A network abnormal behavior analysis method, device, equipment and storage medium

Abstract

The application discloses a network abnormal behavior analysis method and device, equipment and storage medium. The method comprises the following steps: acquiring a network activity log of a to-be-detected scene, and generating an activity set corresponding to the to-be-detected scene according to the network activity log; constructing a traceability graph and a root cause graph according to an activity sequence of a network entity in the activity set; performing abnormal activity evaluation on the activity set through a time sequence feature capture model to obtain an abnormal activity number of an abnormal entity in the activity set; inputting basic attributes, the abnormal activity number, the traceability graph and the root cause graph of the network entity into a graph neural network classifier to obtain an abnormal score of all network entities in the to-be-detected scene; and analyzing the abnormal scores of all network entities to obtain an abnormal behavior analysis result of the to-be-detected scene. The method can improve the detection performance of abnormal behaviors in the network.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network security anomaly detection, and in particular to a network anomaly behavior analysis method and device, equipment and a storage medium. BACKGROUND

[0002] With the popularity of network applications, network attacks tend to be complex and diversified, posing a serious challenge to network security. In order to protect privacy and security from malicious network attacks, various anomaly detection technologies have emerged. The core idea of anomaly detection is to analyze network traffic, system logs and other data to discover behaviors that do not conform to normal behavior patterns, thereby warning potential security threats. Unlike signature-based detection methods, anomaly detection does not rely on known attack features, but rather uses data mining, machine learning and other technologies to build a normal behavior model and use it as a benchmark to detect abnormal behavior. However, the anomaly detection technology in the prior art cannot accurately analyze the abnormal behavior in the network. SUMMARY

[0003] The present application provides a network anomaly behavior analysis method, device, equipment and storage medium to solve the problem that the method in the prior art cannot accurately analyze the abnormal behavior in the network.

[0004] According to an aspect of the present application, a network anomaly behavior analysis method is provided, the method comprising:

[0005] obtaining a network activity log of a scene to be detected, and generating an activity set corresponding to the scene to be detected according to the network activity log;

[0006] constructing a traceability graph and a root cause graph according to the activity sequence of the network entity in the activity set;

[0007] performing abnormal activity evaluation on the activity set through a time series feature capture model to obtain an abnormal activity number of an abnormal entity in the activity set;

[0008] inputting the basic attributes, abnormal activity number, traceability graph and root cause graph of the network entity into a graph neural network classifier to obtain an abnormal score of all network entities in the scene to be detected;

[0009] analyzing the abnormal scores of all network entities to obtain an abnormal behavior analysis result of the scene to be detected.

[0010] According to another aspect of the present application, a network anomaly behavior analysis device is provided, the device comprising:

[0011] an acquisition module configured to obtain a network activity log of a scene to be detected, and generate an activity set corresponding to the scene to be detected according to the network activity log;

[0012] a construction module configured to construct a traceability graph and a root cause graph according to the activity sequence of the network entities in the activity set;

[0013] an evaluation module configured to perform abnormal activity evaluation on the activity set by using a time series feature capture model to obtain an abnormal activity number of the abnormal entities in the activity set;

[0014] an output module configured to input the basic attributes, the abnormal activity number, the traceability graph and the root cause graph of the network entities into a graph neural network classifier to obtain abnormal scores of all the network entities in the to-be-detected scenario;

[0015] an analysis module configured to analyze the abnormal scores of all the network entities to obtain an abnormal behavior analysis result of the to-be-detected scenario.

[0016] According to another aspect of the present application, an electronic device is provided, which comprises at least one processor, and

[0017] a memory connected in communication with the at least one processor; wherein

[0018] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network abnormal behavior analysis method according to any one of the embodiments of the present application.

[0019] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the network abnormal behavior analysis method according to any one of the embodiments of the present application when executed by the processor.

[0020] The network abnormal behavior analysis method, device, equipment and storage medium provided by the embodiment of the application, the method comprises: acquiring a network activity log of a to-be-detected scene, generating an activity set corresponding to the to-be-detected scene according to the network activity log; constructing a traceability graph and a root cause graph according to the activity sequence of a network entity in the activity set; performing abnormal activity evaluation on the activity set through a time sequence feature capture model to obtain an abnormal activity number of an abnormal entity in the activity set; inputting the basic attribute, the abnormal activity number, the traceability graph and the root cause graph of the network entity into a graph neural network classifier to obtain an abnormal score of all network entities in the to-be-detected scene; and analyzing the abnormal scores of all network entities to obtain an abnormal behavior analysis result of the to-be-detected scene. The method can improve the detection performance of abnormal behavior in the network by generating an activity set according to a network activity log, constructing a traceability graph and a root cause set according to the activity set, obtaining an abnormal activity number of an abnormal entity through a time sequence feature capture model, obtaining an abnormal score of a network entity through a graph neural network classifier, and finally analyzing the abnormal score to obtain an abnormal behavior analysis result of the to-be-detected scene, thereby solving the problem that the method in the prior art cannot accurately analyze the abnormal behavior in the network.

[0021] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0023] Figure 1 A flowchart of a network abnormal behavior analysis method provided for the embodiment of the application;

[0024] Figure 2 A schematic diagram of a traceability graph and a root cause graph provided for the embodiment of the application;

[0025] Figure 3 An application schematic diagram of a time sequence capture model provided for the embodiment of the application;

[0026] Figure 4 A schematic diagram of training a graph neural network classifier provided for the embodiment of the application;

[0027] Figure 5 A schematic diagram of determining an abnormal score provided for the embodiment of the application;

[0028] Figure 6 A structural schematic diagram of a network abnormal behavior analysis device provided for embodiment two of the present application;

[0029] Figure 7 A structural schematic diagram of an electronic device of the present application. DETAILED DESCRIPTION

[0030] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts should fall within the scope of protection of the present application. It should be understood that each step in the method embodiments of the present application can be executed in different orders and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the execution of the steps shown. The scope of the present application is not limited in this respect.

[0031] The term "comprising" and variations thereof as used in the present document are open-ended, that is, "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Related definitions will be given in the description below.

[0032] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, any variation of the terms "including", "having" and the like is intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] It should be noted that the modification of "one" or "multiple" mentioned in the present application is illustrative but not limiting, and those skilled in the art should understand that, unless otherwise explicitly indicated in the context, it should be understood as "one or more".

[0034] The names of the messages or information exchanged between the plurality of devices in the embodiments of the present application are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0035] It can be understood that, before using the technical solutions disclosed in the embodiments of the present application, the type, use range, use scenario, etc. of the personal information involved in the present application should be informed to the user and the authorization of the user should be obtained in a proper manner according to relevant laws and regulations.

[0036] For example, in response to receiving an active request of a user, a prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will require obtaining and using the personal information of the user. Thus, the user can voluntarily choose whether to provide the personal information to the software or hardware such as an electronic device, an application program, a server or a storage medium, etc. performing the operation of the technical solutions of the present application according to the prompt information.

[0037] As an optional but non-limiting implementation manner, in response to receiving an active request of a user, the prompt information can be sent to the user in the form of a pop-up window, and the prompt information can be presented in the form of text in the pop-up window. In addition, the pop-up window can also carry a selection control for the user to select to "agree" or "disagree" to provide the personal information to the electronic device.

[0038] It can be understood that the above notification and obtaining of the authorization of the user are only illustrative, and do not limit the implementation manners of the present application, and other manners meeting the relevant laws and regulations can also be applied to the implementation manners of the present application.

[0039] It can be understood that the data (including but not limited to the data itself, the acquisition or use of the data) involved in the present technical solutions should comply with the requirements of the relevant laws and regulations and the relevant provisions.

[0040] Embodiment one

[0041] Figure 1 A flowchart of a network abnormal behavior analysis method provided by the embodiment one of the present application is shown in the figure. The method can be applied to the case of analyzing the abnormal behavior in the network, and the method can be executed by a network abnormal behavior analysis device. The device can be realized by software and / or hardware, and is generally integrated on an electronic device. In the present embodiment, the electronic device includes but is not limited to a computer and the like.

[0042] As shown in the figure, the network abnormal behavior analysis method provided by the embodiment one of the present application includes the following steps: Figure 1

[0043] S110, obtaining a network activity log of a to-be-detected scene, and generating an activity set corresponding to the to-be-detected scene according to the network activity log. ​

[0044] The scenario to be detected can be a scene in the network, such as sending emails, watching videos, reading articles, and downloading files. The network activity log can be a log recording information about activities related to that scenario. An activity set can be a collection of activities or events participated in by entities in the network within a certain time frame; the activities in the activity set can be arranged in timestamp order.

[0045] In this embodiment, network activity logs of the scene to be detected can be obtained, and an activity set corresponding to the scene to be detected can be generated based on the network activity logs. In this embodiment, the scene to be detected can be one or more scenes, and a corresponding activity set will be generated for each scene.

[0046] In one embodiment, obtaining the network activity log of the scene to be detected and generating an activity set corresponding to the scene to be detected based on the network activity log includes: obtaining the network activity log corresponding to the scene to be detected, wherein the network activity log records operations between multiple network entities; filtering out all operations that can lead to data flow from the network activity log, as well as the information corresponding to the operations; taking the information corresponding to each operation as an activity and sorting all activities in chronological order to obtain a constructed activity set; wherein each activity in the activity set includes an activity type, a data output entity, and a data input entity.

[0047] In this context, network entities can be nodes or objects within the network, and their types can include processes, threads, and files. Operations between network entities refer to the interactive behaviors between these entities. Data flow can be the direction of data transmission. Information corresponding to an operation can include the relevant entity and its corresponding activity type. Activity types can include operations such as reading, writing, sending, and receiving, which are performed by processes or threads. A data output entity is an entity that outputs data in an activity, and a data input entity is an entity that receives data in an activity.

[0048] In this embodiment, network activity logs corresponding to the scenario to be detected can be obtained. Based on the network entities and their inter-operations recorded in the network activity logs, operations that can lead to data flow can be filtered out, and the filtered operations can be sorted in chronological order. Each operation and its corresponding information can be considered as an activity, resulting in a constructed activity set. For example, assuming there are m scenarios, all operations that lead to data flow can be sorted by timestamp to obtain an activity set E for all scenarios. E includes multiple activity sets, each recording the activity type (process / thread operations such as read, write, send, and receive), data output entity, and data input entity.

[0049] S120. Construct a source graph and a root cause graph based on the activity sequence of the network entities in the activity set.

[0050] In this context, an activity sequence refers to a sequence of activities arranged chronologically within an activity set. A source graph is a graphical tool used to represent the interactions between objects in a system; it constructs a directed graph containing temporal and spatial information by recording events that occur within the system. A root cause diagram (fishbone diagram) is a method for discovering the "root cause" of a problem, quickly identifying potential underlying causes.

[0051] In this embodiment, the data flow direction of network entities can be determined by the activity sequence of network entities in the activity set, and a source graph G can be constructed based on the entities and data flow direction. provenance and Root Cause Diagram G rca .

[0052] In one embodiment, constructing a source graph and a root cause graph based on the activity sequences of network entities in the activity set includes: obtaining activity sequences directly related to each network entity from the activity set; constructing a source graph according to the data flow direction of each activity sequence, with network entities as nodes, activities corresponding to the activity sequences as edges, and the data flow direction of the activities as the direction of the edges; and performing root cause analysis on the source graph to obtain a root cause graph including multiple root causes.

[0053] Root cause analysis is a systematic method aimed at identifying the root cause of a problem. By deeply analyzing data and related information, it can identify the key factors and driving forces that lead to the problem. A root cause can be the initial node in a causal chain that leads to a certain outcome or consequence.

[0054] In this embodiment, the activity sequence directly related to each network entity can be obtained from the activity set. When constructing the source graph, the network entity can be used as a node, the activity corresponding to the activity sequence as an edge, and the data flow direction of the activity as the direction of the edge. Root cause analysis can be performed on the source graph to find the root cause, thus obtaining the root cause graph. For example, given scenario i, all operations that lead to the data flow and the network entities involved can be filtered from the network activity log. The activity type, data output entity, and data input entity are recorded in chronological order. For all network entities n... i,a E, all activity sequences directly related to the a-th entity in the i-th scenario and the network entity. i,a (The activity sequence of the a-th entity in the i-th scene), construct the source graph G according to the data flow direction. provenanceThe root cause analysis is then performed on the source graph. Based on the timestamp, the first activity of a network entity is determined. If the first activity of a network entity is an outgoing edge, meaning that its first activity will affect other network entities, then that network entity is considered a root cause. Other network entities directly or indirectly affected are considered its neighbors in the root cause graph. Each root cause graph typically has multiple root causes. A root cause refers to the beginning of a data flow and also to candidate anomaly root causes. The root cause graph G is constructed by connecting the root cause entities and the network entities they affect. rca .

[0055] Figure 2 This is a schematic diagram of a source graph and root cause graph provided in an embodiment of the present invention, such as... Figure 2 As shown, the network activity log includes six operations, numbered 1-6 in chronological order. Each operation is: process 1 reads file 1, process 1 writes to file 2, process 2 sends a message to process 1, process 2 sends a message to thread 1, thread 1 reads file 2, and process 3 reads file 2. According to the network activity log, the network entities include process 1, process 2, process 3, thread 1, file 1, and file 2. Based on this network activity log, a source graph can be constructed. Root cause analysis of the source graph identifies file 1 and process 2 as the root causes, thus allowing the construction of the root cause graph.

[0056] S130. The activity set is evaluated for abnormal activities using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set.

[0057] The time-series feature capture model can be a model used to capture behavioral features and occurrence probabilities from the time series of activities. An anomalous entity can be an anomalous network entity. The anomalous activity count can be the number of anomalous activities of the anomalous entity.

[0058] In this embodiment, anomaly assessment of the activity set can be performed using a time-series feature capture model. For abnormal entities in the activity set that exhibit anomalous activity, the number T of their suspected anomalous activities is recorded. i,a In this embodiment, the time-series feature capture model f1 can be pre-trained using a dataset of all benign scenarios in the training activity set. For example, suppose there are m scenarios in total, where the i-th (1≤i≤m) scenario contains n... i Given n entities in the i-th scenario, where c of these are benign scenarios and the remaining (mc) are malicious scenarios with malicious attacks, and the set of data stream behavior E for all benign scenarios in the training activity set. benign Train a time-series feature capture model f1, use f1 to evaluate anomalous activities across the entire activity set E, and record the number of suspected anomalous activities T for entities that initiate suspected anomalous activities. i,a .

[0059] In one embodiment, the step of evaluating the activity set for abnormal activities using a time-series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set includes: evaluating the activities in the activity set for abnormal activities using a sliding window in the time-series feature capture model to obtain the probability of occurrence of each activity; when the probability of occurrence of an activity is not among the preset number of activities with the highest probability in the sliding window, the network entity that initiated the activity is identified as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded; wherein, the time-series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

[0060] In this context, a sliding window refers to a window formed between the elements pointed to by two pointers. Long Short-Term Memory (LSTM) is a type of temporal recurrent neural network suitable for processing and predicting important events in time series with relatively long intervals and delays.

[0061] In this embodiment, the activities in the activity set can be evaluated for abnormal activities by using a sliding window in the time series feature capture model to obtain the occurrence probability of each activity. If the occurrence probability of a certain activity is not among the n activities with the highest probability in the sliding window, the network entity that initiated the activity is regarded as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded.

[0062] The time series feature capture model in this embodiment can be constructed based on a long short-term memory model and a fully connected layer. The specific construction process of the time series feature capture model is as follows: Figure 3 This is a schematic diagram illustrating the application of a time series capture model provided in an embodiment of the present invention, such as... Figure 3 As shown, for the training activity set E, the data flow behavior set E of all benign scenarios is... benign Let the sliding window size be k and the scene number be i. Let the number of any activity in benign scene i be j. Construct a sliding window combination, that is, the (j+k+1)th activity E j+k+1 Compared with its previous k activities E j～j+k Combining sliding window groups (E) j～j+k E j+k+1 This sliding window combination is used as input to the time series feature capture model f1 to capture the long-term and short-term features and their probabilities of occurrence of the (k+1)th activity after a specific set of k activities. The long-term feature in the long-term and short-term features represents the impact of the sliding windows of all currently occurring activities on the probability of occurrence of the current activity, while the short-term feature represents the impact of the current sliding window on the probability of occurrence of the current activity. During training, f1 is trained using supervised learning, with E... j～j+k For input, Ej+k+1 For tags.

[0063] A trained sliding window LSTM model f1 can be used to evaluate anomalous activities across the entire activity set E. If activity E... j+k+1 The z activities with the highest probability of not being predicted by f1, topzf1(E) j～j+k In ), then E is considered j+k+1 The entity n that initiated the activity is suspected of being abnormal. i,a This will be considered a suspected anomalous entity, and the number T of suspected anomalous activities of that entity will be recorded. i,a .

[0064] This embodiment uses a sliding window method with a long short-term memory model to capture the long-term and short-term characteristics of network traffic, and uses a graph neural network with root cause analysis to extract the behavioral patterns of network activity. This can improve the performance of network traffic anomaly detection, ensure network security and reliability, and has broad application scenarios in future network anomaly behavior detection.

[0065] S140. Input the basic attributes, abnormal activity count, source graph and root cause graph of the network entity into the graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected.

[0066] The basic attributes can include the entity type, the number of initiators of various activities, and the number of entities affected. The number of entities affected refers to how many operations directly influence an entity, i.e., the in-degree of the directed graph, with the in-degree calculated separately for each type of operation. Graph Neural Networks (GNN) classifiers refer to neural network models used to process graph-structured data. Anomaly scores can be used to represent the degree of anomaly of network entities.

[0067] In this embodiment, the basic attributes of network entities, the number of abnormal activities, the source graph, and the root cause graph can all be input into the graph neural network classifier. By further analyzing the output of the graph neural network classifier, the abnormal scores of all network entities in the scene to be detected can be obtained.

[0068] S150. Analyze the anomaly scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected.

[0069] Among them, the results of abnormal behavior analysis can be used to indicate whether there is abnormal behavior in the scene to be detected.

[0070] In this embodiment, the abnormal scores of all network entities can be analyzed to obtain the abnormal behavior analysis results of the scene to be detected. For example, the abnormal behavior analysis results can be determined based on the average of the abnormal scores of all network entities, or based on the top few network entities with the highest abnormal scores. This embodiment does not limit this approach.

[0071] In one embodiment, the step of analyzing the abnormal scores of all network entities to obtain the abnormal behavior analysis result of the scene to be detected includes: selecting the highest abnormal score from the abnormal scores of all network entities and using the abnormal score as the abnormal score of the scene to be detected; when the abnormal score of the scene to be detected exceeds the abnormal threshold, determining that the abnormal behavior analysis result of the scene to be detected indicates the presence of abnormal behavior.

[0072] The abnormal threshold can be set according to the actual situation. When the abnormal score exceeds the abnormal threshold, it is considered that there is an abnormality.

[0073] In this embodiment, the highest anomaly score among all network entities can be used as the anomaly score of the scene to be detected. If the anomaly score of the scene to be detected exceeds the anomaly threshold, it is considered that there is abnormal behavior in the scene to be detected.

[0074] This invention provides a method for analyzing abnormal network behavior, comprising: acquiring network activity logs of a scene to be detected; generating an activity set corresponding to the scene to be detected based on the network activity logs; constructing a source graph and a root cause graph based on the activity sequences of network entities in the activity set; evaluating abnormal activities in the activity set using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set; inputting the basic attributes, number of abnormal activities, source graph, and root cause graph of the network entities into a graph neural network classifier to obtain anomaly scores for all network entities in the scene to be detected; and analyzing the anomaly scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected. This method improves the detection performance of abnormal behavior in networks by generating an activity set from network activity logs, constructing a source graph and root cause set based on the activity set, obtaining the number of abnormal activities of abnormal entities using a time series feature capture model, obtaining the anomaly scores of network entities using a graph neural network classifier, and finally analyzing the anomaly scores to obtain the abnormal behavior analysis results of the scene to be detected. This solves the problem that existing methods cannot accurately analyze abnormal behavior in networks.

[0075] Based on the above embodiments, modified embodiments of the above embodiments are proposed. It should be noted that, in order to keep the description brief, only the differences from the above embodiments are described in the modified embodiments.

[0076] In one embodiment, the step of inputting the basic attributes, anomalous activity count, source graph, and root cause graph of the network entities into a graph neural network classifier to obtain anomaly scores for all network entities in the scene to be detected includes: inputting the basic attributes, anomalous activity count, source graph, and root cause graph of the network entities into the graph neural network classifier; obtaining the embedded feature vectors of all network entities in the scene to be detected through the embedding layer of the graph neural network classifier; obtaining the cluster centers of each network entity obtained through the training set; and calculating the minimum Euclidean distance between the embedded feature vectors of all network entities in all scenes to be detected and the cluster centers of each network entity to obtain the anomaly scores for all network entities in the scene to be detected.

[0077] An embedding layer, in this context, refers to a network layer in a neural network used to map discrete, high-dimensional data (such as text, images, and audio) to a low-dimensional, continuous vector space. Embedding layers produce embedded feature vectors, which are techniques for mapping data (such as text, images, and user information) to numerical vectors in a high-dimensional space. These vectors capture the similarities and relationships between data points, bringing similar data points closer together in the vector space. The training set can be the active set used to train a graph neural network classifier. The cluster center can be the mean (centroid) of all sample points in a cluster. Euclidean distance is the "ordinary" (i.e., straight-line) distance between two points in Euclidean space.

[0078] In this embodiment, the embedding feature vectors of all network entities in the scene to be detected can be obtained through the embedding layer of the graph neural network classifier, and the cluster centers of each network entity obtained through the training set can be obtained. The minimum Euclidean distance between the embedding feature vectors of all network entities and each cluster center is calculated, and the minimum Euclidean distance is used as the anomaly score of each network entity. In this embodiment, the graph neural network classifier uses only benign scenes as the training set, uses supervised learning as the training method, and the label is the scene type to which the network entity belongs. Figure 4 This is a schematic diagram of a training graph neural network classifier provided in an embodiment of the present invention, as shown below. Figure 4 As shown, a graph neural network classifier can be trained using source graph set and root cause graph set. Source graph set is a collection of source graphs, root cause graph set is a collection of root cause graphs, and scene set is a collection of scenes.

[0079] For example, based on the calculated number T of suspected abnormal activity of network entities i,a This is combined with the basic attributes of network entities (entity type, number of initiators of various activities, and number of affected entities), and the source graph G. provenanc and Root Cause Diagram G rcaTogether, they serve as input to the deep learning graph neural network classifier f2; the trained graph neural network classifier f2 is used to embed all network entities, resulting in the embedded feature vector V of all network entities. all And obtain the cluster center (KMC) of each network entity. train Calculate the embed feature V of all network entities. all To each cluster center KMC train The minimum Euclidean distance is used as the anomaly score for each network entity to the cluster center of benign entities. The maximum anomaly score for each network entity in each scenario is calculated and used as the anomaly score for that scenario. Scenarios with anomaly scores exceeding a certain threshold are considered anomalous scenarios. For example, Figure 5 This is a schematic diagram illustrating the determination of abnormal scores provided in an embodiment of the present invention, such as... Figure 5 As shown, the training scene set is the dataset used to calculate cluster centers. The training scene set can remain unchanged. When it is necessary to detect the scene to be detected, the scene to be detected is used as the test scene set, and the anomaly score of the test scene set is determined by combining it with the training scene set.

[0080] In one embodiment, obtaining the cluster centers of each network entity obtained from the training set includes: obtaining a dataset that includes only benign scenarios; calculating the embedding feature vectors of all network entities in the training set using a trained graph neural network classifier; and clustering the embedding feature vectors of all network entities in the training set to obtain the cluster centers of each network entity.

[0081] Among them, benign scenarios can be those in which no abnormal behavior occurs in the network.

[0082] In this embodiment, the cluster centers of each network entity can be calculated using a dataset that includes only benign scenarios. For example, the embedded feature vector V of all network entities in the training set can be obtained using the trained f2 algorithm. train , for V train Perform kMeans clustering to obtain the cluster centers (KMCs) for each benign scenario. train Each positive scenario has a corresponding cluster center.

[0083] This embodiment uses a long short-term memory model to analyze the behavioral patterns of suspected abnormal events before and after a certain time interval. By introducing a source graph, the relationship between network entities and network events can be reflected. By performing root cause analysis on the source graph, key points of interest in the graph (i.e., the overall features of the graph and the embedding features of the nodes) are captured. Anomaly detection scores for various scenarios are successfully calculated, and it can be further applied in more complex environments.

[0084] Example 2

[0085] Figure 6 This is a schematic diagram of a network abnormal behavior analysis device provided in Embodiment 2 of the present invention. This device is applicable to analyzing abnormal behaviors in a network. The device can be implemented by software and / or hardware and is generally integrated into an electronic device. Figure 6 As shown, the device includes:

[0086] The acquisition module 210 is used to acquire network activity logs of the scene to be detected and generate an activity set corresponding to the scene to be detected based on the network activity logs.

[0087] Construction module 220 is used to construct a source graph and a root cause graph based on the activity sequence of network entities in the activity set;

[0088] Evaluation module 230 is used to evaluate abnormal activities in the activity set using a time series feature capture model, and obtain the number of abnormal activities of abnormal entities in the activity set;

[0089] The output module 240 is used to input the basic attributes, abnormal activity count, source graph and root cause graph of the network entity into the graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected.

[0090] The analysis module 250 is used to analyze the anomaly scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected.

[0091] This embodiment provides a network abnormal behavior analysis device, comprising: an acquisition module for acquiring network activity logs of a scene to be detected and generating an activity set corresponding to the scene to be detected based on the network activity logs; a construction module for constructing a source graph and a root cause graph based on the activity sequences of network entities in the activity set; an evaluation module for evaluating abnormal activities in the activity set using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set; an output module for inputting the basic attributes of the network entities, the number of abnormal activities, the source graph, and the root cause graph into a graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected; and an analysis module for analyzing the abnormal scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected. By generating an activity set based on network activity logs, constructing a source graph and root cause set based on the activity set, obtaining the number of abnormal activities of abnormal entities through a time series feature capture model, obtaining the abnormal score of network entities through a graph neural network classifier, and finally analyzing the abnormal scores to obtain the abnormal behavior analysis results of the scene to be detected, the detection performance of abnormal behavior in the network can be improved, solving the problem that existing methods cannot accurately analyze abnormal behavior in the network.

[0092] Furthermore, module 210 is specifically used for:

[0093] Obtain the network activity log corresponding to the scenario to be detected. The network activity log records multiple operations between network entities.

[0094] Filter out all operations that can lead to data flow from the network activity log, along with the information corresponding to those operations;

[0095] Each operation is treated as an activity, and all activities are sorted in chronological order to obtain a set of activities.

[0096] Each activity in the activity set includes an activity type, a data output entity, and a data input entity.

[0097] Furthermore, module 220 is specifically used for:

[0098] Based on the activity set, obtain the activity sequence directly related to each network entity;

[0099] Based on the data flow direction of each activity sequence, a source graph is constructed with network entities as points, the activities corresponding to the activity sequence as edges, and the data flow direction of the activities as the direction of the edges.

[0100] Root cause analysis is performed on the source map to obtain a root cause map containing multiple root causes.

[0101] Furthermore, the evaluation module 230 is specifically used for:

[0102] Anomaly assessment of activities in the activity set is performed using a sliding window in the time series feature capture model to obtain the probability of occurrence of each activity.

[0103] When the probability of the activity occurring is not among the preset number of activities with the highest probability in the sliding window, the network entity that initiated the activity is designated as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded.

[0104] The time series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

[0105] Furthermore, the output module 240 is specifically used for:

[0106] The basic attributes, abnormal activity count, source graph, and root cause graph of the network entities are input into a graph neural network classifier, and the embedding feature vectors of all network entities in the scene to be detected are obtained through the embedding layer of the graph neural network classifier.

[0107] Obtain the cluster centers of each network entity obtained from the training set;

[0108] Calculate the minimum Euclidean distance between the embedded feature vectors of all network entities in all scenes to be detected and the cluster centers of each network entity to obtain the anomaly scores of all network entities in the scene to be detected.

[0109] Furthermore, obtaining the cluster centers of each network entity obtained from the training set includes:

[0110] Obtain a dataset that includes only benign scenarios;

[0111] The embedded feature vectors of all network entities in the training set are calculated using a trained graph neural network classifier.

[0112] Clustering is performed on the embedded feature vectors of all network entities in the training set to obtain the cluster center of each network entity.

[0113] Furthermore, the analysis module 250 is specifically used for:

[0114] The highest abnormal score is selected from the abnormal scores of all network entities, and the abnormal score is used as the abnormal score of the scene to be detected.

[0115] When the abnormal score of the scene to be detected exceeds the abnormal threshold, the abnormal behavior analysis result of the scene to be detected is determined to be abnormal behavior.

[0116] The above-mentioned network abnormal behavior analysis device can execute the network abnormal behavior analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0117] Example 3

[0118] Figure 7 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0119] like Figure 7As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0120] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0121] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as network anomaly behavior analysis methods.

[0122] In some embodiments, the network anomaly behavior analysis method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network anomaly behavior analysis method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network anomaly behavior analysis method by any other suitable means (e.g., by means of firmware).

[0123] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0125] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0126] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0127] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0128] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0129] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0130] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for analyzing abnormal network behavior, characterized in that, The method includes: Obtain network activity logs for the scene to be detected, and generate an activity set corresponding to the scene to be detected based on the network activity logs; Construct a source graph and a root cause graph based on the activity sequences of the network entities in the activity set; The abnormal activity of the activity set is evaluated by using a time series feature capture model to obtain the number of abnormal activities of abnormal entities in the activity set. The basic attributes, abnormal activity count, source graph, and root cause graph of the network entities are input into a graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected. The abnormal scores of all network entities are analyzed to obtain the abnormal behavior analysis results of the scene to be detected; The step of evaluating anomalous activities in the activity set using a time-series feature capture model to obtain the number of anomalous activities of anomalous entities in the activity set includes: Anomaly assessment of activities in the activity set is performed using a sliding window in the time series feature capture model to obtain the probability of occurrence of each activity. When the probability of the activity occurring is not among the preset number of activities with the highest probability in the sliding window, the network entity that initiated the activity is designated as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded. The time series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

2. The method according to claim 1, characterized in that, The step of obtaining network activity logs for the scene to be detected and generating an activity set corresponding to the scene to be detected based on the network activity logs includes: Obtain the network activity log corresponding to the scenario to be detected. The network activity log records multiple operations between network entities. Filter out all operations that can lead to data flow from the network activity log, along with the information corresponding to those operations; Each operation is treated as an activity, and all activities are sorted in chronological order to obtain a set of activities. Each activity in the activity set includes an activity type, a data output entity, and a data input entity.

3. The method according to claim 1, characterized in that, The step of constructing the source graph and root cause graph based on the activity sequence of network entities in the activity set includes: Based on the activity set, obtain the activity sequence directly related to each network entity; Based on the data flow direction of each activity sequence, a source graph is constructed with network entities as points, the activities corresponding to the activity sequence as edges, and the data flow direction of the activities as the direction of the edges. Root cause analysis is performed on the source map to obtain a root cause map containing multiple root causes.

4. The method according to claim 1, characterized in that, The step of inputting the basic attributes, anomalous activity count, source graph, and root cause graph of the network entities into a graph neural network classifier to obtain anomaly scores for all network entities in the scene to be detected includes: The basic attributes, abnormal activity count, source graph, and root cause graph of the network entities are input into a graph neural network classifier, and the embedding feature vectors of all network entities in the scene to be detected are obtained through the embedding layer of the graph neural network classifier. Obtain the cluster centers of each network entity obtained from the training set; Calculate the minimum Euclidean distance between the embedded feature vectors of all network entities in all scenes to be detected and the cluster centers of each network entity to obtain the anomaly scores of all network entities in the scene to be detected.

5. The method according to claim 4, characterized in that, The step of obtaining the cluster centers of each network entity obtained from the training set includes: Obtain a dataset that includes only benign scenarios; The embedded feature vectors of all network entities in the training set are calculated using a trained graph neural network classifier. Clustering is performed on the embedded feature vectors of all network entities in the training set to obtain the cluster center of each network entity.

6. The method according to claim 1, characterized in that, The analysis of anomaly scores for all network entities to obtain the abnormal behavior analysis results for the scene to be detected includes: The highest abnormal score is selected from the abnormal scores of all network entities, and the abnormal score is used as the abnormal score of the scene to be detected. When the abnormal score of the scene to be detected exceeds the abnormal threshold, the abnormal behavior analysis result of the scene to be detected is determined to be abnormal behavior.

7. A network abnormal behavior analysis device, characterized in that, The device includes: The acquisition module is used to acquire network activity logs of the scene to be detected and generate an activity set corresponding to the scene to be detected based on the network activity logs. The construction module is used to construct a source graph and a root cause graph based on the activity sequence of network entities in the activity set; The evaluation module is used to evaluate the abnormal activities of the activity set through a time series feature capture model, and obtain the number of abnormal activities of abnormal entities in the activity set. The output module is used to input the basic attributes, abnormal activity count, source graph and root cause graph of the network entity into the graph neural network classifier to obtain the abnormal scores of all network entities in the scene to be detected. The analysis module is used to analyze the anomaly scores of all network entities to obtain the abnormal behavior analysis results of the scene to be detected. The evaluation module is specifically used for: Anomaly assessment of activities in the activity set is performed using a sliding window in the time series feature capture model to obtain the probability of occurrence of each activity. When the probability of the activity occurring is not among the preset number of activities with the highest probability in the sliding window, the network entity that initiated the activity is designated as an abnormal entity, and the number of abnormal activities of the abnormal entity is recorded. The time series feature capture model is constructed based on a long short-term memory model and a fully connected layer.

8. An electronic device, characterized in that, The device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network anomaly behavior analysis method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the network abnormal behavior analysis method according to any one of claims 1-6.

Images