A large model intrusion detection method and device based on user behavior data

Abstract

The application discloses a large model intrusion detection method and device based on user behavior data, and the method comprises the following steps: collecting daily behavior data of users from a plurality of data sources; performing feature extraction and normalization preprocessing on the daily behavior data of the users; according to the preprocessed data, performing serialization modeling by using a Transformer model to obtain an intrusion detection model; generating a behavior portrait of each user by using the intrusion detection model; and when the behavior to be detected of the user does not conform to the behavior portrait of the corresponding user and the deviation value exceeds an intrusion detection threshold, performing intrusion detection alarm. The application can quickly identify potential security threats such as abnormal access, high-risk website connection, large-scale data transmission, internal network scanning, and the like, so as to effectively detect malicious activities and data leakage risks.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology, and in particular to a large-scale intrusion detection method and apparatus based on user behavior data. Background Technology

[0002] With the rapid development of network technology, network security issues are becoming increasingly severe. In particular, the increasing prevalence of complex threats such as Advanced Persistent Threat (APT) attacks, insider threats, and new zero-day attacks poses a significant challenge to traditional intrusion detection systems. Traditional intrusion detection systems are typically based on predefined rules or signature databases. While this approach is effective against known threats, its detection capabilities are insufficient against unknown and complex threats. Furthermore, insider threats (such as malicious actions or accidental errors by employees) are often difficult to detect using traditional intrusion detection methods. Summary of the Invention

[0003] To address the problems in existing technologies, embodiments of the present invention provide a large-scale intrusion detection method and apparatus based on user behavior data. By analyzing users' daily user behavior and monitoring their network access habits, external IP connections, port usage changes, data transmission patterns, and activities during abnormal working hours, the present invention can establish a baseline of daily behavior and quickly identify potential security threats such as abnormal access, high-risk website connections, large-scale data transmission, and intranet scanning, thereby effectively detecting malicious activities and data leakage risks.

[0004] This invention provides a large-scale intrusion detection method based on user behavior data, the method comprising:

[0005] The system collects users' daily behavior data from several data sources, including: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records.

[0006] Feature extraction and normalization preprocessing are performed on the user's daily behavior data;

[0007] Based on the preprocessed data, an intrusion detection model is obtained by using the Transformer model for serialization modeling.

[0008] The intrusion detection model generates a behavioral profile for each user.

[0009] An intrusion detection alarm is triggered when a user's behavior does not match the corresponding user's behavioral profile and the deviation value exceeds the intrusion detection threshold.

[0010] In one embodiment, the training steps of the intrusion detection model include:

[0011] Each operational event in the time series features is mapped to a fixed-dimensional embedding space to generate a high-dimensional vector;

[0012] Add time and location information to each operation using location encoding;

[0013] By calculating the attention weight of each operation to other operations, the mutual influence between operations in the time series features is captured;

[0014] Perform a nonlinear transformation on the self-attention output;

[0015] Perform layer normalization and residual connections;

[0016] Capture higher-order time series features by stacking multiple Transformer modules.

[0017] In one embodiment, the feature extraction and normalization preprocessing of the user's daily behavior data includes:

[0018] The user's daily behavior data is divided into several time windows according to time periods to obtain time series features;

[0019] Numerical features are obtained by encoding and converting the non-numerical data in the user's daily behavior data.

[0020] Normalize all numerical features;

[0021] Calculate the time interval between adjacent actions and perform a logarithmic transformation to obtain the time interval feature;

[0022] The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data.

[0023] In one embodiment, when there is no labeled data, the reconstruction error from unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error from semi-supervised learning combined with cross-entropy loss is used to train the intrusion detection model; and when there is a large amount of labeled data, the cross-entropy loss from supervised learning is used to train the intrusion detection model.

[0024] In one embodiment, the behavioral profile of each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scan requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

[0025] In one embodiment, the method further includes setting different alarm modes and corresponding response measures based on the difference between the deviation value and the intrusion detection threshold.

[0026] This invention also provides a large-scale intrusion detection device based on user behavior data, the device comprising:

[0027] The data collection module is used to collect users' daily behavior data from several data sources. The users' daily behavior data includes: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records.

[0028] The preprocessing module is used to perform feature extraction and normalization preprocessing on the user's daily behavior data;

[0029] The modeling module is used to perform serialization modeling using the Transformer model based on the preprocessed data to obtain an intrusion detection model;

[0030] The behavior profile generation module is used to generate a behavior profile for each user based on the intrusion detection model.

[0031] The alarm module is used to issue an intrusion detection alarm when a user's behavior to be detected does not match the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold.

[0032] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the methods described above.

[0033] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements any of the methods described above.

[0034] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements any of the methods described above.

[0035] This invention provides a large-scale intrusion detection method and apparatus based on user behavior data. By analyzing users' daily behavior and monitoring their network access habits, external IP connections, port usage changes, data transmission patterns, and activities outside of normal working hours, this invention can establish a baseline of daily behavior and quickly identify potential security threats such as abnormal access, high-risk website connections, large-scale data transmission, and internal network scanning. This effectively detects malicious activities and data leakage risks. This invention can automatically identify abnormal activities that differ from users' daily behavior patterns, providing strong support for detecting internal threats and external attacks. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0037] Figure 1 This is a schematic diagram illustrating an application scenario of a large-scale intrusion detection method based on user behavior data, as described in an embodiment of the present invention.

[0038] Figure 2 This is a flowchart of a large-scale intrusion detection method based on user behavior data, as described in an embodiment of the present invention.

[0039] Figure 3 This is a flowchart of a feature extraction and normalization preprocessing method in an embodiment of the present invention;

[0040] Figure 4 This is a flowchart of the training steps of an intrusion detection model in an embodiment of the present invention;

[0041] Figure 5 This is a structural diagram of a large-scale intrusion detection device based on user behavior data according to an embodiment of the present invention;

[0042] Figure 6 This is a structural diagram of another large-scale intrusion detection device based on user behavior data in an embodiment of the present invention;

[0043] Figure 7 This is a schematic diagram of the physical structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0045] To facilitate understanding of the technical solution provided by this invention, the research background of the technical solution of this invention will be briefly explained below.

[0046] Currently, common intrusion detection systems (IDS) primarily rely on two technical approaches. The first is signature-based detection, which matches network traffic, user behavior, or system logs against signatures, rules, or signature databases of known attacks to determine the presence of abnormal behavior. This method relies on previously identified attack characteristics and is effective at detecting known attacks. The second is statistical analysis-based detection, which identifies potential attacks by analyzing statistical characteristics of network behavior (such as abnormal traffic and packet size fluctuations). This approach is effective for certain types of attacks (such as DDoS attacks), but is less effective against more covert attack patterns (such as APTs).

[0047] The existing technical solutions have the following drawbacks.

[0048] 1. Poor detection performance against unknown attacks: Existing feature-based methods perform well against known attacks, but their detection capabilities are severely limited when faced with new attacks due to the lack of corresponding rules or features.

[0049] 2. High false alarm rate: Detection methods based on statistical analysis are prone to false alarms, especially in complex network environments and diverse user behaviors, making it difficult to distinguish between normal operational fluctuations and abnormal attack behaviors.

[0050] 3. Difficulty in identifying internal threats: Traditional detection methods are mostly focused on external attacks, while they are almost ineffective in detecting internal threats (such as malicious operations by employees, abuse of privileges, etc.).

[0051] 4. Lack of self-learning ability: Existing intrusion detection systems cannot adaptively learn based on changes in user behavior, which can easily lead to system failure over time, especially for users with ever-changing behaviors.

[0052] With the widespread application of large-scale modeling technologies such as deep learning, research and applications of artificial intelligence in cybersecurity are gradually emerging, especially in the field of User Behavior Analytics (UBA). By analyzing users' daily behavior, monitoring their network access habits, external IP connections, port usage changes, data transmission patterns, and activities outside of normal working hours, a baseline of daily behavior can be established. This allows for the rapid identification of potential security threats such as abnormal access, high-risk website connections, large-scale data transmission, and internal network scanning, thereby effectively detecting malicious activities and data breach risks. Large-scale model-based detection systems can automatically identify abnormal activities that differ from users' daily behavior patterns, providing a new approach to detecting internal threats and external attacks.

[0053] Figure 1 This is a schematic diagram illustrating an application scenario of a large-scale intrusion detection method based on user behavior data, as described in an embodiment of the present invention. The present invention can be a virtual device deployed on a server. This virtual device is connected to multiple terminals via firewalls and switches, and can also include all terminals in both intranet and extranet environments within its monitoring scope. When a terminal experiences abnormal behavior such as an internal attack, the present invention can promptly detect the abnormal behavior through an intrusion detection model. Similarly, when the server suffers an external intrusion, the present invention can also promptly detect the intrusion behavior through an intrusion detection model. The virtual device of the present invention can periodically collect users' daily behavior data from firewalls, servers, identity and access management systems, terminal detection and response systems, and existing intrusion detection systems.

[0054] like Figure 2 The diagram shows a flowchart of a large-scale intrusion detection method based on user behavior data according to an embodiment of the present invention. This embodiment of the present invention provides a large-scale intrusion detection method based on user behavior data, the method comprising:

[0055] S201. Collect user daily behavior data from several data sources, including: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records;

[0056] S202. Perform feature extraction and normalization preprocessing on the user's daily behavior data;

[0057] S203. Based on the preprocessed data, the Transformer model is used to perform serialization modeling to obtain the intrusion detection model;

[0058] S204. Generate a behavioral profile for each user using the intrusion detection model;

[0059] S205. When a user's behavior to be detected does not match the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm will be issued.

[0060] Specifically, to construct accurate user behavior profiles, this invention collects daily user behavior data from multiple data sources, such as agents or sensors from network devices, servers, and terminals. This data comprehensively depicts the characteristics of users' daily behavior, and user behavior profiles are constructed based on this. To ensure effective analysis and processing of multi-dimensional user daily behavior data, this invention also performs feature extraction and normalization preprocessing on the user's daily behavior data. Based on the preprocessed data, a Transformer model is used for serialization modeling to obtain an intrusion detection model. This invention captures the temporal and spatial characteristics of user behavior through the Transformer model, effectively revealing users' regular operating patterns. Different users have significantly different operating patterns; therefore, this invention generates independent behavior profiles for each user. These profiles not only reflect the user's overall behavior but also cover their operational preferences in daily work (such as commonly used file types, frequently accessed network resources, and frequently used devices). Through these personalized behavior profiles, this invention can identify any abnormal operations that deviate from the normal behavior. When a user's behavior to be detected does not match the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm is issued. This invention monitors user behavior in real time and compares it with previously generated user behavior profiles. Once a significant difference is detected between the current operation and the user behavior profile (such as accessing sensitive files during abnormal time periods or using abnormal devices), it is determined to be abnormal behavior and an intrusion detection alarm is triggered.

[0061] This invention employs the Transformer model for serialization modeling to obtain an intrusion detection model and generate a behavioral profile for each user. It can detect abnormal user behavior in real time, exhibiting significant advantages, particularly in detecting insider threats and advanced persistent threats. This invention can overcome the shortcomings of existing intrusion detection systems in dealing with unknown attacks, reducing false positive rates, and identifying insider threats.

[0062] In one embodiment, the user's daily behavior data includes: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records.

[0063] Specifically, the user login and authentication data collected by this invention includes information such as user login time, login method, and geographical location, used to identify abnormal behaviors such as identity theft and forged access. The system operation logs and file access records collected by this invention include user access behavior to files, folders, and databases, used to monitor abnormal access to sensitive data. The network behavior data collected by this invention includes real-time collection of user network traffic, including accessed external websites, resources, API calls, etc., with particular attention to abnormal network requests (such as access to unknown domains, abnormal port traffic, etc.). The device usage records collected by this invention include tracking the devices connected by the user (such as USB devices, mobile devices), used to identify situations where uncommon devices are connected or unauthorized devices are used.

[0064] In one embodiment, user daily behavior data is collected from devices such as firewalls, intrusion detection systems, web proxy servers, endpoint detection and response systems, and identity and access management systems.

[0065] Specifically, collecting user behavior data from firewall logs includes external IP connection records, URLs of accessed destinations, data volume, and protocol types. Firewall logs can be used to analyze external websites and services accessed by users, identify non-compliant network connections, detect abnormally large amounts of data uploads, and identify whether users have accessed high-risk or restricted websites, or frequently attempt to connect to multiple external IPs. These may indicate malware infection or data leakage risks. Collecting user behavior data from intrusion detection system (IDS) logs and alert events includes captured traffic patterns, protocol analysis, signatures of suspicious traffic, and specific port usage. IDS can identify abnormal behavior through deep packet inspection (DPI) and traffic analysis. Specific attack patterns detected by IDS (such as SQL injection and hacking attempts) can help identify whether users have been subjected to targeted attacks, while recorded port scanning behavior can be used to analyze signs of lateral movement. Collecting user behavior data from the proxy access logs of web proxy servers includes information on all web requests accessed by the user, such as the URL, timestamp, HTTP status code, request method (GET, POST), and content type. This data can help identify whether the user is accessing abnormal websites, such as frequently attempting to access content blocked by the company, or making a large number of HTTP requests in a short period of time, which may indicate malware infection or data breach attempts. Collecting user behavior data from the endpoint activity monitoring logs of endpoint detection and response systems (EDR) includes application execution records, system file changes, process start and termination events, and external storage device connections. EDR systems can provide detailed user behavior data, which helps analyze usage habits and potential threat behaviors. If a user's endpoint device suddenly executes abnormal programs, launches unauthorized scripts, or loads new system drivers, this may indicate malware activity or an attacker's persistence attempt. This invention collects daily user behavior data from the Identity and Access Management (IAM) system's authentication logs and access control policy logs. This data includes the number of failed login attempts, the types and times of accessed resources, the authentication methods used (such as two-factor authentication), and records of user role changes. This data can be used to analyze user login behavior, identifying abnormal login times (such as late-night logins), changes in login location (cross-regional logins), or frequent login failures, which can be used to determine if there is a risk of account theft. Compared to traditional single data sources (such as network traffic or system logs), this invention employs a multi-source data fusion approach, collecting diverse data from multiple data sources for comprehensive analysis of user behavioral characteristics, significantly improving the accuracy and comprehensiveness of intrusion detection.

[0066] like Figure 3The diagram shows a flowchart of feature extraction and normalization preprocessing in an embodiment of the present invention. In one embodiment, the feature extraction and normalization preprocessing of the user's daily behavior data includes:

[0067] S301. The user's daily behavior data is divided into several time windows according to time periods to obtain time series features;

[0068] S302. Encode and convert the non-numerical data in the user's daily behavior data to obtain numerical features;

[0069] S303. Normalize all numerical features;

[0070] S304. Calculate the time interval between adjacent actions and perform a logarithmic transformation to obtain the time interval feature;

[0071] S305. Combine the normalized numerical features and time interval features into a vector and use it as a parameter in the time series features to obtain the final preprocessed data.

[0072] Specifically, to ensure effective analysis and processing of multi-dimensional user behavior data, this invention requires feature extraction and normalization preprocessing of users' daily behavior data to facilitate subsequent serialization modeling. The preprocessing of this invention mainly includes the following steps.

[0073] (1) The user's daily behavior data is divided into several time windows according to time periods to obtain time series features. Specifically, the present invention first needs to filter the collected raw data and extract key behavioral features, such as operation time, operation frequency, request target, execution command type, data access path, etc. In order to capture the time series features of user behavior, the key behavioral features are divided into multiple time windows according to time periods. For example, the key behavioral features can be divided into time periods of 5 minutes, 1 hour, or 1 day. Specific processing methods include: for short-term anomaly detection, a smaller time window (such as 5 minutes) is used to capture rapidly changing behaviors; for long-term behavior analysis, a larger time window (such as 1 hour or 1 day) is used to detect periodic or gradually evolving anomalies.

[0074] (2) Encode and convert non-numerical data in the user's daily behavior data to obtain numerical features. Specifically, encode and convert non-numerical data such as operation type (login, query, file transfer, etc.) and target resource (database, server, etc.) to obtain numerical features. One-hot encoding or embedding encoding (such as Word2Vec or BERT) can be used.

[0075] (3) Normalize all numerical features. Specifically, normalize numerical features such as data size, port number, and time interval to a range of 0 to 1. For example, normalizing operation time can be achieved by converting the timestamp to a relative time within a day (seconds / 86400). This invention uses Min-Max normalization technology to standardize the data to eliminate differences between data of different dimensions. The Min-Max normalization formula is as follows.

[0076]

[0077] In the formula, x is the original data, x' is the normalized data, and min(x) and max(x) are the minimum and maximum values ​​of the original data, respectively.

[0078] (4) Calculate the time interval between adjacent actions and perform a logarithmic transformation to obtain the time interval feature. Specifically, calculate the time interval between adjacent operations and use logarithmic transformation or bucketing to obtain the time interval feature to adapt to different time scales.

[0079] (5) The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data. Specifically, the category features, numerical features, and time interval features of each operation are combined into a vector and used as a parameter in the time series features. In addition, the present invention also truncates or pads the time series features of each user behavior to ensure that the sequence input into the deep learning model has a uniform length.

[0080] In one embodiment, the training steps of the intrusion detection model include:

[0081] S4021. Map each operational event in the time series features to a fixed-dimensional embedding space to generate a high-dimensional vector;

[0082] S4022. Add time and location information to each operation through location coding;

[0083] S4023. By calculating the attention weight of each operation to other operations, the mutual influence between operations in the time series features is captured.

[0084] S4024. Perform a nonlinear transformation on the self-attention output;

[0085] S4025, Perform layer normalization and residual connection;

[0086] S4026. Capture higher-order time series features by stacking multiple Transformer modules.

[0087] Specifically, this invention uses the Transformer model to analyze the time-series features of user behavior, and the training steps of the intrusion detection model are as follows.

[0088] like Figure 4 The diagram shows a flowchart of the training steps for an intrusion detection model according to an embodiment of the present invention.

[0089] S401. Construct the input time series features by inputting the preprocessed time series feature vector into the Transformer model. Assume a sequence consists of N operation events, each represented as a multi-dimensional feature vector. Example input: A user's 5-minute operation window, including operation time (normalized), operation type (encoding conversion), access target (encoding conversion), and other features.

[0090] S402. Construct the Transformer model. The Transformer consists of multiple layers and mainly includes the following parts:

[0091] S4021, Input Embedding Layer: Maps each operation event in the sequence to a fixed-dimensional embedding space to generate a high-dimensional vector representation.

[0092] S4022, Positional Encoding: Since Transformer does not have built-in order awareness, positional encoding is needed to add time position information to each operation (e.g., using sine and cosine functions to encode position).

[0093] S4023, Multi-Head Self-Attention: By calculating the attention weights of each operation with other operations, it captures the mutual influence between operations in the sequence. This allows it to identify which operations are most relevant to the current operation.

[0094] S4024, Feed-Forward Network: Performs non-linear transformation on the self-attention output to enhance the model's expressive power.

[0095] S4025, Layer Normalization and Residual Connections: Stabilize the training process and accelerate model convergence.

[0096] S4026, Stacking Multiple Transformers: Higher-order sequence features can be captured by stacking multiple Transformer models (such as 6 or 12 layers).

[0097] In one embodiment, when there is no labeled data, the reconstruction error from unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error from semi-supervised learning combined with cross-entropy loss is used to train the intrusion detection model; and when there is a large amount of labeled data, the cross-entropy loss from supervised learning is used to train the intrusion detection model.

[0098] Specifically, this invention focuses on identifying potential abnormal behaviors and threats. However, in practical applications, labeled abnormal behavior data is usually limited. Therefore, this invention uses unsupervised learning's reconstruction error method to train the intrusion detection model. Of course, when labeled data is available, a semi-supervised learning method combining reconstruction error and cross-entropy can also be used to train the intrusion detection model, or a cross-entropy loss method can be used. The specific training method chosen depends on the actual data characteristics and labeling situation. Specifically, when there is no labeled data, unsupervised learning's reconstruction error is used to train the intrusion detection model; when there is a small amount of labeled data, semi-supervised learning's reconstruction error combined with cross-entropy loss is used; and when there is a large amount of labeled data, supervised learning's cross-entropy loss is used.

[0099] Specifically, unsupervised learning (suitable for unlabeled data) uses reconstruction error as the objective function. If the dataset is unlabeled, meaning there are no explicit markers indicating which behaviors are normal and which are abnormal, autoencoders (such as Transformer autoencoders) can be used for unsupervised training. Specific methods include: training an autoencoder model on users' daily operational behaviors, enabling the model to reconstruct the input behavior sequence; training the model by minimizing the difference between the original input and the reconstructed output; using mean squared error (MSE) or mean absolute error (MAE) as the loss function to measure the difference between the original and reconstructed sequences; and during the detection phase, considering the behavior sequence potentially abnormal when the reconstruction error exceeds a certain threshold. Intrusion detection models trained using unsupervised learning methods to address reconstruction error are suitable for detecting unknown abnormal behaviors, especially novel threats or attacks.

[0100] In one embodiment, the mean square error is expressed as follows.

[0101]

[0102] Where, x i This represents the i-th feature of the original input. Let N represent the i-th feature of the reconstructed output, and N represent the number of features.

[0103] In one embodiment, the mean absolute error is expressed as follows. MAE measures the reconstruction error by calculating the absolute difference between the input and the output.

[0104]

[0105] Where, x i This represents the i-th feature of the original input. Let N represent the i-th feature of the reconstructed output, and N represent the number of features.

[0106] Specifically, semi-supervised learning combines unsupervised reconstruction error with supervised cross-entropy loss. When there is a small amount of labeled data, semi-supervised learning can be performed by combining reconstruction error and cross-entropy loss. Specific methods include: for a small amount of labeled data, using cross-entropy loss to supervise the model in learning the difference between anomalies and normal data; for unlabeled data, using reconstruction error to train the model to learn features of everyday behavior. The loss function is designed as follows: the total loss function is the reconstruction error loss plus the cross-entropy loss, where weights can be assigned to each loss term to adjust their impact on training.

[0107] In one embodiment, the total loss function of semi-supervised learning can be expressed as a weighted sum of the two losses, specifically as follows:

[0108]

[0109] λ1 and λ2 are weighting coefficients used to adjust the effects of unsupervised reconstruction error and supervised cross-entropy loss.

[0110] In one embodiment, the unsupervised reconstruction error is the mean squared error (MSE) or the mean absolute error (MAE).

[0111] In one embodiment, the mean square error is expressed as follows.

[0112]

[0113] Where, x i This represents the i-th feature of the original input. Let N represent the i-th feature of the reconstructed output, and N represent the number of features.

[0114] In one embodiment, the mean absolute error is expressed as follows. MAE measures the reconstruction error by calculating the absolute difference between the input and the output.

[0115]

[0116] Where, x i This represents the i-th feature of the original input. Let N represent the i-th feature of the reconstructed output, and N represent the number of features.

[0117] In one embodiment, the supervised cross-entropy loss function is:

[0118]

[0119] Where M represents the number of samples, y j p is the true label of the j-th sample (0 indicates normal, 1 indicates abnormal). j It is the probability that the j-th sample is predicted to be abnormal.

[0120] By designing this loss function through semi-supervised learning, the intrusion detection model can utilize both labeled and unlabeled data, while balancing the accuracy and generalization ability of anomaly detection.

[0121] Semi-supervised learning uses users' daily behavior time-series features as a training set to train the model to learn users' daily behavior patterns. Randomly sampled daily behavior time-series features are input into the Transformer model, and the model parameters are adjusted to minimize the objective function.

[0122] Specifically, supervised learning (suitable for labeled data) employs the cross-entropy loss function. If labeled data explicitly identifies whether each action is normal or abnormal, supervised learning can be used to train the model. Specific methods include defining the task as a binary classification problem (normal or abnormal), and training the model to predict the abnormal probability of each action or sequence. Supervised learning uses the cross-entropy loss function to calculate the difference between the predicted probability and the true label. Cross-entropy performs well in classification tasks, especially for multi-class or binary classification problems. In supervised learning, the goal of model training is to make the predicted abnormal probability as close as possible to the true label.

[0123] In one embodiment, the cross-entropy loss function (for binary classification problems) is expressed as:

[0124]

[0125] Where M represents the number of samples, y j p is the true label of the j-th sample (0 indicates normal, 1 indicates abnormal). j It is the probability that the j-th sample is predicted to be abnormal.

[0126] In one embodiment, the behavioral profile of each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scan requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

[0127] Specifically, this invention identifies the presence of abnormal website access based on abnormal website access data. This abnormal website access data originates from firewall, web filtering devices, and proxy server logs. The abnormal website access data includes a timestamp recording the access time, a user ID or device ID to identify the visitor, a URL recording the complete URL accessed by the user, domain classification parameters (such as news, social media, etc.) for classifying the accessed domains, and a security score for determining whether the website is high-risk based on threat intelligence. During the anomaly detection phase, if a user suddenly and frequently accesses high-risk websites (such as known malicious domains) or visits sites unrelated to their work (such as social media), it may indicate that the local device is infected with malware or that user credentials have been compromised.

[0128] Specifically, this invention identifies the existence of abnormal IP connections based on anomalous IP connection data. This anomalous IP connection data originates from network firewalls, IDS / IPS (Intrusion Detection / Prevention Systems), network traffic analysis tools, etc., and includes timestamps recording connection times, source IP addresses recording the user device's IP, target IP addresses recording the user's connection to external IPs, geographical location parameters recording the target IP, connection frequency parameters recording the number of connections and time intervals, and threat intelligence data recording whether the target IP is in a known list of malicious IPs. During the anomaly detection phase, if a user connects to a high-risk target IP or an uncommon IP address, this may indicate malicious traffic, data breaches, or control activities by external attackers.

[0129] Specifically, this invention identifies port usage anomalies based on abnormal port usage change data. This abnormal port usage change data originates from devices such as host firewalls, system logs, and SIEM (Security Information and Event Management System). The data includes timestamps recording port status changes, port numbers used or open, port protocols (e.g., TCP, UDP), service names associated with the port (e.g., HTTP, RDP), and user accounts performing the operations. During the anomaly detection phase, if an infrequently used port (e.g., remote desktop port 3389 or file transfer port 21) is suddenly opened, it may indicate an attacker attempting lateral movement or remote control of the local device.

[0130] Specifically, this invention identifies whether there is a data transmission exceeding a first preset number based on the recorded data of data upload and download modes. The recorded data for these modes originates from traffic monitoring tools (such as NetFlow), firewall logs, and data loss prevention (DLP) systems. This recorded data includes a timestamp recording the upload or download operation time, a user ID or device ID identifying the upload or download source, the amount of data uploaded / downloaded, the file format (such as ZIP, PDF), the target location (URL / IP) for the file upload / download, and the protocol used (such as HTTP, FTP, SFTP). During the anomaly detection phase, if a user uploads more than the first preset number of files within a short period, especially to cloud storage or file sharing services, it indicates a potential risk of data leakage.

[0131] Specifically, this invention identifies whether there are more than a second preset number of operations during abnormal working hours based on operation record data. This abnormal working hour operation record data originates from log management systems, employee attendance systems, VPN logs, etc., and includes a timestamp recording the operation time, a user ID recording the user performing the operation, the type of resource accessed by the user (e.g., database, file server), and the operation type (e.g., login, file access, data transfer). During the anomaly detection phase, if a user performs a large number of operations (e.g., remote login, database query) during abnormal working hours (e.g., 2 AM), it may be a sign of unauthorized access or malicious activity.

[0132] Specifically, this invention identifies whether there are more than a third preset number of network scanning requests and more than a fourth preset number of simultaneous requests to connect to internal network device ports based on the recorded data of internal network scanning and lateral movement. The recorded data of internal network scanning and lateral movement originates from intrusion detection systems (IDS), network traffic analysis tools, host protection systems, etc.; the recorded data includes a timestamp recording the time of the scanning behavior, the IP address of the device initiating the scan, the target network address of the scan, a list of ports attempted to connect to, and the scanning frequency. During the anomaly detection phase, if a user host simultaneously requests to connect to more than a fourth preset number of internal network device ports, or more than a third preset number of network scanning requests, it indicates that an attacker may be probing the network environment and attempting lateral movement.

[0133] This invention monitors a user's current behavior in real time and compares it with a previously generated user behavior profile. If a significant difference is detected between the user's current behavior and the user's behavior profile (such as accessing sensitive files during abnormal time periods or using abnormal devices), or if the behavior deviates from the behavior characteristic threshold, it is determined to be abnormal behavior and the user's current behavior is marked as a potential threat behavior.

[0134] In one embodiment, the method further includes setting different alarm modes and corresponding response measures based on the difference between the deviation value and the intrusion detection threshold.

[0135] Specifically, this invention also sets different alarm modes and corresponding response measures based on the difference between the user's current behavior and the deviation value of the user's behavior profile and the intrusion detection threshold. Different difference ranges represent different threat levels, and different threat levels require different response measures, such as sending alarms, blocking access, and increasing security verification requirements. This invention also designs a multi-layered anomaly threshold mechanism, setting different thresholds according to the risk level of the operation. For example, frequent access to database tables may only trigger low-level alarms, while modifying sensitive files or transmitting large amounts of data externally will trigger high-level alarms. This invention comprehensively considers multiple dimensions of behavior, such as time, space, and operation frequency, to ensure that potential attack behaviors can be detected comprehensively. For example, if a user suddenly accesses a local device from a different geographical location and performs high-risk operations, this invention will immediately mark them as high-risk. When abnormal behavior is identified, this invention will take appropriate response measures according to the threat level. For example, when a low-level threat is identified, i.e., abnormal operation frequency but no sensitive data leakage, this invention will send an alarm to the administrator and suggest further investigation. When identified as a medium-level threat—that is, access to sensitive files without external transmission—this invention will restrict certain user operation permissions and require the user to perform additional authentication. When identified as an advanced threat—that is, signs of a large-scale data breach or internal attack are detected—this invention will immediately block the user's operation permissions, forcibly log the user out, and simultaneously trigger a comprehensive security audit.

[0136] This invention also incorporates a self-learning mechanism that dynamically updates the intrusion detection model based on the user's latest behavioral data. This mechanism enables the invention to maintain high detection efficiency even when faced with natural changes in user behavior, avoiding false positives or false negatives caused by behavioral changes. Whenever new user operation data is collected, the invention periodically retrains the intrusion detection model to ensure that it remains consistent with the user's latest behavioral patterns.

[0137] In one embodiment, suppose a user performs a series of actions, including logging in, querying a database, downloading a file, and closing an application. Within a 5-minute time window, these actions form a sequence. Analysis by a Transformer model detects abnormal behavior at a certain step (e.g., excessive download volume, abnormal operation time). The model identifies these anomalies and triggers a response strategy.

[0138] In one embodiment, suppose a user performed the following operation within a certain time period:

[0139] 2024-10-25 10:00:00, query table T1 in database A.

[0140] At 10:02:00 on October 25, 2024, data was inserted into table T2 of database A.

[0141] 2024-10-25 10:04:30, delete table T3 in database B.

[0142] This invention preprocesses each operation into a feature vector and uses a Transformer model to capture the correlations between these operations, thereby detecting potential threats (such as abnormal operation sequence or frequency). By combining operation timestamps, this invention performs time-series analysis on user operation steps, ensuring that it not only focuses on the anomalies of individual operations but also identifies potential threats in continuous operations. For example, consecutive batch operations on multiple database tables may be potential data theft, while a single query operation is more conventional. Serialization modeling methods can not only analyze the anomalies of individual operations but also detect more complex potential threats by combining related operations. This invention also analyzes the temporal and spatial dimensions of user behavior by collecting user IP addresses and operation times, focusing on differences in user behavior across different time periods and geographical locations. For example, a user accessing a company's internal computer at night may be abnormal behavior, especially when their geographical location changes abnormally, which may indicate intrusion.

[0143] In one embodiment, the present invention includes the following steps.

[0144] 1. Input Design. The input user behavior data includes various behavioral features, such as the accessed IP address, port number, access time, and target URL. Assume the input time-series feature vector is: X = [Access Time, IP Feature Encoding, Port Encoding, URL Encoding]. For example, a user's behavior record might be:

[0145] X1=[0.75, 0.6, 0.2, 0.8];

[0146] X2=[0.80, 0.7, 0.1, 0.6];

[0147] X3=[0.65, 0.5, 0.4, 0.9];

[0148] The data here has been normalized to the range [0, 1] for easier model processing.

[0149] 2. Model Design. A Transformer autoencoder is used as the model structure. Specifically, the autoencoder maps the input feature sequence to a low-dimensional space (encoding) and then restores it to a high-dimensional space (decoding). The training objective is to make the decoder's reconstructed output as close to the input as possible, so that the model can learn the user's daily behavior patterns.

[0150] 3. Loss Function Design. In each iteration, the mean squared error (MSE) or mean absolute error (MAE) is used to measure the difference between the input and the reconstructed output. For example: Input sequence (X): [0.75, 0.6, 0.2, 0.8]; Reconstructed output (X_hat): [0.70, 0.58, 0.25, 0.75]. Assuming the number of features N = 4, the formula for calculating the mean squared error (MSE) is:

[0151]

[0152] 4. Anomaly Detection. After training on a large amount of daily data, a reconstruction error threshold is set (e.g., 0.005). When the reconstruction error of a certain behavior exceeds this threshold, it is considered an anomaly. For example, the reconstruction error of 0.003875 mentioned above is less than the threshold, so the behavior is judged as normal.

[0153] This invention enables effective detection of unknown attacks and internal threats, making up for the shortcomings of traditional intrusion detection systems; it significantly reduces the false alarm rate and the workload of security personnel in handling false alarms; the self-learning capability of the intrusion detection model of this invention ensures that the intrusion detection model dynamically adjusts the user profile according to changes in the user's daily behavior, guaranteeing continuous security protection.

[0154] In one embodiment, such as Figure 5 The diagram shown is a structural diagram of a large-scale intrusion detection device based on user behavior data in an embodiment of the present invention. The embodiment of the present invention also provides a large-scale intrusion detection device 005 based on user behavior data. The device 005 includes a data collection module 501, a preprocessing module 502, a modeling module 503, a behavior profile generation module 504, and an alarm module 505.

[0155] The data collection module 501 is used to collect users' daily behavior data from several data sources, including: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records;

[0156] The preprocessing module 502 is used to perform feature extraction and normalization preprocessing on the user's daily behavior data;

[0157] The modeling module 503 is used to perform serialization modeling using the Transformer model based on the preprocessed data to obtain an intrusion detection model;

[0158] Behavioral profile generation module 504 is used to generate a behavioral profile for each user through the intrusion detection model;

[0159] The alarm module 505 is used to issue an intrusion detection alarm when a user's behavior to be detected does not match the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold.

[0160] The embodiments of the device provided in this invention can be used to execute the processing flow of the above-described method embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the above-described method embodiments.

[0161] In another embodiment, such as Figure 6 The diagram shows a structural representation of another large-scale intrusion detection device 006 based on user behavior data according to an embodiment of the present invention. This large-scale intrusion detection device 006 based on user behavior data includes a multi-source data collection module 601, a behavior feature extraction and preprocessing module 602, a user behavior modeling module 603, an abnormal behavior detection module 604, a response and alarm module 605, and a self-learning and model update module 606.

[0162] The multi-source data collection module 601 is used to collect user login and authentication data, system operation logs and file access records, network behavior data, and device usage records. To construct an accurate user behavior profile, this invention extracts daily user behavior data from multiple sources. Through the integration of this multi-source data, this invention can comprehensively depict the user's daily behavioral characteristics and construct a user behavior profile based on this.

[0163] Specifically, the user login and authentication data collected by this invention includes information such as user login time, login method, and geographical location, used to identify abnormal behaviors such as identity theft and forged access. The system operation logs and file access records collected by this invention include user access behavior to files, folders, and databases, used to monitor abnormal access to sensitive data. The network behavior data collected by this invention includes real-time collection of user network traffic, including accessed external websites, resources, API calls, etc., with particular attention to abnormal network requests (such as access to unknown domains, abnormal port traffic, etc.). The device usage records collected by this invention include tracking the devices connected by the user (such as USB devices, mobile devices), used to identify situations where uncommon devices are connected or unauthorized devices are used.

[0164] The behavioral feature extraction and preprocessing module 602 is used for feature selection and normalization processing, and spatiotemporal feature analysis.

[0165] Specifically, this invention first requires filtering the collected raw data to extract key behavioral features, such as operation time, operation frequency, request target, command type, and data access path. To capture the time-series characteristics of user behavior, the key behavioral features are divided into multiple time windows. For example, key behavioral features can be segmented into time periods of 5 minutes, 1 hour, or 1 day. Specific processing methods include: for short-term anomaly detection, using a smaller time window (e.g., 5 minutes) to capture rapidly changing behaviors; for long-term behavior analysis, using a larger time window (e.g., 1 hour or 1 day) to detect periodic or gradually evolving anomalies. Non-numerical data such as operation type (login, query, file transfer, etc.) and target resources (database, server, etc.) are encoded and converted to obtain numerical features. Specifically, one-hot encoding or embedding encoding (such as Word2Vec or BERT) techniques can be used. Numerical features such as data size, port number, and time interval are normalized to a range of 0 to 1. For example, operation time normalization can be achieved by converting the timestamp to a relative time within a day (seconds / 86400). This invention employs Min-Max normalization technology to standardize data, eliminating differences between data from different dimensions. The Min-Max normalization formula is as follows.

[0166]

[0167] In the formula, x is the original data, x' is the normalized data, and min(x) and max(x) are the minimum and maximum values ​​of the original data, respectively.

[0168] Furthermore, the time interval between adjacent operations is calculated, and logarithmic transformation or bucketing is used to obtain time interval features to adapt to different time scales. The categorical features, numerical features, and time interval features of each operation are combined into a vector, which serves as a parameter in the time series features. In addition, this invention truncates or pads the time series features of each user behavior to ensure that the sequences input into the deep learning model have a uniform length.

[0169] The user behavior modeling module 603 is used for serial modeling, personalized behavior profile generation, and dynamic model updating.

[0170] In one embodiment, the training steps of the intrusion detection model include:

[0171] Each operational event in the time series features is mapped to a fixed-dimensional embedding space to generate a high-dimensional vector;

[0172] Add time and location information to each operation using location encoding;

[0173] By calculating the attention weight of each operation to other operations, the mutual influence between operations in the time series features is captured;

[0174] Perform a nonlinear transformation on the self-attention output;

[0175] Perform layer normalization and residual connections;

[0176] Capture higher-order time series features by stacking multiple Transformer modules.

[0177] Specifically, this invention uses the Transformer model to analyze the time-series features of user behavior, and the training steps of the intrusion detection model are as follows.

[0178] a. Construct the input time series features by inputting the preprocessed time series feature vector into the Transformer model. Assume a sequence consists of N operation events, each represented as a multi-dimensional feature vector. Example input: A user's 5-minute operation window, including operation time (normalized), operation type (encoding conversion), and access target (encoding conversion) features.

[0179] b. Construct the Transformer model. The Transformer consists of multiple layers and mainly includes the following parts:

[0180] Constructing a Transformer model involves multiple layers, primarily comprising the following parts:

[0181] Input embedding layer: Maps each operation event in the sequence to a fixed-dimensional embedding space to generate a high-dimensional vector representation.

[0182] Positional encoding: Since Transformer does not have built-in order awareness, positional encoding is needed to add time position information to each operation (e.g., using sine and cosine functions to encode position).

[0183] Multi-head self-attention captures the interactions between operations in a sequence by calculating the attention weights of each operation with other operations. This allows us to identify which operations are most relevant to the current operation.

[0184] Feed-Forward Network: Performs non-linear transformations on the self-attention output to enhance the model's expressive power.

[0185] Layer normalization and residual connections: stabilize the training process and accelerate model convergence.

[0186] Stacking multiple Transformers: Higher-order sequence features can be captured by stacking multiple Transformer models (such as 6 or 12 layers).

[0187] In one embodiment, when there is no labeled data, the reconstruction error from unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error from semi-supervised learning combined with cross-entropy loss is used to train the intrusion detection model; and when there is a large amount of labeled data, the cross-entropy loss from supervised learning is used to train the intrusion detection model.

[0188] Specifically, this invention focuses on identifying potential abnormal behaviors and threats. However, in practical applications, labeled abnormal behavior data is usually scarce. Therefore, this invention uses unsupervised learning reconstruction error methods to train intrusion detection models, or semi-supervised learning combined with reconstruction error and cross-entropy methods, or cross-entropy loss methods. The specific training method chosen depends on the characteristics and labeling of the actual data. Specifically, when there is no labeled data, autoencoder reconstruction error is used to detect anomalies. When there is a small amount of labeled data, semi-supervised learning is used, combining reconstruction error and cross-entropy loss for training. When there is a large amount of labeled data, cross-entropy loss is directly used for supervised classification model training.

[0189] This invention generates a behavioral profile for each user through the intrusion detection model; the behavioral profile for each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scanning requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports.

[0190] The abnormal behavior detection module 604 is used for real-time behavior comparison, multi-level abnormal thresholds, and comprehensive multi-dimensional abnormal detection.

[0191] Specifically, this invention monitors the user's current behavior in real time and compares it with the previously generated user behavior profile. Once a significant difference is detected between the user's current behavior and the user's behavior profile (such as accessing sensitive files during abnormal time periods, using abnormal devices, etc.), or if the behavior deviates from the behavior feature threshold, it is determined to be abnormal behavior, and the user's current behavior is marked as a potential threat behavior.

[0192] The Response and Alarm Module 605 is used to generate different alarms based on low-level threats, medium-level threats, and high-level threats.

[0193] Specifically, this invention also sets different alarm modes and corresponding response measures based on the difference between the user's current behavior and the deviation value of the user's behavior profile and the intrusion detection threshold. Different difference ranges represent different threat levels, and different threat levels require different response measures, such as sending alarms, blocking access, and increasing security verification requirements. This invention also designs a multi-layered anomaly threshold mechanism, setting different thresholds according to the risk level of the operation. For example, frequent access to database tables may only trigger low-level alarms, while modifying sensitive files or transmitting large amounts of data externally will trigger high-level alarms. This invention comprehensively considers multiple dimensions of behavior, such as time, space, and operation frequency, to ensure that potential attack behaviors can be detected comprehensively. For example, if a user suddenly accesses a local device from a different geographical location and performs high-risk operations, this invention will immediately mark them as high-risk. When abnormal behavior is identified, appropriate response measures will be taken according to the threat level. For example, when a low-level threat is identified, i.e., abnormal operation frequency but no sensitive data leakage, this invention will send an alarm to the administrator and suggest further investigation. When identified as a medium-level threat—that is, access to sensitive files without external transmission—this invention will restrict certain user operation permissions and require the user to perform additional authentication. When identified as an advanced threat—that is, signs of a large-scale data breach or internal attack are detected—this invention will immediately block the user's operation permissions, forcibly log the user out, and simultaneously trigger a comprehensive security audit.

[0194] The self-learning and model update module 606 is used to implement the self-learning and dynamic updating of the model.

[0195] Specifically, this invention also incorporates a self-learning mechanism that dynamically updates the intrusion detection model based on the user's latest behavioral data. This mechanism enables the invention to maintain high detection efficiency even when faced with natural changes in user behavior, avoiding false positives or false negatives caused by behavioral changes. Whenever new user operation data is collected, the invention periodically retrains the intrusion detection model to ensure that it remains consistent with the user's latest behavioral patterns.

[0196] Compared to traditional intrusion detection systems that rely on a single data source (such as network traffic), this invention utilizes multi-source data (such as system logs, network behavior, and file access) to comprehensively analyze user behavior, significantly improving the accuracy and comprehensiveness of detection. This invention generates personalized behavioral profiles for each user and performs fine-grained modeling of user behavior based on a large model, effectively detecting abnormal operations that deviate from individual behavioral patterns, making it particularly suitable for internal threat detection. Through a self-learning mechanism, this invention can dynamically update the intrusion detection model as user behavior changes daily, ensuring the continuous effectiveness of the model's detection capabilities and avoiding false positives and false negatives caused by model aging in traditional intrusion detection systems. This invention also designs response mechanisms for different threat levels, enabling flexible security measures based on different risk scenarios.

[0197] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the methods described above.

[0198] like Figure 7 The diagram shown is a schematic representation of the physical structure of a computer device according to an embodiment of the present invention. The computer device 007 includes a processor 701, a memory 702, and a bus 703. The processor 701 and the memory 702 communicate with each other via the bus 703.

[0199] The processor 701 is used to call program instructions in the memory 702 to execute the methods provided in the above-described method embodiments.

[0200] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements any of the methods described above.

[0201] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements any of the methods described above.

[0202] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0203] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0204] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0205] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0206] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A large-scale intrusion detection method based on user behavior data, characterized in that, include: The system collects users' daily behavior data from several data sources, including: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records. Feature extraction and normalization preprocessing are performed on the user's daily behavior data; Based on the preprocessed data, an intrusion detection model is obtained by using the Transformer model for serialization modeling. The intrusion detection model generates a behavioral profile for each user. The behavioral profile of each user is used to identify whether each user’s device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scanning requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports. When a user's behavior to be detected does not match the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold, an intrusion detection alarm will be issued. The feature extraction and normalization preprocessing of the user's daily behavior data includes: The user's daily behavior data is divided into several time windows according to time periods to obtain time series features; Numerical features are obtained by encoding and converting the non-numerical data in the user's daily behavior data. Normalize all numerical features; Calculate the time interval between adjacent actions and perform a logarithmic transformation to obtain the time interval feature; The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data.

2. The method as described in claim 1, characterized in that, The training steps for the intrusion detection model include: Each operational event in the time series features is mapped to a fixed-dimensional embedding space to generate a high-dimensional vector; Add time and location information to each operation using location encoding; By calculating the attention weight of each operation to other operations, the mutual influence between operations in the time series features is captured; Perform a nonlinear transformation on the self-attention output; Perform layer normalization and residual connections; Capture higher-order time series features by stacking multiple Transformer modules.

3. The method as described in claim 1, characterized in that, When there is no labeled data, the reconstruction error from unsupervised learning is used to train the intrusion detection model; when there is a small amount of labeled data, the reconstruction error from semi-supervised learning combined with cross-entropy loss is used to train the intrusion detection model; when there is a large amount of labeled data, the cross-entropy loss from supervised learning is used to train the intrusion detection model.

4. The method as described in claim 1, characterized in that, Also includes: Based on the difference between the deviation value and the intrusion detection threshold, different alarm modes are set and corresponding response measures are configured.

5. A large-scale intrusion detection device based on user behavior data, characterized in that, include: The data collection module is used to collect users' daily behavior data from several data sources. The users' daily behavior data includes: user login data and authentication data, system operation logs and file access records, network behavior data, and device usage records. The preprocessing module is used to perform feature extraction and normalization preprocessing on the user's daily behavior data; The modeling module is used to perform serialization modeling using the Transformer model based on the preprocessed data to obtain an intrusion detection model; The behavior profile generation module is used to generate a behavior profile for each user through the intrusion detection model. The behavior profile of each user is used to identify whether each user's device has abnormal website access, abnormal IP connection, abnormal port usage, data transmission exceeding a first preset number, operations exceeding a second preset number during abnormal working hours, network scanning requests exceeding a third preset number, and simultaneous requests to connect to more than a fourth preset number of intranet device ports. The alarm module is used to issue an intrusion detection alarm when a user's behavior to be detected does not match the corresponding user's behavior profile and the deviation value exceeds the intrusion detection threshold. The preprocessing module is specifically used for: The user's daily behavior data is divided into several time windows according to time periods to obtain time series features; Numerical features are obtained by encoding and converting the non-numerical data in the user's daily behavior data. Normalize all numerical features; Calculate the time interval between adjacent actions and perform a logarithmic transformation to obtain the time interval feature; The normalized numerical features and time interval features are combined into a vector and used as a parameter in the time series features to obtain the final preprocessed data.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 4.

8. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 4.

Images