Zero-trust abnormal behavior detection method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a zero-trust abnormal behavior detection method and device, computer equipment, a readable storage medium and a program product. Respectively processing the to-be-detected behavior log and the normal behavior log through a preset feature extraction model to obtain a to-be-detected behavior feature vector and a normal behavior feature vector, and then inputting the to-be-detected behavior feature vector and the normal behavior feature vector into a preset detection model, obtaining a prediction similarity between the to-be-detected behavior log and the normal behavior log; whether the to-be-detected behavior log is an abnormal behavior or not can be judged by comparing the obtained predicted similarity with a preset similarity threshold value. Therefore, on the basis of the zero-trust abnormal behavior detection method, continuous risk assessment can be carried out on the real-time access behavior of the zero-trust user and / or equipment, and the detection accuracy of the abnormal behavior is improved.

Description

Technical Field

[0001] The present application relates to the technical field of zero-trust abnormal behavior detection, and in particular to a zero-trust abnormal behavior detection method, apparatus, computer equipment, readable storage medium, and program product. Background Art

[0002] With the rapid development of information technology, enterprises are facing more and more challenges in security. Therefore, the zero-trust security model based on the security principle of "never trust, always verify" has emerged. This zero-trust model reduces the scope of trust to the minimum. It no longer trusts internal users and devices by default, but always authenticates and authorizes all users and devices. Under the zero-trust model, identifying and preventing abnormal user behavior becomes the key to maintaining enterprise security.

[0003] In the existing technology, the abnormal behavior detection method based on the zero-trust model relies on predefined rules and policies. These rules and policies are usually formulated based on the experience of system administrators or security experts, so they cannot flexibly respond to threat attack behaviors that adapt to environmental changes and new threat attack behaviors, resulting in the problem of underreporting. Summary of the invention

[0004] Based on this, it is necessary to provide a zero-trust abnormal behavior detection method, device, computer equipment, readable storage medium and program product that can improve the detection accuracy of abnormal behavior in response to the above technical problems.

[0005] In a first aspect, the present application provides a zero-trust abnormal behavior detection method, comprising:

[0006] Inputting the behavior log to be detected into a preset feature extraction model to obtain a feature vector of the behavior to be detected; the preset feature extraction model is a model that converts the information of the behavior log into a corresponding feature vector;

[0007] Input the normal behavior log into a preset feature extraction model to obtain a normal behavior feature vector;

[0008] Inputting the behavior feature vector to be detected and the normal behavior feature vector into a preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; the preset detection model is a detection model based on the similarity between the abnormal behavior log and the normal behavior log obtained by training the behavior log training samples;

[0009] Based on the predicted similarity and the preset similarity threshold, determine whether the behavior log to be detected is an abnormal behavior.

[0010] In one embodiment, the step of determining the preset detection model includes:

[0011] Obtaining a behavior log training sample set, and randomly dividing the behavior log training sample set into a first training set and a second training set, wherein the behavior log training sample set includes normal behavior logs and abnormal behavior logs;

[0012] Inputting the first training set and the second training set into a preset feature extraction model respectively to obtain a first behavior feature vector and a second behavior feature vector;

[0013] The first behavior feature vector and the second behavior feature vector are respectively input into the deep twin self-attention network and trained to obtain a preset detection model.

[0014] In one embodiment, after obtaining the behavior log training sample set and before the step of randomly dividing the behavior log training sample set into a first training set and a second training set, the method includes:

[0015] Standardize the text data in the behavior logs in the behavior log training sample set to obtain standardized data;

[0016] Segment the standardized data based on the word segmenter, and mark the starting point and the end point of the standardized data respectively;

[0017] The non-text data in the behavior log is mapped to discrete integer values ​​to determine the discrete data.

[0018] In one embodiment, the steps of inputting the first behavior feature vector and the second behavior feature vector into the deep twin self-attention network respectively and training them to obtain a preset detection model include:

[0019] Inputting the first behavior feature vector into a preset input layer to obtain first data matching the shared network;

[0020] Inputting the second behavior feature vector into a preset input layer to obtain second data matching the shared network;

[0021] Inputting the first data and the second data into a shared network to extract features of the first data and features of the second data;

[0022] Enhance the extracted features of the first data and the extracted features of the second data respectively based on the self-attention layer to obtain a first output corresponding to the first data and a second output corresponding to the second data;

[0023] determining a predicted similarity between the first output and the second output;

[0024] According to the predicted similarity and the deviation of the actual similarity between the first behavior feature vector and the second behavior feature vector, the parameters of the deep twin self-attention network are adjusted until the end condition is reached;

[0025] The trained deep twin self-attention network is used as the preset detection model.

[0026] In one embodiment, the method further comprises:

[0027] Determine a loss value according to the predicted similarity and the comparison loss function; wherein the loss value is used to represent the distance between the normal behavior log and the abnormal behavior log;

[0028] The training parameters of the deep twin self-attention network are adjusted according to the loss value to optimize the deep twin self-attention network.

[0029] In one embodiment, after the step of mapping the non-text data in the behavior log to discrete integer values ​​to determine the discrete data, the method further includes:

[0030] Add the discrete data to the standardized data to determine the data to be adjusted;

[0031] The length of the data to be adjusted is adjusted to the preset length by padding or truncation.

[0032] In a second aspect, the present application also provides a zero-trust abnormal behavior detection device, including:

[0033] A first feature vector extraction module is used to input the behavior log to be detected into a preset feature extraction model to obtain a feature vector of the behavior to be detected; the preset feature extraction model is a model that converts the information of the behavior log into a corresponding feature vector;

[0034] A second feature vector extraction module, used for inputting the normal behavior log into a preset feature extraction model to obtain a normal behavior feature vector;

[0035] A detection module, used to input the behavior feature vector to be detected and the normal behavior feature vector into a preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; the preset detection model is a detection model based on the similarity between the abnormal behavior log and the normal behavior log obtained by training based on the behavior log training sample;

[0036] The judgment module is used to judge whether the behavior log to be detected is an abnormal behavior based on the predicted similarity and the preset similarity threshold.

[0037] In a third aspect, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements any step in the above-mentioned zero-trust abnormal behavior detection method when executing the computer program.

[0038] In a fourth aspect, the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, any step in the above-mentioned zero-trust abnormal behavior detection method is implemented.

[0039] In a fifth aspect, the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements any step in the above-mentioned zero-trust abnormal behavior detection method.

[0040] The above-mentioned zero-trust abnormal behavior detection method, device, computer equipment, readable storage medium and program product respectively process the behavior log to be detected and the normal behavior log through a preset feature extraction model to obtain the behavior feature vector to be detected and the normal behavior feature vector, and then input the behavior feature vector to be detected and the normal behavior feature vector into the preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; by comparing the obtained predicted similarity with the preset similarity threshold, it can be determined whether the behavior log to be detected is an abnormal behavior. Therefore, based on the above-mentioned zero-trust abnormal behavior detection method, it is possible to conduct continuous risk assessment of the real-time access behavior of zero-trust users and / or devices, thereby improving the accuracy of abnormal behavior detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 This is an application environment diagram of a zero-trust abnormal behavior detection method in an embodiment;

[0043] Figure 2 Schematic diagram of a process of a zero-trust abnormal behavior detection method in one embodiment;

[0044] Figure 3 A schematic diagram of a process for determining a preset detection model in an embodiment;

[0045] Figure 4 It is a structural block diagram of a zero-trust abnormal behavior detection device in one embodiment;

[0046] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] The zero-trust abnormal behavior detection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process, the preset feature extraction model and the preset detection model. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 obtains the behavior log to be detected input from the terminal 102, and inputs the behavior log to be detected into the preset feature extraction model to obtain the behavior feature vector to be detected; the server also obtains the normal behavior log from the terminal 102 or the data storage system, and inputs the normal behavior log into the same preset feature extraction model to obtain the normal behavior feature vector; then the above-mentioned behavior feature vector to be detected and the normal behavior feature vector are respectively input into the preset detection model pre-stored in the data storage system to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; according to the size relationship between the obtained predicted similarity and the preset similarity threshold, it can be judged whether the behavior log to be detected is an abnormal behavior. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers and portable wearable devices of Internet of Things devices. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0049] In an exemplary embodiment, Figure 2 As shown, a zero-trust abnormal behavior detection method is provided, which is applied to Figure 1 The following is an example of a server in the example, including:

[0050] S202, inputting the behavior log to be detected into a preset feature extraction model to obtain a feature vector of the behavior to be detected; the preset feature extraction model is a model that converts the information of the behavior log into a corresponding feature vector.

[0051] S204, input the normal behavior log into a preset feature extraction model to obtain a normal behavior feature vector. The normal behavior log refers to the activity records generated by users and devices in the system or network under normal operation conditions, and these activity records represent that the users and devices are in a compliant and expected behavior mode. Correspondingly, the abnormal behavior log refers to the activity records in the system or network where the behavior of users or devices deviates from the normal behavior mode, and these behaviors represent possible security threats, attacks or violations.

[0052] Inputting the behavior log to be detected and the normal behavior log into the preset feature extraction model to extract feature vectors respectively can highlight the important information in the behavior log to be detected and the normal behavior log, while eliminating noise and redundant information, so that in the subsequent detection process, the preset detection model can focus more on these feature vectors. Furthermore, using the behavior feature vector to be detected to represent the behavior log to be detected and using the normal behavior feature vector to represent the normal behavior log can reduce storage and calculation of the ride, thereby greatly reducing the consumption of computing resources and improving computing efficiency.

[0053] Exemplarily, the preset feature extraction model may be BERT (Bidirectional Encoder Representations from Transformers). BERT is a pre-trained language representation model that uses the Transformer architecture to capture the contextual information of the behavior logs to be detected and the contextual information of the normal behavior logs through training on large-scale behavior logs to be detected and normal behavior logs, that is, it can capture the long-distance dependencies in the behavior logs to be detected and the long-distance dependencies in the normal behavior logs, thereby improving the connection between the data in the behavior logs to be detected, the connection between the normal behavior logs, and the understanding of the behavior logs to be detected and the normal behavior logs.

[0054] Therefore, the preset feature extraction model can capture the long-distance dependencies in the behavior logs to be detected and the long-distance dependencies in the normal behavior logs, so that it can detect abnormal behavior logs corresponding to threat attack behaviors that have adapted to environmental changes, new threat attack behaviors, etc., reduce underreporting, and improve the accuracy of abnormal behavior detection.

[0055] S206, inputting the behavior feature vector to be detected and the normal behavior feature vector into a preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; the preset detection model is a detection model based on the similarity between the abnormal behavior log and the normal behavior log obtained by training based on the behavior log training samples.

[0056] S208: judging whether the behavior log to be detected is an abnormal behavior according to the predicted similarity and the preset similarity threshold.

[0057] The feature vector of the behavior to be detected and the feature vector of the normal behavior obtained after processing by the preset feature extraction model are input into the preset detection model to predict the feature vector of the behavior to be detected. When the output prediction similarity is less than the preset similarity threshold, it can be considered that the similarity between the behavior log to be detected and the normal behavior log is low, and the behavior log to be detected can be characterized as an abnormal behavior log; when the output prediction similarity is greater than or equal to the preset similarity threshold, it can be considered that the similarity between the behavior log to be detected and the normal behavior log is high, and the behavior log to be detected can be characterized as a normal behavior log.

[0058] Therefore, the above-mentioned zero-trust abnormal behavior detection method processes the behavior log to be detected and the normal behavior log respectively through a preset feature extraction model to obtain the behavior feature vector to be detected and the normal behavior feature vector, and then inputs the behavior feature vector to be detected and the normal behavior feature vector into the preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; by comparing the obtained predicted similarity with the preset similarity threshold, it can be determined whether the behavior log to be detected is an abnormal behavior. Therefore, based on the above-mentioned zero-trust abnormal behavior detection method, it is possible to conduct continuous risk assessment of the real-time access behavior of zero-trust users and / or devices, thereby improving the accuracy of abnormal behavior detection. Furthermore, in the case of detecting an abnormal behavior log, the access rights of the client can be adjusted, and the adjustment actions include issuing access blocking, logout and other disposal actions, thereby ensuring the security of enterprise resource access.

[0059] In an exemplary embodiment, the step of determining the preset detection model includes:

[0060] A behavior log training sample set is obtained, and the behavior log training sample set is randomly divided into a first training set and a second training set, wherein the behavior log training sample set includes normal behavior logs and abnormal behavior logs.

[0061] The first training set and the second training set are respectively input into a preset feature extraction model to obtain a first behavior feature vector and a second behavior feature vector.

[0062] The first behavior feature vector and the second behavior feature vector are respectively input into the deep twin self-attention network and trained to obtain a preset detection model.

[0063] Specifically, when the first training set is a normal behavior log, the second training set may be a normal behavior log or an abnormal behavior log; correspondingly, when the first training set is an abnormal behavior log, the second training set may be a normal behavior log, thereby determining the distance between normal behavior logs and normal behavior logs and the distance between normal behavior logs and abnormal behavior logs, so that the obtained preset detection model can effectively detect the behavior logs to be detected, thereby improving the accuracy and reliability of the zero-trust abnormal behavior detection method.

[0064] In an exemplary embodiment, Figure 3 As shown, after obtaining the behavior log training sample set and before the step of randomly dividing the behavior log training sample set into the first training set and the second training set, the above zero-trust abnormal behavior detection method includes:

[0065] The text data in the behavior logs in the behavior log training sample set is standardized to obtain standardized data.

[0066] Since the behavior log training sample set includes normal behavior logs and abnormal behavior logs, the text data in the normal behavior logs and abnormal behavior logs are standardized, including standard case format processing, removal of useless spaces and special characters, etc., to obtain the input data form that matches the preset feature extraction model. The above text data includes but is not limited to client operating system information, client version information, device information, joined domain, network information, terminal installed software information, process information, login geographic location, access geographic location, and accessed resource information.

[0067] The standardized data is segmented based on the word segmenter, and the starting point and the end point of the standardized data are marked respectively.

[0068] The standardized data is tokenized to convert it into Token (the smallest unit after tokenization by the tokenizer), and a start tag [CLS] is added at the starting point of each standardized data, and an end tag [SEP] is added at the end point of each standardized data to mark the beginning and end of the sentence where the standardized data is located, so that the preset detection model can capture the sentence-level features of the standardized data to more accurately understand the context, sentence structure and semantic relationship of the standardized data, thereby improving the generalization ability of the preset detection model, so that the zero-trust abnormal behavior detection method can detect more types of abnormal behavior logs.

[0069] The non-text data in the behavior log is mapped to discrete integer values ​​to determine the discrete data.

[0070] Correspondingly, the non-text data in the behavior log includes the non-text data in the normal behavior log and the non-text data in the abnormal behavior log. These non-text data are mapped in a similar range by normalization or standardization. Specifically, one-hot (One-hot Encoding) encoding can be used to map these non-text data into discrete integer values ​​to process these non-text data in a unified dimension. Among them, the above non-text data includes but is not limited to the client login status, the built-in firewall opening status, and the high-risk service opening status.

[0071] In an exemplary embodiment, Figure 3 As shown, the steps of inputting the first behavior feature vector and the second behavior feature vector into the deep twin self-attention network respectively and training them to obtain the preset detection model include:

[0072] The first behavior feature vector is input into a preset input layer to obtain first data matched with the shared network.

[0073] The second behavior feature vector is input into a preset input layer to obtain second data matched with the shared network.

[0074] The first data and the second data are input into the shared network to extract features of the first data and features of the second data.

[0075] Based on the self-attention layer, the extracted features of the first data and the extracted features of the second data are enhanced respectively to obtain a first output corresponding to the first data and a second output corresponding to the second data.

[0076] A predicted similarity between the first output and the second output is determined.

[0077] According to the predicted similarity and the deviation between the actual similarity of the first behavior feature vector and the second behavior feature vector, the parameters of the deep twin self-attention network are adjusted until the end condition is reached.

[0078] The trained deep twin self-attention network is used as the preset detection model.

[0079] The first behavior feature vector and the second behavior feature vector processed by the preset feature extraction model are respectively input into the preset input layer to obtain the first data and the second data matching the public grain network, wherein the first data and the second data can be regarded as a zero-trust behavior feature vector pair. Then the first data and the second data are respectively input into a shared network with shared weights and parameters and consistent network structure to perform the same feature extraction and feature learning on the first data and the second data. Then the features of the first data and the features of the second data obtained are input into the self-attention layer to weight the features therein, thereby interfering with the key features that can be determined as abnormal behavior logs. Then iterative training is performed based on the above training process until the iterative training is completed, and an output model of an iterative training is obtained. The output model is verified by the validation set. When the deviation between the corresponding predicted similarity and the actual similarity of the validation set exceeds the appropriate range, the parameters in the deep twin self-attention network are adjusted according to the deviation value between the predicted similarity and the actual similarity of the validation set until the above deviation is in the appropriate range, the output model can be determined to be the preset detection model.

[0080] Among them, the above-mentioned predicted similarity can be determined by measuring the similarity between the output of the feature input of the first data to the self-attention layer and the output of the feature input of the second data to the self-attention layer based on the cosine similarity function.

[0081] Among them, the above-mentioned self-attention layer can select a suitable self-attention layer according to the performance requirements and efficiency requirements in practical applications.

[0082] In an exemplary embodiment, the above zero-trust abnormal behavior detection method further includes:

[0083] A loss value is determined according to the predicted similarity and the contrast loss function; wherein the loss value is used to characterize the distance between the normal behavior log and the abnormal behavior log.

[0084] The training parameters of the deep twin self-attention network are adjusted according to the loss value to optimize the deep twin self-attention network.

[0085] The predicted similarity is input into the contrast loss function to determine the loss value. When the loss value is lower, it can be characterized as the smaller the distance between normal behavior logs and normal behavior logs, and the larger the distance between normal behavior logs and abnormal behavior logs, that is, the higher the detection accuracy of the preset detection model at this time. Therefore, based on the size of the loss value, the parameters in the deep twin self-attention network can be adjusted accordingly, thereby optimizing the deep twin self-attention network to obtain a preset detection model with better performance and improve the detection accuracy of the zero-trust abnormal behavior detection method.

[0086] In an exemplary embodiment, after the step of mapping the non-text data in the behavior log to discrete integer values ​​to determine the discrete data, the zero-trust abnormal behavior detection method further includes:

[0087] The discrete data is added to the normalized data to determine the data to be adjusted.

[0088] The length of the data to be adjusted is adjusted to the preset length by padding or truncation.

[0089] The discrete data that is not the text data is added to the standardized data of the text data to form the data to be adjusted that represents the complete behavior log, and the data to be adjusted is adjusted to a consistent length by padding or truncation to prevent batches of consistent length and perform more efficient parallel computing, thereby accelerating the training process.

[0090] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0091] Based on the same inventive concept, the embodiment of the present application also provides a zero-trust abnormal behavior detection device for implementing the zero-trust abnormal behavior detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more zero-trust abnormal behavior detection device embodiments provided below can refer to the limitations of the zero-trust abnormal behavior detection method above, and will not be repeated here.

[0092] In an exemplary embodiment, Figure 4 As shown, a zero-trust abnormal behavior detection device 400 is provided, including: a first feature vector extraction module 402, a second feature vector extraction module 404, a detection module 406 and a judgment module 408, wherein:

[0093] The first feature vector extraction module 402 is used to input the behavior log to be detected into a preset feature extraction model to obtain the behavior feature vector to be detected; the preset feature extraction model is a model that converts the information of the behavior log into a corresponding feature vector.

[0094] The second feature vector extraction module 404 is used to input the normal behavior log into a preset feature extraction model to obtain a normal behavior feature vector.

[0095] The detection module 406 is used to input the behavior feature vector to be detected and the normal behavior feature vector into a preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; the preset detection model is a detection model based on the similarity between the abnormal behavior log and the normal behavior log obtained by training the behavior log training samples.

[0096] The judgment module 408 is used to judge whether the behavior log to be detected is an abnormal behavior according to the predicted similarity and a preset similarity threshold.

[0097] In an exemplary embodiment, the detection module 406 includes: a training set determination module, a behavior feature vector determination module and a preset detection model determination module.

[0098] The training set determination module is used to obtain a behavior log training sample set and randomly divide the behavior log training sample set into a first training set and a second training set. The behavior log training sample set includes normal behavior logs and abnormal behavior logs.

[0099] The behavior feature vector determination module is used to input the first training set and the second training set into a preset feature extraction model respectively to obtain a first behavior feature vector and a second behavior feature vector.

[0100] The preset detection model determination module is used to input the first behavior feature vector and the second behavior feature vector into the deep twin self-attention network respectively and perform training to obtain the preset detection model.

[0101] In an exemplary embodiment, the training set determination module includes: a first text data processing module, a second text data processing module and a non-text data processing module.

[0102] The first text data processing module is used to perform standardization processing on the text data in the behavior log in the behavior log training sample set to obtain standardized data.

[0103] The second text data processing module is used to segment the standardized data based on the word segmenter, and mark the starting point and the end point of the standardized data respectively.

[0104] The non-text data processing module is used to map the non-text data in the behavior log into discrete integer values ​​to determine the discrete data.

[0105] In an exemplary embodiment, the above-mentioned preset detection model determination module includes: a first preset input layer processing module, a second preset input layer processing module, a feature extraction module, a feature enhancement module, a prediction similarity determination module, an iteration module and a selection module.

[0106] The first preset input layer processing module is used to input the first behavior feature vector into the preset input layer to obtain first data matching the shared network.

[0107] The second preset input layer processing module is used to input the second behavior feature vector into the preset input layer to obtain second data matching the shared network.

[0108] The feature extraction module is used to input the first data and the second data into the shared network to extract the features of the first data and the features of the second data.

[0109] The feature enhancement module is used to enhance the features of the extracted first data and the features of the second data respectively based on the self-attention layer to obtain a first output corresponding to the first data and a second output corresponding to the second data.

[0110] The prediction similarity determination module is used to determine the prediction similarity between the first output and the second output.

[0111] The iteration module is used to adjust the parameters of the deep twin self-attention network according to the predicted similarity and the deviation of the actual similarity between the first behavior feature vector and the second behavior feature vector until the end condition is reached.

[0112] The optimization module is used to use the trained deep twin self-attention network as the preset detection model.

[0113] In an exemplary embodiment, the above-mentioned zero-trust abnormal behavior detection device 400 also includes: a loss value determination module and an optimization module.

[0114] The loss value determination module is used to determine the loss value according to the predicted similarity and the contrast loss function; wherein the loss value is used to characterize the distance between the normal behavior log and the abnormal behavior log.

[0115] The optimization module is used to adjust the training parameters of the deep twin self-attention network according to the loss value to optimize the deep twin self-attention network.

[0116] In an exemplary embodiment, the above-mentioned zero-trust abnormal behavior detection device 400 also includes: a data integration module and a length adjustment module.

[0117] The data integration module is used to add discrete data to standardized data to determine the data to be adjusted.

[0118] The length adjustment module is used to adjust the length of the data to be adjusted to a preset length by padding or truncation.

[0119] Each module in the above-mentioned zero-trust abnormal behavior detection device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0120] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data in a behavior log training sample set. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a zero-trust abnormal behavior detection method is implemented.

[0121] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor executes the steps of any one of the above-mentioned zero-trust abnormal behavior detection methods.

[0123] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any method of the above-mentioned zero-trust abnormal behavior detection method are implemented.

[0124] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned zero-trust abnormal behavior detection methods.

[0125] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0126] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0127] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A zero-trust abnormal behavior detection method, characterized in that: The method comprises: Inputting the behavior log to be detected into a preset feature extraction model to obtain a feature vector of the behavior to be detected; the preset feature extraction model is a model that converts the information of the behavior log into a corresponding feature vector; Inputting the normal behavior log into the preset feature extraction model to obtain a normal behavior feature vector; Inputting the behavior feature vector to be detected and the normal behavior feature vector into a preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; the preset detection model is a detection model of the similarity between the abnormal behavior log and the normal behavior log obtained by training based on the behavior log training sample; According to the predicted similarity and a preset similarity threshold, it is determined whether the behavior log to be detected is an abnormal behavior.

2. The method according to claim 1, characterized in that The step of determining the preset detection model includes: Acquire a behavior log training sample set, and randomly divide the behavior log training sample set into a first training set and a second training set, wherein the behavior log training sample set includes normal behavior logs and abnormal behavior logs; Inputting the first training set and the second training set into the preset feature extraction model respectively to obtain a first behavior feature vector and a second behavior feature vector; The first behavior feature vector and the second behavior feature vector are respectively input into a deep twin self-attention network and trained to obtain the preset detection model.

3. The method according to claim 2, characterized in that After obtaining the behavior log training sample set and before the step of randomly dividing the behavior log training sample set into a first training set and a second training set, the method includes: Standardize the text data in the behavior logs in the behavior log training sample set to obtain standardized data; Segmenting the standardized data based on a word segmenter, and marking the starting point and the ending point of the standardized data respectively; The non-text data in the behavior log is mapped to discrete integer values ​​to determine discrete data.

4. The method according to claim 2, characterized in that: The step of inputting the first behavior feature vector and the second behavior feature vector into a deep twin self-attention network and training the network to obtain the preset detection model includes: Inputting the first behavior feature vector into a preset input layer to obtain first data matching a shared network; Inputting the second behavior feature vector into the preset input layer to obtain second data matching the shared network; Inputting the first data and the second data into the shared network to extract features of the first data and features of the second data; Enhance the extracted features of the first data and the extracted features of the second data respectively based on the self-attention layer to obtain a first output corresponding to the first data and a second output corresponding to the second data; determining a predicted similarity between the first output and the second output; According to the predicted similarity and the deviation of the actual similarity between the first behavior feature vector and the second behavior feature vector, adjusting the parameters of the deep twin self-attention network until an end condition is reached; The trained deep twin self-attention network is used as the preset detection model.

5. The method according to claim 4, characterized in that The method further comprises: Determine a loss value according to the predicted similarity and the comparison loss function; wherein the loss value is used to characterize the distance between the normal behavior log and the abnormal behavior log; Adjust the training parameters of the deep twin self-attention network according to the loss value to optimize the deep twin self-attention network.

6. The method according to claim 3, characterized in that After the step of mapping the non-text data in the behavior log into discrete integer values ​​to determine discrete data, the method further includes: Adding the discrete data to the standardized data to determine the data to be adjusted; The length of the data to be adjusted is adjusted to a preset length by padding or truncation.

7. A zero-trust abnormal behavior detection device, characterized in that: The device comprises: A first feature vector extraction module is used to input the behavior log to be detected into a preset feature extraction model to obtain a feature vector of the behavior to be detected; the preset feature extraction model is a model that converts the information of the behavior log into a corresponding feature vector; A second feature vector extraction module, used for inputting the normal behavior log into the preset feature extraction model to obtain a normal behavior feature vector; A detection module, used for inputting the behavior feature vector to be detected and the normal behavior feature vector into a preset detection model to obtain the predicted similarity between the behavior log to be detected and the normal behavior log; the preset detection model is a detection model of the similarity between the abnormal behavior log and the normal behavior log obtained by training based on the behavior log training sample; The judgment module is used to judge whether the behavior log to be detected is an abnormal behavior according to the predicted similarity and a preset similarity threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images