Large model intrusion detection method and device based on user behavior data

Abstract

The invention discloses a large model intrusion detection method and device based on user behavior data. The method comprises the following steps: collecting daily behavior data of a user from a plurality of data sources; performing feature extraction and normalization preprocessing on the daily behavior data of the user; according to the preprocessed data, carrying out serialized modeling by adopting a Transform model to obtain an intrusion detection model; generating a behavior portrait of each user through the intrusion detection model; and when the to-be-detected behavior of the user does not conform to the behavior portrait of the corresponding user and the deviation value exceeds an intrusion detection threshold value, performing intrusion detection alarm. According to the method, potential security threats such as abnormal access, high-risk website connection, large-scale data transmission and intranet scanning can be quickly identified, so that malicious activities and data leakage risks are effectively detected.

Description

Technical Field

[0001] The present invention relates to the field of intrusion detection technology, and in particular to a large model intrusion detection method and device based on user behavior data. Background Art

[0002] With the rapid development of network technology, network security issues are becoming more and more serious. In particular, the increasing number of complex threats such as advanced persistent threat (APT) attacks, internal threats and new zero-day attacks has brought huge challenges to traditional intrusion detection systems. Traditional intrusion detection systems are usually based on predefined rules or feature libraries. Although this method is effective in dealing with known threats, its detection capabilities are insufficient when facing unknown attacks and complex threats. In addition, internal threats (such as malicious behavior or accidental mistakes by employees) are often difficult to detect through traditional intrusion detection methods. Summary of the invention

[0003] In response to the problems in the prior art, an embodiment of the present invention provides a large-model intrusion detection method and device based on user behavior data. The present invention analyzes the user's daily user behavior, monitors the user's network access habits, external IP connections, port usage changes, data transmission patterns, and activities during abnormal working hours, etc., to establish a daily behavior baseline, quickly identify potential security threats such as abnormal access, high-risk website connections, large-scale data transmission, intranet scanning, etc., thereby effectively detecting malicious activities and data leakage risks.

[0004] An embodiment of the present invention provides a large model intrusion detection method based on user behavior data, the method comprising:

[0005] Collecting daily behavior data of users from several data sources, the daily behavior data of users including: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records;

[0006] Performing feature extraction and normalization preprocessing on the daily behavior data of the user;

[0007] According to the preprocessed data, the Transformer model is used for serialization modeling to obtain the intrusion detection model;

[0008] Generate a behavior profile of each user through the intrusion detection model;

[0009] When the user's behavior to be detected does not conform to the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm is issued.

[0010] In one embodiment, the training step of the intrusion detection model includes:

[0011] Map each operation event in the time series features to an embedding space of fixed dimension to generate a high-dimensional vector;

[0012] Add time location information to each operation through position encoding;

[0013] By calculating the attention weight of each operation and other operations, the mutual influence between operations in the time series features is captured;

[0014] Perform nonlinear transformation on the self-attention output;

[0015] Perform layer normalization and residual connection;

[0016] Capture higher-order time series features by stacking multiple Transformer modules.

[0017] In one embodiment, the feature extraction and normalization preprocessing of the daily behavior data of the user includes:

[0018] Dividing the user's daily behavior data into a number of time windows according to time periods to obtain time series features;

[0019] Encoding and converting the non-numerical data in the daily behavior data of the user to obtain numerical features;

[0020] Normalize all numerical features;

[0021] Calculate the time interval between adjacent behaviors and perform logarithmic transformation to obtain the time interval feature;

[0022] The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data.

[0023] In one embodiment, when there is no labeled data, the reconstruction error of unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error of semi-supervised learning combined with the cross entropy loss is used to train the intrusion detection model; when there is a large amount of labeled data, the cross entropy loss of supervised learning is used to train the intrusion detection model.

[0024] In one embodiment, the behavioral profile of each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scan requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

[0025] In one embodiment, it also includes: setting different alarm modes and corresponding response measures according to the difference between the deviation value and the intrusion detection threshold.

[0026] The embodiment of the present invention further provides a large model intrusion detection device based on user behavior data, the device comprising:

[0027] A data collection module is used to collect the user's daily behavior data from several data sources, wherein the user's daily behavior data includes: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records;

[0028] A preprocessing module, used for performing feature extraction and normalization preprocessing on the daily behavior data of the user;

[0029] A modeling module is used to obtain an intrusion detection model by serializing and modeling the preprocessed data using a Transformer model;

[0030] A behavior profile generation module, used to generate a behavior profile of each user through the intrusion detection model;

[0031] The alarm module is used to issue an intrusion detection alarm when the user's behavior to be detected does not conform to the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold.

[0032] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above methods when executing the computer program.

[0033] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.

[0034] An embodiment of the present invention further provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.

[0035] The embodiment of the present invention provides a large-model intrusion detection method and device based on user behavior data. The present invention can establish a daily behavior baseline by analyzing the user's daily user behavior, monitoring the user's network access habits, external IP connections, port usage changes, data transmission patterns, and activities during abnormal working hours, etc., and quickly identify potential security threats such as abnormal access, high-risk website connections, large-scale data transmission, and intranet scanning, thereby effectively detecting malicious activities and data leakage risks. The present invention can automatically identify abnormal activities that are different from the user's daily behavior patterns, providing strong support for detecting internal threats and external attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0037] Figure 1 A schematic diagram of an application scenario of a large model intrusion detection method based on user behavior data in an embodiment of the present invention;

[0038] Figure 2 This is a flow chart of a large model intrusion detection method based on user behavior data in an embodiment of the present invention;

[0039] Figure 3 is a flow chart of feature extraction and normalization preprocessing in an embodiment of the present invention;

[0040] Figure 4 is a flow chart of the training steps of an intrusion detection model in an embodiment of the present invention;

[0041] Figure 5 This is a structural diagram of a large model intrusion detection device based on user behavior data in an embodiment of the present invention;

[0042] Figure 6 is a structural diagram of another large model intrusion detection device based on user behavior data in an embodiment of the present invention;

[0043] Figure 7 A schematic diagram of a computer device entity structure provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0045] In order to facilitate understanding of the technical solution provided by the present invention, the research background of the technical solution of the present invention is briefly described below.

[0046] At present, common intrusion detection systems (IDS, Intrusion Detection System) mainly rely on two technical routes. The first is detection based on feature libraries. Such systems use signatures, rules or feature libraries of known attacks to match network traffic, user behavior or system logs to determine whether there is abnormal behavior. This method relies on previously identified attack features and has a good detection effect on known attacks. The second is detection based on statistical analysis. This type of method identifies potential attacks by analyzing the statistical characteristics of network behavior (such as traffic anomalies, data packet size fluctuations, etc.). This method is more effective for certain types of attacks (such as DDoS attacks), but it is not easy to detect more hidden attack modes (such as APT).

[0047] The prior art solutions have the following disadvantages.

[0048] 1. Poor detection effect for unknown attacks: Existing feature library-based methods perform well for known attacks, but when faced with new attacks, the detection ability is severely limited due to the lack of corresponding rules or features.

[0049] 2. High false alarm rate: Detection methods based on statistical analysis are prone to false alarms, especially in complex network environments and diverse user behaviors. It is difficult to distinguish between normal operation fluctuations and abnormal attack behaviors.

[0050] 3. Internal threats are difficult to identify: Traditional detection methods mostly focus on external attacks, while the detection of internal threats (such as malicious operations by employees, abuse of privileges, etc.) is almost ineffective.

[0051] 4. Lack of self-learning ability: Existing intrusion detection systems are unable to perform adaptive learning based on changes in user behavior, which can easily lead to system failure over time, especially for ever-changing user behavior.

[0052] With the widespread application of large model technologies such as deep learning, the research and application of network security using artificial intelligence technology has gradually emerged, especially in the field of user behavior analysis (UBA). By analyzing users' daily user behavior, monitoring users' network access habits, external IP connections, port usage changes, data transmission patterns, and activities during abnormal working hours, etc., a daily behavior baseline can be established to quickly identify potential security threats such as abnormal access, high-risk website connections, large-scale data transmission, and intranet scanning, thereby effectively detecting malicious activities and data leakage risks. The detection system based on large models can automatically identify abnormal activities that are different from users' daily behavior patterns, providing a new way to detect internal threats and external attacks.

[0053] Figure 1 Schematic diagram of an application scenario of a large model intrusion detection method based on user behavior data in an embodiment of the present invention. The present invention may be a virtual device deployed in a server. The virtual device of the present invention is connected to multiple terminals through a firewall and a switch, and all terminals in the intranet environment and the extranet environment may also be included in the monitoring scope. When an abnormal behavior such as an internal attack occurs in the terminal, the present invention may detect the abnormal behavior in time through the intrusion detection model. When the server suffers an external intrusion, the present invention may also detect the intrusion behavior in time through the intrusion detection model. The virtual device of the present invention may regularly collect daily behavior data of users from firewalls, servers, identity and access management systems, terminal detection and response systems, and existing intrusion detection systems.

[0054] like Figure 2 The flowchart of the large model intrusion detection method based on user behavior data in an embodiment of the present invention is shown. The embodiment of the present invention provides a large model intrusion detection method based on user behavior data, the method comprising:

[0055] S201, collecting daily behavior data of users from several data sources, wherein the daily behavior data of users include: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records;

[0056] S202, performing feature extraction and normalization preprocessing on the daily behavior data of the user;

[0057] S203, according to the preprocessed data, using the Transformer model to perform serialization modeling to obtain an intrusion detection model;

[0058] S204, generating a behavior profile of each user through the intrusion detection model;

[0059] S205: When the user's behavior to be detected does not conform to the behavior profile of the corresponding user and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm is issued.

[0060] Specifically, in order to construct an accurate user behavior portrait, the present invention collects the daily behavior data of users from multiple data sources, such as collecting the daily behavior data of users from network devices, servers, terminals and other devices through agents or sensors. These data can comprehensively depict the daily behavior characteristics of users, and on this basis, construct the user's behavior portrait. In order to ensure that the daily behavior data of users in multiple dimensions can be effectively analyzed and processed, the present invention also needs to perform feature extraction and normalization preprocessing on the daily behavior data of users. Based on the preprocessed data, the Transformer model is used for serialization modeling to obtain an intrusion detection model. The present invention captures the temporal and spatial characteristics of user behavior through the Transformer model, and can effectively know the user's regular operation mode. There are significant differences in the operation modes of different users, so the present invention generates an independent behavior portrait for each user. These portraits not only reflect the overall behavior of the user, but also cover their operation preferences in daily work (such as commonly used file types, frequently accessed network resources, commonly used devices, etc.). Through these personalized behavior portraits, the present invention can identify any abnormal operation that deviates from conventional behavior. When the user's behavior to be detected does not conform to the corresponding user's behavior portrait and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm is issued. The present invention monitors the user behavior in real time and compares it with the user behavior portrait generated previously. Once a significant difference is detected between the current operation and the user behavior portrait (such as accessing sensitive files in an abnormal time period, using abnormal equipment for operation, etc.), it is determined to be abnormal behavior and an intrusion detection alarm is issued.

[0061] The present invention uses the Transformer model for serialization modeling to obtain an intrusion detection model and generate a behavioral profile of each user, which can detect abnormal behavior in user behavior in real time, especially in detecting internal threats and advanced persistent threats. The present invention can make up for the deficiencies of existing intrusion detection systems in responding to unknown attacks, reducing false alarm rates, and identifying internal threats.

[0062] In one embodiment, the user's daily behavior data includes: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records.

[0063] Specifically, the user login and identity authentication data collected by the present invention include information such as user login time, login method, geographic location, etc., which are used to identify abnormal behaviors such as identity theft and forged access. The system operation logs and file access records collected by the present invention include user access behaviors to files, folders and databases, which are used to monitor abnormal access to sensitive data. The network behavior data collected by the present invention includes real-time collection of user network traffic, including accessed external websites, resources, API calls, etc., with particular attention to abnormal network requests (such as access to unknown domain names, abnormal port traffic, etc.). The device usage records collected by the present invention include tracking devices accessed by users (such as USB devices, mobile devices), which are used to identify uncommon device access or unauthorized device use.

[0064] In one embodiment, the daily behavior data of users is collected from devices such as firewalls, intrusion detection systems, Web proxy servers, terminal detection and response systems, and identity and access management systems.

[0065] Specifically, the daily behavior data of users collected from firewall logs include external IP connection records, URLs of access destinations, data volume and protocol types transmitted, etc. Firewall logs can be used to analyze external websites and services visited by users, identify non-compliant network connections, or detect whether there are abnormal large-scale data upload behaviors, as well as discover whether users have visited high-risk or restricted websites, or whether there are frequent attempts to connect to multiple external IPs, which may indicate the risk of malware infection or data leakage. The daily behavior data of users collected from the intrusion detection logs and alarm events of the intrusion detection system (IDS) include captured traffic patterns, protocol analysis, signature codes of suspicious traffic, and usage of specific ports, etc. IDS can identify abnormal behaviors through deep packet inspection (DPI) and traffic analysis; specific attack patterns detected by IDS (such as SQL injection, cracking attempts) can help identify whether users are under targeted attacks, and the recorded port scanning behaviors can be used to analyze signs of lateral movement. Collecting daily user behavior data from the proxy access log of the Web proxy server includes all Web request information accessed by the user, such as the URL accessed, timestamp, HTTP status code, request method (GET, POST), and content type of the request. This data can help identify whether the user has accessed abnormal websites, such as frequently trying to access content blocked by the company, or making a large number of HTTP requests in a short period of time, which may indicate infection with malware or attempts to leak data. Collecting daily user behavior data from the terminal activity monitoring log of the terminal detection and response system (EDR) includes application execution records, changes to system files, process start and termination events, and connection status of external storage devices. The EDR system can provide detailed user behavior data to help analyze usage habits and potential threat behaviors; if the user's terminal device suddenly executes an abnormal program, starts an unauthorized script, or loads a new system driver, this may indicate malware activity or an attacker's persistence attempt. Collecting daily behavior data of users from the authentication log and access control policy log of the identity and access management system (IAM) includes the number of failed logins, the type and time of resources accessed, the authentication method used (such as two-factor authentication), and user role change records, etc.; these data can analyze the user's login behavior, identify abnormal login time (such as late night login), login location changes (cross-region login) or frequent login failures, etc., and can be used to determine whether there is a risk of account theft. Compared with the traditional single data source (such as network traffic or system logs), the present invention adopts a multi-source data fusion method, that is, collecting diverse data from multiple data sources to comprehensively analyze the user's behavior characteristics, which significantly improves the accuracy and comprehensiveness of intrusion detection.

[0066] like Figure 3The flowchart of feature extraction and normalization preprocessing in an embodiment of the present invention is shown. In one embodiment, the feature extraction and normalization preprocessing of the user's daily behavior data includes:

[0067] S301, dividing the daily behavior data of the user into a plurality of time windows according to time periods to obtain time series features;

[0068] S302, encoding and converting the non-numerical data in the daily behavior data of the user to obtain numerical features;

[0069] S303, normalizing all numerical features;

[0070] S304, calculating the time interval between adjacent behaviors, and performing logarithmic transformation to obtain a time interval feature;

[0071] S305 , combining the normalized numerical features and time interval features into a vector and using it as a parameter in the time series features to obtain the final preprocessed data.

[0072] Specifically, in order to ensure that multi-dimensional user behavior data can be effectively analyzed and processed, the present invention needs to perform feature extraction and normalization preprocessing on the user's daily behavior data so that serialized modeling can be performed later. The preprocessing of the present invention mainly includes the following steps.

[0073] (1) The daily behavior data of the user is divided into several time windows according to time periods to obtain time series features. Specifically, the present invention first needs to screen the collected raw data and extract key behavior features, such as operation time, operation frequency, request target, execution command type, data access path, etc. In order to capture the time series characteristics of user behavior, the key behavior features are divided into multiple time windows according to time periods. For example, the key behavior features can be divided into time periods of 5 minutes, 1 hour or 1 day. The specific processing methods include: for short-term anomaly detection, a smaller time window (such as 5 minutes) is used to capture rapidly changing behaviors; for long-term behavior analysis, a larger time window (such as 1 hour or 1 day) is used to detect periodic or gradually evolving anomalies.

[0074] (2) Encoding and converting the non-numerical data in the daily behavior data of the user to obtain numerical features. Specifically, encoding and converting the non-numerical data such as operation type (login, query, file transfer, etc.), target resource (database, server, etc.) to obtain numerical features. Specifically, one-hot encoding (One-Hot encoding) or word encoding (Embedding encoding, such as Word2Vec or BERT) and other technologies can be used.

[0075] (3) All numerical features are normalized. Specifically, numerical features such as data size, port number, time interval, etc. are normalized to be within the range of 0 to 1. For example, the normalization of operation time can be performed by converting the timestamp into a relative time of the day (seconds / 86400). The present invention uses Min-Max normalization technology to standardize the data to eliminate the differences between data of different dimensions. The Min-Max normalization formula is as follows.

[0076]

[0077] In the formula, x is the original data, x' is the normalized data, min(x) and max(x) are the minimum and maximum values ​​of the original data, respectively.

[0078] (4) Calculate the time interval between adjacent actions and perform logarithmic transformation to obtain the time interval feature. Specifically, calculate the time interval between adjacent operations and perform logarithmic transformation or bucketing to obtain the time interval feature to adapt to different time scales.

[0079] (5) The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data. Specifically, the category features, numerical features, time interval features, etc. of each operation are combined into a vector and used as a parameter in the time series features. In addition, the present invention also performs length truncation or padding on the time series features of each user behavior to ensure that the sequence input to the deep learning model has a uniform length.

[0080] In one embodiment, the training step of the intrusion detection model includes:

[0081] S4021, mapping each operation event in the time series feature to an embedding space of fixed dimension to generate a high-dimensional vector;

[0082] S4022, adding time and location information to each operation through position coding;

[0083] S4023, by calculating the attention weight of each operation and other operations, capturing the mutual influence between operations in the time series features;

[0084] S4024, performing nonlinear transformation on the self-attention output;

[0085] S4025, performing layer normalization and residual connection;

[0086] S4026. Capture higher-order time series features by stacking multiple Transformer modules.

[0087] Specifically, the present invention uses the Transformer model to analyze the time series characteristics of user behavior, and the training steps of the intrusion detection model are as follows.

[0088] like Figure 4 Shown is a flow chart of the training steps of an intrusion detection model in an embodiment of the present invention.

[0089] S401. Construct input time series features and input the preprocessed time series feature vector into the Transformer model. Assume that a sequence consists of N operation events, and each event is represented as a multidimensional feature vector. Example input: a 5-minute operation window of a user, including operation time (normalized), operation type (encoding conversion), access target (encoding conversion) and other features.

[0090] S402. Build the Transformer model. The Transformer model consists of multiple layers, mainly including the following parts:

[0091] S4021. Input embedding layer (EmbeddingLayer): maps each operation event in the sequence to an embedding space of fixed dimension to generate a high-dimensional vector representation.

[0092] S4022, Positional Encoding: Since Transformer does not have built-in order perception capabilities, it is necessary to add temporal position information to each operation through positional encoding (for example, using sine and cosine functions to encode the position).

[0093] S4023, Multi-Head Self-Attention: Captures the mutual influence between operations in a sequence by calculating the attention weight of each operation with other operations. This allows identifying which operations are most relevant to the current operation.

[0094] S4024, Feed-Forward Network: Perform nonlinear transformation on self-attention output to enhance the expressive power of the model.

[0095] S4025, Layer Normalization and Residual Connections: Stabilize the training process and speed up the model convergence.

[0096] S4026. Stacked Multi-layer Transformer: Multiple Transformer models (such as 6 or 12 layers) can be stacked to capture higher-order sequence features.

[0097] In one embodiment, when there is no labeled data, the reconstruction error of unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error of semi-supervised learning combined with the cross entropy loss is used to train the intrusion detection model; when there is a large amount of labeled data, the cross entropy loss of supervised learning is used to train the intrusion detection model.

[0098] Specifically, the present invention focuses on identifying potential abnormal behaviors and threats, but in practical applications, the labeled abnormal behavior data is usually less, so the present invention uses the reconstruction error method of unsupervised learning to train the intrusion detection model. Of course, when there is labeled data, semi-supervised learning combined with reconstruction error and cross entropy methods can also be used to train the intrusion detection model, or the cross entropy loss method can be used to train the intrusion detection model. The specific training method to be selected can be determined based on the actual data characteristics and labeling situation. Specifically, when there is no labeled data, the reconstruction error of unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error of semi-supervised learning is combined with the cross entropy loss to train the intrusion detection model; when there is a large amount of labeled data, the cross entropy loss of supervised learning is used to train the intrusion detection model.

[0099] Specifically, unsupervised learning (suitable for unlabeled data) uses reconstruction error as the objective function. If the data set is not labeled, that is, there is no clear mark on which behaviors are normal and which are abnormal, an autoencoder (such as Transformer autoencoder) can be used for unsupervised training. Specific methods include: using the autoencoder model to train the user's daily operation behavior so that the model can reconstruct the input behavior sequence; training the model by minimizing the difference between the original input and the reconstructed output; using mean square error (MSE) or mean absolute error (MAE) as the loss function to measure the difference between the original sequence and the reconstructed sequence; in the detection stage, when the reconstruction error exceeds a certain threshold, the behavior sequence is considered to be abnormal. The intrusion detection model trained by the reconstruction error method of unsupervised learning is suitable for detecting unknown abnormal behaviors, especially new threats or attacks.

[0100] In one embodiment, the mean square error is expressed as follows.

[0101]

[0102] Among them, x i represents the i-th feature of the original input, represents the i-th feature of the reconstructed output, and N represents the number of features.

[0103] In one embodiment, the mean absolute error is expressed as follows: MAE measures the reconstruction error by calculating the absolute difference between input and output.

[0104]

[0105] Among them, x i represents the i-th feature of the original input, represents the i-th feature of the reconstructed output, and N represents the number of features.

[0106] Specifically, semi-supervised learning is unsupervised reconstruction error and supervised cross entropy loss. When there is a small amount of labeled data, semi-supervised learning can be performed by combining reconstruction error and cross entropy loss. The specific method includes: for a small amount of labeled data, using cross entropy loss to supervise the model to learn the difference between abnormal and normal; for unlabeled data, using reconstruction error to train the model to learn the characteristics of daily behavior. The loss function is designed as follows: the total loss function is reconstruction error loss and cross entropy loss, where weights can be assigned to each loss to adjust their impact in training.

[0107] In one embodiment, the total loss function of semi-supervised learning can be expressed as a weighted sum of two losses, specifically:

[0108]

[0109] Among them, λ1 and λ2 are weight coefficients used to adjust the impact of unsupervised reconstruction error and supervised cross entropy loss.

[0110] In one embodiment, the unsupervised reconstruction error is a mean square error (MSE) or a mean absolute error (MAE).

[0111] In one embodiment, the mean square error is expressed as follows.

[0112]

[0113] Among them, x i represents the i-th feature of the original input, represents the i-th feature of the reconstructed output, and N represents the number of features.

[0114] In one embodiment, the mean absolute error is expressed as follows: MAE measures the reconstruction error by calculating the absolute difference between input and output.

[0115]

[0116] Among them, x i represents the i-th feature of the original input, represents the i-th feature of the reconstructed output, and N represents the number of features.

[0117] In one embodiment, the supervised cross entropy loss function is:

[0118]

[0119] Where M represents the number of samples, y j is the true label of the jth sample (0 for normal, 1 for abnormal), p j is the probability that the jth sample is predicted to be abnormal.

[0120] Through the design of the loss function of semi-supervised learning, the intrusion detection model can utilize both labeled and unlabeled data, while taking into account the accuracy and generalization ability of anomaly detection.

[0121] Semi-supervised learning uses the time series features of users’ daily behaviors as training sets to train the model to learn users’ daily behavior patterns. The time series features of users’ daily behaviors are randomly sampled and input into the Transformer model, and the model parameters are adjusted to minimize the objective function.

[0122] Specifically, supervised learning (suitable for labeled data) uses the cross-entropy loss function (Cross-EntropyLoss). If there is labeled data that clearly marks whether each operation behavior is normal or abnormal, supervised learning can be used to train the model. The specific method includes: defining the task as a binary classification problem (normal or abnormal), and training the model to predict the abnormal probability of each operation or sequence. Supervised learning uses the cross-entropy loss function to calculate the difference between the predicted probability and the true label. Cross entropy works well in classification tasks, especially for multi-classification or binary classification problems. In supervised learning, the goal of model training is to make the predicted abnormal probability as close as possible to the true label.

[0123] In one embodiment, the cross entropy loss function (for a binary classification problem) is expressed as:

[0124]

[0125] Where M represents the number of samples, y j is the true label of the jth sample (0 for normal, 1 for abnormal), p j is the probability that the jth sample is predicted to be abnormal.

[0126] In one embodiment, the behavioral profile of each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scan requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

[0127] Specifically, the present invention identifies whether there is abnormal website access based on abnormal website access data, the abnormal website access data is derived from firewalls, web filtering devices, and proxy server logs; the abnormal website access data includes a timestamp for recording the access time, a user ID or device ID for identifying the visitor, a URL for recording the full URL visited by the user, a domain name classification parameter for classifying the visited domain name (such as news, social media, etc.), and a security score for judging whether the website is high-risk based on threat intelligence. In the anomaly detection stage, if a user suddenly frequently visits high-risk websites (such as known malicious domain names), or visits sites that are not related to his work (such as social media), it may indicate that the local device is infected with malware or the user's credentials are leaked.

[0128] Specifically, the present invention identifies whether there is an abnormal IP connection based on abnormal IP connection data, the abnormal IP connection data is derived from a network firewall, IDS / IPS (intrusion detection / protection system), network traffic analysis tools, etc., and the abnormal IP connection data includes a timestamp for recording the connection time, a source IP address for recording the user device IP, a target IP address for recording the user's connection to an external IP, a parameter for recording the geographic location of the target IP, a connection number and frequency parameter for recording the number of connections and time intervals, and threat intelligence data for recording whether the target IP is in a known malicious IP list. In the anomaly detection stage, if the user connects to a high-risk target IP or an uncommon IP address, this may indicate malicious traffic, data leakage, or control behavior by an external attacker.

[0129] Specifically, the present invention identifies whether there is abnormal port usage based on abnormal port usage change data, the abnormal port usage change data is derived from the host firewall, system log, SIEM (security information and event management system) and other devices, and the abnormal port usage change data includes a timestamp for recording the time of port status change, a port number for recording the port number used or opened, a port protocol (such as TCP, UDP), a service name associated with the port (such as HTTP, RDP), a user account for recording the execution of the operation, etc. In the abnormal detection stage, if an uncommon port (such as remote desktop port 3389 or file transfer port 21) is suddenly opened, it may indicate that the attacker is trying to move laterally or remotely control the local device.

[0130] Specifically, the present invention identifies whether there is data transmission exceeding a first preset amount based on the recorded data of the data upload and download mode, the recorded data of the data upload and download mode is derived from a flow monitoring tool (such as NetFlow), a firewall log, a data loss prevention (DLP) system, etc., and the recorded data of the data upload and download mode includes a timestamp for recording the upload or download operation time, a user ID or device ID for identifying the upload or download source, the amount of data uploaded / downloaded, the file format of the upload / download (such as ZIP, PDF), the target location of the file upload / download (URL / IP), the protocol used (such as HTTP, FTP, SFTP), etc. In the abnormality detection stage, if a user uploads files exceeding the first preset amount in a short period of time, especially uploading to a cloud storage or file sharing service, it indicates that there may be a risk of data leakage.

[0131] Specifically, the present invention identifies whether there are operations exceeding a second preset number during abnormal working hours based on operation record data during abnormal working hours, the operation record data during abnormal working hours is derived from a log management system, an employee attendance system, a VPN log, etc., and the operation record data during abnormal working hours includes a timestamp for recording the operation time, a user ID for recording the execution of the operation, the type of resource accessed by the user (such as a database, a file server), and the type of operation (such as login, file access, data transmission). In the anomaly detection stage, if a user performs a large number of operations (such as remote login, database query) during abnormal working hours (such as 2 a.m.), it may be a sign of unauthorized access or malicious activity.

[0132] Specifically, the present invention identifies whether there are network scanning requests exceeding a third preset number and simultaneous requests to connect to more than a fourth preset number of intranet device ports based on the intranet scanning and lateral movement record data, the intranet scanning and lateral movement record data are derived from an intrusion detection system (IDS), a network traffic analysis tool, a host protection system, etc.; the intranet scanning and lateral movement record data include a timestamp for recording the time when the scanning behavior occurs, the IP of the device initiating the scan, the target network address of the scan, a list of ports attempted to connect, a scanning frequency, etc. In the abnormality detection stage, if the user host simultaneously requests to connect to more than the fourth preset number of intranet device ports, or more than the third preset number of network scanning requests, it means that the attacker may be probing the network environment and trying to move laterally.

[0133] The present invention monitors the user's current behavior in real time and compares it with the user's behavior profile generated previously. Once it is detected that there is a significant difference between the user's current behavior and the user's behavior profile (such as accessing sensitive files in an abnormal time period, using abnormal devices for operations, etc.), or it deviates from the behavior feature threshold, it is determined to be abnormal behavior, and the user's current behavior is marked as a potential threatening behavior.

[0134] In one embodiment, it also includes: setting different alarm modes and corresponding response measures according to the difference between the deviation value and the intrusion detection threshold.

[0135] Specifically, the present invention also sets different alarm modes and corresponding response measures according to the difference between the deviation value of the user's current behavior and the user's behavior profile and the intrusion detection threshold. Different difference ranges represent different threat levels, and different response measures are taken for different threat levels, such as sending alarms, blocking access, and increasing security verification requirements. The present invention also designs a multi-level abnormal threshold mechanism, and sets different thresholds according to the risk level of the operation. For example, frequent access to database tables may only trigger low-level alarms, while modifying sensitive files or transmitting a large amount of data to the outside will trigger high-level alarms. The present invention comprehensively considers multiple dimensions such as time, space, and operation frequency of the behavior to ensure that potential attack behaviors can be fully detected. For example, if a user suddenly accesses a local device from a different geographical location and performs a high-risk operation, the present invention will immediately mark it as high risk. When abnormal behavior is identified, the present invention will take appropriate response measures according to the threat level. For example, when it is identified as a low-level threat, that is, the operation frequency is abnormal but there is no sensitive data leakage, the present invention will send an alarm prompt to the administrator and recommend further investigation. When a medium-level threat is identified, i.e., access to sensitive files without external transmission, the present invention will restrict certain user operation permissions and require the user to perform additional identity verification. When a high-level threat is identified, i.e., large-scale data leakage or signs of internal attacks are found, the present invention will immediately block the user's operation permissions, force the user to log off, and trigger a comprehensive security audit at the same time.

[0136] The present invention also designs a self-learning mechanism that can dynamically update the intrusion detection model based on the user's latest behavior data. This mechanism enables the present invention to maintain efficient detection capabilities in the face of natural changes in user behavior, avoiding false positives or false negatives caused by behavioral changes. Whenever new user operation data is collected, the present invention will regularly retrain the intrusion detection model to ensure that the intrusion detection model is always consistent with the user's latest behavior pattern.

[0137] In one embodiment, suppose a user performs a series of operations, including logging in, querying a database, downloading files, and closing an application. Within a 5-minute time window, these operations form a sequence. After analysis by the Transformer model, it is detected that the user has abnormal behavior in a certain step (such as excessive download volume, abnormal operation time, etc.). The model identifies these anomalies and triggers a response strategy.

[0138] In one embodiment, assume that a user performs the following operations in a certain time period:

[0139] 2024-10-25 10:00:00, query table T1 of database A.

[0140] 2024-10-25 10:02:00, insert data into table T2 of database A.

[0141] 2024-10-25 10:04:30, table T3 of database B is deleted.

[0142] Through preprocessing, the present invention can convert each operation into a feature vector, and use the Transformer model to capture the association between these operations to detect whether there is a potential threat (such as abnormal operation sequence or abnormal operation frequency). The present invention combines the operation timestamp to perform a time series analysis of the user's operation steps to ensure that the present invention not only focuses on the abnormality of a single operation, but also identifies potential threats in continuous operations. For example, continuous batch operations on multiple database tables may be potential data theft, while single query operations are more conventional. The serialization modeling method can not only analyze the abnormality of a single operation, but also detect more complex potential threats in combination with the operations associated with each other. The present invention also analyzes the time and space dimensions of user behavior, and by collecting user IP addresses and operation times, pays attention to the differences in user behavior in different time periods and geographical locations. For example, a user accessing a company's internal computer at night may be an abnormal behavior, especially when its geographical location changes abnormally, there is a high probability of intrusion.

[0143] In one embodiment, the present invention includes the following steps.

[0144] 1. Input design. The input user behavior data contains various behavior features, such as the accessed IP, port number, access time, target URL, etc. Assume that the input time series feature vector is: X = [access time, IP feature code, port code, URL code]. For example, a user's behavior record is:

[0145] X1=[0.75, 0.6, 0.2, 0.8];

[0146] X2=[0.80, 0.7, 0.1, 0.6];

[0147] X3=[0.65, 0.5, 0.4, 0.9];

[0148] Here the data has been normalized to the range of [0, 1] for ease of model processing.

[0149] 2. Model design. Use Transformer autoencoder as the model structure. Specifically, the autoencoder maps the input feature sequence to a low-dimensional space (encoding), and then restores it from the low-dimensional space to a high-dimensional space (decoding). The training goal is to make the decoder reconstructed output as close to the input as possible, so that the model can learn the daily patterns of user behavior.

[0150] 3. Loss function design. In each iteration, the mean square error (MSE) or mean absolute error (MAE) is used to measure the difference between the input and the reconstructed output. For example: input sequence (X): [0.75, 0.6, 0.2, 0.8]; reconstructed output (X_hat): [0.70, 0.58, 0.25, 0.75]. Assuming that the number of features N = 4, the mean square error MSE calculation formula is:

[0151]

[0152] 4. Anomaly detection. After training a large amount of daily data, a reconstruction error threshold (for example, 0.005) is set. When the reconstruction error of a certain behavior exceeds the threshold, it is considered abnormal. For example, the above reconstruction error 0.003875 is less than the threshold, so the behavior is judged as normal.

[0153] The present invention realizes effective detection of unknown attacks and internal threats, making up for the deficiencies of traditional intrusion detection systems; greatly reduces the false alarm rate and reduces the workload of security personnel in handling false alarms; the self-learning ability of the intrusion detection model of the present invention ensures that the intrusion detection model dynamically adjusts the user portrait as the user's daily behavior changes, ensuring a continuous security protection effect.

[0154] In one embodiment, Figure 5 The figure shows a structural diagram of a large model intrusion detection device based on user behavior data in an embodiment of the present invention. The embodiment of the present invention also provides a large model intrusion detection device based on user behavior data 005, which includes a data collection module 501, a preprocessing module 502, a modeling module 503, a behavior portrait generation module 504, and an alarm module 505.

[0155] The data collection module 501 is used to collect the user's daily behavior data from several data sources, and the user's daily behavior data includes: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records;

[0156] The preprocessing module 502 is used to perform feature extraction and normalization preprocessing on the daily behavior data of the user;

[0157] The modeling module 503 is used to obtain an intrusion detection model by serializing and modeling the preprocessed data using a Transformer model;

[0158] The behavior profile generation module 504 is used to generate a behavior profile of each user through the intrusion detection model;

[0159] The alarm module 505 is used to issue an intrusion detection alarm when the user's behavior to be detected does not conform to the behavior profile of the corresponding user and the deviation value exceeds the intrusion detection threshold.

[0160] The embodiments of the apparatus provided in the embodiments of the present invention can be specifically used to execute the processing flow of the above-mentioned method embodiments, and its functions are not described in detail here, and reference can be made to the detailed description of the above-mentioned method embodiments.

[0161] In another embodiment, Figure 6 The structure diagram of another large model intrusion detection device 006 based on user behavior data in an embodiment of the present invention is shown. The large model intrusion detection device 006 based on user behavior data includes a multi-source data collection module 601, a behavior feature extraction and preprocessing module 602, a user behavior modeling module 603, an abnormal behavior detection module 604, a response and alarm module 605, and a self-learning and model update module 606.

[0162] The multi-source data collection module 601 is used to collect user login and identity authentication data, system operation logs and file access records, network behavior data, and device usage records. In order to build an accurate user behavior portrait, the present invention collects the user's daily behavior data from multi-source data. Through the integration of these multi-source data, the present invention can comprehensively depict the user's daily behavior characteristics and build a user behavior portrait on this basis.

[0163] Specifically, the user login and identity authentication data collected by the present invention include information such as user login time, login method, geographic location, etc., which are used to identify abnormal behaviors such as identity theft and forged access. The system operation logs and file access records collected by the present invention include user access behaviors to files, folders and databases, which are used to monitor abnormal access to sensitive data. The network behavior data collected by the present invention includes real-time collection of user network traffic, including accessed external websites, resources, API calls, etc., with particular attention to abnormal network requests (such as access to unknown domain names, abnormal port traffic, etc.). The device usage records collected by the present invention include tracking devices accessed by users (such as USB devices, mobile devices), which are used to identify uncommon device access or unauthorized device use.

[0164] The behavior feature extraction and preprocessing module 602 is used for feature selection and normalization processing, and spatiotemporal feature analysis.

[0165] Specifically, the present invention first needs to screen the collected raw data and extract key behavior features, such as operation time, operation frequency, request target, execution command type, data access path, etc. In order to capture the time series characteristics of user behavior, the key behavior features are divided into multiple time windows according to time periods. For example, the key behavior features can be divided into time periods of 5 minutes, 1 hour or 1 day. The specific processing methods include: for short-term anomaly detection, a smaller time window (such as 5 minutes) is used to capture rapidly changing behaviors; for long-term behavior analysis, a larger time window (such as 1 hour or 1 day) is used to detect periodic or gradually evolving anomalies. The non-numerical data such as operation type (login, query, file transfer, etc.) and target resources (database, server, etc.) are encoded and converted to obtain numerical features. Specifically, one-hot encoding (One-Hot encoding) or word encoding (Embedding encoding, such as Word2Vec or BERT) and other technologies can be used. Numerical features such as data size, port number, time interval, etc. are normalized so that they are within the range of 0 to 1. For example, the normalization of the operation time can be performed by converting the timestamp into a relative time in a day (seconds / 86400). The present invention uses the Min-Max normalization technique to normalize the data to eliminate the differences between data of different dimensions. The Min-Max normalization formula is as follows.

[0166]

[0167] In the formula, x is the original data, x' is the normalized data, min(x) and max(x) are the minimum and maximum values ​​of the original data, respectively.

[0168] In addition, the time intervals between adjacent operations are calculated, and the time interval features are obtained by logarithmic transformation or bucketing to adapt to different time scales. The category features, numerical features, time interval features, etc. of each operation are combined into a vector as a parameter in the time series feature. In addition, the present invention also performs length truncation or padding on the time series features of each user behavior to ensure that the sequence input to the deep learning model has a uniform length.

[0169] The user behavior modeling module 603 is used for serialized modeling, personalized behavior portrait generation, and dynamic model updating.

[0170] In one embodiment, the training step of the intrusion detection model includes:

[0171] Map each operation event in the time series features to an embedding space of fixed dimension to generate a high-dimensional vector;

[0172] Add time location information to each operation through position encoding;

[0173] By calculating the attention weight of each operation and other operations, the mutual influence between operations in the time series features is captured;

[0174] Perform nonlinear transformation on the self-attention output;

[0175] Perform layer normalization and residual connection;

[0176] Multiple Transformer modules are stacked to capture higher-order time series features.

[0177] Specifically, the present invention uses the Transformer model to analyze the time series characteristics of user behavior, and the training steps of the intrusion detection model are as follows.

[0178] a. Construct input time series features and input the preprocessed time series feature vector into the Transformer model. Assume that a sequence consists of N operation events, and each event is represented as a multidimensional feature vector. Example input: A user's 5-minute operation window, including operation time (normalized), operation type (encoding conversion), access target (encoding conversion) and other features.

[0179] b. Build the Transformer model. The Transformer model consists of multiple layers, mainly including the following parts:

[0180] Build the Transformer model. Transformer consists of multiple layers, mainly including the following parts:

[0181] Input Embedding Layer: Maps each operation event in the sequence to an embedding space of fixed dimension to generate a high-dimensional vector representation.

[0182] Positional Encoding: Since Transformer has no built-in order perception, positional encoding is needed to add temporal position information to each operation (for example, using sine and cosine functions to encode the position).

[0183] Multi-Head Self-Attention: This captures the mutual influence between operations in a sequence by calculating the attention weights of each operation with other operations. This allows identifying which operations are most relevant to the current operation.

[0184] Feed-Forward Network: Perform nonlinear transformation on self-attention output to enhance the expressiveness of the model.

[0185] Layer Normalization and Residual Connections: Stabilize the training process and speed up model convergence.

[0186] Stacking multiple layers of Transformer: You can capture higher-order sequence features by stacking multiple Transformer models (such as 6 or 12 layers).

[0187] In one embodiment, when there is no labeled data, the reconstruction error of unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error of semi-supervised learning combined with the cross entropy loss is used to train the intrusion detection model; when there is a large amount of labeled data, the cross entropy loss of supervised learning is used to train the intrusion detection model.

[0188] Specifically, the present invention focuses on identifying potential abnormal behaviors and threats, but in practical applications, the labeled abnormal behavior data is usually less, so the present invention uses the reconstruction error method of unsupervised learning to train the intrusion detection model, or uses semi-supervised learning combined with the reconstruction error and cross entropy method to train the intrusion detection model, or uses the cross entropy loss method to train the intrusion detection model. Which training method to choose specifically can be determined based on the actual data characteristics and labeling situation. Specifically, when there is no labeled data, the autoencoder reconstruction error is used to detect anomalies. When there is a small amount of labeled data, semi-supervised learning is used, combined with reconstruction error and cross entropy loss for training. When there is a large amount of labeled data, cross entropy loss is directly used for supervised classification model training.

[0189] The present invention generates a behavior profile of each user through the intrusion detection model; the behavior profile of each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scan requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

[0190] The abnormal behavior detection module 604 is used for real-time behavior comparison, multi-level abnormal thresholds, and comprehensive multi-dimensional abnormal detection.

[0191] Specifically, the present invention monitors the user's current behavior in real time and compares it with the user's behavior portrait generated previously. Once it is detected that there is a significant difference between the user's current behavior and the user's behavior portrait (such as accessing sensitive files in an abnormal time period, using abnormal devices for operations, etc.), or it deviates from the behavior feature threshold, that is, it is determined to be abnormal behavior, the user's current behavior will be marked as a potential threatening behavior.

[0192] The response and alarm module 605 is used to issue different alarms according to low-level threats, medium-level threats, and high-level threats.

[0193] Specifically, the present invention also sets different alarm modes and corresponding response measures according to the difference between the deviation value of the user's current behavior and the user's behavior profile and the intrusion detection threshold. Different difference ranges represent different threat levels, and different response measures are taken for different threat levels, such as sending alarms, blocking access, and increasing security verification requirements. The present invention also designs a multi-level abnormal threshold mechanism, and sets different thresholds according to the risk level of the operation. For example, frequent access to database tables may only trigger low-level alarms, while modifying sensitive files or transmitting a large amount of data to the outside will trigger high-level alarms. The present invention comprehensively considers multiple dimensions such as time, space, and operation frequency of the behavior to ensure that potential attack behaviors can be fully detected. For example, if a user suddenly accesses a local device from a different geographical location and performs a high-risk operation, the present invention will immediately mark it as high risk. When abnormal behavior is identified, appropriate response measures will be taken according to the threat level. For example, when it is identified as a low-level threat, that is, the operation frequency is abnormal but there is no sensitive data leakage, the present invention will send an alarm to the administrator and recommend further investigation. When a medium-level threat is identified, i.e., access to sensitive files without external transmission, the present invention will restrict certain user operation permissions and require the user to perform additional identity verification. When a high-level threat is identified, i.e., large-scale data leakage or signs of internal attacks are found, the present invention will immediately block the user's operation permissions, force the user to log off, and trigger a comprehensive security audit at the same time.

[0194] The self-learning and model updating module 606 is used to implement self-learning and dynamic updating of the model.

[0195] Specifically, the present invention also designs a self-learning mechanism that can dynamically update the intrusion detection model based on the user's latest behavior data. This mechanism enables the present invention to maintain efficient detection capabilities in the face of natural changes in user behavior, avoiding false positives or false negatives caused by behavioral changes. Whenever new user operation data is collected, the present invention will regularly retrain the intrusion detection model to ensure that the intrusion detection model is always consistent with the user's latest behavior pattern.

[0196] Compared with the traditional intrusion detection system that only detects intrusion based on a single data source (such as network traffic), the present invention uses multi-source data (such as system logs, network behavior, file access, etc.) to conduct a comprehensive analysis of user behavior, which significantly improves the accuracy and comprehensiveness of detection. The present invention generates a personalized behavior portrait for each user, and performs fine-grained modeling of user behavior based on a large model. It can effectively detect abnormal operations that deviate from individual behavior patterns, and is particularly suitable for internal threat detection. Through a self-learning mechanism, the present invention can dynamically update the intrusion detection model when the user's daily behavior changes, ensure the continued effectiveness of the model's detection capabilities, and avoid underreporting and false alarms caused by model aging in traditional intrusion detection systems. The present invention also designs response mechanisms for different threat levels, which can perform flexible security disposal according to different risk scenarios.

[0197] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above methods when executing the computer program.

[0198] like Figure 7 The figure shows a physical structure diagram of a computer device provided by an embodiment of the present invention. The computer device 007 includes a processor 701, a memory 702 and a bus 703. The processor 701 and the memory 702 communicate with each other through the bus 703.

[0199] The processor 701 is used to call the program instructions in the memory 702 to execute the methods provided by the above-mentioned method embodiments.

[0200] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.

[0201] An embodiment of the present invention further provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.

[0202] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0203] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0206] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A large model intrusion detection method based on user behavior data, characterized in that: include: Collecting daily behavior data of users from several data sources, the daily behavior data of users including: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records; Performing feature extraction and normalization preprocessing on the daily behavior data of the user; According to the preprocessed data, the Transformer model is used for serialization modeling to obtain the intrusion detection model; Generate a behavior profile of each user through the intrusion detection model; When the user's behavior to be detected does not conform to the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm is issued.

2. The method according to claim 1, characterized in that: The training steps of the intrusion detection model include: Map each operation event in the time series features to an embedding space of fixed dimension to generate a high-dimensional vector; Add time location information to each operation through position encoding; By calculating the attention weight of each operation and other operations, the mutual influence between operations in the time series features is captured; Perform nonlinear transformation on the self-attention output; Perform layer normalization and residual connection; Capture higher-order time series features by stacking multiple Transformer modules.

3. The method according to claim 1, characterized in that: The feature extraction and normalization preprocessing of the daily behavior data of the user includes: Dividing the user's daily behavior data into a number of time windows according to time periods to obtain time series features; Encoding and converting the non-numerical data in the daily behavior data of the user to obtain numerical features; Normalize all numerical features; Calculate the time interval between adjacent behaviors and perform logarithmic transformation to obtain the time interval feature; The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data.

4. The method according to claim 1, characterized in that: When there is no labeled data, the reconstruction error of unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error of semi-supervised learning combined with the cross entropy loss is used to train the intrusion detection model; when there is a large amount of labeled data, the cross entropy loss of supervised learning is used to train the intrusion detection model.

5. The method according to claim 1, characterized in that: The behavioral portrait of each user is used to identify whether each user's device has abnormal website visits, abnormal IP connections, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scan requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

6. The method according to claim 1, characterized in that: Also includes: According to the difference between the deviation value and the intrusion detection threshold, different alarm modes are set and corresponding response measures are set.

7. A large model intrusion detection device based on user behavior data, characterized in that: include: A data collection module is used to collect the user's daily behavior data from several data sources, wherein the user's daily behavior data includes: user login data and identity authentication data, system operation logs and file access records, network behavior data, and device usage records; A preprocessing module, used for performing feature extraction and normalization preprocessing on the daily behavior data of the user; A modeling module is used to obtain an intrusion detection model by serializing and modeling the preprocessed data using a Transformer model; A behavior profile generation module, used to generate a behavior profile of each user through the intrusion detection model; The alarm module is used to issue an intrusion detection alarm when the user's behavior to be detected does not conform to the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images