phase, data acquisition tools are first used to collect normal access behavior logs of all databases, ultimately generating a training dataset of normal database behavior. Let the training dataset be D.

[0125] Then, feature engineering techniques are used to clean the training dataset. After that, word vectorization techniques Word2Vec and TF-IDF are combined to generate a vectorized representation for each behavior.

[0126] Specifically, the behavior statements in each line of the database behavior log are first extracted using the log preprocessing tool Drain, and the variable parameters of each behavior statement are extracted. Each behavior statement then corresponds to a template key. Next, the words of each behavior statement are extracted using the NLTK tool, and these words are then fed into the Word2Vec model for training. Finally, the word vectors of each word can be obtained from the trained Word2Vec model. The vectorization operation of the words in the template is shown in formula (1).

[0127]

[0128] Where w represents a word, v represents the word vector of each word, and m is the number of words.

[0129] In addition, to obtain information such as the weight and frequency of words in all behaviors, TF-IDF is used to obtain the frequency value of each word. The calculation formula of TF-IDF is shown in formula (2), where TF-IDF... i，j Word frequency (tf) i,j and inverted text frequency IDFi,j The product of , where i represents a word and j represents the j-th line vector of long text.

[0130] tfidf i,j =tf i,j ×idf i,j (2)

[0131] Finally, the word vectors corresponding to each word in the template and their TF-IDF values ​​are multiplied together and then summed to obtain the vectorized representation of each action statement template. The specific formula is shown in formula (3).

[0132]

[0133] Where V represents the vectorized representation of each action statement template, w i V represents the TF-IDF value of each word. i The word vector representation of each word.

[0134] Figure 3 This illustration shows a schematic diagram of a detection process based on a sliding window and reconstruction network algorithm according to an embodiment of this application. Figure 3 As shown, multiple behavioral statements (i.e., labels L1 to Ln) are first obtained from the behavioral statement vectorization module 301, resulting in multiple behavioral vector sequences. After passing through a Long Short-Term Memory (LSTM) network block, these sequences are concatenated by the vector concatenation module 302. The sequences then pass through the encoder 303, the hidden space 304, and the decoder 305 in sequence to locate abnormal behavioral sequence segments.

[0135] As can be seen, after obtaining the final training sample set, the BiLSTM prediction time series model in the sliding window algorithm is used to predict the behavior vector sequence (A1...A n The information is input into the model for training, enabling the time-series prediction model to learn the behavioral sequence information of normal behavior. Specifically, as shown in formula (4).

[0136] O n =BiLSTM(A1,A2,...,A) n (4)

[0137] Among them, O n This represents the model's output after receiving a sequence of normal behavior vectors as input, indicating the predicted next behavior. The output is represented as a vector.

[0138] Furthermore, the same training sample set can be input into the reconstructed network model for training. The sequence of action vectors (B1...B2) is defined in units of window length L2. nThe input is fed into the reconstruction network model for training, enabling the reconstruction network model to learn the behavioral sequence information of normal behavior and minimize the reconstruction error value of the normal behavior sequence vector. The encoder and decoder are usually implemented using a neural network structure. This method selects a Long Short-Term Memory (LSTM) neural network as the autoencoder, so that the reconstruction network model can better learn the normal behavioral feature representation of the behavioral sequence data. Specifically, as shown in formula (5).

[0139]

[0140] In the above formula, B represents the vector sequence input to the autoencoder. F(·) represents the encoder function, g(·) represents the decoder function, Z represents the encoder output vector, and B' represents the decoder output. The goal of the autoencoder is to make the input and output of a normal behavior sequence as close as possible (to minimize the reconstruction error), while maximizing the difference between the input and output of an abnormal behavior sequence (to maximize the reconstruction error).

[0141] After training the detection model using an abnormal behavior detection method based on sliding window and reconstructed network algorithm during the offline model training phase, the model is deployed to the online service center through deployment tools for real-time detection.

[0142] After obtaining the database access behavior log, the system uses steps 2 to 6 to obtain the vectorized representation of each behavior. Figure 4 A flowchart for the vectorization of behavioral statements provided in this application embodiment; such as Figure 4 As shown, the behavior sequence is input into the single extraction module 401, and then the Word2Vec module 402 and TF-IDF technology 403 are used to perform word segmentation and weight calculation respectively, and finally the vectorized representation of the behavior statement is obtained.

[0143] After the behavior is vectorized, the vector sequence is input into the detection model. The sliding window algorithm module in the detection model first determines the existence of abnormal behavior, and then locates the abnormal behavior range through the reconstruction network algorithm, and finally determines all abnormal behaviors. As shown in formula (6).

[0144]

[0145] Where D i Representing the dataset, A i V represents the behavior log of preprocessing. i Represents a log vector, O i This represents the output after passing through the BiLSTM. If an anomaly is detected, it is input to the autoencoder to detect the anomaly sequence, and the final output is the anomaly sequence A. n A n+1,...A m .

[0146] In practical implementation, it is necessary to determine whether the first actual behavior is abnormal. The specific determination method is not limited; any solution can be selected based on the actual situation. This application provides a specific determination solution.

[0147] As mentioned above, the acquired historical behavior sequence includes a first behavior sequence segment and a first actual behavior. All behaviors in the first behavior sequence segment preceding the first actual behavior are normal. Therefore, if the first actual behavior is determined to be an abnormal behavior, before obtaining the next actual behavior and thus the second actual behavior, the first behavior sequence segment is first input into a pre-trained behavior prediction time-series model to predict the next behavior of the first behavior sequence segment, resulting in the first predicted behavior. Then, if the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition, the first actual behavior is determined to be an abnormal behavior.

[0148] There are no restrictions on the similarity criteria here; they can be determined based on the actual situation. For example, the similarity between the first predicted behavior and the first actual behavior can be calculated, and then it can be determined whether the similarity is greater than the similarity threshold. If it is not greater, then it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity criteria.

[0149] In this embodiment, the next action is predicted by the first action sequence segment, and then the predicted first action is compared with the first actual action. If the similarity does not meet the similarity condition, the first actual action is determined to be abnormal. In this way, it is possible to quickly determine whether the first actual action is abnormal.

[0150] This application provides another specific scheme for similarity conditions. First, the set of all possible actions for the next action sequence segment is obtained; the set of actions includes the first actual action. Then, the similarity between the first predicted action and each action in the set of actions is obtained; and the actions in the set of actions are sorted in descending order of similarity to the first predicted action. If the first actual action is not among the first M actions in the sorted list, it is determined that the similarity between the first predicted action and the first actual action does not satisfy the similarity condition.

[0151] Here, M is a positive integer, and its specific size can be set according to the actual situation. If the similarity of the first actual behavior ranks high in the set of behaviors, it indicates that the first actual behavior and the first predicted behavior are sufficiently similar, and the similarity between the first predicted behavior and the first actual behavior meets the similarity condition. Conversely, if the similarity of the first actual behavior ranks low in the set of behaviors, it indicates that the similarity between the first actual behavior and the first predicted behavior is low, and the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition.

[0152] Based on the similarity to the first predicted behavior, the embodiments of this application rank all possible behaviors for the next time, and then determine whether the actual behavior ranks high, thereby quickly determining whether the actual behavior is sufficiently similar to the first predicted behavior.

[0153] As mentioned above, the first action sequence segment is input into a pre-trained action prediction time series model to predict the next action of the first action sequence segment and obtain the first predicted action. Before this, it is necessary to build and train the prediction time series model. This application provides a specific solution.

[0154] First, an initial behavior prediction time-series model is constructed, and then training samples are obtained. The training samples include behavior sequence segments and the next actual behavior of the behavior sequence segments. Next, the behavior sequence segments are input into the initial behavior prediction time-series model to predict the next behavior of the behavior sequence segments, thus obtaining the second predicted behavior, and the loss function value between the second predicted behavior and the third actual behavior is determined.

[0155] If the loss function value does not meet the iteration stopping condition, the parameters of the initial behavior prediction time series model are adjusted, the training samples are updated, and the process returns to inputting the behavior sequence segment samples into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment samples, thus obtaining the second predicted behavior. In other words, the iteration is repeated if the loss function value does not meet the iteration stopping condition to adjust the model parameters and improve the model's prediction accuracy.

[0156] If the loss function value satisfies the iteration stopping condition, the initial behavior prediction time series model is determined as the behavior prediction time series model.

[0157] The specific content of the above-mentioned iteration stopping condition is determined according to the actual situation, and it can be that the loss function value tends to remain unchanged.

[0158] The embodiments of this application train a prediction time series model based on training samples. By continuously iterating and adjusting the model parameters, the prediction time series model can accurately predict the first predicted behavior based on the historical behavior sequence.

[0159] This application provides a fine-grained detection system for concealing abnormal behavior in databases, used to implement the above-described method. Figure 5 This is an architecture diagram of a fine-grained detection system for hidden abnormal behavior in databases. Figure 5 As shown, the detection system architecture 501 includes an interface layer, a business logic layer, and a data support layer.

[0160] The interface layer includes an Application Programming Interface (API) interface 502. The business logic layer includes a training phase and a detection phase. The training phase involves modules such as a data preprocessing module 503, a feature vectorization module 504, and a model training module 505. The detection phase involves modules such as a feature processing module 506, an anomaly detection module 507, and an interval localization module 508. The data support layer includes a database 509 and a real-time acquisition module 510. The following describes some of the functional modules:

[0161] API interface 502 is a functional module that provides interface calls between modules within the system.

[0162] Data preprocessing module 503 is a module that obtains normal behavior logs from database 509, performs data cleaning and behavior statement vectorization on the log dataset, and realizes the functionality of data training.

[0163] The model training module 505 is a functional module that provides model training and other functions, based on the database 509 anomaly hidden behavior detection method implemented by sliding window and reconstruction network algorithm.

[0164] The feature vectorization module 504 is a functional module that performs feature vectorization on the collected database access behavior statements 509.

[0165] The anomaly detection module 507 is a functional module that uses an anomaly detection model to perform inference calculations on the vectorized database access behavior statements 509 and detect anomalies.

[0166] The principles and features of the embodiments of this application are described below with reference to the accompanying drawings. The examples given are only for explaining the solution of this application and are not intended to limit the scope of this application.

[0167] This embodiment discloses a method for detecting abnormal behavior, which can be implemented based on the aforementioned detection system architecture 501. This system includes nine functional modules: an API interface 502, a data preprocessing module 503, a feature vectorization module 504, a model training module 505, a feature processing module 506, an anomaly detection module 507, an interval localization module 508, a database, and a real-time acquisition module 510. The specific steps of this method are as follows:

[0168] Step 20: Training data acquisition and processing. During the offline training phase, the system uses the API call to obtain the set D of all normal behavior statement log sequences in the database, and then sends the set to the data processing module. After receiving the data, the data processing module performs vectorization operation on the behavior sequence and finally obtains a long text vector V, which is sent to the sliding window module; as shown in formula (7).

[0169]

[0170] Step 21: Offline training of the sliding window model. After receiving the input sample V, the sliding window module can set the length of the second sliding window to L, and input the input samples one by one into the BiLSTM prediction time series model in sequence, using the sliding window as the unit, to learn the normal behavior sequence; as shown in formula (8).

[0171]

[0172] Where x i Represents a vectorized action statement. n This represents the output after passing through the sliding window module, i.e., the next behavior after its predicted behavior sequence. If the actual next behavior is not similar to the output, it is judged as abnormal. The similarity judgment method used is cosine similarity, as shown in formula (9).

[0173]

[0174] Step 22: Offline training of the reconstructed network model. The same training data is sent to the reconstructed network model for offline training. The window size L is set, and the normal sample vectors within the window are reconstructed so that the model can have a smaller reconstruction error when facing normal behavior, and a larger reconstruction error when facing abnormal behavior. Finally, by setting a reconstruction threshold, the model can identify whether the behavior sequence segment is normal; as shown in formula (10).

[0175]

[0176] The reconstruction error can be calculated using the cross-entropy loss function.

[0177] Step 23: Abnormal Behavior Detection. After the model training is complete, fine-grained abnormal behavior detection can begin. First, the collected data is vectorized in the feature processing module 506 to obtain a vectorized representation of the behavior. The vector sequence is then input into the anomaly detection module 507. Abnormal behavior is first detected by the sliding window module, and then the abnormal behavior is precisely located by the reconstruction network module, ultimately generating the abnormal behavior range.

[0178] The specific process of the embodiments of this application is described below with reference to examples:

[0179] Assuming there are N databases, each recording behavioral logs, the specific implementation process is as follows:

[0180] The specific steps for acquiring and processing training data in step 20 are as follows:

[0181] Step 20.1: In the offline training phase, the data processing module uses the database read call interface provided by the API interface 502 module to read all normal database behavior sequences, and then performs data cleaning and other operations on the original data to obtain a usable dataset D. Table 1 shows an example of the collected normal database behavior sequences.

[0182] Table 1 Examples of Normal Behavioral Sequences

[0183]

[0184] Step 20.2: After cleaning the raw data, the feature vectorization module 504 inputs the words in each action sentence into the Word2Vec model as a bag-of-words for training. The finally trained Word2Vec model will output W for each word. i Provides a unique word vector representation w i Then, the TF-IDF value of each word is calculated, and multiplied by the word vector of each word to obtain the final word vector representation v. i Then, the vectors of each word in the action statement are weighted and averaged to obtain a vectorized representation V of the action statement. i .

[0185] The specific steps for training the concealed abnormal behavior detection model in step 21 are as follows:

[0186] Step 21.1: After receiving the vectorized data, the sliding window module sets the sliding window size L and inputs the input samples one by one into the BiLSTM in sequence, using the sliding window as the unit, to learn the normal behavior sequence;

[0187] Step 21.2: The same training data is sent to the reconstructed network model for offline training. A window size L is set, and normal sample vectors within the window are reconstructed. This ensures that the model has a smaller reconstruction error when dealing with normal behavior, but a larger reconstruction error when dealing with abnormal behavior. Finally, a threshold Q is set to enable the model to identify whether the behavior range is normal.

[0188] The specific steps for anomaly detection in step 22 are as follows:

[0189] Step 22.1: The data preprocessing module 503 in the detection model first preprocesses the read data D to generate output A, and then calls the feature processing module 506 to semantically vectorize the behavioral statement to generate vector V.

[0190] Step 22.2: After the behavioral statement is converted into a semantic vector V, it is input into the sliding window module to detect hidden abnormal behaviors and finally determine the abnormal behavior number i, which is then input into the reconstruction network module.

[0191] Step 22.3: Input the abnormal behavior index i into the reconstructed network module, set the window size L, and process the vector sequence {V} within the window. i V i+1 ,...,V i+L-1 The system reconstructs the behavior sequence within a window based on whether the reconstructed loss value exceeds a reconstruction threshold Q. If abnormal behavior exists, the system continues to slide and assess the behavior; if all behavior is normal, the abnormal behavior interval {V} is determined. i V i+1 ,...,V m Then return to step 22.1 and start re-detecting abnormal behavior from sequence number m until all behaviors have been detected.

[0192] This application proposes a fine-grained detection method for hidden abnormal behavior in databases based on sliding window and reconstruction network. On the basis of the sliding window model, a reconstruction network is introduced to perform fine-grained abnormal behavior detection, which can accurately locate specific abnormal behaviors in long behavior sequences.

[0193] To address the aforementioned technical problems, embodiments of this application also provide a device for detecting abnormal behavior. Figure 6 A schematic diagram of the structure of the abnormal behavior detection device provided in an embodiment of this application is shown. Figure 6 As shown, the device includes the following modules:

[0194] The first acquisition module 601 is used to acquire the historical behavior sequence of accessing the target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and all behaviors in the first behavior sequence segment are normal behaviors;

[0195] The second acquisition module 602 is used to acquire the next actual behavior of the first actual behavior and obtain the second actual behavior when it is determined that the first actual behavior is an abnormal behavior.

[0196] The first determining module 603 is used to determine the corresponding first sliding window based on the second actual behavior; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and N consecutive behaviors thereafter; N is a positive integer;

[0197] Input module 604 is used to input the second row of sequence segments in the first sliding window into the pre-built reconstruction network for anomaly detection;

[0198] The sliding module 605 is used to slide the first sliding window one action backward on the historical action sequence when the second action sequence segment is an abnormal action sequence segment, to obtain the updated first sliding window, and to trigger the input module 604 until the second action sequence segment is a normal action sequence segment.

[0199] The second determining module 606 is used to determine the behavior in the historical behavior sequence that is located between the first behavior sequence segment and the normal second behavior sequence segment as abnormal behavior.

[0200] In some embodiments, the input module 604 is specifically used for:

[0201] The second line sequence segment is input into the reconstruction network to obtain the reconstruction line sequence segment;

[0202] Determine the reconstruction error value between the second-line sequence segment and the reconstructed sequence segment;

[0203] If the reconstruction error value is greater than the reconstruction threshold, the second line sequence segment is determined to be an abnormal line sequence segment.

[0204] In some embodiments, the abnormal behavior detection device further includes:

[0205] The vectorization module is used to vectorize each behavior in the historical behavior sequence after obtaining the historical behavior sequence of accessing the target database, so as to obtain a vectorized representation.

[0206] The input module 604 is specifically used to vectorize the corresponding rows in the second row sequence segment and input them into the reconstruction network for anomaly detection.

[0207] The first prediction module is specifically used to vectorize the corresponding behavior in the first behavior sequence segment and input it into the pre-trained behavior prediction time series model to obtain the first predicted behavior.

[0208] In some embodiments, the vectorization module is specifically used for:

[0209] Convert each word in each action statement in the historical action sequence into a word vector;

[0210] Determine the word frequency and reverse document frequency for each word;

[0211] The target weight value of each word is determined based on word frequency and inverse document frequency.

[0212] Based on word vectors and target weight values, the corresponding vectorized representation is determined.

[0213] In some embodiments, the vectorization module is specifically used to: for each word, multiply the word vector by the target weight value of the corresponding word to obtain the target vector;

[0214] The target vector is weighted and averaged to obtain a vectorized representation.

[0215] In some embodiments, the abnormal behavior detection device further includes:

[0216] The third acquisition module is used to acquire normal behavior sequence samples before inputting the second behavior sequence segment in the first sliding window into the pre-built reconstruction network for anomaly detection;

[0217] The extraction module is used to extract feature information from normal behavior sequence samples;

[0218] The first building block is used to train and reconstruct the network based on feature information.

[0219] In some embodiments, the abnormal behavior detection device further includes:

[0220] The first prediction module is used to obtain the next actual behavior of the first actual behavior when the first actual behavior is determined to be an abnormal behavior. Before obtaining the second actual behavior, the first behavior sequence segment is input into the pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment and obtain the first predicted behavior.

[0221] The second building module is used to build the initial behavior prediction time series model;

[0222] The fourth acquisition module is used to acquire training samples; the training samples include behavior sequence segment samples and the next third actual behavior of the behavior sequence segment samples;

[0223] The second prediction module is used to input the behavior sequence segment sample into the initial behavior prediction time series model, predict the next behavior of the behavior sequence segment sample, and obtain the second predicted behavior.

[0224] The third determination module is used to determine the loss function value between the second predicted action and the third actual action;

[0225] The adjustment module is used to adjust the parameters of the initial behavior prediction time series model and update the training samples when the loss function value does not meet the iteration stopping condition. It also returns the steps of inputting behavior sequence segment samples into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment samples and obtain the second predicted behavior.

[0226] The fourth determination module is used to determine the initial behavior prediction time series model as the behavior prediction time series model when the loss function value meets the iteration stopping condition.

[0227] The fifth determination module is used to determine that the first actual behavior is an abnormal behavior when the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition.

[0228] In some embodiments, the abnormal behavior detection device further includes:

[0229] The fifth acquisition module is used to acquire the set of all possible behaviors for the next time of the first behavior sequence segment before determining that the first actual behavior is an abnormal behavior if the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition; the set of behaviors includes the first actual behavior.

[0230] The sixth acquisition module is used to acquire the similarity between the first predicted behavior and each behavior in the behavior set;

[0231] The sorting module is used to sort the behaviors in the behavior set in descending order of similarity to the first predicted behavior.

[0232] The sixth determination module is used to determine that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition when the first actual behavior does not belong to the first M behaviors in the sorting; M is a positive integer.

[0233] The apparatus provided in this application is the same as the method in the above embodiments, and therefore both have the same embodiments and beneficial effects, which will not be repeated here.

[0234] Figure 7 A schematic diagram of the hardware structure of the abnormal behavior detection device provided in an embodiment of this application is shown. Figure 7 As shown, the device for detecting abnormal behavior may include a processor 701 and a memory 702 storing computer program instructions.

[0235] Specifically, the processor 701 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0236] Memory 702 may include mass storage for data or instructions. For example, and not limitingly, memory 702 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 702 may include removable or non-removable (or fixed) media. Where appropriate, memory 702 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 702 is non-volatile solid-state memory.

[0237] Memory 702 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0238] The processor 701 reads and executes computer program instructions stored in the memory 702 to implement any of the abnormal behavior detection methods in the above embodiments.

[0239] In one example, the device for detecting abnormal behavior may also include a communication interface 703 and a bus 704. The processor 701, memory 702, and communication interface 703 are connected via the bus 704 and communicate with each other.

[0240] The communication interface 703 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0241] Bus 704 includes hardware, software, or both, that couples components of a device for detecting anomalous behavior together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 704 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0242] Furthermore, in conjunction with the abnormal behavior detection methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the abnormal behavior detection methods in the above embodiments.

[0243] This application also provides a computer program product, including a computer program, which, when executed, implements a method for detecting any of the abnormal behaviors described in the above embodiments.

[0244] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0245] The functional blocks shown in the structural diagram above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0246] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0247] The foregoing flowcharts and / or block diagrams describing an abnormal behavior detection method, apparatus, device, medium, and product according to embodiments of this disclosure have described various aspects of the present disclosure. It should be understood that each block in the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to create a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowcharts and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0248] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting abnormal behavior, characterized in that, include: Obtain the historical behavior sequence of accessing the target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and all behaviors in the first behavior sequence segment are normal behaviors; If the first actual behavior is determined to be an abnormal behavior, the next actual behavior of the first actual behavior is obtained to obtain the second actual behavior; Based on the second actual behavior, determine the corresponding first sliding window; The first sliding window includes a second row sequence segment. The second row sequence segment in the first sliding window corresponding to the second actual action includes the second actual action and N consecutive actions thereafter; N is a positive integer. The second row of the sequence segment in the first sliding window is input into the pre-built reconstruction network for anomaly detection; If the second behavior sequence segment is an abnormal behavior sequence segment, slide the first sliding window one behavior backward on the historical behavior sequence to obtain the updated first sliding window, and return to the step of inputting the second behavior sequence segment in the first sliding window into the pre-built reconstruction network for anomaly detection, until the second behavior sequence segment is a normal behavior sequence segment; The behaviors located between the first behavior sequence segment and the normal second behavior sequence segment in the historical behavior sequence are identified as abnormal behaviors. Abnormal behaviors are detected through the first sliding window to determine the start point of the abnormal behavior. Fine-grained anomaly detection is performed through the reconstruction network to locate the abnormal behavior, determine the end point of the abnormal behavior, and determine the abnormal behavior range. Before obtaining the next actual behavior and thus the second actual behavior after determining that the first actual behavior is an abnormal behavior, the method further includes: The first behavior sequence segment is input into a pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment, thus obtaining the first predicted behavior. Obtain the set of all possible actions for the next occurrence of the first action sequence segment; the set of actions includes the first actual action. The similarity between the first predicted behavior and each behavior in the behavior set is obtained respectively; Based on the order of similarity to the first predicted behavior from largest to smallest, the behaviors in the behavior set are sorted. If the first actual behavior does not belong to the first M behaviors in the ranking, it is determined that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition; M is a positive integer. If the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition, the first actual behavior is determined to be an abnormal behavior.

2. The method for detecting abnormal behavior according to claim 1, characterized in that, The step of inputting the second row of the sequence segment in the first sliding window into the pre-constructed reconstruction network for anomaly detection includes: The second action sequence segment is input into the reconstruction network to obtain the reconstruction action sequence segment; Determine the reconstruction error value between the second behavior sequence segment and the reconstructed behavior sequence segment; If the reconstruction error value is greater than the reconstruction threshold, the second behavior sequence segment is determined to be an abnormal behavior sequence segment.

3. The method for detecting abnormal behavior according to claim 1, characterized in that, After obtaining the historical behavior sequence of accessing the target database, the method further includes: Each behavior in the historical behavior sequence is vectorized into a statement to obtain a vectorized representation; The step of inputting the second row of the sequence segment in the first sliding window into the pre-constructed reconstruction network for anomaly detection includes: The vectorized representations corresponding to each behavior in the second behavior sequence segment are input into the reconstructed network for anomaly detection. The step of inputting the first behavior sequence segment into a pre-trained behavior prediction time-series model to predict the next behavior of the first behavior sequence segment and obtain the first predicted behavior includes: The vectorized representations corresponding to each behavior in the first behavior sequence segment are input into a pre-trained behavior prediction time series model to obtain the first predicted behavior.

4. The method for detecting abnormal behavior according to claim 3, characterized in that, The step of vectorizing each behavior in the historical behavior sequence to obtain a vectorized representation includes: Convert each word in each action statement in the historical action sequence into a word vector; Determine the word frequency and reverse document frequency of each of the aforementioned words; Based on the word frequency and the inverse document frequency, determine the target weight value for each word; Based on the word vectors and the target weight values, the corresponding vectorized representations are determined.

5. The method for detecting abnormal behavior according to claim 4, characterized in that, The step of determining the corresponding vectorized representation based on the word vectors and the target weight value includes: For each of the aforementioned words, the word vector is multiplied by the target weight value corresponding to the word to obtain the target vector; The target vector is weighted and averaged to obtain a vectorized representation.

6. The method for detecting abnormal behavior according to any one of claims 1 to 5, characterized in that, Before inputting the second row sequence segment from the first sliding window into the pre-constructed reconstruction network for anomaly detection, the method further includes: Obtain normal behavior sequence samples; Extract feature information from the normal behavior sequence samples; The reconstructed network is trained based on the aforementioned feature information.

7. The method for detecting abnormal behavior according to claim 1, characterized in that, Before predicting the next behavior of the first behavior sequence segment and obtaining the first predicted behavior in the pre-trained behavior prediction time series model, the method further includes: Construct an initial behavior prediction time series model; Obtain training samples; the training samples include behavior sequence segment samples and the next third actual behavior of the behavior sequence segment samples; The behavior sequence segment sample is input into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample, thus obtaining the second predicted behavior; Determine the loss function value between the second predicted behavior and the third actual behavior; If the loss function value does not meet the iteration stopping condition, adjust the parameters of the initial behavior prediction time series model, update the training samples, and return to the step of inputting the behavior sequence segment sample into the initial behavior prediction time series model to predict the next behavior of the behavior sequence segment sample and obtain the second predicted behavior. If the loss function value satisfies the iteration stopping condition, the initial behavior prediction time series model is determined as the behavior prediction time series model.

8. A device for detecting abnormal behavior, characterized in that, The device includes: The first acquisition module is used to acquire a historical behavior sequence of accessing the target database; the historical behavior sequence includes a first behavior sequence segment and a first actual behavior, the first actual behavior is the next actual behavior of the first behavior sequence segment, and all behaviors in the first behavior sequence segment are normal behaviors; The second acquisition module is used to acquire the next actual behavior of the first actual behavior when it is determined that the first actual behavior is an abnormal behavior, so as to obtain the second actual behavior. The first determining module is used to determine the corresponding first sliding window based on the second actual behavior; the first sliding window includes a second behavior sequence segment, and the second behavior sequence segment in the first sliding window corresponding to the second actual behavior includes the second actual behavior and N consecutive behaviors thereafter; N is a positive integer; The input module is used to input the second row of sequence segments in the first sliding window into the pre-constructed reconstruction network for anomaly detection; The sliding module is used to slide the first sliding window one behavior backward on the historical behavior sequence when the second behavior sequence segment is an abnormal behavior sequence segment, to obtain an updated first sliding window, and return to the step of inputting the second behavior sequence segment in the first sliding window into the pre-built reconstruction network for anomaly detection, until the second behavior sequence segment is a normal behavior sequence segment; The second determining module is used to determine the behavior in the historical behavior sequence that is located between the first behavior sequence segment and the normal second behavior sequence segment as abnormal behavior, detect the abnormal behavior through the first sliding window, determine the start point of the abnormal behavior, and perform fine-grained anomaly detection through the reconstruction network to locate the abnormal behavior, determine the end point of the abnormal behavior, and determine the abnormal behavior interval. The second acquisition module is further configured to, before obtaining the second actual behavior, input the first behavior sequence segment into a pre-trained behavior prediction time series model to predict the next behavior of the first behavior sequence segment, thereby obtaining the first predicted behavior; acquire a set of all possible next behaviors of the first behavior sequence segment; the set of behaviors includes the first actual behavior; acquire the similarity between the first predicted behavior and each behavior in the set of behaviors respectively; sort the behaviors in the set of behaviors based on the order of their similarity to the first predicted behavior from largest to smallest; determine that the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition if the first actual behavior is not among the first M behaviors in the sort; M is a positive integer; and determine that the first actual behavior is an abnormal behavior if the similarity between the first predicted behavior and the first actual behavior does not meet the similarity condition.

9. A device for detecting abnormal behavior, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the abnormal behavior detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the method for detecting abnormal behavior as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the abnormal behavior detection method as described in any one of claims 1 to 7.

Images