Network abnormal behavior analysis method and device, equipment and storage medium

Abstract

The invention discloses a network abnormal behavior analysis method and device, equipment and a storage medium. The method comprises the following steps: acquiring a network activity log of a scene to be detected, and generating an activity set corresponding to the scene to be detected according to the network activity log; constructing a traceability graph and a root cause graph according to the activity sequence of the network entities in the activity set; performing abnormal activity evaluation on the activity set through a time sequence feature capture model to obtain an abnormal activity number of abnormal entities in the activity set; inputting the basic attributes, the abnormal activity number, the traceability graph and the root cause graph of the network entities into a graph neural network classifier to obtain abnormal scores of all the network entities in the scene to be detected; and analyzing the abnormal scores of all the network entities to obtain an abnormal behavior analysis result of the scene to be detected. According to the method, the detection performance of the abnormal behaviors in the network can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of network anomaly detection, and in particular to a method, device, equipment and storage medium for analyzing network abnormal behavior. Background Art

[0002] With the popularization of network applications, network attacks tend to be more complex and diversified, posing a severe challenge to network security. In order to protect privacy and security from malicious network attacks, various anomaly detection technologies have emerged. The core idea of ​​anomaly detection is to analyze network traffic, system logs and other data to find behaviors that do not conform to normal behavior patterns, thereby warning of potential security threats. Unlike signature-based detection methods, anomaly detection does not rely on known attack features, but instead uses data mining, machine learning and other technologies to build a normal behavior model and use it as a benchmark to detect abnormal behavior. However, the anomaly detection technology in the existing technology cannot accurately analyze abnormal behaviors in the network. Summary of the invention

[0003] The present invention provides a method, device, equipment and storage medium for analyzing abnormal network behavior, so as to solve the problem that the methods in the prior art cannot accurately analyze abnormal behaviors in the network.

[0004] According to one aspect of the present invention, a method for analyzing abnormal network behavior is provided, the method comprising:

[0005] Obtaining a network activity log of a scene to be detected, and generating an activity set corresponding to the scene to be detected according to the network activity log;

[0006] Constructing a traceability graph and a root cause graph according to the activity sequence of the network entities in the activity set;

[0007] Performing abnormal activity evaluation on the activity set by using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set;

[0008] Input the basic attributes, number of abnormal activities, traceability graph and root cause graph of the network entity into the graph neural network classifier to obtain the abnormality scores of all network entities in the scene to be detected;

[0009] The abnormal scores of all network entities are analyzed to obtain the abnormal behavior analysis results of the scene to be detected.

[0010] According to another aspect of the present invention, a network abnormal behavior analysis device is provided, the device comprising:

[0011] An acquisition module, used to acquire a network activity log of a scene to be detected, and generate an activity set corresponding to the scene to be detected according to the network activity log;

[0012] A construction module, used to construct a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set;

[0013] An evaluation module, used for evaluating the abnormal activities of the activity set by using a time series feature capture model to obtain the number of abnormal activities of the abnormal entities in the activity set;

[0014] An output module, used to input the basic attributes, number of abnormal activities, traceability graph and root cause graph of the network entity into a graph neural network classifier to obtain anomaly scores of all network entities in the scene to be detected;

[0015] The analysis module is used to analyze the abnormal scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected.

[0016] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising: at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network abnormal behavior analysis method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network abnormal behavior analysis method described in any embodiment of the present invention when executed.

[0020] A network abnormal behavior analysis method, device, equipment and storage medium of an embodiment of the present invention, the method includes: obtaining a network activity log of a scene to be detected, generating an activity set corresponding to the scene to be detected according to the network activity log; constructing a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set; evaluating the abnormal activity of the activity set through a time series feature capture model to obtain the number of abnormal activities of the abnormal entity in the activity set; inputting the basic attributes, the number of abnormal activities, the traceability graph and the root cause graph of the network entity into a graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected; analyzing the abnormal scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected. The method generates an activity set according to the network activity log, constructs a traceability graph and a root cause set according to the activity set, obtains the number of abnormal activities of the abnormal entity through a time series feature capture model, obtains the abnormal score of the network entity through a graph neural network classifier, and finally obtains the abnormal behavior analysis results of the scene to be detected by analyzing the abnormal score, which can improve the detection performance of abnormal behavior in the network and solve the problem that the methods in the prior art cannot accurately analyze abnormal behavior in the network.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A flowchart of a method for analyzing abnormal network behavior provided in Embodiment 1 of the present invention;

[0024] Figure 2 A schematic diagram of a source tracing diagram and a root cause diagram provided by an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of an application of a time series capture model provided by an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of a training graph neural network classifier provided in an embodiment of the present invention;

[0027] Figure 5 A schematic diagram of determining anomaly scores provided by an embodiment of the present invention;

[0028] Figure 6 A schematic diagram of the structure of a network abnormal behavior analysis device provided in Embodiment 2 of the present invention;

[0029] Figure 7 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should belong to the scope of protection of the present invention. It should be understood that the various steps recorded in the method implementation of the present invention can be performed in different orders and / or in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0031] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, any variations of the terms "including" and "having" are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0034] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0035] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0036] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0037] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0038] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0039] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0040] Embodiment 1

[0041] Figure 1 A flow chart of a method for analyzing abnormal network behavior provided in the first embodiment of the present invention is provided. The method can be applied to the situation of analyzing abnormal behavior in the network. The method can be performed by a network abnormal behavior analysis device, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. In this embodiment, the electronic device includes but is not limited to: computers and other devices.

[0042] like Figure 1 As shown, a method for analyzing abnormal network behavior provided by Embodiment 1 of the present invention includes the following steps:

[0043] S110: Acquire a network activity log of a scene to be detected, and generate an activity set corresponding to the scene to be detected according to the network activity log.

[0044] The scene to be detected may be a scene in the network, for example, the scene to be detected may include sending emails, watching videos, reading articles, downloading files, etc. The network activity log may be a log recording information of scene-related activities. The activity set may be a collection of activities or events participated in by entities in the network within a certain time range, and the activities in the activity set may be arranged in order of timestamps.

[0045] In this embodiment, the network activity log of the scene to be detected can be obtained, and the activity set corresponding to the scene to be detected can be generated according to the network activity log. In this embodiment, the scene to be detected obtained can be one or more scenes, and each scene will generate a corresponding activity set.

[0046] In one embodiment, the method of obtaining a network activity log of a scene to be detected and generating an activity set corresponding to the scene to be detected based on the network activity log includes: obtaining a network activity log corresponding to the scene to be detected, wherein the network activity log records operations between multiple network entities; filtering out all operations that can cause data flow and information corresponding to the operations from the network activity log; taking the information corresponding to each operation as an activity and sorting all activities in chronological order to obtain a constructed activity set; wherein each activity in the activity set includes an activity type, a data output entity, and a data input entity.

[0047] The network entity may be a node or object in the network, and the type of the network entity may include a process, a thread, and a file. The operation between network entities refers to the interaction between entities in the network. The data flow direction may be the transmission direction of the data. The information corresponding to the operation may include the related entity and the corresponding activity type. The activity type may include the operation of a process or thread such as read, write, send, and receive. The data output entity may be an entity that outputs data in an activity, and the data input entity may be an entity that receives data in an activity.

[0048] In this embodiment, the network activity log corresponding to the scene to be detected can be obtained, and the operations that can cause data flow can be screened out according to the relevant information of the network entities and the operations between them recorded in the network activity log, and the screened operations can be sorted in chronological order, and each operation and the corresponding information can be used as an activity to obtain a constructed activity set. Exemplarily, assuming that there are m scenes in total, all operations that cause data flow can be sorted by timestamp to obtain an activity set E of all scenes, E includes multiple activity sets, each activity set records the activity type (process thread operations such as reading, writing, sending and receiving), data output entity and data input entity.

[0049] S120: Construct a source traceability graph and a root cause graph according to the activity sequences of the network entities in the activity set.

[0050] Among them, the activity sequence can refer to the activity sequence of entities arranged in chronological order in the activity set. The traceability diagram can be a graphical tool used to represent the interaction relationship between various objects in the system. It can construct a directed graph containing time and space information by recording the events that occur in the system. The root cause diagram (fishbone diagram) can be a method to discover the "root cause" of the problem, which can quickly find the potential root cause of the problem.

[0051] In this embodiment, the data flow direction of the network entity can be determined by the activity sequence of the network entity in the activity set, and the traceability graph G can be constructed according to the entity and the data flow direction. provenance and root cause graph G rca .

[0052] In one embodiment, constructing a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set includes: acquiring the activity sequence directly related to each network entity according to the activity set; constructing a traceability graph according to the data flow direction of each activity sequence, with the network entity as a point, the activity corresponding to the activity sequence as an edge, and the data flow direction of the activity as the direction of the edge; and performing a root cause analysis on the traceability graph to obtain a root cause graph including multiple root causes.

[0053] Among them, root cause analysis is a systematic method that aims to find the root cause of the problem. By deeply analyzing data and related information, the key factors and drivers that lead to the problem can be identified. The root cause can be the node of the initial cause of the causal chain that leads to a certain outcome or consequence.

[0054] In this embodiment, the activity sequence directly related to each network entity can be obtained based on the activity set. When constructing a traceability graph, the network entity can be used as a point, the activity corresponding to the activity sequence as an edge, and the data flow direction of the activity as the direction of the edge to construct a traceability graph. The traceability graph is analyzed for cause, and the root cause in the graph is found to obtain a root cause graph. Exemplarily, given scenario i, all operations that lead to data flow and the network entities involved can be filtered out from the network activity log, and the activity type, data output entity, and data input entity are recorded in chronological order. For all network entities n, i,a (the ath entity in the ith scene) and all activity sequences E directly related to the network entity i,a (Activity sequence of the ath entity in the ith scene), construct the traceability graph G according to the data flow provenance. Then, the root cause analysis is performed on the traceability graph, and the first activity of the network entity is determined according to the timestamp. If the first activity of the network entity is an outgoing edge, it means that the first activity of the network entity will have an impact on other network entities. In this case, the network entity will be regarded as the root cause, and other network entities that are directly or indirectly affected will be regarded as neighbors of the network entity in the root cause graph. Each root cause graph usually has multiple root causes. This root cause refers to the beginning of the data flow, and also refers to the candidate abnormal root cause. The root cause graph G is constructed by connecting the root cause entity and the network entity it affects. rca .

[0055] Figure 2 A schematic diagram of a source tracing diagram and a root cause diagram provided by an embodiment of the present invention, such as Figure 2 As shown in the figure, the network activity log includes 6 operations, with a time sequence of 1-6. Each operation is process 1 reading file 1, process 1 writing file 2, process 2 sending a message to process 1, process 2 sending a message to thread 1, thread 1 reading file 2, and process 3 reading file 2. According to the network activity log, the network entities include process 1, process 2, process 3, thread 1, file 1, and file 2. Based on the network activity log, a traceability graph can be constructed, and the traceability graph can be analyzed to find the root causes file 1 and process 2, so that the root cause graph can be constructed.

[0056] S130 , performing abnormal activity evaluation on the activity set by using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set.

[0057] The time series feature capture model may be a model for capturing behavior features and occurrence probabilities from the time series of activities. The abnormal entity may be an abnormal network entity. The number of abnormal activities may be the number of abnormal activities of the abnormal entity.

[0058] In this embodiment, the activity set can be evaluated for abnormal activities through the time series feature capture model. For abnormal entities in the activity set with abnormal activities, the number of suspected abnormal activities T is recorded. i,a The time series feature capture model f1 in this embodiment can be pre-trained by using a data stream behavior set belonging to all benign scenarios in the training activity set. For example, assuming there are m scenarios in total, the i-th (1≤i≤m) scenario contains n i (n entities of the i-th scene) entities, and c of them are benign scenes, and the remaining (mc) scenes are malignant scenes with malicious attacks. For all the data flow behavior set E belonging to benign scenes in the training activity set benign Train the time series feature capture model f1, use f1 to evaluate the abnormal activities of the entire activity set E, and record the number of suspected abnormal activities T for the entity that initiates the suspected abnormal activity i,a .

[0059] In one embodiment, the abnormal activity evaluation of the activity set through the time series feature capture model to obtain the number of abnormal activities of the abnormal entities in the activity set includes: abnormal activity evaluation of the activities in the activity set through the sliding window in the time series feature capture model to obtain the occurrence probability of each activity; when the occurrence probability of the activity is not among a preset number of activities with the highest probability in the sliding window, the network entity that initiated the activity is regarded as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded; wherein the time series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

[0060] The sliding window may refer to a window formed between the elements pointed to by two pointers. The Long Short-Term Memory (LSTM) model is a time recurrent neural network that is suitable for processing and predicting important events with relatively long intervals and delays in time series.

[0061] In this embodiment, the activities in the activity set can be evaluated for abnormal activities through the sliding window in the time series feature capture model to obtain the occurrence probability of each activity. If the occurrence probability of a certain activity is not among the n activities with the highest probability in the sliding window, the network entity that initiates the activity is regarded as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded.

[0062] The time series feature capture model in this embodiment can be constructed based on the long short-term memory model and the fully connected layer. The specific construction process of the time series feature capture model is as follows: Figure 3 A schematic diagram of an application of a time series capture model provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, for all data flow behavior sets E belonging to benign scenarios in the training activity set E benign , set the sliding window size to k and the scene number to i, and the number of any activity in benign scene i to j. Construct a sliding window combination, i.e. the j+k+1th activity E j+k+1 and its previous k activities E j～j+k Composed sliding window combination (E j～j+k , E j+k+1 ), and use this sliding window combination as the input of the time series feature capture model f1 to capture the long-term and short-term features and their occurrence probability of the k+1th activity after the specific k activities. The long-term features in the long-term and short-term features are the impact of the sliding window of all the activities that have occurred on the probability of the current activity, and the short-term features in the long-term and short-term features are the impact of the current sliding window on the probability of the current activity. In the training process, supervised learning is used to train f1, with E j～j+k is the input, Ej+k+1 For label.

[0063] The trained sliding window LSTM model f1 can be used to evaluate abnormal activities on the entire activity set E. If activity E j+k+1 The z activities with the highest probability of not being predicted by f1 topzf1(E j～j+k ), then E j+k+1 The entity that initiated the suspected abnormal activity is n i,a It will be regarded as a suspected abnormal entity, and the number of suspected abnormal activities of the entity will be recorded. i,a .

[0064] In this embodiment, a long short-term memory model with a sliding window method is used to capture the long-term and short-term characteristics of network traffic, and a graph neural network with root cause analysis is used to extract the behavioral patterns of network activities. This can improve the performance of anomaly detection of network traffic and ensure network security and reliability. It has broad application scenarios in future network abnormal behavior detection.

[0065] S140. Input the basic attributes, number of abnormal activities, traceability graph and root cause graph of the network entity into a graph neural network classifier to obtain the abnormality scores of all network entities in the scene to be detected.

[0066] Among them, basic attributes may include the type of entity, the number of initiators and the number of affected activities. The number of affected may refer to how many operations directly affect the entity, that is, the in-degree of the directed graph, and the in-degree is calculated separately for each type of operation. A graph neural network (GNN) classifier may refer to a neural network model for processing graph structured data. Anomaly scores may be used to indicate the degree of abnormality of network entities.

[0067] In this embodiment, the basic attributes of the network entity, the number of abnormal activities, the traceability diagram and the root cause diagram can be input into the graph neural network classifier, and the results output by the graph neural network classifier can be further analyzed to obtain the anomaly scores of all network entities in the scene to be detected.

[0068] S150: Analyze the abnormal scores of all network entities to obtain abnormal behavior analysis results of the scenario to be detected.

[0069] The abnormal behavior analysis result can be used to indicate whether there is abnormal behavior in the scene to be detected.

[0070] In this embodiment, the abnormal scores of all network entities can be analyzed to obtain the abnormal behavior analysis results of the scene to be detected. For example, the abnormal behavior analysis results can be determined based on the average value of the abnormal scores of all network entities, or based on the top few abnormal scores of all network entities, which is not limited in this embodiment.

[0071] In one embodiment, the abnormal scores of all network entities are analyzed to obtain the abnormal behavior analysis result of the scene to be detected, including: screening out the abnormal score with the highest score from the abnormal scores of all network entities, and using the abnormal score as the abnormal score of the scene to be detected; when the abnormal score of the scene to be detected exceeds an abnormal threshold, determining that the abnormal behavior analysis result of the scene to be detected is that abnormal behavior exists.

[0072] Among them, the abnormality threshold can be set according to the actual situation. When the abnormality score exceeds the abnormality threshold, it is considered that an abnormality exists.

[0073] In this embodiment, the highest anomaly score among all network entities may be used as the anomaly score of the scene to be detected. If the anomaly score of the scene to be detected exceeds an anomaly threshold, it is considered that abnormal behavior exists in the scene to be detected.

[0074] A method for analyzing abnormal network behavior provided by the first embodiment of the present invention includes: obtaining a network activity log of a scene to be detected, generating an activity set corresponding to the scene to be detected according to the network activity log; constructing a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set; evaluating the abnormal activity of the activity set through a time series feature capture model to obtain the number of abnormal activities of the abnormal entity in the activity set; inputting the basic attributes, the number of abnormal activities, the traceability graph and the root cause graph of the network entity into a graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected; analyzing the abnormal scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected. The method generates an activity set according to the network activity log, constructs a traceability graph and a root cause set according to the activity set, obtains the number of abnormal activities of the abnormal entity through a time series feature capture model, obtains the abnormal score of the network entity through a graph neural network classifier, and finally obtains the abnormal behavior analysis results of the scene to be detected by analyzing the abnormal score, which can improve the detection performance of abnormal behavior in the network and solve the problem that the methods in the prior art cannot accurately analyze abnormal behavior in the network.

[0075] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0076] In one embodiment, the basic attributes, number of abnormal activities, tracing graph and root cause graph of the network entity are input into a graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected, including: inputting the basic attributes, number of abnormal activities, tracing graph and root cause graph of the network entity into a graph neural network classifier, and obtaining the embedded feature vectors of all network entities in the scene to be detected through the embedding layer of the graph neural network classifier; obtaining the cluster center of each network entity obtained through the training set; calculating the minimum Euclidean distance between the embedded feature vectors of all network entities in all scenes to be detected and the cluster center of each network entity, to obtain the abnormal scores of all network entities in the scene to be detected.

[0077] Among them, the embedding layer can refer to a network layer in a neural network, which is used to map discrete high-dimensional data (such as text, pictures, audio) to a low-dimensional continuous vector space. The embedding layer can obtain an embedded feature vector. Embedding feature vectors are a technology that maps data (such as text, images, user information) to digital vectors in a high-dimensional space. It can capture the similarities and relationships between data, so that similar data points are close to each other in the vector space. The training set can be used to train the active set of the graph neural network classifier. The cluster center can be the mean (center of mass) of all sample points in a cluster. The Euclidean distance is the "ordinary" (i.e. straight line) distance between two points in the Euclidean space.

[0078] In this embodiment, the embedded feature vectors of all network entities in the scene to be detected can be obtained through the embedding layer of the graph neural network classifier, and the cluster center of each network entity obtained through the training set is obtained, and the minimum Euclidean distance between the embedded feature vectors of all network entities and each cluster center is calculated, and the minimum Euclidean distance is used as the abnormal score of each network entity. The graph neural network classifier in this embodiment only uses benign scenes as training sets, uses supervised learning as the training method, and the label is the scene type to which the network entity belongs. Figure 4 A schematic diagram of a training graph neural network classifier provided by an embodiment of the present invention, such as Figure 4 As shown, the graph neural network classifier can be trained through the traceability atlas and the root cause atlas. The traceability atlas is a collection of traceability graphs, the root cause atlas is a collection of root cause graphs, and the scene set is a collection of scenes.

[0079] For example, according to the calculated number of suspected abnormal activities of the network entity T i,a , and compare it with the basic attributes of network entities (entity type, number of initiators and affected numbers of various activities), the traceability graph G provenanc and root cause graph G rcaTogether they serve as the input of the deep learning graph neural network classifier f2; all network entities are embedded using the trained graph neural network classifier f2 to obtain the embed feature vectors V of all network entities all , and obtain the cluster center KMC of each network entity train , calculate the embed features V of all network entities all To each cluster center KMC train The minimum Euclidean distance of each network entity to the benign entity cluster center is used as the anomaly score; the maximum value of the network entity anomaly score in each scenario is calculated and used as the anomaly score of the scenario. The scenario with an anomaly score exceeding a certain threshold is considered an abnormal scenario. For example, Figure 5 A schematic diagram of determining anomaly scores provided by an embodiment of the present invention is as follows: Figure 5 As shown, the training scene set is a data set used to calculate the cluster center. The training scene set can remain unchanged. When it is necessary to detect a scene to be detected, the scene to be detected is used as a test scene set, and the abnormality score of the test scene set is determined in combination with the training scene set.

[0080] In one embodiment, obtaining the cluster center of each network entity obtained through the training set includes: obtaining a data set that only includes benign scenarios; calculating the embedded feature vectors of all network entities in the training set through a trained graph neural network classifier; clustering the embedded feature vectors of all network entities in the training set to obtain the cluster center of each network entity.

[0081] Among them, a benign scenario may be a scenario that does not generate abnormal behavior in the network.

[0082] In this embodiment, the cluster center of each network entity can be calculated using a data set that only includes benign scenarios. For example, the embed feature vector V of all network entities in the training set can be obtained using the trained f2. train , for V train Perform kMeans clustering to obtain the cluster center KMC of each benign scenario train , each benign scenario has a corresponding cluster center.

[0083] This embodiment uses the long short-term memory model to analyze the behavior patterns of suspected abnormal events before and after a certain time interval. By introducing the traceability graph, it can reflect the relationship between network entities and network events. By performing root cause analysis on the traceability graph, the key points of interest in the graph (i.e., the overall characteristics of the graph and the embedded characteristics of the nodes) are captured, and the anomaly detection scores for various scenarios are successfully calculated, which can be further applied in more complex environments.

[0084] Embodiment 2

[0085] Figure 6 This is a schematic diagram of the structure of a network abnormal behavior analysis device provided in the second embodiment of the present invention. The device can be applied to the situation of analyzing abnormal behavior in the network, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. Figure 6 As shown, the device comprises:

[0086] An acquisition module 210 is used to acquire a network activity log of a scene to be detected, and generate an activity set corresponding to the scene to be detected according to the network activity log;

[0087] A construction module 220, configured to construct a source traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set;

[0088] An evaluation module 230 is used to evaluate the abnormal activities of the activity set by using a time series feature capture model to obtain the number of abnormal activities of the abnormal entities in the activity set;

[0089] An output module 240 is used to input the basic attributes, the number of abnormal activities, the traceability graph and the root cause graph of the network entity into a graph neural network classifier to obtain anomaly scores of all network entities in the scene to be detected;

[0090] The analysis module 250 is used to analyze the abnormal scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected.

[0091] The present embodiment provides a network abnormal behavior analysis device, including: an acquisition module, used to acquire a network activity log of a scene to be detected, and generate an activity set corresponding to the scene to be detected according to the network activity log; a construction module, used to construct a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set; an evaluation module, used to evaluate the abnormal activities of the activity set through a time series feature capture model, and obtain the number of abnormal activities of the abnormal entities in the activity set; an output module, used to input the basic attributes of the network entity, the number of abnormal activities, the traceability graph and the root cause graph into a graph neural network classifier, and obtain the abnormal scores of all network entities in the scene to be detected; an analysis module, used to analyze the abnormal scores of all network entities, and obtain the abnormal behavior analysis results of the scene to be detected. By generating an activity set based on the network activity log, and constructing a traceability graph and a root cause set based on the activity set, the number of abnormal activities of the abnormal entity is obtained through the time series feature capture model, and the abnormal score of the network entity is obtained through the graph neural network classifier. Finally, by analyzing the abnormal score, the abnormal behavior analysis result of the scene to be detected is obtained. This can improve the detection performance of abnormal behavior in the network and solve the problem that the methods in the prior art cannot accurately analyze abnormal behavior in the network.

[0092] Furthermore, the acquisition module 210 is specifically used for:

[0093] Obtaining a network activity log corresponding to the scenario to be detected, wherein the network activity log records operations between multiple network entities;

[0094] Filtering all operations that can cause data flow and information corresponding to the operations from the network activity log;

[0095] Take the information corresponding to each operation as an activity and sort all activities in chronological order to obtain a constructed activity set;

[0096] Each activity in the activity set includes an activity type, a data output entity and a data input entity.

[0097] Furthermore, the construction module 220 is specifically used for:

[0098] Acquire an activity sequence directly related to each network entity according to the activity set;

[0099] According to the data flow direction of each activity sequence, a traceability graph is constructed with network entities as points, activities corresponding to the activity sequence as edges, and the data flow direction of the activity as the direction of the edge;

[0100] Performing a root cause analysis on the source tracing diagram to obtain a root cause diagram including multiple root causes.

[0101] Furthermore, the evaluation module 230 is specifically configured to:

[0102] Performing abnormal activity evaluation on the activities in the activity set through a sliding window in a time series feature capture model to obtain the occurrence probability of each activity;

[0103] When the occurrence probability of the activity is not among the preset number of activities with the highest probability in the sliding window, the network entity initiating the activity is regarded as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded;

[0104] Among them, the time series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

[0105] Furthermore, the output module 240 is specifically used for:

[0106] Input the basic attributes, abnormal activity number, source traceability graph and root cause graph of the network entity into the graph neural network classifier, and obtain the embedded feature vectors of all network entities in the scene to be detected through the embedding layer of the graph neural network classifier;

[0107] Obtain the cluster center of each network entity obtained through the training set;

[0108] The minimum Euclidean distance between the embedded feature vectors of all network entities in all scenes to be detected and the cluster center of each network entity is calculated to obtain the anomaly scores of all network entities in the scenes to be detected.

[0109] Furthermore, the obtaining of the cluster center of each network entity obtained through the training set includes:

[0110] Obtain a dataset that includes only benign scenarios;

[0111] Calculate the embedded feature vectors of all network entities in the training set through the trained graph neural network classifier;

[0112] The embedded feature vectors of all network entities in the training set are clustered to obtain the cluster center of each network entity.

[0113] Furthermore, the analysis module 250 is specifically used for:

[0114] Filtering out the anomaly score with the highest score from the anomaly scores of all network entities, and using the anomaly score as the anomaly score of the scene to be detected;

[0115] When the abnormality score of the scene to be detected exceeds the abnormality threshold, it is determined that the abnormal behavior analysis result of the scene to be detected is that abnormal behavior exists.

[0116] The above-mentioned network abnormal behavior analysis device can execute the network abnormal behavior analysis method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Embodiment 3

[0118] Figure 7 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0120] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network abnormal behavior analysis method.

[0122] In some embodiments, the network abnormal behavior analysis method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network abnormal behavior analysis method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the network abnormal behavior analysis method in any other appropriate manner (e.g., by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for analyzing abnormal network behavior, characterized in that: The method comprises: Obtaining a network activity log of a scene to be detected, and generating an activity set corresponding to the scene to be detected according to the network activity log; Constructing a traceability graph and a root cause graph according to the activity sequence of the network entities in the activity set; Performing abnormal activity evaluation on the activity set by using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set; Input the basic attributes, number of abnormal activities, traceability graph and root cause graph of the network entity into the graph neural network classifier to obtain the abnormality scores of all network entities in the scene to be detected; The abnormal scores of all network entities are analyzed to obtain the abnormal behavior analysis results of the scene to be detected.

2. The method according to claim 1, characterized in that The obtaining of a network activity log of a scene to be detected, and generating an activity set corresponding to the scene to be detected according to the network activity log, includes: Obtaining a network activity log corresponding to the scenario to be detected, wherein the network activity log records operations between multiple network entities; Filtering all operations that can cause data flow and information corresponding to the operations from the network activity log; Take the information corresponding to each operation as an activity and sort all activities in chronological order to obtain a constructed activity set; Each activity in the activity set includes an activity type, a data output entity and a data input entity.

3. The method according to claim 1, characterized in that The constructing of a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set includes: Acquire an activity sequence directly related to each network entity according to the activity set; According to the data flow direction of each activity sequence, a traceability graph is constructed with network entities as points, activities corresponding to the activity sequence as edges, and the data flow direction of the activity as the direction of the edge; Performing a root cause analysis on the source tracing diagram to obtain a root cause diagram including multiple root causes.

4. The method according to claim 1, characterized in that: The abnormal activity evaluation of the activity set by the time series feature capture model to obtain the number of abnormal activities of the abnormal entities in the activity set includes: Performing abnormal activity evaluation on the activities in the activity set through a sliding window in a time series feature capture model to obtain the occurrence probability of each activity; When the occurrence probability of the activity is not among the preset number of activities with the highest probability in the sliding window, the network entity initiating the activity is regarded as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded; Among them, the time series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

5. The method according to claim 1, characterized in that The basic attributes, number of abnormal activities, traceability graph and root cause graph of the network entity are input into the graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected, including: Input the basic attributes, abnormal activity number, source traceability graph and root cause graph of the network entity into the graph neural network classifier, and obtain the embedded feature vectors of all network entities in the scene to be detected through the embedding layer of the graph neural network classifier; Obtain the cluster center of each network entity obtained through the training set; The minimum Euclidean distance between the embedded feature vectors of all network entities in all scenes to be detected and the cluster center of each network entity is calculated to obtain the anomaly scores of all network entities in the scenes to be detected.

6. The method according to claim 5, characterized in that The step of obtaining the cluster center of each network entity obtained through the training set includes: Obtain a dataset that includes only benign scenarios; Calculate the embedded feature vectors of all network entities in the training set through the trained graph neural network classifier; The embedded feature vectors of all network entities in the training set are clustered to obtain the cluster center of each network entity.

7. The method according to claim 1, characterized in that The abnormal scores of all network entities are analyzed to obtain abnormal behavior analysis results of the scene to be detected, including: Filtering out the anomaly score with the highest score from the anomaly scores of all network entities, and using the anomaly score as the anomaly score of the scene to be detected; When the abnormality score of the scene to be detected exceeds the abnormality threshold, it is determined that the abnormal behavior analysis result of the scene to be detected is that abnormal behavior exists.

8. A network abnormal behavior analysis device, characterized in that: The device comprises: An acquisition module, used to acquire a network activity log of a scene to be detected, and generate an activity set corresponding to the scene to be detected according to the network activity log; A construction module, used to construct a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set; An evaluation module, used for evaluating the abnormal activities of the activity set by using a time series feature capture model to obtain the number of abnormal activities of the abnormal entities in the activity set; An output module, used to input the basic attributes, number of abnormal activities, traceability graph and root cause graph of the network entity into a graph neural network classifier to obtain anomaly scores of all network entities in the scene to be detected; The analysis module is used to analyze the abnormal scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected.

9. An electronic device, characterized in that: The device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network abnormal behavior analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network abnormal behavior analysis method according to any one of claims 1 to 7 when executed.

Images