Equipment abnormal access record identification method and device, terminal equipment and storage medium

Abstract

The invention discloses an equipment abnormal access record identification method and device, terminal equipment and a storage medium, and the method comprises the steps: obtaining an access log of target equipment in a target time period, carrying out the feature analysis of an access record in the access log, and generating a plurality of feature sequences; dividing the plurality of feature sequences into a plurality of segmented features, inputting the segmented features into an exception recognition model, so that the exception recognition model recognizes the segmented features to obtain exception scores corresponding to the feature sequences in the segmented features, and according to the exception scores corresponding to the feature sequences in the segmented features, performing exception recognition on the feature sequences according to the exception scores corresponding to the feature sequences in the segmented features. And determining an abnormal condition of the access record corresponding to each feature sequence. According to the invention, the abnormal access record can be accurately positioned.

Description

Technical Field

[0001] The present invention relates to the field of power systems, and in particular to a method, a device, a terminal device and a storage medium for identifying abnormal access records of equipment. Background Art

[0002] As an important trend in the development of modern power systems, the power Internet of Things (IoT) has been widely popularized, and many IoT devices have been integrated into the power system, driving the power grid towards intelligent and automated management. These devices are connected to the power grid system with the help of IoT technology to achieve real-time data collection, transmission and analysis, effectively improving the efficiency and reliability of power grid operation.

[0003] However, the power Internet of Things still faces many technical challenges in its current practical applications, and device access behavior monitoring is one of them. Accurately identifying behavioral data such as device access frequency and access resource type can provide a basis for analyzing abnormal changes in IoT devices. For example, when a server frequently experiences access request timeouts, it is very likely caused by its hardware failure or software vulnerability. However, in the existing technology, there are obvious deficiencies in the real-time evaluation system of device access behavior. At this stage, it is often only possible to rely on manual methods to identify possible abnormal situations in many access records. This mode of manual judgment is inefficient. When faced with a large amount of complex data, it is difficult to quickly and accurately discover the hidden abnormal information, which makes it difficult to detect abnormal behavior of the device in time. This undoubtedly brings huge security risks to the power Internet of Things system, seriously threatening the stability and safe operation of the power grid system and the confidentiality and integrity of user data. Summary of the invention

[0004] The present invention provides a method, apparatus, terminal device and storage medium for identifying abnormal access records of a device. The method effectively improves the accuracy of abnormality identification and reduces the risk of misjudgment and missed judgment, thereby more accurately locating access records that may have problems.

[0005] An embodiment of the present invention provides a method for identifying abnormal access records of a device, comprising:

[0006] Obtaining an access log of a target device within a target time period; wherein the access log includes a plurality of access records; the data type of the data recorded in each access record includes a device number, access time, access resource, and access type;

[0007] Serializing the access records to obtain time series corresponding to each access record, and sorting the time series according to the access time recorded in each access record;

[0008] According to the preset time step, the sorted time series is divided into several subsequence sets;

[0009] Performing feature analysis on each of the subsequence sets respectively to obtain a feature sequence corresponding to each of the subsequence sets;

[0010] Combining the feature sequences into a feature sequence set, and traversing the feature sequence set based on a pre-constructed sliding window to obtain a plurality of segment features;

[0011] The segmented features are input into an anomaly recognition model so that the anomaly recognition model recognizes the segmented features and obtains anomaly scores corresponding to each feature sequence in the segmented features; wherein the anomaly recognition model is obtained after training by taking a number of historical segmented features and label anomaly scores corresponding to each historical feature sequence in the historical segmented features as inputs and taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmented features as outputs;

[0012] According to the abnormality scores corresponding to each feature sequence in the segmented features, the abnormality of the access record corresponding to each feature sequence is determined.

[0013] Furthermore, the construction process of the anomaly recognition model includes:

[0014] Obtaining a historical access log sample set; wherein the historical access log sample set includes a number of historical access records;

[0015] Serializing the historical access records to obtain a historical time series corresponding to each historical access record;

[0016] According to the time step, the historical time series is divided into a plurality of historical subsequence sets, and feature analysis is performed on each of the historical subsequence sets to obtain a historical feature sequence corresponding to each of the historical subsequence sets;

[0017] For each of the historical feature sequences, determine a label anomaly score corresponding to the historical feature sequence according to the total number of historical accesses, the proportion of historical access types, the historical resource access frequency, and the mean of the historical access intervals in the historical feature sequence;

[0018] Combining the historical feature sequences into a historical feature sequence set, and traversing the historical feature sequence set based on the sliding window to obtain a plurality of historical segment features;

[0019] Constructing a double-layer LSTM model, taking the historical segmentation feature and the label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input, taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output, and iteratively training the double-layer LSTM model until the loss function value of the double-layer LSTM model converges;

[0020] The trained double-layer LSTM model is used as the anomaly recognition model;

[0021] In each training process, the predicted anomaly score obtained by the current two-layer LSTM model is compared with the corresponding label anomaly score, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges.

[0022] If yes, stop training and get the two-layer LSTM model after training.

[0023] If not, adjust the weight value of the current two-layer LSTM model to obtain a two-layer LSTM model for the next iterative training.

[0024] Furthermore, the serialization process of the historical access records to obtain the historical time series corresponding to each historical access record includes:

[0025] According to a preset time conversion rule, the historical access time corresponding to the historical access record is standardized to obtain a standardized historical access time;

[0026] According to a preset access resource mapping rule table, encoding the historical access resources in the historical access records to obtain encoded historical access resources;

[0027] According to a preset access type mapping rule table, encoding the historical access type in the historical access record to obtain the encoded historical access type;

[0028] According to a preset format conversion rule, the device ID in the historical access record is standardized to obtain a standardized device ID;

[0029] A time series corresponding to each of the historical access records is generated according to the standardized historical access time, the encoded historical access resource, the encoded historical access type, and the standardized device ID.

[0030] Furthermore, the historical time series is divided into a plurality of historical subsequence sets according to the time step, and feature analysis is performed on each of the historical subsequence sets to obtain a historical feature sequence corresponding to each of the historical subsequence sets, including:

[0031] Sorting the historical time series according to the standardized historical access time to obtain a historical time series set arranged in order of historical access time;

[0032] According to the time step, the historical time series in the historical time series set is divided into a plurality of historical subsequence sets;

[0033] For each of the historical subsequence sets, feature analysis is performed on all device IDs, historical access times, historical access resources, and historical access types in the historical subsequence set to obtain a historical feature sequence corresponding to the historical subsequence set; wherein the historical feature sequence includes the total number of historical accesses, the proportion of historical access types, the historical resource access frequency, and the mean of historical access intervals.

[0034] Furthermore, the historical feature sequences are combined into a historical feature sequence set, and based on the sliding window, the historical feature sequence set is traversed to obtain a number of historical segment features, including:

[0035] Combining the historical feature sequences corresponding to each historical subsequence set into a feature sequence set;

[0036] Initialize the sliding window so that the initial position of the sliding window coincides with the initial position of the historical feature sequence set; wherein the window size of the sliding window is M; M is a positive integer;

[0037] The sliding window is moved according to a preset sliding window step length until the historical feature sequence set is traversed to obtain a number of historical segment features; wherein, when the sliding window completes a movement according to the sliding window step length, a historical segment feature is generated.

[0038] Furthermore, the method for identifying abnormal device access records further includes:

[0039] Accumulating the anomaly scores corresponding to each feature sequence in the segmented features to obtain an accumulated anomaly score;

[0040] The accumulated anomaly score is matched with a preset permission allocation mapping table, and the permission of the target device is adjusted according to the matching result.

[0041] An embodiment of the present invention further provides a device abnormal access record identification device, comprising: an access log acquisition module, an access record processing module, a time series processing module, a feature sequence generation module, a segment feature generation module, an abnormal score determination module, and an abnormal situation determination module;

[0042] The access log acquisition module is used to acquire the access log of the target device within the target time period; wherein the access log includes a plurality of access records; the data type of the data recorded in each access record includes the device number, access time, access resource and access type;

[0043] The access record processing module is used to serialize the access records to obtain a time series corresponding to each access record, and sort the time series according to the access time recorded in each access record;

[0044] The time series processing module is used to divide the sorted time series into a plurality of subsequence sets according to a preset time step;

[0045] The feature sequence generation module is used to perform feature analysis on each of the subsequence sets to obtain a feature sequence corresponding to each of the subsequence sets;

[0046] The segment feature generation module is used to combine the feature sequences into a feature sequence set, and traverse the feature sequence set based on a pre-built sliding window to obtain a number of segment features;

[0047] The anomaly score determination module is used to input the segmentation feature into the anomaly recognition model so that the anomaly recognition model recognizes the segmentation feature and obtains the anomaly score corresponding to each feature sequence in the segmentation feature; wherein the anomaly recognition model is obtained after training by taking a number of historical segmentation features and the label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input and taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output;

[0048] The abnormality determination module is used to determine the abnormality of the access record corresponding to each feature sequence according to the abnormality scores corresponding to each feature sequence in the segmented features.

[0049] Furthermore, the device abnormal access record identification apparatus further includes: a permission adjustment module;

[0050] The permission adjustment module is used to accumulate the anomaly scores corresponding to each feature sequence in the segmented feature to obtain an accumulated anomaly score; match the accumulated anomaly score with a preset permission allocation mapping table, and adjust the permission of the target device according to the matching result.

[0051] The present application also provides a terminal device, including:

[0052] one or more processors;

[0053] A memory, coupled to the processor, for storing one or more programs;

[0054] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for identifying abnormal device access records as described in the above-mentioned embodiment of the invention.

[0055] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for identifying abnormal device access records as described in the above-mentioned embodiment of the invention is implemented.

[0056] The following beneficial effects are achieved by implementing the present invention:

[0057] The present invention provides a method, device, terminal device and storage medium for identifying abnormal access records of equipment. The method processes the access records in a serialized manner to ensure that each access event is recorded and arranged in chronological order, thereby forming a continuous time series, which helps to maintain the integrity and continuity of the data and provides a reliable basis for subsequent analysis; then the time series is divided into a number of subsequence sets according to a preset time step, and feature analysis is performed on each subsequence set to extract the deep-level features of the equipment access behavior, such as access frequency and access resource type distribution, so as to more accurately understand the equipment access behavior; the feature sequence set is traversed through a pre-constructed sliding window to generate a number of segmented features, and the features are input into the abnormal access record. A common recognition model is used to enable the anomaly recognition model to analyze the feature relationship between feature sequences in each segmented feature, thereby deriving the anomaly score corresponding to each feature sequence in each segmented feature, and then determining whether the access record corresponding to each feature sequence has an anomaly based on these anomaly scores; in the process of recognition by the anomaly recognition model, the anomaly recognition model focuses on the key feature relationship within each segmented feature, and because the segmented features have a strong temporal correlation, during the processing, it is possible to avoid data with weak correlation or interference in long sequences without having to process them, which not only effectively improves the accuracy of anomaly recognition, but also reduces the risk of misjudgment and missed judgment, so that access records that may have problems can be more accurately located. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the implementation manner will be briefly introduced below. Obviously, the drawings described below are only some implementation manners of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 It is a flowchart of a method for identifying abnormal access records of a device provided in a certain embodiment of the present application;

[0060] Figure 2 It is a structural diagram of a device abnormal access record identification device provided by a certain embodiment of the present application;

[0061] Figure 3 It is a structural diagram of a device abnormal access record identification device provided by another embodiment of the present application;

[0062] Figure 4 It is a structural diagram of a terminal device provided in a certain embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0065] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0066] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0067] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0068] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0069] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0070] See also Figure 1 , is a flow chart of a method for identifying abnormal access records of a device provided by an embodiment of the present invention, comprising:

[0071] S1. Obtaining an access log of a target device within a target time period; wherein the access log includes a plurality of access records; the data type of the data recorded in each access record includes a device number, access time, access resource, and access type;

[0072] Specifically, assuming that the device currently to be identified is target device A, and the target time period is 4pm to 5pm on a certain day, then first, it is necessary to obtain the access log of target device A from 4pm to 5pm on that day, where the access log contains multiple access records, each of which includes the device number, access time, access resource, and access type.

[0073] S2, serializing the access records to obtain a time series corresponding to each access record, and sorting the time series according to the access time recorded in each access record;

[0074] Indicatively, the access time is standardized according to a preset time conversion rule to obtain a standardized historical access time;

[0075] Specifically, the access time in each access record is uniformly converted into a standard time format. The time conversion rule may be a Unix timestamp format, and the time conversion rule is not limited here;

[0076] In an illustrative manner, according to a preset access resource mapping rule table, the access resource in the access record is encoded to obtain the encoded access resource;

[0077] Specifically, the access resources accessed by IoT devices may include files, databases, APIs, network services, etc. Therefore, for standardization, the access resources in the access records can be encoded with specific values. For example: (1) When the access resource recorded in an access record is a file system, the recorded file system is mapped to the number 1; (2) When the access resource recorded in an access record is a database, the recorded database is mapped to the number 2; (3) When the access resource recorded in an access record is an API, the recorded API is mapped to the number 3; (4) When the access resource recorded in an access record is a network service, the recorded network service is mapped to the number 4; (5) When the access resource recorded in an access record is sensor data, the recorded sensor data is mapped to the number 5;

[0078] It should be noted that the access resource mapping rule table can be set according to actual needs, and the encoding rules can also be set according to actual needs. This application does not specifically limit this.

[0079] Indicatively, according to a preset access type mapping rule table, the access type in the access record is encoded to obtain an encoded access type;

[0080] Specifically, when an IoT device is accessed, the access type can be operations such as read, write, update, delete, and execute. Therefore, for standardization, the access type in the access record can be encoded with a specific value. For example: (1) When the access type recorded in an access record is read, the recorded read is mapped to the number 11; (2) When the access type recorded in an access record is write, the recorded write is mapped to the number 22; (3) When the access type recorded in an access record is update, the recorded update is mapped to the number 33; (4) When the access type recorded in an access record is delete, the recorded delete is mapped to the number 44; (5) When the access type recorded in an access record is execute, the recorded execution is mapped to the number 55;

[0081] It should be noted that the access type mapping rule table can be set according to actual needs, and the encoding rules can also be set according to actual needs. This application does not specifically limit this.

[0082] Indicatively, the device ID in the access record is standardized according to a preset format conversion rule to obtain a standardized device ID;

[0083] Specifically, ensure that the device IDs in the access records are in a unified format, such as converting all to lowercase / uppercase, removing extra spaces and special characters, mapping to digital identifiers, etc.; for example, unify the format of the device ID according to the set format conversion rules;

[0084] Specifically, a time series corresponding to each access record is generated based on the standardized access time, the encoded access resource, the encoded access type and the standardized device ID. Then, in order to ensure the continuity of the time series, it is necessary to sort the time series according to the access time recorded in each access record so that the access time of the sorted time series is continuous.

[0085] S3, dividing the sorted time series into a number of subsequence sets according to a preset time step;

[0086] Schematically, the time step determines the granularity of the time series; therefore, the time step needs to be determined first; the time step can be set to every minute, every hour, every day, etc.

[0087] Specifically, assuming that the current time step is set to every 5 minutes, the access time corresponding to the first time series in the sorted time series is taken as the starting point, and all time series within 5 minutes after the starting point are classified into a subsequence set, and so on, thereby dividing the sorted time series into several subsequence sets.

[0088] S4, performing feature analysis on each of the subsequence sets respectively to obtain a feature sequence corresponding to each of the subsequence sets;

[0089] Specifically, the time series in each subsequence set are analyzed for features, including the total number of accesses, the proportion of access types, the resource access frequency, and the mean access interval;

[0090] Assuming that the current subsequence set set1 includes three time series, it means that the total number of visits is 3;

[0091] Next, assume that the first time series in the subsequence set set1 has a recorded access time of 16:02:01 on November 29, 2024, an access type of delete, and an access resource of the file system; assume that the second time series in the subsequence set set1 has a recorded access time of 16:03:05 on November 29, 2024, an access type of write, and an access resource of the file system; assume that the third time series in the subsequence set set1 has a recorded access time of 16:04:18 on November 29, 2024, an access type of update, and an access resource of the file system;

[0092] Then, based on the contents recorded in each time series in the subsequence set set1, the access type ratio, resource access frequency and access interval mean will be analyzed:

[0093] (1) Since the access types in the subsequence set set1 are delete, write, and update, and the delete mapping is 44, the write mapping is 22, and the update mapping is 33, then the value of the access type ratio is (44+22+33) / 3=66;

[0094] (2) Since the access resources in the subsequence set set1 are file system, file system, and file system, respectively, and the file system is mapped to the number 1, the access frequency of the "file system" resource is (1+1+1) / 3=1;

[0095] (3) Since the mean access intervals in the subsequence set set1 are 64 and 73 respectively, the mean access interval of the subsequence set set1 is 68.5;

[0096] Therefore, the characteristic sequence of the subsequence set set1 is [3, 66, 1, 68.5], and so on, so as to obtain the characteristic sequence corresponding to each of the subsequence sets.

[0097] S5, combining the feature sequences into a feature sequence set, and traversing the feature sequence set based on a pre-constructed sliding window to obtain a plurality of segment features;

[0098] Specifically, assuming that five feature sequences are obtained in step S4, the feature sequences are combined into a feature sequence set: [

[0100] [3,66,1,68.5],

[0101] [4,33,3,56],

[0102] [8,38.5,2.5,43],

[0103] [12,27.5,4.2,34],

[0104] [10,35,3.6,41] ]

[0106] Then, a sliding window is constructed, and the window size of the sliding window is M. Assuming that the current M=3, and the sliding window step size of the sliding window is 1, then for the combined feature sequence set, 3 segment features will be obtained. Specifically, each segment feature is as follows:

[0107] The first segment feature:

[0108] [[3,66,1,68.5],

[0109] [4,33,3,56],

[0110] [8,38.5,2.5,43]]

[0111] The second segmentation feature:

[0112] [[4,33,3,56],

[0113] [8,38.5,2.5,43],

[0114] [12,27.5,4.2,34]]

[0115] The third segmentation feature:

[0116] [[8,38.5,2.5,43],

[0117] [12,27.5,4.2,34],

[0118] [10,35,3.6,41]].

[0119] S6. Input the segmentation feature into an anomaly recognition model so that the anomaly recognition model recognizes the segmentation feature and obtains an anomaly score corresponding to each feature sequence in the segmentation feature; wherein the anomaly recognition model is obtained after training by taking a number of historical segmentation features and label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input and taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output;

[0120] Specifically, after obtaining a plurality of segment features in step S5, the segment features are input into the anomaly recognition model in the form of a data shape of (3, 3, 4), so that the anomaly recognition model recognizes the segment features and obtains anomaly scores corresponding to each feature sequence in the segment features;

[0121] S7, determining the abnormality of the access record corresponding to each feature sequence according to the abnormality score corresponding to each feature sequence in the segmented feature;

[0122] Specifically, according to the size of the anomaly score corresponding to each feature sequence in the segmented feature, the abnormal situation of the access record corresponding to each feature sequence is determined. For example, an abnormal range can be set. When the anomaly score falls into the abnormal range, the abnormal situation of the access record corresponding to the anomaly score is determined to be abnormal.

[0123] In a preferred embodiment, the method for identifying abnormal device access records further includes:

[0124] Accumulating the anomaly scores corresponding to each feature sequence in the segmented features to obtain an accumulated anomaly score;

[0125] Matching the accumulated anomaly score with a preset permission allocation mapping table, and adjusting the permission of the target device according to the matching result;

[0126] Specifically, the anomaly scores corresponding to each feature sequence within the segmented feature are accumulated one by one to obtain an accumulated anomaly score value, and then the accumulated anomaly score is compared and matched with a pre-set permission allocation mapping table, and the permissions of the target device are adjusted accordingly based on the matching results.

[0127] In a preferred embodiment, the process of constructing the abnormality recognition model includes:

[0128] Obtaining a historical access log sample set; wherein the historical access log sample set includes a number of historical access records;

[0129] Serializing the historical access records to obtain a historical time series corresponding to each historical access record;

[0130] According to the time step, the historical time series is divided into a plurality of historical subsequence sets, and feature analysis is performed on each of the historical subsequence sets to obtain a historical feature sequence corresponding to each of the historical subsequence sets;

[0131] For each of the historical feature sequences, determine a label anomaly score corresponding to the historical feature sequence according to the total number of historical accesses, the proportion of historical access types, the historical resource access frequency, and the mean of the historical access intervals in the historical feature sequence;

[0132] Combining the historical feature sequences into a historical feature sequence set, and traversing the historical feature sequence set based on the sliding window to obtain a plurality of historical segment features;

[0133] Constructing a double-layer LSTM model, taking the historical segmentation feature and the label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input, taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output, and iteratively training the double-layer LSTM model until the loss function value of the double-layer LSTM model converges;

[0134] The trained double-layer LSTM model is used as the anomaly recognition model;

[0135] In each training process, the predicted anomaly score obtained by the current two-layer LSTM model is compared with the corresponding label anomaly score, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges.

[0136] If yes, stop training and get the two-layer LSTM model after training.

[0137] If not, adjust the weight value of the current two-layer LSTM model to obtain a two-layer LSTM model for the next iterative training;

[0138] Specifically, the constructed two-layer LSTM model includes a first-layer LSTM model and a second-layer LSTM model;

[0139] The first LSTM model is used for preliminary detection, including: a first input layer, a first LSTM, a first Dropout layer, a second LSTM, a second Dropout layer and a first fully connected layer of time distribution;

[0140] The first input layer is used to obtain historical segmentation features with a data shape of (3,3,4); the first LSTM contains 64 units, return_sequences=True, and is used to output the hidden state of each historical feature sequence; the Dropout rate of the first Dropout layer is set to 0.2; the second LSTM contains 32 units, return_sequences=True, and is used to output the hidden state of each historical feature sequence; the Dropout rate of the second Dropout layer is set to 0.2; the first fully connected layer of the time distribution contains one unit, the activation function is Sigmoid, and is used to output the initial label anomaly score;

[0141] The second-layer LSTM model is used for fine-grained detection, including: a second input layer, a third LSTM, a third Dropout layer, a fourth LSTM, a fourth Dropout layer, a fully connected layer and a second fully connected layer of time distribution; the second input layer is used to obtain the abnormal historical segmentation features detected by the first-layer LSTM model; the third LSTM contains 128 units, return_sequences=True, and is used to output the hidden state of each historical feature sequence; the Dropout rate of the third Dropout layer is set to 0.3; the fourth LSTM contains 64 units, return_sequences=True, and is used to output the hidden state of each historical feature sequence; the Dropout rate of the fourth Dropout layer is set to 0.3; the fully connected layer contains 32 units, the activation function is ReLU, and the Dropout rate of the Dropout layer is set to 0.2; the second fully connected layer of time distribution contains 1 unit, the activation function is Sigmoid, and is used to output the label anomaly score;

[0142] Specifically, the error function of the first layer LSTM model is:

[0143]

[0144] Where: Loss1 represents the error of the first layer LSTM model; Represents the predicted value of the first layer LSTM model; y 1,i Represents the true value corresponding to the input data of the first-layer LSTM model; N represents the total number of input data of the first-layer LSTM model;

[0145] Specifically, the error function of the second layer LSTM model is:

[0146]

[0147] Where: Loss2 represents the error of the second layer LSTM model; Represents the predicted value of the second layer LSTM model; y 2,i Represents the true value corresponding to the input data of the second-layer LSTM model; M represents the number of input data of the second-layer LSTM model; λ represents the adjustment coefficient;

[0148] Then, based on the error function of the first layer LSTM model and the error function of the second layer LSTM model, a total loss function is constructed:

[0149] Total Loss=α·Loss1+β·Loss2;

[0150] Where: α and β represent adjustment weights, α+β=1;

[0151] Specifically, in each training process, the predicted anomaly score predicted by the current double-layer LSTM model is compared with the corresponding label anomaly score, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the double-layer LSTM model after the training is completed, if not, the weight value in the total loss function of the current double-layer LSTM model is adjusted to obtain the double-layer LSTM model for the next iterative training.

[0152] In a preferred embodiment, the serializing the historical access records to obtain the historical time series corresponding to each historical access record includes:

[0153] According to a preset time conversion rule, the historical access time corresponding to the historical access record is standardized to obtain a standardized historical access time;

[0154] According to a preset access resource mapping rule table, encoding the historical access resources in the historical access records to obtain encoded historical access resources;

[0155] According to a preset access type mapping rule table, encoding the historical access type in the historical access record to obtain the encoded historical access type;

[0156] According to a preset format conversion rule, the device ID in the historical access record is standardized to obtain a standardized device ID;

[0157] Generate a time series corresponding to each of the historical access records according to the standardized historical access time, the encoded historical access resource, the encoded historical access type, and the standardized device ID;

[0158] Specifically, during the training process of the anomaly recognition model, the serialization processing of the historical access records is consistent with the processing process described in step S2. The only difference is that the input data (data to be processed) is different, so it will not be repeated.

[0159] In a preferred embodiment, the historical time series is divided into a plurality of historical subsequence sets according to the time step, and feature analysis is performed on each of the historical subsequence sets to obtain a historical feature sequence corresponding to each of the historical subsequence sets, including:

[0160] Sorting the historical time series according to the standardized historical access time to obtain a historical time series set arranged in order of historical access time;

[0161] According to the time step, the historical time series in the historical time series set is divided into a plurality of historical subsequence sets;

[0162] For each of the historical subsequence sets, feature analysis is performed on all device IDs, historical access times, historical access resources, and historical access types in the historical subsequence set to obtain a historical feature sequence corresponding to the historical subsequence set; wherein the historical feature sequence includes the total number of historical accesses, the proportion of historical access types, the historical resource access frequency, and the mean of historical access intervals;

[0163] Specifically, during the training of the anomaly recognition model, the feature analysis process is consistent with the processing process described in step S3 to step S4, the only difference is that the input data (data to be processed) is different, so it will not be repeated.

[0164] In a preferred embodiment, the historical feature sequences are combined into a historical feature sequence set, and based on the sliding window, the historical feature sequence set is traversed to obtain a number of historical segment features, including:

[0165] Combining the historical feature sequences corresponding to each historical subsequence set into a feature sequence set;

[0166] Initialize the sliding window so that the initial position of the sliding window coincides with the initial position of the historical feature sequence set; wherein the window size of the sliding window is M; M is a positive integer;

[0167] According to a preset sliding window step length, the sliding window is moved until the historical feature sequence set is traversed to obtain a plurality of historical segment features; wherein, when the sliding window completes a movement according to the sliding window step length, a historical segment feature is generated;

[0168] Specifically, during the training of the anomaly recognition model, the process of determining the segmented features is consistent with the processing process described in step S5, the only difference being that the input data (data to be processed) is different, and thus it will not be described in detail.

[0169] See also Figure 2 , is a device abnormal access record identification device provided by an embodiment of the present invention, comprising: an access log acquisition module, an access record processing module, a time series processing module, a feature sequence generation module, a segment feature generation module, an abnormal score determination module and an abnormal situation determination module;

[0170] The access log acquisition module is used to acquire the access log of the target device within the target time period; wherein the access log includes a plurality of access records; the data type of the data recorded in each access record includes the device number, access time, access resource and access type;

[0171] The access record processing module is used to serialize the access records to obtain a time series corresponding to each access record, and sort the time series according to the access time recorded in each access record;

[0172] The time series processing module is used to divide the sorted time series into a plurality of subsequence sets according to a preset time step;

[0173] The feature sequence generation module is used to perform feature analysis on each of the subsequence sets to obtain a feature sequence corresponding to each of the subsequence sets;

[0174] The segment feature generation module is used to combine the feature sequences into a feature sequence set, and traverse the feature sequence set based on a pre-built sliding window to obtain a number of segment features;

[0175] The anomaly score determination module is used to input the segmentation feature into the anomaly recognition model so that the anomaly recognition model recognizes the segmentation feature and obtains the anomaly score corresponding to each feature sequence in the segmentation feature; wherein the anomaly recognition model is obtained after training by taking a number of historical segmentation features and the label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input and taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output;

[0176] The abnormality determination module is used to determine the abnormality of the access record corresponding to each feature sequence according to the abnormality scores corresponding to each feature sequence in the segmented features.

[0177] See also Figure 3 ,In a preferred embodiment, the device abnormal access record identification apparatus further includes: a permission adjustment module;

[0178] The permission adjustment module is used to accumulate the anomaly scores corresponding to each feature sequence in the segmented feature to obtain an accumulated anomaly score; match the accumulated anomaly score with a preset permission allocation mapping table, and adjust the permission of the target device according to the matching result.

[0179] See also Figure 4 , a certain embodiment of the present application further provides a terminal device, including:

[0180] one or more processors;

[0181] A memory, coupled to the processor, for storing one or more programs;

[0182] When the one or more programs are executed by the one or more processors, the one or more processors implement the device abnormal access record identification method as described above.

[0183] The processor is used to control the overall operation of the terminal device to complete all or part of the steps of the above-mentioned device abnormal access record identification method. The memory is used to store various types of data to support the operation of the terminal device, and these data may include, for example, instructions for any application or method used to operate on the terminal device, and application-related data. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0184] In an exemplary embodiment, the terminal device can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the device abnormal access record identification method as described in any of the above embodiments and achieve the technical effect consistent with the above method.

[0185] In another exemplary embodiment, a computer-readable storage medium including a computer program is also provided, and when the computer program is executed by a processor, the steps of the device abnormal access record identification method as described in any of the above embodiments are implemented. For example, the computer-readable storage medium can be the above-mentioned memory including the computer program, and the above-mentioned computer program can be executed by the processor of the terminal device to complete the device abnormal access record identification method as described in any of the above embodiments, and achieve the technical effect consistent with the above method.

[0186] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal access records of a device, characterized in that: include: Obtaining an access log of a target device within a target time period; wherein the access log includes a plurality of access records; the data type of the data recorded in each access record includes a device number, access time, access resource, and access type; Serializing the access records to obtain time series corresponding to each access record, and sorting the time series according to the access time recorded in each access record; According to the preset time step, the sorted time series is divided into several subsequence sets; Performing feature analysis on each of the subsequence sets respectively to obtain a feature sequence corresponding to each of the subsequence sets; Combining the feature sequences into a feature sequence set, and traversing the feature sequence set based on a pre-constructed sliding window to obtain a plurality of segment features; The segmented features are input into an anomaly recognition model so that the anomaly recognition model recognizes the segmented features and obtains anomaly scores corresponding to each feature sequence in the segmented features; wherein the anomaly recognition model is obtained after training by taking a number of historical segmented features and label anomaly scores corresponding to each historical feature sequence in the historical segmented features as inputs and taking predicted anomaly scores corresponding to each historical feature sequence in the historical segmented features as outputs; According to the abnormality scores corresponding to each feature sequence in the segmented features, the abnormality of the access record corresponding to each feature sequence is determined.

2. The method for identifying abnormal device access records according to claim 1, characterized in that: The construction process of the anomaly recognition model includes: Obtaining a historical access log sample set; wherein the historical access log sample set includes a number of historical access records; Serializing the historical access records to obtain a historical time series corresponding to each historical access record; According to the time step, the historical time series is divided into a plurality of historical subsequence sets, and feature analysis is performed on each of the historical subsequence sets to obtain a historical feature sequence corresponding to each of the historical subsequence sets; For each of the historical feature sequences, determine a label anomaly score corresponding to the historical feature sequence according to the total number of historical accesses, the proportion of historical access types, the historical resource access frequency, and the mean of the historical access intervals in the historical feature sequence; Combining the historical feature sequences into a historical feature sequence set, and traversing the historical feature sequence set based on the sliding window to obtain a plurality of historical segment features; Constructing a double-layer LSTM model, taking the historical segmentation feature and the label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input, taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output, and iteratively training the double-layer LSTM model until the loss function value of the double-layer LSTM model converges; The trained double-layer LSTM model is used as the anomaly recognition model; In each training process, the predicted anomaly score obtained by the current two-layer LSTM model is compared with the corresponding label anomaly score, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges. If yes, stop training and get the two-layer LSTM model after training. If not, adjust the weight value of the current two-layer LSTM model to obtain a two-layer LSTM model for the next iterative training.

3. The method for identifying abnormal device access records according to claim 2, characterized in that: The serializing the historical access records to obtain a historical time series corresponding to each historical access record includes: According to a preset time conversion rule, the historical access time corresponding to the historical access record is standardized to obtain a standardized historical access time; According to a preset access resource mapping rule table, encoding the historical access resources in the historical access records to obtain encoded historical access resources; According to a preset access type mapping rule table, encoding the historical access type in the historical access record to obtain the encoded historical access type; According to a preset format conversion rule, the device ID in the historical access record is standardized to obtain a standardized device ID; A time series corresponding to each of the historical access records is generated according to the standardized historical access time, the encoded historical access resource, the encoded historical access type, and the standardized device ID.

4. The method for identifying abnormal device access records according to claim 3, characterized in that: The historical time series is divided into a plurality of historical subsequence sets according to the time step, and feature analysis is performed on each of the historical subsequence sets to obtain a historical feature sequence corresponding to each of the historical subsequence sets, including: Sorting the historical time series according to the standardized historical access time to obtain a historical time series set arranged in order of historical access time; According to the time step, the historical time series in the historical time series set is divided into a plurality of historical subsequence sets; For each of the historical subsequence sets, feature analysis is performed on all device IDs, historical access times, historical access resources, and historical access types in the historical subsequence set to obtain a historical feature sequence corresponding to the historical subsequence set; wherein the historical feature sequence includes the total number of historical accesses, the proportion of historical access types, the historical resource access frequency, and the mean of historical access intervals.

5. The method for identifying abnormal device access records according to claim 4, characterized in that: The historical feature sequences are combined into a historical feature sequence set, and based on the sliding window, the historical feature sequence set is traversed to obtain a number of historical segment features, including: Combining the historical feature sequences corresponding to each historical subsequence set into a feature sequence set; Initialize the sliding window so that the initial position of the sliding window coincides with the initial position of the historical feature sequence set; wherein the window size of the sliding window is M; M is a positive integer; The sliding window is moved according to a preset sliding window step length until the historical feature sequence set is traversed to obtain a number of historical segment features; wherein, when the sliding window completes a movement according to the sliding window step length, a historical segment feature is generated.

6. The method for identifying abnormal device access records according to claim 1, characterized in that: Also includes: Accumulating the anomaly scores corresponding to each feature sequence in the segmented features to obtain an accumulated anomaly score; The accumulated anomaly score is matched with a preset permission allocation mapping table, and the permission of the target device is adjusted according to the matching result.

7. A device for identifying abnormal access records of a device, characterized in that: include: Access log acquisition module, access record processing module, time series processing module, feature sequence generation module, segment feature generation module, anomaly score determination module and anomaly situation determination module; The access log acquisition module is used to acquire the access log of the target device within the target time period; wherein the access log includes a plurality of access records; the data type of the data recorded in each access record includes the device number, access time, access resource and access type; The access record processing module is used to serialize the access records to obtain a time series corresponding to each access record, and sort the time series according to the access time recorded in each access record; The time series processing module is used to divide the sorted time series into a plurality of subsequence sets according to a preset time step; The feature sequence generation module is used to perform feature analysis on each of the subsequence sets to obtain a feature sequence corresponding to each of the subsequence sets; The segment feature generation module is used to combine the feature sequences into a feature sequence set, and traverse the feature sequence set based on a pre-built sliding window to obtain a number of segment features; The anomaly score determination module is used to input the segmentation feature into the anomaly recognition model so that the anomaly recognition model recognizes the segmentation feature and obtains the anomaly score corresponding to each feature sequence in the segmentation feature; wherein the anomaly recognition model is obtained after training by taking a number of historical segmentation features and the label anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as input and taking the predicted anomaly scores corresponding to each historical feature sequence in the historical segmentation feature as output; The abnormality determination module is used to determine the abnormality of the access record corresponding to each feature sequence according to the abnormality scores corresponding to each feature sequence in the segmented features.

8. The device for identifying abnormal access records of a device according to claim 7, characterized in that: Also includes: permission adjustment module; The permission adjustment module is used to accumulate the anomaly scores corresponding to each feature sequence in the segmented feature to obtain an accumulated anomaly score; match the accumulated anomaly score with a preset permission allocation mapping table, and adjust the permission of the target device according to the matching result.

9. A terminal device, characterized in that: include: one or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the device abnormal access record identification method as described in any one of claims 1-6.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying abnormal device access records according to any one of claims 1 to 6 is implemented.

Images