Network situation awareness method and system based on user behavior analysis

Abstract

The invention relates to the technical field of network security, in particular to a network situation awareness method and system based on user behavior analysis, and the method comprises the following steps: collecting a network data packet in real time, preprocessing the collected network data packet, and extracting flow data and log data; extracting behavior characteristics from the flow data and the log data, and constructing an organization diagram; inputting the organization diagram into a pre-trained diagram convolutional network model, and outputting to obtain a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network. By implementing the security situation awareness technology based on user behavior analysis, the capabilities of identifying, analyzing and responding to complex security threats in a large-scale network environment are effectively improved. The graph convolutional network model can self-learn and adapt to a new threat mode, the detection strategy is automatically adjusted, the threat detection accuracy and recognition capability are improved, and the detection efficiency is also improved through automatic detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network situation awareness method and system based on user behavior analysis. Background Art

[0002] With the popularization of network information technology, the number of network users is increasing, and security incidents such as network attacks are becoming more and more prominent. Traditional technologies such as data encryption, identity authentication, and firewalls can no longer meet the needs of maintaining network security. Although existing network security situation awareness technologies have made progress, they still face challenges, such as the difficulty of processing due to the surge in data volume, the lack of real-time monitoring and response, the problem of false positives and false negatives, the lack of adaptability, the high resource consumption, the limitations of user behavior analysis, the reliance on historical data, the integration compatibility issues, the privacy compliance challenges, the lack of unknown threat detection capabilities, and the excessive reliance on expert knowledge.

[0003] For example, the invention with publication number CN117978836A discloses a "large-screen situational awareness system applied to a cloud monitoring service platform". Through the user behavior analysis module, the user's activities after each login are tracked, and a behavior analysis table is created. Combined with the behavior monitoring and evaluation module, the system reviews the user's login and operation behavior within a specific time and generates a short-term behavior reference table. The system can more accurately evaluate the security of the user's current operation based on the user's historical and recent operation data. Although this invention improves security and accuracy, it requires a large amount of data processing and storage resources. When facing complex and changing network threats, it is difficult to update the evaluation model in time to adapt to emerging threat patterns. Summary of the invention

[0004] The purpose of the present invention is to provide a network situation awareness method and system based on user behavior analysis to improve the problem that the prior art cannot adapt to new threat models.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides a network situation awareness method based on user behavior analysis, comprising the following steps:

[0007] Collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format;

[0008] extracting behavioral features from the traffic data and log data and constructing an organizational chart;

[0009] The organizational chart is input into a pre-trained graph convolutional network model, and a network security situation awareness result is output; the graph convolutional network model is integrated with a first generative adversarial network.

[0010] In the above scheme, traffic data and log data are first extracted from the collected network data packets, retaining the user's behavioral characteristics while removing noise. The traffic data and log data are converted into organizational charts to facilitate graph convolutional network model recognition. The graph convolutional network model has adaptive learning capabilities and can adapt to new threat methods. The graph convolutional network model is used to identify network security situations with high accuracy. In particular, the graph convolutional network model is integrated with a generative adversarial network. During the model training process, the generative adversarial network can generate samples of new threat patterns, which can further enhance the recognition ability of the graph convolutional network model, and then various threat patterns can be perceived in actual use.

[0011] In a further optimized solution, the pretreatment includes:

[0012] First, remove the noisy data;

[0013] Then, fill in the missing data;

[0014] Then, the numerical range of IP addresses is scaled from 0 to 2^32 to between 0 and 1, packets of a set time length are aggregated, timestamps are converted from UTC to local time, and dimensionality reduction is performed through rotation and projection.

[0015] In the above scheme, the influence of erroneous data can be eliminated by denoising, and the influence of missing data can be avoided by filling in missing data. Then, through data normalization, aggregation, switching, rotation and projection operations, the dimension of the data can be effectively reduced, the number of valid variables can be reduced, and then it is more conducive to extracting behavioral features.

[0016] In a possible implementation scheme, constructing the organization chart includes: taking a user day as a node, and taking the relationship between user days as edges, the organization chart is composed of nodes and edges, and the user day refers to all behavioral characteristics of a user in a day.

[0017] In one possible implementation, the organization chart is embedded in a pre-trained graph convolutional network model in the following manner:

[0018]

[0019] B i represents the i-th node in the organization diagram, Embed() is the embedding function, H i (0) represents the initial features of the node, H (l) represents the node features of the lth layer, W (l) is the weight matrix of the lth layer, σ is the activation function, is the adjacency matrix, is the degree matrix, is the normalized graph Laplacian matrix.

[0020] In a further optimized solution, the graph convolutional network model is trained by the following steps:

[0021] Collect network data packets, pre-process the collected network data packets, extract traffic data and log data, and process them into a consistent format to obtain real samples;

[0022] Generate augmented samples using a second generative adversarial network;

[0023] Train the graph convolutional network model based on augmented samples and real samples.

[0024] In the above scheme, not only real network data packets are collected to construct real samples, but also non-real expanded samples are generated through generative adversarial networks. Samples with more threat patterns will participate in model training, solving the problem of sample imbalance. After the training, the graph convolutional network model has stronger recognition ability and can identify various and new threat patterns.

[0025] In one possible implementation scheme, the second generative adversarial network includes a generator G and a discriminator D. The generator G samples the expanded sample G(z) from the prior random noise distribution Pz(z), and the discriminator D determines the source of the sample. The goal of the second generative adversarial network is to make the expanded sample distribution Pg of the generator G close to the real data distribution Pdata, and the discriminator D distinguishes the expanded sample from the real sample. The objective function is:

[0026]

[0027] In a second aspect, the present invention provides a network situation awareness system based on user behavior analysis, comprising:

[0028] The data collection module is used to collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format;

[0029] An organization chart construction module, used to extract behavior features from the traffic data and log data and construct an organization chart;

[0030] A situation awareness module is used to input the organizational chart into a pre-trained graph convolutional network model and output a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network.

[0031] In a third aspect, the present invention provides a computer program product, comprising computer-readable instructions, characterized in that the computer-readable instructions, when executed by a processor, implement the steps of the network situation awareness method based on user behavior analysis of the present invention.

[0032] In a fourth aspect, the present invention provides a computer-readable storage medium comprising computer-readable instructions, characterized in that the computer-readable instructions, when executed by a processor, implement the steps of the network situation awareness method based on user behavior analysis of the present invention.

[0033] In a fifth aspect, the present invention provides an electronic device, comprising: a memory storing program instructions; a processor connected to the memory, executing the program instructions in the memory, and implementing the steps in the network situation awareness method based on user behavior analysis of the present invention.

[0034] Compared with the prior art, the present invention has the following technical advantages:

[0035] Through the application of deep learning and graph convolutional networks, multiple challenges in network security situation awareness are effectively addressed. Faced with the surge in data volume, the use of GAN not only solves the problem of sample imbalance, but also improves the model's ability to process large-scale data. In terms of real-time monitoring, GCN can analyze user behavior in real time, quickly identify internal threats, and reduce false positives and false negatives. The graph convolutional network model is adaptive and can automatically adjust the analysis model and detection strategy to effectively respond to unknown threats. In terms of resource consumption, by optimizing data balance, the dependence on computing resources is reduced. At the same time, in user behavior analysis, the recognition and generalization capabilities of the model are improved by extracting the contextual features of user behavior. It can also be seamlessly integrated with existing security tools to enhance the compatibility of the system. In terms of privacy protection, data desensitization measures are taken to ensure compliance. The model reduces dependence on expert knowledge, reduces the workload of experts through automated and intelligent methods, and improves the overall network security protection capabilities. These improvements reflect the advantages of the present invention in solving the challenges of existing network security situation awareness technologies.

[0036] For other advantages of the present invention, please refer to the relevant description in the embodiment section. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 The flowchart of the network situation awareness method based on user behavior analysis is given as an example in the embodiment.

[0039] Figure 2 The figure is a training flowchart of the convolutional network model GCN in the embodiment.

[0040] Figure 3 Schematic diagram of the GAN workflow in the embodiment.

[0041] Figure 4 FIG. 4 is a flowchart of the GCN workflow in the embodiment.

[0042] Figure 5 It is a block diagram of the composition of the network situation awareness system based on user behavior analysis in the embodiment.

[0043] Figure 6 FIG. 4 is a block diagram of the electronic device in the embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0045] See also Figure 1 In this embodiment, a network situation awareness method based on user behavior analysis is provided, comprising the following steps:

[0046] S10, collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format to provide raw materials for subsequent feature extraction and organization chart construction.

[0047] In this embodiment, the Scapy library of Python is adopted to capture network data packets. Through this library, the original network traffic can be captured and preliminary filtering is performed on it.

[0048] During data collection, you may encounter some obviously erroneous noise data, such as negative packet sizes or abnormally large timestamps. These can be identified and removed through statistical analysis, such as Z-score or IQR, and threshold setting based on domain knowledge. For example, if the packet size is usually between a few hundred bytes and a few megabytes, then a packet size of a few hundred KB can be considered an anomaly.

[0049] After removing outliers, you need to deal with missing values ​​in the data, which can be done in a variety of ways. For example, for numerical data, you can use the mean or median to fill in; for categorical data, you can use the mode to fill in. In addition, there are interpolation methods, such as linear interpolation, or using machine learning models to predict missing values ​​is also a common method to fill missing data. For example, if the timestamps of some data packets in the data set are missing, you can use the timestamps of the previous and next data packets to perform linear interpolation to estimate the missing timestamps.

[0050] In order to facilitate the reduction of the number of effective variables, after performing the missing value filling process, preprocessing can also include data normalization, induction, switching, rotation and projection in sequence, which can help reduce the dimension of the data and extract more meaningful features.

[0051] Data normalization refers to scaling the numerical range of IP addresses from 0 to 2^32 to between 0 and 1. This ensures consistency in scale between different features.

[0052] Summarization refers to aggregating data packets of a set time length, such as aggregating hourly packet counts into daily totals, to reduce the granularity of the data and extract more important trend information.

[0053] Switching refers to converting timestamps from UTC to local time for easier analysis and understanding.

[0054] In addition, dimensionality reduction techniques such as PCA are used to rotate and project high-dimensional data to reveal the main patterns in the data and reduce the computational burden in subsequent model training.

[0055] In addition, it is necessary to eliminate attributes that cannot describe the key features of user behavior, merge key data of the same type, and obtain a refined attribute set that can fully describe the object. When eliminating attributes that cannot describe key features, it is necessary to determine which attributes have a direct impact on system behavior, which can be achieved through correlation analysis, feature importance evaluation, or methods based on domain knowledge. For example, in network traffic analysis, the source IP address and the destination IP address may be key features because they indicate the initiator and receiver of the communication, while the color of the data packet may not be a key feature. The representation of the attribute set can be a vector, a data frame, or a dictionary. In Python, the DataFrame of the Pandas library is usually used to represent the attribute set, where each column represents an attribute and each row represents a data point. For example, a DataFrame can be created that contains attributes such as source IP, destination IP, and packet size, and each row corresponds to the relevant information of a network packet. This representation method not only facilitates data management and analysis, but also makes subsequent data processing and model training more efficient.

[0056] S20, extracts behavioral features from traffic data and log data, and constructs an organizational chart.

[0057] In S10, network data packets are preprocessed to extract useful information and convert it into structured data. These data record the specific behavior of users and are the basis for building organizational charts and extracting user behavior characteristics.

[0058] In this step, behavioral features are extracted from traffic data and log data, that is, key features of user behavior, such as login time, logout time, first device activity time, last device activity time, number of device activities during non-working hours, file operations, Web browsing operations, USB flash drive usage, and other internal features. Then, an organizational chart is constructed based on this information. Each node represents a user day. A user day refers to all behavioral features of a user (specified user) on a day (specified date). Node attributes include internal user channel features extracted from user activity logs.

[0059] The embedding formula of the graph convolutional network GCN is as follows:

[0060] H i (0) =Embed(B i ) (2)

[0061]

[0062] Formula (2) represents the node embedding step in the graph convolutional network, B i Represents the i-th node in the organization diagram. Embed() is an embedding function that embeds node B i Mapped into a low-dimensional vector space, the initial feature representation H of the node can be obtained through this formula i (0) Formula (3) represents the forward propagation step in the graph convolutional network, H (l) is the node feature representation of the lth layer, W (l) is the weight matrix of the lth layer, σ is the activation function, is the adjacency matrix (a matrix representation of the connection relationship between nodes in the graph), is a degree matrix (a diagonal matrix, where the elements on the diagonal are the degrees of the corresponding nodes). is the normalized graph Laplacian matrix, which is used to smooth node features so that the graph convolutional network model can capture the local connection relationship between nodes. Through this formula, the feature representation of each node will be updated to include the information of its neighboring nodes.

[0063] See also Figure 4, in the process of constructing the node features of the organization chart, the goal is to extract key features from user activities that help identify user behavior patterns. Taking a specific user as an example, assume that there is a data frame df of the user activity log, which contains the user's login (Logon) and logoff (Logoff) activity records. First, initialize two empty DataFrame objects out1 and out2 to store the first login and last logoff time of each user, respectively. Then, traverse each user, and for each user, traverse the date of each day. For each day, filter out the login and logoff records of the user on that day from df. Suppose today is October 16, 2024, and the focus is on user A. On this day, user A logged into the system at 9 am and logged out at 5 pm. The following two pieces of information will be recorded: the first login time is 9 am and the last logoff time is 5 pm. These time information will be formatted and stored in out1 and out2, corresponding to the -f1 and -f2 features of user A, respectively. Next, merge the two DataFrames and delete the day column that is no longer needed. The merged DataFrame contains the two key behavior features of user A on this day. Finally, save this DataFrame as a CSV file, the file name can be A.csv, and store it in a pre-specified file path. This process is repeated for all users until features are extracted and saved for each node in the organizational chart (i.e., each user day). In this way, the node feature data is prepared for the graph convolutional network model, which can be used to analyze and identify abnormal behavior patterns, such as unusual login or logout times that may indicate the presence of security threats. In this way, the original log data can be converted into structured feature data that can be used for machine learning model training, providing data support for network security situation awareness.

[0064] To convert user behaviors into an organizational chart structure, each user's behavior must first be treated as a node. If two behaviors are close in time or belong to the same user, an edge can be created between the corresponding nodes. For example, if user A logs in to the system at 9 a.m. on a weekday, a node can be created for this behavior. If the email sent by user A is to user B, then in the organizational chart, an edge may be created between the nodes representing user A and user B to represent the communication behavior between them.

[0065] S30, inputting the constructed organizational chart into a pre-trained graph convolutional network model, and outputting a network security situation awareness result.

[0066] In this embodiment, the structure of the graph convolutional network GCN includes an input layer, a plurality of graph convolutional layers and an output layer. The main function of each graph convolutional layer is to aggregate the features of the node itself and the features of its neighboring nodes to update the representation of the node.

[0067] In addition, the graph convolutional network model also integrates the first generative adversarial network GAN (for the sake of distinction, the GAN here is defined as the first GAN, and the GAN when constructing the sample is defined as the second GAN). The generative adversarial network consists of a generator and a discriminator. For example, the generator can contain a three-layer fully connected network, which converts a 100-dimensional noise vector into a sample of the same dimension as the real data. Each layer is followed by a LeakyReLU activation function, and dropout is used after some layers. The discriminator can be composed of a two-layer fully connected network. After inputting the sample, it outputs a probability value, indicating the possibility that the sample is real data, using LeakyReLU and Sigmoid activation functions, and also applying dropout.

[0068] The generator and discriminator of GAN in this step are integrated into the graph convolutional network model. The generator is used to generate new user behavior samples, and the discriminator is used to evaluate the authenticity of these samples and improve the discriminative ability of the graph convolutional network model through adversarial training. In this way, GAN not only helps solve the problem of sample imbalance, but also enhances the ability of the graph convolutional network model to identify abnormal behaviors.

[0069] See also Figure 2 , the graph convolutional network model is trained through the following steps:

[0070] S100, collecting network data packets in real time, and preprocessing the collected network data packets to obtain real samples. The specific processing process can refer to the relevant description in the above step S10.

[0071] S200, constructing an expanded sample by using a generative adversarial network (GAN) to expand the data sample.

[0072] Sample imbalance is a common problem in the field of network security due to reasons such as uneven natural distribution, high cost of collecting specific samples, incomplete data collection due to human bias, and resource and time constraints. Sample imbalance refers to the situation in which there is a significant difference in the number of samples of different categories in a dataset, usually the number of malicious samples (such as attack behaviors) is far less than the number of benign samples (such as normal behaviors). This imbalance may cause machine learning models to be biased towards the majority class during training, resulting in poor performance when predicting the minority class.

[0073] In order to solve this problem, this embodiment uses a generative adversarial network (GAN) to generate high-quality benign behavior samples and malicious behavior samples to achieve data augmentation. The GAN model includes a generator G and a discriminator D. The generator G samples the expanded sample G(z) from the prior random noise distribution Pz(z), and the discriminator D determines the source of the sample. The goal of GAN is to make the expanded sample distribution Pg of the generator G as close as possible to the real data distribution Pdata, and at the same time, the discriminator D distinguishes the expanded samples and the real samples as much as possible. Therefore, the objective function of the GAN model is:

[0074]

[0075] Generator G requires basic data when generating samples. Specifically, the generator G of GAN samples the generated samples G(z) from the prior random noise distribution Pz(z), and uses a small number of malicious class labels as conditions. This means that the generator G relies on two pieces of information when generating samples:

[0076] 1) Prior random noise distribution: The generator G first samples from this distribution to obtain a noise vector z, which is the basis for generating samples.

[0077] 2) Conditional information: a small number of malicious class labels, which provide the generator G with specific patterns or features that must be followed when generating samples.

[0078] That is, the generator G generates samples based on a given random noise vector and conditional information. This process involves learning from the noise and generating data with specified characteristics, which are as close to the real data distribution Pdata as possible in distribution. These generated samples help optimize the problem of sample imbalance while maintaining the authenticity of the data distribution and improve the graph convolutional network model's ability to identify abnormal behaviors.

[0079] The process of constructing the augmented sample can be found in Figure 3 After constructing the augmented samples, the similarity of data distribution and the authenticity of synthetic data can be evaluated by kernel density estimation (KDE) and t-distributed stochastic neighbor embedding (t-SNE) methods.

[0080] The samples generated by GAN should theoretically be in a log data format that can be directly used to build an organizational chart. This is because GAN learns the distribution characteristics of real data during training, and its goal is to generate samples that are statistically indistinguishable from real data. Therefore, these samples should conform to the structure and characteristics of the original log data when they are generated. However, in order to ensure reliability and to ensure that they fully meet the data requirements for building organizational charts, preprocessing steps can also be performed on the generated augmented samples, such as format unification to ensure that the generated samples are in the same format as the original log data; data cleaning to remove possible outliers or noise; data conversion, such as timestamp conversion, numerical range scaling, etc.

[0081] Through these methods, it is possible to ensure that the synthetic data is highly similar to the original data in distribution, while maintaining the diversity and authenticity of the data, providing more balanced and comprehensive data support for subsequent model training and internal threat detection. Such data enhancement strategies help improve the generalization ability of the model, enabling it to make more accurate predictions and responses when faced with abnormal situations in the real world. The GAN in this step is mainly used for data enhancement, that is, generating synthetic user behavior data to solve the problem of sample imbalance.

[0082] S300, extracting behavioral features from real samples and augmented samples, and constructing an organization chart. The specific processing process of this step can refer to the relevant description in the aforementioned step S20.

[0083] S400, training a graph convolutional network model using the constructed organizational chart.

[0084] In this embodiment, the structure of the graph convolutional network GCN includes an input layer, a plurality of graph convolutional layers and an output layer. The main function of each graph convolutional layer is to aggregate the features of the node itself and the features of its neighboring nodes to update the representation of the node.

[0085] In addition, the first generative adversarial network (GAN) is integrated into the graph convolutional network model. The generative adversarial network consists of a generator and a discriminator. For example, the generator can contain a three-layer fully connected network, which converts a 100-dimensional noise vector into a sample of the same dimension as the real data. Each layer is followed by a LeakyReLU activation function, and some layers are followed by dropout. The discriminator can be composed of a two-layer fully connected network. After inputting a sample, it outputs a probability value indicating the possibility that the sample is real data. It uses LeakyReLU and Sign activation functions, and also applies dropout. Through this adversarial training, the generator learns to generate more realistic samples, while the discriminator improves its recognition ability. When training a generative adversarial network (GAN), a binary cross entropy loss function is used to train the generator and the discriminator. The loss function of the generator is based on the frequency with which the samples it generates are misclassified as real samples by the discriminator, while the loss of the discriminator is based on its accuracy in classifying real samples and augmented samples. During the training process, the generator and the discriminator are trained alternately: the generator strives to generate more and more realistic samples to confuse the discriminator, while the discriminator continuously improves its recognition ability. This adversarial training encourages the generator to capture the distribution of real data, while the discriminator becomes more sensitive. In order to further optimize the training process, gradient penalty and virtual batch normalization are introduced to improve the stability of the model and the quality of the expanded samples. Through these methods, the generator can more effectively learn to generate high-quality synthetic samples, while the discriminator can more accurately evaluate the authenticity of the samples.

[0086] The generator and discriminator of GAN in this step are integrated into the graph convolutional network model. The generator is used to generate new user behavior samples, and the discriminator is used to evaluate the authenticity of these samples and improve the discriminative ability of the graph convolutional network model through adversarial training. In this way, GAN not only helps solve the problem of data imbalance, but also enhances the model's ability to identify abnormal behavior.

[0087] It should be noted that during the model training process, GAN is mainly used to generate synthetic data and optimize model performance, and improve the model's ability to identify network threats through adversarial training, but the role in actual use may be different. In the actual use stage, GAN may no longer directly generate samples unless it is necessary to simulate new threats or update the model to adapt to new data distributions. At this time, the discriminator part of GAN may no longer be used to judge the sample recognition ability, because the main task of the model is to analyze actual user behavior data and detect anomalies.

[0088] During the training process, comparative experiments were also conducted, using graph convolutional networks (GCN) and support vector machines (SVM) as classifiers for classifier selection. After the model training was completed, the model performance was evaluated using indicators such as accuracy, precision, recall, and F1 score.

[0089]

[0090] The performance indicators of the model under different classifiers were collected, including accuracy, precision, recall, and F1 score. The confusion matrix helped to understand the performance of the model in the classification process in detail. After that, the authenticity of the synthetic data was evaluated using kernel density estimation and t-SNE techniques, and the results showed that the synthetic data and the original data were highly similar in distribution. By comparing the performance of the two classifiers, GCN and SVM, the impact of different feature combinations on the model performance was analyzed. The calculation of ROC curves and AUC values ​​further confirmed the superiority of the model in the task of internal threat detection.

[0091] By implementing the security situation awareness technology based on user behavior analysis of the present invention, the ability to identify, analyze and respond to complex security threats in large-scale network environments is effectively improved. First, user behavior data from different sources, such as login records, network access and file operation logs, are integrated and cleaned. Then, the contextual features of user behavior are analyzed using a graph convolutional network, and nodes of user behavior are constructed to extract complex interactive relationships between nodes. In order to solve the problem of sample imbalance, synthetic data is generated using a generative adversarial network to enhance the ability of the graph convolutional network model to identify rare threats. Next, the graph convolutional network model is trained on a balanced data set so that the graph convolutional network model can automatically detect abnormal behaviors, such as unauthorized data access or suspicious network traffic, and mark these behaviors as potential threats. For example, if an employee tries to access sensitive data during non-working hours, this behavior will be captured by the graph convolutional network model and analyzed for its deviation from the normal behavior pattern, while the synthetic data generated by the generative adversarial network helps the model learn this abnormal pattern and finally identify the real threat in actual detection. The final recognition result is a detailed report that lists the behaviors marked as abnormal, including the behavior type, time, users and system assets involved, and risk level. This automated threat detection process reduces reliance on manual intervention, improves response speed and accuracy, and significantly enhances the intelligence level of network security protection. The graph convolutional network model is able to self-learn and adapt to new threat patterns and automatically adjust detection strategies, reflecting enhanced automation capabilities. In this way, not only the efficiency of threat detection is improved, but also the workload of security analysts is reduced, allowing them to focus on more complex security issues.

[0092] The present invention effectively addresses multiple challenges in network security situation awareness through the application of deep learning and graph convolutional networks. Faced with the surge in data volume, the use of GAN not only solves the problem of sample imbalance, but also improves the ability of graph convolutional network models to process large-scale data. In terms of real-time monitoring, GCN can analyze user behavior in real time, quickly identify internal threats, and reduce false positives and false negatives. In addition, the graph convolutional network model is adaptive and can automatically adjust the analysis model and detection strategy. For example, in step S400, the first generative adversarial network (GAN) is integrated into the GCN model. Through adversarial training, the generator generates new user behavior samples, and the discriminator evaluates the authenticity of these samples, thereby improving the discrimination ability of the graph convolutional network model, realizing adaptive learning of the model and automatic adjustment of the detection strategy, and effectively responding to unknown threats.

[0093] In terms of resource consumption, by optimizing data balance, the dependence on computing resources is reduced. At the same time, in user behavior analysis, by extracting the contextual features of user behavior, the recognition and generalization capabilities of the graph convolutional network model are improved. The technology of the present invention is also seamlessly integrated with existing security tools, enhancing the compatibility of the system, which is mainly reflected in the ability to directly apply deep learning models, especially graph convolutional networks (GCNs) and generative adversarial networks (GANs), to the augmentation and feature extraction of user behavior data. These models not only improve the simulation capabilities of complex data distributions, but also enhance the fusion extraction of user behavior contextual features, providing a richer and more accurate representation for network security situation awareness. In this way, the technology of the present invention can be easily embedded in existing security monitoring and threat detection systems, without major modifications or reconstructions, to improve the performance and intelligence level of these systems.

[0094] In terms of privacy protection, data desensitization measures have been taken, which are mainly reflected in the data preprocessing process, which requires the removal of obviously erroneous noise data and duplicate records, filling in missing data, and scaling the numerical range of IP addresses, timestamp conversion, dimensionality reduction and other operations. These steps may involve the processing of sensitive information, such as anonymizing or generalizing sensitive information such as IP addresses to protect user privacy. These measures help to protect users' personal privacy information from being leaked while improving network security protection capabilities.

[0095] The graph convolutional network model reduces the reliance on expert knowledge and, through automated and intelligent methods, reduces the workload of experts and improves the overall network security protection capabilities.

[0096] See also Figure 5 Based on the same inventive concept, this embodiment also provides a network situation awareness system based on user behavior analysis, including:

[0097] The data collection module is used to collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format;

[0098] An organization chart construction module, used to extract behavior features from the traffic data and log data and construct an organization chart;

[0099] A situation awareness module is used to input the organizational chart into a pre-trained graph convolutional network model and output a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network.

[0100] The specific execution process of each component module in the above system can be found in the relevant description of the above method, which will not be repeated here.

[0101] like Figure 6 As shown, this embodiment also provides an electronic device, which may include a processor 41 and a memory 42, wherein the memory 42 is coupled to the processor 41. It is worth noting that this figure is exemplary, and other types of structures may be used to supplement or replace this structure to achieve data extraction, report generation, communication or other functions.

[0102] like Figure 6 As shown, the electronic device may further include: an input unit 43, a display unit 44 and a power supply 45. It is worth noting that the electronic device does not necessarily have to include Figure 6 In addition, electronic devices may also include Figure 6 For components not shown, reference may be made to the prior art.

[0103] The processor 41 is sometimes also called a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The processor 41 receives inputs and controls the operations of various components of the electronic device.

[0104] The memory 42 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices, and may store information such as configuration information of the processor 41 and instructions executed by the processor 41. The processor 41 may execute the program stored in the memory 42 to implement information storage or processing. In one embodiment, the memory 42 also includes a buffer memory, i.e., a buffer, to store intermediate information.

[0105] An embodiment of the present invention further provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed in an electronic device, the program product enables the electronic device to execute the operation steps included in the method of the present invention.

[0106] An embodiment of the present invention further provides a storage medium storing computer-readable instructions, wherein the computer-readable instructions enable an electronic device to execute the operation steps included in the method of the present invention.

[0107] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0108] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-On lyMemory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0109] The above-described embodiments are only specific implementations of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications, replacements and improvements within the technical scope disclosed by the present invention, and these modifications, replacements and improvements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network situation awareness method based on user behavior analysis, characterized in that: The following steps are involved: Collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format; extracting behavioral features from the traffic data and log data and constructing an organizational chart; The organizational chart is input into a pre-trained graph convolutional network model, and a network security situation awareness result is output; the graph convolutional network model is integrated with a first generative adversarial network.

2. The network situation awareness method based on user behavior analysis according to claim 1 is characterized in that: The pre-processing comprises: First, remove the noisy data; Then, fill in the missing data; Then, the numerical range of IP addresses is scaled from 0 to 2^32 to between 0 and 1, packets of a set time length are aggregated, timestamps are converted from UTC to local time, and dimensionality reduction is performed through rotation and projection.

3. The network situation awareness method based on user behavior analysis according to claim 1 is characterized in that: The construction of the organizational chart includes: Take a user day as a node and the relationship between user days as edges. The organizational diagram consists of nodes and edges. User day refers to all behavioral characteristics of a user in one day.

4. The network situation awareness method based on user behavior analysis according to claim 3 is characterized in that: The organizational chart is embedded into a pre-trained graph convolutional network model in the following way: H i (0) =Embed(B i ); B i represents the i-th node in the organization diagram, Embed() is the embedding function, H i (0) represents the initial features of the node, H (l) represents the node features of the lth layer, W (l) is the weight matrix of the lth layer, σ is the activation function, is the adjacency matrix, is the degree matrix, is the normalized graph Laplacian matrix.

5. The network situation awareness method based on user behavior analysis according to claim 1 is characterized in that: The graph convolutional network model is trained by the following steps: Collect network data packets, pre-process the collected network data packets, extract traffic data and log data, and process them into a consistent format to obtain real samples; Generate augmented samples using a second generative adversarial network; Train the graph convolutional network model based on augmented samples and real samples.

6. The network situation awareness method based on user behavior analysis according to claim 5 is characterized in that: The second generative adversarial network includes a generator G and a discriminator D. The generator G samples the expanded sample G(z) from the prior random noise distribution Pz(z), and the discriminator D determines the source of the sample. The goal of the second generative adversarial network is to make the expanded sample distribution Pg generated by the generator G close to the real data distribution Pdata, and the discriminator D distinguishes the expanded samples from the real samples. The objective function is:

7. A network situation awareness system based on user behavior analysis, characterized in that: include: The data collection module is used to collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format; An organization chart construction module, used to extract behavior features from the traffic data and log data and construct an organization chart; A situation awareness module is used to input the organizational chart into a pre-trained graph convolutional network model and output a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network.

8. A computer program product comprising computer readable instructions, characterized in that: The computer-readable instructions, when executed by a processor, implement the steps in the network situation awareness method based on user behavior analysis described in any one of claims 1 to 6.

9. A computer-readable storage medium comprising computer-readable instructions, characterized in that: The computer-readable instructions, when executed by a processor, implement the steps in the network situation awareness method based on user behavior analysis described in any one of claims 1 to 6.

10. An electronic device, characterized in that: include: Memory, which stores program instructions; A processor is connected to the memory and executes program instructions in the memory to implement the steps in the network situation awareness method based on user behavior analysis described in any one of claims 1 to 6.

Images