Network situation awareness method and system based on user behavior analysis

Abstract

The present invention relates to the field of network security technology, and in particular to a network situation awareness method and system based on user behavior analysis, the method comprising the following steps: collecting network data packets in real time, and pre-processing the collected network data packets to extract flow data and log data; extracting behavioral features from the flow data and log data, and constructing an organization chart; inputting the organization chart into a pre-trained graph convolutional network model, and outputting a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network. By implementing the security situation awareness technology based on user behavior analysis of the present invention, the ability to identify, analyze and respond to complex security threats in large-scale network environments is effectively improved. The graph convolutional network model can self-learn and adapt to new threat patterns, automatically adjust detection strategies, improve the accuracy and recognition capabilities of threat detection, and automated detection also improves detection efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network situation awareness method and system based on user behavior analysis. Background Art

[0002] With the widespread adoption of network information technology, the number of internet users has increased, and security incidents such as cyberattacks have become increasingly prominent. Traditional technologies such as data encryption, identity authentication, and firewalls are no longer sufficient to maintain network security. While existing network security situational awareness technologies have made progress, they still face challenges, such as processing difficulties caused by the surge in data volumes, inadequate real-time monitoring and response, false positives and false negatives, lack of adaptability, high resource consumption, limitations in user behavior analysis, reliance on historical data, integration and compatibility issues, privacy compliance challenges, insufficient detection of unknown threats, and over-reliance on expert knowledge.

[0003] For example, invention publication number CN117978836A discloses a "large-screen situational awareness system for a cloud monitoring service platform." This system uses a user behavior analysis module to track user activity after each login, creating a behavior analysis table. Combined with a behavior monitoring and evaluation module, the system reviews user login and operation behaviors within a specific timeframe and generates a short-term behavior reference table. This system can more accurately assess the security of a user's current operations based on their historical and recent operation data. While this invention improves security and accuracy, it requires significant data processing and storage resources. In the face of complex and ever-changing network threats, it is difficult to promptly update the evaluation model to adapt to emerging threat patterns. Summary of the Invention

[0004] The purpose of the present invention is to provide a network situation awareness method and system based on user behavior analysis to improve the problem that the existing technology cannot adapt to new threat models.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides a network situation awareness method based on user behavior analysis, comprising the following steps:

[0007] Collect network data packets in real time, pre-process the collected network data packets, extract traffic data and log data, and process them into a consistent format;

[0008] extracting behavioral features from the traffic data and log data and constructing an organizational chart;

[0009] The organizational chart is input into a pre-trained graph convolutional network model, and a network security situation awareness result is output; the graph convolutional network model is integrated with a first generative adversarial network.

[0010] In the above scheme, traffic data and log data are first extracted from the collected network data packets, retaining the user's behavioral characteristics while removing noise. By converting the traffic data and log data into organizational charts, it is convenient for graph convolutional network model recognition. The graph convolutional network model has adaptive learning capabilities and can adapt to new threat methods. The graph convolutional network model is used to identify network security situations with high accuracy, especially the graph convolutional network model is integrated with a generative adversarial network. During the model training process, the generative adversarial network can generate samples of new threat patterns, which can further enhance the recognition ability of the graph convolutional network model, and then be able to perceive various threat patterns in actual use.

[0011] In a further optimized solution, the pretreatment includes:

[0012] First, remove the noisy data;

[0013] Then, fill in the missing data;

[0014] Then, the numerical range of IP addresses is scaled from 0 to 2^32 to between 0 and 1, packets of a set time length are aggregated, timestamps are converted from UTC to local time, and dimensionality reduction is performed through rotation and projection.

[0015] In the above scheme, the influence of erroneous data can be eliminated through denoising, and the influence of missing data can be avoided by filling in the missing data. Then, through data normalization, aggregation, switching, rotation and projection operations, the dimension of the data can be effectively reduced, the number of valid variables can be reduced, and then it is more conducive to extracting behavioral features.

[0016] In one possible implementation, constructing the organization chart includes: taking a user day as a node and the relationship between user days as edges, the organization chart consisting of nodes and edges, and a user day refers to all behavioral characteristics of a user in a day.

[0017] In one possible implementation, the organizational chart is embedded in a pre-trained graph convolutional network model in the following manner:

[0018]

[0019] B i Represents the i-th node in the organization diagram, Embed() is the embedding function, H i (0) represents the initial features of the node, H (l) represents the node features of the lth layer, W (l) is the weight matrix of the lth layer, σ is the activation function, is the adjacency matrix, is the degree matrix, is the normalized graph Laplacian matrix.

[0020] In a further optimized solution, the graph convolutional network model is trained through the following steps:

[0021] Collect network data packets, pre-process them, extract traffic data and log data, and process them into a consistent format to obtain real samples;

[0022] Generate augmented samples using the second generative adversarial network;

[0023] Train graph convolutional network models based on augmented samples and real samples.

[0024] In the above scheme, not only real network data packets are collected to construct real samples, but also non-real expanded samples are generated through generative adversarial networks. Samples with more threat patterns will participate in model training, solving the problem of sample imbalance. After training, the graph convolutional network model has stronger recognition capabilities and can identify various and new threat patterns.

[0025] In one possible implementation, the second generative adversarial network includes a generator G and a discriminator D. The generator G samples the expanded sample G(z) from the prior random noise distribution Pz(z), and the discriminator D determines the source of the sample. The goal of the second generative adversarial network is to make the expanded sample distribution Pg of the generator G close to the real data distribution Pdata, while the discriminator D distinguishes the expanded sample from the real sample. The objective function is:

[0026]

[0027] In a second aspect, the present invention provides a network situation awareness system based on user behavior analysis, comprising:

[0028] The data collection module is used to collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format;

[0029] an organization chart construction module, configured to extract behavioral features from the traffic data and log data and construct an organization chart;

[0030] A situation awareness module is used to input the organizational chart into a pre-trained graph convolutional network model and output a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network.

[0031] In a third aspect, the present invention provides a computer program product comprising computer-readable instructions, wherein the computer-readable instructions, when executed by a processor, implement the steps of the network situation awareness method based on user behavior analysis of the present invention.

[0032] In a fourth aspect, the present invention provides a computer-readable storage medium comprising computer-readable instructions, characterized in that when the computer-readable instructions are executed by a processor, the steps in the network situation awareness method based on user behavior analysis of the present invention are implemented.

[0033] In a fifth aspect, the present invention provides an electronic device comprising: a memory storing program instructions; a processor connected to the memory, executing the program instructions in the memory, and implementing the steps in the network situation awareness method based on user behavior analysis of the present invention.

[0034] Compared with the prior art, the present invention has the following technical advantages:

[0035] Through the application of deep learning and graph convolutional networks, multiple challenges in cybersecurity situational awareness are effectively addressed. Faced with a surge in data volumes, the use of GANs not only addresses sample imbalance but also improves the model's ability to process large amounts of data. In terms of real-time monitoring, GCNs can analyze user behavior in real time, quickly identify insider threats, and reduce false positives and missed detections. The graph convolutional network model is adaptive, automatically adjusting analysis models and detection strategies to effectively address unknown threats. In terms of resource consumption, optimizing data balance reduces reliance on computing resources. In user behavior analysis, extracting contextual features of user behavior improves the model's recognition and generalization capabilities. It also seamlessly integrates with existing security tools, enhancing system compatibility. In terms of privacy protection, data desensitization measures are implemented to ensure regulatory compliance. The model reduces reliance on expert knowledge and, through automated and intelligent approaches, reduces the workload of experts and improves overall cybersecurity protection capabilities. These improvements demonstrate the advantages of this invention in addressing the challenges of existing cybersecurity situational awareness technologies.

[0036] For other advantages of the present invention, please refer to the relevant description in the embodiment section. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 The flowchart of the network situation awareness method based on user behavior analysis is given as an example in the embodiment.

[0039] Figure 2 This is a training flowchart of the convolutional network model GCN in the embodiment.

[0040] Figure 3 2 is a flowchart of the GAN workflow in the embodiment.

[0041] Figure 4 4 is a flowchart of the GCN workflow in the embodiment.

[0042] Figure 5 2 is a block diagram of the network situation awareness system based on user behavior analysis in an embodiment.

[0043] Figure 6 FIG. 4 is a block diagram of the electronic device in the embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0045] See also Figure 1 , this embodiment provides a network situation awareness method based on user behavior analysis, including the following steps:

[0046] S10, real-time collection of network data packets, and pre-processing of the collected network data packets, extraction of flow data and log data, and processing into a consistent format, providing raw materials for subsequent feature extraction and organization diagram construction.

[0047] In this embodiment, the Scapy library of Python is adopted to capture network data packets. Through this library, original network traffic can be captured and preliminary filtering is performed on it.

[0048] During data collection, you may encounter some obvious noisy data, such as negative packet sizes or unusually large timestamps. These can be identified and removed through statistical analysis, such as the Z-score or IQR, and thresholding based on domain knowledge. For example, if packet sizes typically range from a few hundred bytes to several megabytes, packets of a few hundred KB can be considered anomalies.

[0049] After removing outliers, missing values ​​in the data need to be addressed. This can be done in a variety of ways. For example, for numerical data, the mean or median can be used; for categorical data, the mode can be used. Interpolation methods, such as linear interpolation, or using machine learning models to predict missing values ​​are also commonly used to fill missing data. For example, if the timestamps of some packets in a dataset are missing, the missing timestamps can be estimated by linear interpolation using the timestamps of the preceding and following packets.

[0050] In order to reduce the number of effective variables, after performing the missing value filling process, preprocessing can also include data normalization, induction, switching, rotation and projection in sequence, which can help reduce the dimension of the data and extract more meaningful features.

[0051] Data normalization refers to scaling the numerical range of IP addresses from 0 to 2^32 to between 0 and 1. This ensures consistency in scale across different features.

[0052] Summarization refers to aggregating data packets of a set time length, such as aggregating hourly packet counts into a daily total, to reduce the granularity of the data and extract more important trend information.

[0053] Switching refers to converting timestamps from UTC to local time for easier analysis and understanding.

[0054] In addition, dimensionality reduction techniques such as PCA are used to rotate and project high-dimensional data to reveal the main patterns in the data and reduce the computational burden in subsequent model training.

[0055] Furthermore, it's necessary to eliminate attributes that don't capture key characteristics of user behavior and merge key data of the same type to obtain a concise attribute set that fully describes the object. When eliminating attributes that don't capture key characteristics, it's important to determine which attributes directly impact system behavior. This can be achieved through correlation analysis, feature importance assessment, or domain knowledge-based methods. For example, in network traffic analysis, the source and destination IP addresses may be key features because they indicate the initiator and receiver of a communication, while the color of the packet may not be a key feature. Attribute sets can be represented as vectors, data frames, or dictionaries. In Python, the Pandas library's DataFrame is commonly used to represent attribute sets, where each column represents an attribute and each row represents a data point. For example, a DataFrame can be created containing attributes such as source IP, destination IP, and packet size, with each row corresponding to information about a network packet. This representation not only facilitates data management and analysis but also makes subsequent data processing and model training more efficient.

[0056] S20, extracts behavioral features from traffic data and log data, and constructs an organizational chart.

[0057] In S10, network data packets are preprocessed to extract useful information and convert it into structured data. This data records the specific behavior of users and is the basis for constructing organizational charts and extracting user behavior characteristics.

[0058] In this step, behavioral features are extracted from traffic data and log data. These features include key features of user behavior, such as login time, logout time, first device activity time, last device activity time, number of device activities during non-working hours, file operations, web browsing operations, USB flash drive usage, and other internal features. An organizational chart is then constructed based on this information. Each node represents a user day, which refers to all behavioral features of a user (specified user) on a single day (specified date). Node attributes include internal user channel features extracted from user activity logs.

[0059] The embedding formula of the graph convolutional network GCN is as follows:

[0060] H i (0) =Embed(B i ) (2)

[0061]

[0062] Formula (2) represents the node embedding step in the graph convolutional network, B i Represents the i-th node in the organization diagram, Embed() is an embedding function that embeds node B i Mapped into a low-dimensional vector space, the initial feature representation H of the node can be obtained through this formula i (0) Formula (3) represents the forward propagation step in the graph convolutional network, H (l) is the node feature representation of the lth layer, W (l) is the weight matrix of the lth layer, σ is the activation function, is the adjacency matrix (a matrix representation of the connection relationship between nodes in the graph), Is the degree matrix (diagonal matrix, the elements on the diagonal are the degrees of the corresponding nodes). is the normalized graph Laplacian matrix, which is used to smooth node features so that the graph convolutional network model can capture the local connection relationship between nodes. Through this formula, the feature representation of each node is updated to include information about its neighboring nodes.

[0063] See Figure 4When constructing organizational chart node features, the goal is to extract key features from user activity that can help identify user behavior patterns. For a specific user, assume there is a DataFrame df containing user activity logs, which contains the user's login and logoff activity records. First, initialize two empty DataFrame objects, out1 and out2, to store each user's first login and last logoff times, respectively. Then, iterate over each user and, for each user, iterate over the date of each day. For each day, filter out the login and logoff records for that user on that day from df. Suppose today is October 16, 2024, and we are focusing on user A. On that day, user A logged in at 9:00 AM and logged out at 5:00 PM. Two pieces of information will be recorded: the first login time is 9:00 AM and the last logoff time is 5:00 PM. This time information will be formatted and stored in out1 and out2, corresponding to user A's -f1 and -f2 features, respectively. Next, merge the two DataFrames, removing the no longer needed day column. The merged DataFrame contains the two key behavioral features of user A on that day. Finally, save this DataFrame as a CSV file, perhaps named A.csv, and store it in a pre-specified file path. This process is repeated for all users until features have been extracted and saved for each node in the organizational chart (i.e., each user day). This prepares node feature data for the graph convolutional network model, which can be used to analyze and identify abnormal behavior patterns. For example, unusual login or logout times may indicate the presence of a security threat. In this way, raw log data can be converted into structured feature data that can be used for machine learning model training, providing data support for network security situational awareness.

[0064] To convert user behaviors into an organizational chart, each user's behavior is first treated as a node. If two behaviors are close in time or belong to the same user, an edge can be created between the corresponding nodes. For example, if user A logs in to the system at 9:00 AM on a weekday, a node can be created for this behavior. If user A sends an email to user B, then in the organizational chart, an edge might be created between the nodes representing user A and user B to represent the communication behavior between them.

[0065] S30, inputting the constructed organizational chart into a pre-trained graph convolutional network model, and outputting a network security situation awareness result.

[0066] In this embodiment, the structure of the graph convolutional network (GCN) includes an input layer, several graph convolutional layers, and an output layer. The main function of each graph convolutional layer is to aggregate the features of the node itself and the features of its neighboring nodes to update the node representation.

[0067] In addition, the graph convolutional network model also integrates the first generative adversarial network (GAN) (for ease of distinction, the GAN here is defined as the first GAN, and the GAN used to construct the sample is defined as the second GAN). The generative adversarial network consists of a generator and a discriminator. For example, the generator can contain a three-layer fully connected network that converts a 100-dimensional noise vector into a sample of the same dimension as the real data. Each layer is followed by a LeakyReLU activation function, and dropout is used after some layers. The discriminator can be composed of a two-layer fully connected network. After inputting the sample, it outputs a probability value, indicating the possibility that the sample is real data. It uses LeakyReLU and Sigmoid activation functions and also applies dropout.

[0068] In this step, the GAN generator and discriminator are integrated into the graph convolutional network model. The generator is used to generate new user behavior samples, while the discriminator is used to evaluate the authenticity of these samples and improve the discriminative ability of the graph convolutional network model through adversarial training. In this way, GAN not only helps solve the sample imbalance problem but also enhances the graph convolutional network model's ability to identify abnormal behavior.

[0069] See also Figure 2 , the graph convolutional network model is trained through the following steps:

[0070] S100: Collect network data packets in real time and pre-process the collected network data packets to obtain real samples. The specific processing process can be found in the relevant description of the above step S10.

[0071] S200, constructing an expanded sample by using a second generative adversarial network (GAN) to expand the data sample.

[0072] Sample imbalance is a widespread problem in cybersecurity due to factors such as uneven natural distribution, the high cost of collecting specific samples, incomplete data collection due to human bias, and resource and time constraints. Sample imbalance refers to a significant disparity in the number of samples from different categories in a dataset, typically with malicious samples (such as attack behaviors) far fewer than benign samples (such as normal behavior). This imbalance can cause machine learning models to favor the majority class during training, resulting in poor performance when predicting the minority class.

[0073] To address this issue, this embodiment uses a generative adversarial network (GAN) to generate high-quality samples of benign and malicious behaviors to achieve data augmentation. The GAN model includes a generator G and a discriminator D. The generator G samples and expands samples G(z) from a prior random noise distribution Pz(z), and the discriminator D determines the source of the samples. The goal of the GAN is to make the generator G's expanded sample distribution Pg as close as possible to the real data distribution Pdata, while the discriminator D distinguishes the expanded samples from the real samples as much as possible. Therefore, the objective function of the GAN model is:

[0074]

[0075] Generator G requires basic data when generating samples. Specifically, the GAN generator G samples samples G(z) from the prior random noise distribution Pz(z), while using a small amount of malicious class labels as conditions. This means that the generator G relies on two pieces of information when generating samples:

[0076] 1) Prior random noise distribution: The generator G first samples from this distribution to obtain a noise vector z, which is the basis for generating samples.

[0077] 2) Conditional information: a small number of malicious class labels, which provide the generator G with specific patterns or features that must be followed when generating samples.

[0078] The generator G generates samples based on a given random noise vector and conditional information. This process involves learning from the noise and generating data with specified characteristics, whose distribution closely approximates the true data distribution Pdata. These generated samples maintain the authenticity of the data distribution while helping to address sample imbalance and improving the graph convolutional network model's ability to identify abnormal behavior.

[0079] The process of constructing the expanded sample can be found in Figure 3 After constructing the augmented samples, the similarity of data distribution and the authenticity of the synthetic data can be evaluated by kernel density estimation (KDE) and t-distributed stochastic neighbor embedding (t-SNE) methods.

[0080] In theory, the samples generated by a GAN should be in a log data format that can be directly used to construct an organization chart. This is because the GAN learns the distribution characteristics of real data during training, and its goal is to generate samples that are statistically indistinguishable from real data. Therefore, these samples should conform to the structure and characteristics of the original log data when they are generated. However, to ensure reliability and that they fully conform to the data requirements for constructing an organization chart, the generated augmented samples can also undergo preprocessing steps, such as formatting to ensure that the generated samples are completely consistent with the format of the original log data; data cleaning to remove possible outliers or noise; and data transformations such as timestamp conversion and value range scaling.

[0081] These methods ensure that the distribution of the synthesized data is highly similar to the original data while maintaining its diversity and authenticity, providing more balanced and comprehensive data support for subsequent model training and insider threat detection. This data augmentation strategy helps improve the model's generalization capabilities, enabling it to make more accurate predictions and responses to real-world anomalies. The GAN used in this step is primarily used for data augmentation, generating synthetic user behavior data to address sample imbalance.

[0082] S300: extracting behavioral features from the real sample and the augmented sample, and constructing an organizational chart. The specific processing process of this step can refer to the relevant description in the aforementioned step S20.

[0083] S400, using the constructed organizational chart to train a graph convolutional network model.

[0084] In this embodiment, the structure of the graph convolutional network (GCN) includes an input layer, several graph convolutional layers, and an output layer. The main function of each graph convolutional layer is to aggregate the features of the node itself and the features of its neighboring nodes to update the node representation.

[0085] The graph convolutional network model also integrates the first generative adversarial network (GAN). A GAN consists of a generator and a discriminator. For example, the generator can consist of a three-layer fully connected network, converting a 100-dimensional noise vector into samples of the same dimensionality as real data. Each layer is followed by a LeakyReLU activation function, and some layers are followed by dropout. The discriminator can consist of a two-layer fully connected network. After taking a sample as input, it outputs a probability value indicating the likelihood that the sample is real data. It uses LeakyReLU and Sigmoid activation functions, and also applies dropout. Through this adversarial training, the generator learns to produce more realistic samples, while the discriminator improves its recognition ability. When training a GAN, a binary cross-entropy loss function is used to train both the generator and the discriminator. The generator's loss function is based on the frequency with which the discriminator misclassifies its generated samples as real samples, while the discriminator's loss is based on its accuracy in classifying real and augmented samples. During training, the generator and discriminator alternate between training: the generator strives to produce increasingly realistic samples to confuse the discriminator, while the discriminator continuously improves its recognition ability. This adversarial training forces the generator to capture the distribution of real data, while the discriminator becomes more discerning. To further optimize the training process, gradient penalty and virtual batch normalization are introduced to improve model stability and the quality of augmented samples. Through these methods, the generator can more effectively learn to generate high-quality synthetic samples, while the discriminator can more accurately assess the authenticity of samples.

[0086] In this step, the GAN generator and discriminator are integrated into the graph convolutional network model. The generator is used to generate new user behavior samples, while the discriminator is used to evaluate the authenticity of these samples. Adversarial training is used to improve the discriminative ability of the graph convolutional network model. In this way, GAN not only helps solve the data imbalance problem but also enhances the model's ability to identify abnormal behavior.

[0087] It's important to note that during model training, GANs are primarily used to generate synthetic data and optimize model performance, improving the model's ability to identify cyber threats through adversarial training. However, this role may differ in actual use. In actual use, GANs may no longer directly generate samples unless new threats need to be simulated or the model needs to be updated to adapt to new data distributions. In these cases, the GAN's discriminator may no longer be used to determine sample recognition capabilities, as the model's primary task is to analyze actual user behavior data and detect anomalies.

[0088] During the training process, comparative experiments were conducted, using graph convolutional networks (GCN) and support vector machines (SVM) as classifiers. After model training, model performance was evaluated using metrics such as accuracy, precision, recall, and F1 score.

[0089]

[0090] We collected performance metrics for the model using different classifiers, including accuracy, precision, recall, and F1 score. A confusion matrix provided a detailed understanding of the model's classification performance. We then used kernel density estimation and t-SNE techniques to assess the authenticity of the synthesized data. The results showed that the distribution of the synthesized data was highly similar to that of the original data. By comparing the performance of the GCN and SVM classifiers, we analyzed the impact of different feature combinations on model performance. The calculation of ROC curves and AUC values ​​further confirmed the model's superiority in the insider threat detection task.

[0091] By implementing the present invention's security situation awareness technology based on user behavior analysis, the ability to identify, analyze, and respond to complex security threats in large-scale network environments is effectively improved. First, user behavior data from various sources, such as login records, network access, and file operation logs, is integrated and cleaned. Then, a graph convolutional network (GCNN) is used to analyze the contextual features of user behavior, construct nodes of user behavior, and extract the complex interactions between nodes. To address the sample imbalance issue, a generative adversarial network (GAN) is used to generate synthetic data, enhancing the GCN model's ability to identify rare threats. Next, the GCN model is trained on a balanced dataset, enabling it to automatically detect anomalous behaviors, such as unauthorized data access or suspicious network traffic, and flag these behaviors as potential threats. For example, if an employee attempts to access sensitive data during off-hours, this behavior will be captured by the GCN model and analyzed for deviations from normal behavior patterns. The synthetic data generated by the GAN helps the model learn these anomalous patterns, ultimately identifying real threats in real-world detection. The final identification result is a detailed report listing the behaviors flagged as anomalous, including the type of behavior, time of day, the users and system assets involved, and the risk level. This automated threat detection process reduces reliance on manual intervention, improves response speed and accuracy, and significantly enhances the intelligence of network security protection. The graph convolutional network model can self-learn and adapt to new threat patterns, automatically adjusting detection strategies, demonstrating enhanced automation capabilities. This approach not only improves threat detection efficiency but also reduces the workload of security analysts, allowing them to focus on more complex security issues.

[0092] The present invention effectively addresses multiple challenges in network security situational awareness through the application of deep learning and graph convolutional networks. Faced with the surge in data volume, the use of GAN not only solves the sample imbalance problem, but also improves the ability of graph convolutional network models to process large-scale data. In terms of real-time monitoring, GCN can analyze user behavior in real time, quickly identify internal threats, and reduce false positives and missed reports. In addition, the graph convolutional network model is adaptive and can automatically adjust the analysis model and detection strategy. For example, in step S400, the first generative adversarial network (GAN) is integrated into the GCN model. Through adversarial training, the generator generates new user behavior samples, and the discriminator evaluates the authenticity of these samples, thereby improving the discrimination ability of the graph convolutional network model, realizing adaptive learning of the model and automatic adjustment of the detection strategy, and effectively responding to unknown threats.

[0093] In terms of resource consumption, by optimizing data balance, the dependence on computing resources is reduced. At the same time, in user behavior analysis, by extracting the contextual features of user behavior, the recognition and generalization capabilities of the graph convolutional network model are improved. The technology of the present invention is also seamlessly integrated with existing security tools, enhancing the compatibility of the system. This is mainly reflected in the ability to directly apply deep learning models, especially graph convolutional networks (GCNs) and generative adversarial networks (GANs), to the augmentation and feature extraction of user behavior data. These models not only improve the simulation capabilities of complex data distributions, but also enhance the fusion extraction of user behavior contextual features, providing a richer and more accurate representation for network security situational awareness. In this way, the technology of the present invention can be easily embedded in existing security monitoring and threat detection systems, and the performance and intelligence level of these systems can be improved without major modifications or reconstructions.

[0094] In terms of privacy protection, data desensitization measures have been implemented. These primarily involve removing obviously erroneous noise and duplicate records during data preprocessing, filling in missing data, and performing operations such as scaling the IP address range, converting timestamps, and performing dimensionality reduction. These steps may involve processing sensitive information, such as anonymizing or generalizing IP addresses, to protect user privacy. These measures help improve network security while protecting users' personal privacy.

[0095] The graph convolutional network model reduces dependence on expert knowledge, reduces the workload of experts through automation and intelligent methods, and improves overall network security protection capabilities.

[0096] See also Figure 5 Based on the same inventive concept, this embodiment also provides a network situation awareness system based on user behavior analysis, including:

[0097] The data collection module is used to collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format;

[0098] an organization chart construction module, configured to extract behavioral features from the traffic data and log data and construct an organization chart;

[0099] A situation awareness module is used to input the organizational chart into a pre-trained graph convolutional network model and output a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network.

[0100] The specific execution process of each component module in the above system can be found in the relevant description of the above method, which will not be repeated here.

[0101] like Figure 6 As shown, this embodiment also provides an electronic device, which may include a processor 41 and a memory 42, wherein the memory 42 is coupled to the processor 41. It is worth noting that this figure is exemplary, and other types of structures may be used to supplement or replace this structure to implement data extraction, report generation, communication or other functions.

[0102] like Figure 6 As shown, the electronic device may further include: an input unit 43, a display unit 44 and a power supply 45. It is worth noting that the electronic device does not necessarily have to include Figure 6 In addition, electronic devices may also include Figure 6 For components not shown, reference may be made to the prior art.

[0103] The processor 41 is sometimes also called a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The processor 41 receives inputs and controls the operations of various components of the electronic device.

[0104] The memory 42 may be, for example, one or more of a cache, flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices, and may store information such as configuration information of the processor 41 and instructions executed by the processor 41. The processor 41 may execute programs stored in the memory 42 to implement information storage or processing. In one embodiment, the memory 42 also includes a buffer memory to store intermediate information.

[0105] An embodiment of the present invention further provides a computer program product, comprising computer-readable instructions. When the computer-readable instructions are executed in an electronic device, the program product enables the electronic device to perform the operating steps included in the method of the present invention.

[0106] An embodiment of the present invention further provides a storage medium storing computer-readable instructions, wherein the computer-readable instructions enable an electronic device to execute the operation steps included in the method of the present invention.

[0107] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0108] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0109] The above-described embodiments are merely specific implementations of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications, substitutions, and improvements within the technical scope disclosed in the present invention, and such modifications, substitutions, and improvements are intended to be encompassed within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A network situation awareness method based on user behavior analysis, characterized in that: The following steps are involved: Collect network data packets in real time, pre-process the collected network data packets, extract traffic data and log data, and process them into a consistent format; extracting behavioral features from the traffic data and log data and constructing an organizational chart; Constructing the organizational chart includes: taking a user day as a node and the relationship between user days as edges, the organizational chart consisting of nodes and edges, wherein a user day refers to all behavioral characteristics of a user in a day; The organizational chart is input into a pre-trained graph convolutional network model, and the network security situation awareness result is output; the graph convolutional network model integrates a first generative adversarial network, which is composed of a generator and a discriminator. The generator is used to generate new user behavior samples, and the discriminator is used to evaluate the authenticity of these samples, and improve the discrimination ability of the graph convolutional network model through adversarial training; the graph convolutional network model is trained by the following steps: collecting network data packets, and preprocessing the collected network data packets, extracting traffic data and log data, and processing them into a consistent format to obtain real samples; using the second generative adversarial network to generate expanded samples; training the graph convolutional network model based on the expanded samples and real samples.

2. The network situation awareness method based on user behavior analysis according to claim 1 is characterized in that: The pretreatment includes: First, remove the noisy data; Then, fill in the missing data; Then, the numerical range of IP addresses is scaled from 0 to 2^32 to between 0 and 1, packets of a set time length are aggregated, timestamps are converted from UTC to local time, and dimensionality reduction is performed through rotation and projection.

3. The network situation awareness method based on user behavior analysis according to claim 1 is characterized in that: The organizational chart is embedded into a pre-trained graph convolutional network model in the following way: B i Represents the i-th node in the organization diagram, Embed() is the embedding function, H i (0) represents the initial features of the node, H (l) represents the node features of the lth layer, W (l) is the weight matrix of the lth layer, σ is the activation function, is the adjacency matrix, is the degree matrix, is the normalized graph Laplacian matrix.

4. The network situation awareness method based on user behavior analysis according to claim 1 is characterized in that: The second generative adversarial network includes a generator G and a discriminator D. The generator G samples the expanded sample G(z) from the prior random noise distribution Pz(z), and the discriminator D determines the source of the sample. The goal of the second generative adversarial network is to make the expanded sample distribution Pg generated by the generator G close to the real data distribution Pdata. At the same time, the discriminator D distinguishes the expanded samples from the real samples. The objective function is:

5. A network situation awareness system based on user behavior analysis, characterized in that: include: The data collection module is used to collect network data packets in real time, pre-process the collected network data packets, extract flow data and log data, and process them into a consistent format; an organization chart construction module, configured to extract behavioral features from the traffic data and log data and construct an organization chart; Constructing the organizational chart includes: taking a user day as a node and the relationship between user days as edges, the organizational chart consisting of nodes and edges, wherein a user day refers to all behavioral characteristics of a user in a day; A situation awareness module is used to input the organizational chart into a pre-trained graph convolutional network model and output a network security situation awareness result; the graph convolutional network model is integrated with a first generative adversarial network, which is composed of a generator and a discriminator. The generator is used to generate new user behavior samples, and the discriminator is used to evaluate the authenticity of these samples and improve the discrimination ability of the graph convolutional network model through adversarial training; the graph convolutional network model is trained through the following steps: collecting network data packets, and preprocessing the collected network data packets, extracting traffic data and log data, and processing them into a consistent format to obtain real samples; using a second generative adversarial network to generate expanded samples; training the graph convolutional network model based on the expanded samples and real samples.

6. A computer program product comprising computer-readable instructions, characterized in that When the computer-readable instructions are executed by a processor, the steps of the network situation awareness method based on user behavior analysis according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium comprising computer-readable instructions, characterized in that: When the computer-readable instructions are executed by a processor, the steps of the network situation awareness method based on user behavior analysis according to any one of claims 1 to 4 are implemented.

8. An electronic device, characterized in that: include: Memory, which stores program instructions; A processor is connected to the memory and executes program instructions in the memory to implement the steps in the network situation awareness method based on user behavior analysis according to any one of claims 1 to 4.

Images