Unknown security event response method, system and equipment based on user behavior and traffic analysis and medium
By monitoring and analyzing network traffic and user behavior in real time, detecting and responding to unknown security events, the problem of difficulty in identifying and responding to new types of cyber attacks is solved in the existing technology, and fast and accurate security incident response is achieved.
Patent Information
- Application Number
- CN202411688397.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-03-07
Smart Images
Figure CN119583137A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of computer network security, and in particular relates to a method, system, device and medium for responding to unknown security events based on user behavior and traffic analysis. Background Art
[0002] In the face of an increasingly severe cybersecurity environment, more and more companies are beginning to deploy SOAR systems for security emergency response. Although SOAR systems can help companies achieve automated responses to most security incidents. However, the implementation of SOAR systems depends on the security technology capabilities of companies and SOAR security vendors. SOAR systems can only help companies use existing traditional security defense methods to assist in solving the response problems of known security incidents (companies or SOAR security vendors have relevant experience or knowledge). However, in today's Internet era, network attack methods are emerging in an endless stream, and this method that relies on the knowledge accumulation of companies or security vendors can no longer meet the needs of combating new attacks. Therefore, how to quickly and accurately discover, identify, respond to and deal with unknown security incidents has become an important challenge facing the field of information security. Summary of the invention
[0003] In view of the deficiencies in the prior art, the present invention provides a method, system, device and medium for responding to unknown security events based on user behavior and traffic analysis. The method monitors and analyzes network traffic and user behavior in real time to discover abnormal attack behaviors. At the same time, various logs and event data are collected to compare the characteristics of abnormal behaviors and automatically generate blocking scripts, thereby realizing rapid identification and response to unknown security events.
[0004] To achieve the above object, the present invention adopts the following technical solutions:
[0005] A response system for unknown security events based on user behavior and traffic analysis, including:
[0006] A traffic feature extractor, used to extract traffic features from mirrored network traffic or packet streams;
[0007] Behavior feature extractor, used to extract user behavior features;
[0008] Action feature library, used to store traffic features and behavior features corresponding to known actions;
[0009] The anomaly detector compares the traffic features extracted by the traffic feature extractor with the traffic features in the action feature library, and compares the behavior features extracted by the behavior feature extractor with the behavior features in the action feature library. If the comparison is successful, an abnormal action is detected, and the detection result of the abnormal action is sent to the generator;
[0010] Function library, used to store blocking codes;
[0011] The generator, in response to the anomaly detector, queries the blocking code of the abnormal action from the function library, generates a blocking script, and stores it in the script library;
[0012] Script library, used to store blocking scripts.
[0013] The present invention also proposes a method for responding to unknown security events based on user behavior and traffic analysis based on the system as described above, comprising the following steps:
[0014] Extract traffic features from mirrored network traffic or packet streams;
[0015] Extracting user behavior characteristics;
[0016] The traffic characteristics and behavior characteristics corresponding to the known actions are stored in the action characteristic library;
[0017] The extracted traffic features are compared with the traffic features in the action feature library, and the extracted behavior features are compared with the behavior features in the action feature library. If the comparison is successful, an abnormal action is detected; the blocking code of the abnormal action is queried from the function library to generate a blocking script;
[0018] After converting the blocking script into an executable program, the firewall interface is called to block the user's access to the server, or the corresponding interface of the server or service is called to interrupt the user's access, or the server or service is directly shut down.
[0019] To optimize the above technical solutions, the specific measures taken also include:
[0020] Further, the traffic characteristics include statistical characteristics and session attributes of the session;
[0021] The statistical characteristics of the session include: session duration, total data volume and time distribution of data volume;
[0022] The session attributes include: session protocol, source / destination IP address, source port number, and load request header sequence.
[0023] Furthermore, the extraction of user behavior characteristics is specifically as follows:
[0024] Parse the audit log and service access log, read the audit log and service access log in a fixed-size time window, and extract user behavior features from them. The user behavior features include user ID, time, action name and action result; a user behavior is an action sequence consisting of one or more actions arranged in time.
[0025] Furthermore, the action feature library includes a known action library, a request action mapping table and a known session tag library;
[0026] The known action library stores action names, action types, action contents, preceding action names, subsequent action names, and abnormality labels;
[0027] The request action mapping table stores a mapping relationship between a load request header and an action name, and an attribute value used to mark whether the load request header corresponds to an abnormal action;
[0028] The known session tag library stores statistical features of known sessions, known session attributes, and tags marking whether the session is abnormal; the statistical features include session duration, total data volume, and time distribution of data volume; the session attributes include session protocol, source / destination IP address, source port number, and load request header sequence.
[0029] Furthermore, the extracted traffic features are compared with the traffic features in the action feature library, and the extracted behavior features are compared with the behavior features in the action feature library. If the comparison is successful, the specific process of detecting abnormal actions is as follows:
[0030] Step 1.1, obtain the action sequence S2 output by the behavior feature extractor;
[0031] Step 1.2: Based on the action sequence, query the action names in the known action library one by one to determine whether there are abnormal actions in the action sequence. If the label of at least one action in the action sequence is marked as "yes", go to step 1.3; if all labels are marked as "no", go to step 2.1;
[0032] Step 1.3: Determine whether the action result is successful. If successful, output the abnormal action and end the detection; if unsuccessful, go to step 2.1;
[0033] Step 2.1, obtain traffic features from the traffic feature extractor, query the known session tag library, convert the load request header sequence in the traffic features into the action name sequence S1, and compare whether the action names of the action name sequence S1 and the action sequence S2 are the same. If the actions are exactly the same, go to step 2.2, otherwise, go to step 3.1;
[0034] Step 2.2: Determine whether the action result is successful. If successful, output an exception. Otherwise, go to step 3.1.
[0035] Step 3.1, input the action name sequence S1 into the first convolutional network for feature extraction, and input the traffic features into the second convolutional network for dimensionality reduction;
[0036] Step 3.2: The output of the first convolutional network is combined with the output of the second convolutional network and then input into the third convolutional network. The third convolutional network outputs the session feature f0 to be judged. In the judgment model, an abnormal judgment is made on the session feature f0 to be judged.
[0037] Furthermore, the abnormality judgment of the to-be-judged session feature f0 in the judgment model is specifically as follows:
[0038] The sessions marked as abnormal in the known session tag library are converted and input into the deep learning model to obtain the session feature set F. The session feature f0 to be judged is compared with the elements in the session feature set F. If there is an element f whose Euclidean distance with f0 is less than the threshold, the session corresponding to the session feature f0 to be judged is judged as abnormal.
[0039] Furthermore, the blocking codes in the function library are divided into action blocking, session blocking, service blocking and shutdown blocking.
[0040] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for responding to unknown security events based on user behavior and traffic analysis as described above is implemented.
[0041] The present invention also proposes a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the above-mentioned method for responding to unknown security events based on user behavior and traffic analysis.
[0042] The beneficial effects of the present invention are as follows: the present invention detects abnormal attack behaviors by real-time monitoring and analysis of network traffic and user behaviors; at the same time, it collects various logs and event data to compare the characteristics of abnormal behaviors and automatically generates blocking scripts, thereby realizing rapid identification and response to unknown security events. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] Figure 1 This is a structural diagram of the unknown security incident response system based on user behavior and traffic analysis proposed by the present invention;
[0044] Figure 2 is a flow chart of an implementation method of an anomaly detector of the present invention;
[0045] Figure 3 This is a structural diagram of the deep learning model;
[0046] Figure 4 The implementation method of the generator;
[0047] Figure 5This is a schematic diagram of an application scenario of the system for responding to unknown security events based on user behavior and traffic analysis of the present invention. DETAILED DESCRIPTION
[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0049] Glossary
[0050] Action: It is an identifier representing user operations and requests in the present invention. It is the smallest granularity identifier. For example, when a user visits a certain page, it can be divided into the user's click action, multiple actions for requesting the page, and other related request actions required to generate the page. Common audit logs and access logs can record such action logs.
[0051] Behavior: A behavior is composed of one or more actions of the user, arranged in time, and the time series value of the composition. For example, a user visiting a certain page is a behavior, which will include one or more request actions initiated by clicking a button and the button response. When a behavior has multiple actions, the actions are arranged in time.
[0052] Embodiment 1
[0053] The present invention proposes a response system for unknown security events based on user behavior and traffic analysis, such as Figure 1 As shown, including:
[0054] A traffic feature extractor, used to extract traffic features from mirrored network traffic or packet streams;
[0055] Behavior feature extractor, used to extract user behavior features;
[0056] Action feature library, used to store traffic features and behavior features corresponding to known actions;
[0057] The anomaly detector compares the traffic features extracted by the traffic feature extractor with the traffic features in the action feature library, and compares the behavior features extracted by the behavior feature extractor with the behavior features in the action feature library. If the comparison is successful, an abnormal action is detected, and the detection result of the abnormal action is sent to the generator;
[0058] Function library, used to store blocking codes;
[0059] The generator, in response to the anomaly detector, queries the blocking code of the abnormal action from the function library, generates a blocking script, and stores it in the script library;
[0060] Script library, used to store blocking scripts.
[0061] The implementation of each component in the system is as follows:
[0062] 1. Traffic feature extractor:
[0063] The input of this component is the mirrored network traffic or packet stream input by the network packet capturer. This component mainly extracts two types of features from it: statistical features of specific sessions and specific session attributes.
[0064] Statistical features of a specific session: session duration, total data volume, and time distribution of data volume. This can be expanded to increase statistical dimensions based on actual conditions.
[0065] Specific session attributes: related to the service being accessed, usually requiring the protocol, source / destination IP address, source port number; and the request header sequence extracted from the session's payload (a session usually contains one or more request headers).
[0066] 2. Behavioral feature extractor:
[0067] The input of this component is the parsed audit log and service access log. This component reads the log in a fixed-size time window and extracts user behavior features from it. The features are mainly the corresponding attributes of the user's operation. The basic attributes include user ID, time, action name, action result (success / failure), etc. It can be expanded accordingly.
[0068] 3. Action feature library:
[0069] This component mainly stores the traffic characteristics and behavior characteristics corresponding to known actions.
[0070] At least the following is stored:
[0071] Known action library: action name, action type, action content, preceding action name, following action name, and abnormality label, etc.
[0072] Request action mapping table: the mapping relationship between the payload request header (extracted from the traffic) and the action name, and the attribute value of whether it is abnormal. That is, it includes at least three attributes: payload request header, corresponding action name, and whether it is abnormal. If there is no corresponding action name, the payload request header is marked as an abnormal action by default.
[0073] Known session tag library: Usually the statistical characteristics of the session (session duration, total data volume, time distribution of data volume) and session attributes (session protocol, source / destination IP address, source port number, request header time series) and tags to mark whether the session is abnormal.
[0074] 4. Anomaly Detector:
[0075] This component is one of the core components of the present invention. It is mainly used to detect anomalies from traffic characteristics and behavior characteristics. The main workflows include tag-based behavior detection, tag-based session detection, and deep learning-based behavior detection. The three workflows are executed in sequence, and the execution flow chart is as follows: Figure 2 shown.
[0076] The specific process is:
[0077] Step 1.1, obtain the action sequence S2 output by the behavior feature extractor;
[0078] Step 1.2: Based on the action sequence, query the action names in the known action library one by one to determine whether there are abnormal actions in the action sequence. If the label of at least one action in the action sequence is marked as "yes", go to step 1.3; if all labels are marked as "no", go to step 2.1;
[0079] Step 1.3: Determine whether the action result is successful. If successful, output the abnormal action and end the detection; if unsuccessful, go to step 2.1;
[0080] Step 2.1, obtain traffic features from the traffic feature extractor, query the known session tag library, convert the load request header sequence in the traffic features into the action name sequence S1, and compare whether the action names of the action name sequence S1 and the action sequence S2 are the same. If the actions are exactly the same, go to step 2.2, otherwise, go to step 3.1;
[0081] Step 2.2: Determine whether the action result is successful. If successful, output an exception. Otherwise, go to step 3.1.
[0082] Step 3.1, input the action name sequence S1 into the first convolutional network for feature extraction, and input the traffic features into the second convolutional network for dimensionality reduction;
[0083] Step 3.2: The output of the first convolutional network is combined with the output of the second convolutional network and then input into the third convolutional network, and the third convolutional network outputs the session feature f0 to be judged; and the session feature f0 to be judged is judged abnormally in the judgment model. The specific method of judging abnormally the session feature f0 to be judged in the judgment model is as follows:
[0084] The sessions marked as abnormal in the known session tag library are converted and input into the deep learning model. The structure of the deep learning model is as follows: Figure 3 , obtain the session feature set F, compare the session feature f0 to be judged with the elements in the session feature set F, if there is an element f and f0 whose Euclidean distance is less than the threshold, then the session corresponding to the session feature f0 to be judged is judged as abnormal.
[0085] 5. Function library:
[0086] This component is used to store code snippets. Known actions will have corresponding blocking code snippets. Blocking is divided into action blocking, session blocking, service blocking and shutdown blocking.
[0087] Action blocking: Prevent users from performing corresponding actions at the application level.
[0088] Session blocking: Prevent users from performing corresponding actions at the network session level and prevent users from initiating subsequent actions.
[0089] Service blocking: Close the service corresponding to the action and prevent all users from performing new actions.
[0090] Shutdown blocking: Shut down the service corresponding to the action and its associated services, preventing all users from performing new actions.
[0091] The structure of the code snippet is one-to-one input and output. The input is the action name, and the output is the instruction that can initiate blocking.
[0092] 6. Generator:
[0093] The generator automatically arranges the function library to generate pseudo-code blocking scripts according to the abnormality level and strategy. Figure 4 shown.
[0094] Users can customize strategies to call different blocking levels to generate blocking scripts. If the number of abnormalities to a certain session exceeds a certain threshold, "session blocking" will be called; if the number of abnormal sessions of a certain service exceeds a certain threshold, service blocking or even shutdown blocking will be called.
[0095] 7. Script Library:
[0096] Used to store pseudocode blocking scripts. The script library provides an interface for the user environment's automation system to insert pseudocode blocking scripts. To generate executable blocking code, the user environment's automation system needs to support converting pseudocode into its executable program / script.
[0097] The application scenarios of the system of this embodiment are as follows: Figure 5As shown, in this implementation example, although the firewall can block most attacks from outside the server, it cannot detect or block unknown attacks, and is powerless against harmful behaviors after successful invasion of the server. In this example, the traffic collector collects traffic and inputs it into the system's "traffic feature extractor", and the log is collected and parsed and processed into the server log and then input into the "behavior feature extractor". When the system finds an abnormality, it will generate a responsive "pseudo-code script" for the automation platform to use. After the automation platform converts the "pseudo-code script" into an executable program, it can call the firewall interface to block user access to the server, or call the corresponding interface of the server / service to interrupt user access, or directly shut down the system.
[0098] In this scenario, the present invention can block external attacks and a series of harmful behaviors after the server is invaded.
[0099] Embodiment 2
[0100] The present invention proposes a method for responding to unknown security events based on user behavior and traffic analysis based on the system of embodiment 1, comprising the following steps:
[0101] Extracting traffic features from the mirrored network traffic or data packet stream; the traffic features include statistical features and session attributes of the session;
[0102] The statistical characteristics of the session include: session duration, total data volume and time distribution of data volume;
[0103] The session attributes include: session protocol, source / destination IP address, source port number, and load request header sequence.
[0104] Extracting the user's behavioral features; the extracting the user's behavioral features is specifically:
[0105] Parse the audit log and service access log, read the audit log and service access log in a fixed-size time window, and extract user behavior features from them. The user behavior features include user ID, time, action name and action result; a user behavior is an action sequence consisting of one or more actions arranged in time.
[0106] The traffic characteristics and behavior characteristics corresponding to the known actions are stored in an action characteristic library; the action characteristic library includes a known action library, a request action mapping table and a known session tag library;
[0107] The known action library stores action names, action types, action contents, preceding action names, subsequent action names, and abnormality labels;
[0108] The request action mapping table stores a mapping relationship between a load request header and an action name, and an attribute value used to mark whether the load request header corresponds to an abnormal action;
[0109] The known session tag library stores statistical features of known sessions, known session attributes, and tags marking whether the session is abnormal; the statistical features include session duration, total data volume, and time distribution of data volume; the session attributes include session protocol, source / destination IP address, source port number, and load request header sequence.
[0110] The extracted traffic features are compared with the traffic features in the action feature library, and the extracted behavior features are compared with the behavior features in the action feature library. If the comparison is successful, the abnormal action is detected. The specific process of comparing the extracted traffic features with the traffic features in the action feature library, and comparing the extracted behavior features with the behavior features in the action feature library, and if the comparison is successful, the abnormal action is detected is:
[0111] Step 1.1, obtain the action sequence S2 output by the behavior feature extractor;
[0112] Step 1.2: Based on the action sequence, query the action names in the known action library one by one to determine whether there are abnormal actions in the action sequence. If the label of at least one action in the action sequence is marked as "yes", go to step 1.3; if all labels are marked as "no", go to step 2.1;
[0113] Step 1.3: Determine whether the action result is successful. If successful, output the abnormal action and end the detection; if unsuccessful, go to step 2.1;
[0114] Step 2.1, obtain traffic features from the traffic feature extractor, query the known session tag library, convert the load request header sequence in the traffic features into the action name sequence S1, and compare whether the action names of the action name sequence S1 and the action sequence S2 are the same. If the actions are exactly the same, go to step 2.2, otherwise, go to step 3.1;
[0115] Step 2.2: Determine whether the action result is successful. If successful, output an exception. Otherwise, go to step 3.1.
[0116] Step 3.1, input the action name sequence S1 into the first convolutional network for feature extraction, and input the traffic features into the second convolutional network for dimensionality reduction;
[0117] Step 3.2: The output of the first convolutional network is combined with the output of the second convolutional network and then input into the third convolutional network, and the third convolutional network outputs the session feature f0 to be judged; and the session feature f0 to be judged is judged abnormally in the judgment model. The specific method of judging abnormally the session feature f0 to be judged in the judgment model is as follows:
[0118] The sessions marked as abnormal in the known session tag library are converted and input into the deep learning model to obtain the session feature set F. The session feature f0 to be judged is compared with the elements in the session feature set F. If there is an element f whose Euclidean distance with f0 is less than the threshold, the session corresponding to the session feature f0 to be judged is judged as abnormal.
[0119] The blocking code of abnormal action is queried from the function library to generate a blocking script; the blocking codes in the function library are divided into action blocking, session blocking, service blocking and shutdown blocking.
[0120] After converting the blocking script into an executable program, the firewall interface is called to block the user's access to the server, or the corresponding interface of the server or service is called to interrupt the user's access, or the server or service is directly shut down.
[0121] Embodiment 3
[0122] The present invention proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a method for responding to unknown security events based on user behavior and traffic analysis as described in Example 2 is implemented.
[0123] Embodiment 4
[0124] The present invention provides a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the method for responding to unknown security events based on user behavior and traffic analysis as described in Example 2.
[0125] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of computer storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.
[0126] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0127] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.
Claims
1. A response system for unknown security events based on user behavior and traffic analysis, characterized in that: include: A traffic feature extractor, used to extract traffic features from mirrored network traffic or packet streams; Behavior feature extractor, used to extract user behavior features; Action feature library, used to store traffic features and behavior features corresponding to known actions; The anomaly detector compares the traffic features extracted by the traffic feature extractor with the traffic features in the action feature library, and compares the behavior features extracted by the behavior feature extractor with the behavior features in the action feature library. If the comparison is successful, an abnormal action is detected, and the detection result of the abnormal action is sent to the generator; Function library, used to store blocking codes; The generator, in response to the anomaly detector, queries the blocking code of the abnormal action from the function library, generates a blocking script, and stores it in the script library; Script library, used to store blocking scripts.
2. A method for responding to unknown security events based on user behavior and traffic analysis based on the system of claim 1, characterized in that: The following steps are involved: Extract traffic features from mirrored network traffic or packet streams; Extracting user behavior characteristics; The traffic characteristics and behavior characteristics corresponding to the known actions are stored in the action characteristic library; The extracted traffic features are compared with the traffic features in the action feature library, and the extracted behavior features are compared with the behavior features in the action feature library. If the comparison is successful, an abnormal action is detected; the blocking code of the abnormal action is queried from the function library to generate a blocking script; After converting the blocking script into an executable program, the firewall interface is called to block the user's access to the server, or the corresponding interface of the server or service is called to interrupt the user's access, or the server or service is directly shut down.
3. The method for responding to unknown security events based on user behavior and traffic analysis according to claim 2, characterized in that: The traffic characteristics include statistical characteristics and session attributes of the session; The statistical characteristics of the session include: session duration, total data volume and time distribution of data volume; The session attributes include: session protocol, source / destination IP address, source port number, and load request header sequence.
4. The method for responding to unknown security events based on user behavior and traffic analysis as claimed in claim 2, characterized in that: The specific extraction of user behavior features is as follows: Parse the audit log and service access log, read the audit log and service access log in a fixed-size time window, and extract user behavior features from them. The user behavior features include user ID, time, action name and action result; a user behavior is an action sequence consisting of one or more actions arranged in time.
5. The method for responding to unknown security events based on user behavior and traffic analysis according to claim 2, characterized in that: The action feature library includes a known action library, a request action mapping table and a known session tag library; The known action library stores action names, action types, action contents, preceding action names, subsequent action names, and abnormality labels; The request action mapping table stores a mapping relationship between a load request header and an action name, and an attribute value used to mark whether the load request header corresponds to an abnormal action; The known session tag library stores statistical features of known sessions, known session attributes, and tags marking whether the session is abnormal; the statistical features include session duration, total data volume, and time distribution of data volume; the session attributes include session protocol, source / destination IP address, source port number, and load request header sequence.
6. The method for responding to unknown security events based on user behavior and traffic analysis according to claim 5, characterized in that: The specific process of comparing the extracted traffic features with the traffic features in the action feature library, and comparing the extracted behavior features with the behavior features in the action feature library, if the comparison is successful, then the abnormal action is detected is: Step 1.1, obtain the action sequence S2 output by the behavior feature extractor; Step 1.2: Based on the action sequence, query the action names in the known action library one by one to determine whether there are abnormal actions in the action sequence. If the label of at least one action in the action sequence is marked as "yes", go to step 1.3; if all labels are marked as "no", go to step 2.1; Step 1.3: Determine whether the action result is successful. If successful, output the abnormal action and end the detection; if unsuccessful, go to step 2.1; Step 2.1, obtain traffic features from the traffic feature extractor, query the known session tag library, convert the load request header sequence in the traffic features into the action name sequence S1, and compare whether the action names of the action name sequence S1 and the action sequence S2 are the same. If the actions are exactly the same, go to step 2.2, otherwise, go to step 3.1; Step 2.2, determine whether the action result is successful, if successful, output an exception, otherwise go to step 3.1; Step 3.1, input the action name sequence S1 into the first convolutional network for feature extraction, and input the traffic features into the second convolutional network for dimensionality reduction; Step 3.2: The output of the first convolutional network is combined with the output of the second convolutional network and then input into the third convolutional network. The third convolutional network outputs the session feature f0 to be judged. In the judgment model, an abnormal judgment is made on the session feature f0 to be judged.
7. The method for responding to unknown security events based on user behavior and traffic analysis according to claim 6, characterized in that: The abnormal judgment of the session feature f0 to be judged in the judgment model is specifically as follows: The sessions marked as abnormal in the known session tag library are converted and input into the deep learning model to obtain the session feature set F. The session feature f0 to be judged is compared with the elements in the session feature set F. If there is an element f whose Euclidean distance with f0 is less than the threshold, the session corresponding to the session feature f0 to be judged is judged as abnormal.
8. The method for responding to unknown security events based on user behavior and traffic analysis according to claim 2, characterized in that: The blocking codes in the function library are divided into action blocking, session blocking, service blocking and shutdown blocking.
9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for responding to unknown security events based on user behavior and traffic analysis as described in any one of claims 2 to 8 is implemented.
10. A computer-readable storage medium storing a computer program, characterized in that: The computer program enables the computer to execute the method for responding to unknown security events based on user behavior and traffic analysis as described in any one of claims 2-8.