Method and device for identifying file copying behavior

Abstract

The invention relates to the technical field of computer security, and discloses a method for identifying a file copying behavior, and the method comprises the steps: obtaining file associated data which is obtained based on a current system log, current system call monitoring data and current user behavior data; target features are extracted from the file associated data, file associated features are obtained, and the target features are features associated with the detected file copying behavior; encoding the file association features to obtain file association output features; and inputting the file associated output feature into a pre-trained file copying behavior recognition model to obtain a predicted behavior tag for recognizing the file copying behavior. According to the invention, the accuracy and reliability of identifying the file copying behavior are improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of computer security, and in particular to a method and device for identifying file copying behavior. Background Art

[0002] The file copy behavior identification method in Linux system mainly refers to the technology or mechanism of monitoring and identifying file copy operations, which can be achieved through a variety of methods, including system call monitoring, file system audit logs, and the use of specific tools. These methods are usually used in security auditing, data leakage prevention, and system monitoring scenarios.

[0003] In the related technology, by analyzing the operational behavior of file copying in the Linux environment, the file descriptors between the pipeline and the source file and the destination file are associated and analyzed based on the action behavior in the process, and a file copying behavior identification method is given for the specific scenario where the read and write caches are provided by the kernel pipeline during file copying.

[0004] However, in the related technology, the process behavior needs to be continuously monitored and associated, and the logic is relatively complex, which may increase the workload in implementation and maintenance, especially when dealing with multi-process or multi-threaded file operations. At the same time, due to the dynamic changes of pipes and file descriptors, misjudgment may occur. Therefore, how to improve the accuracy and reliability of identifying file copy operation behavior has become an urgent problem to be solved. Summary of the invention

[0005] In view of this, the present disclosure provides a method and apparatus for identifying file copying behavior to solve the problem of how to improve the accuracy and reliability of identifying file copying operation behavior.

[0006] In a first aspect, the present disclosure provides a method for identifying file copying behavior, the method comprising: obtaining file association data, the file association data being obtained based on current system logs, current system call monitoring data, and current user behavior data; extracting target features from the file association data to obtain file association features, wherein the target features are features associated with detecting file copying behavior; encoding the file association features to obtain file association output features; inputting the file association output features into a pre-trained file copying behavior recognition model to obtain a predicted behavior label for identifying file copying behavior.

[0007] In a second aspect, the present disclosure provides a device for identifying file copying behavior, the device comprising: an associated data acquisition module, used to acquire file associated data, the file associated data being obtained based on current system logs, current system call monitoring data and current user behavior data; a target feature extraction module, used to extract target features from the file associated data to obtain file associated features, wherein the target features are features associated with detecting file copying behavior; an associated feature encoding module, used to encode file associated features to obtain file associated output features; and a behavior label prediction module, used to input the file associated output features into a pre-trained file copying behavior recognition model to obtain a predicted behavior label for identifying file copying behavior.

[0008] In a third aspect, the present disclosure provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for identifying file copying behavior of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0009] In a fourth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for identifying file copying behavior of the first aspect or any corresponding embodiment thereof.

[0010] The method for identifying file copying behavior provided in the embodiments of the present disclosure improves the integrity and comprehensiveness of data when obtaining file association data based on the current system log, the current system call monitoring data and the current user behavior data; extracts target features that are strongly related to the detection of file copying behavior from the file association data to obtain file association features, thereby improving the efficiency and accuracy of the file copying behavior recognition model in learning useful information; then, uses reasonable features that are suitable for the file copying behavior recognition model to encode the file association features to obtain file association output features, thereby improving the model's ability to recognize and understand features; finally, uses a pre-trained file copying behavior recognition model to process the file association output features to obtain a predicted behavior label for identifying file copying behavior, thereby improving the accuracy and reliability of identifying file copying behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the specific embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0012] Figure 1 is a flowchart of a method for identifying file copying behavior according to an embodiment of the present disclosure;

[0013] Figure 2 is a flowchart of the training steps of the file copy behavior recognition model in the method for recognizing file copy behavior according to an embodiment of the present disclosure;

[0014] Figure 3 is a flowchart of a training step of a file copy behavior recognition model in another method for identifying file copy behavior according to an embodiment of the present disclosure;

[0015] Figure 4 is a structural block diagram of a device for identifying file copying behavior according to an embodiment of the present disclosure;

[0016] Figure 5 It is a schematic diagram of the hardware structure of the computer device of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0018] According to an embodiment of the present disclosure, a method embodiment for identifying file copying behavior is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0019] In this embodiment, a method for identifying file copying behavior is provided, which can be used in the above-mentioned computer system. Figure 1 is a flow chart of a method for identifying file copying behavior according to an embodiment of the present disclosure. Figure 1 As shown, the process includes the following steps:

[0020] Step S101, obtaining file association data, where the file association data is obtained based on current system logs, current system call monitoring data, and current user behavior data.

[0021] In this embodiment, when analyzing real-time data streams, you can first collect the current system logs, current system call monitoring data, and current user behavior data; then, normalize the collected data to convert data of different formats and ranges into a unified format to obtain file-related data to facilitate subsequent data processing.

[0022] Specifically, collecting system logs is to collect records of file access, copy and move operations from the audit logs recorded by the system monitoring tool. The records may include: timestamp, user, source file path, target file path and operation type. System call monitoring is to use tools to collect system call data related to file operations. Taking the Linux operating system as an example, the tool may be the tracking and analysis tool strace or bpftrace. The strace tool can be used to monitor the system calls and signals of the program; bpftrace can be used to comprehensively capture the behavior of the program, which is suitable for complex monitoring needs. Collecting user behavior data is to record the user's operation history, which includes file creation, reading, writing and deletion.

[0023] Step S102: extracting target features from the file association data to obtain file association features.

[0024] In this embodiment, the target features are features associated with detecting file copying behavior. That is, when these target features are detected, file copying behavior can usually be found. By extracting the target features from the file association data, discrete file association features can be obtained.

[0025] In some specific examples, the above target features may include one, two or more of the following: file operation frequency, file operation time interval, file size, file type, file operation type, number of bytes of file read and write operations, file time features, file user behavior features and file attributes. Among them, file operation types include: read, write and execute, and file time features are file operation time and file periodic activities.

[0026] Step S103: Encode the file association feature to obtain the file association output feature.

[0027] In this embodiment, the format of the input data of the file copy behavior recognition model should be adapted to the type of the file copy behavior recognition model. Therefore, the encoding type used for the input data can be predetermined according to the type of the file copy behavior recognition model, in order to obtain a format of the input data that meets the requirements.

[0028] In some specific examples, if the file copy behavior recognition model is logistic regression, support vector machine (SVM), neural network, K-nearest neighbor (KNN) or some rule-based models and ensemble learning methods (such as some implementations in random forests), then when encoding file association features, one-hot encoding can be used as the input of the model, thereby avoiding the influence of the sequential relationship between category labels on the model and improving the accuracy of the model.

[0029] In other specific examples, if the file copy behavior recognition model is a decision tree, random forest or gradient boosting machine, label encoding can be used as the input of the model when encoding file association features, thereby improving the applicability of the model input and the model's data processing when there is a natural order between category labels.

[0030] After the encoding type is determined, the determined encoding type can be used to encode the file association features to obtain file association output features, thereby facilitating the file copying behavior recognition model to efficiently process data during the model application stage.

[0031] Step S104: input the file-associated output features into a pre-trained file copy behavior recognition model to obtain a predicted behavior label for identifying the file copy behavior.

[0032] In this embodiment, the predicted behavior label may indicate the preset label category to which the file-associated output feature belongs. For example, the predicted label category may include: a file copy behavior label and a file non-copy behavior label. When the predicted behavior label belongs to a file copy behavior label, it indicates that there is a file copy behavior.

[0033] The file copy behavior recognition model can map the input data to a predefined category space, thereby realizing classification prediction of unknown data, and can be realized by using classification prediction models in existing technologies or technologies to be developed in the future, which is not limited by the present disclosure. For example, the file copy behavior recognition model can be realized by using logistic regression, support vector machine (SVM), neural network, K-nearest neighbor (KNN) or some rule-based models and ensemble learning methods (such as some implementations in random forests), or by using decision trees, random forests or gradient boosting machines.

[0034] The pre-trained file copy behavior recognition model can be deployed in a real-time monitoring environment to perform real-time detection of file operation behaviors. For example, the model can be integrated into the monitoring tool of the operating system to analyze the real-time data stream to ensure the real-time and accuracy of the file copy behavior recognition model in actual deployment.

[0035] When deploying the file copy behavior recognition model, taking the Linux system as an example, you can use the lightweight Web application framework Flask or the Web framework FastAPI to create a real-time reasoning API service, integrate it with the monitoring of the audit system daemon auditd or the open source tracking program bpftrace at runtime, capture file operation data in real time, and send the data to the file copy behavior recognition model through the API for prediction.

[0036] It is understandable that, since the data representation of the above file association output features is compatible with the file copy behavior recognition model, inputting the file association output features into the pre-trained file copy behavior recognition model can efficiently and accurately obtain the predicted behavior label for identifying file copy behavior.

[0037] The method for identifying file copying behavior provided in this embodiment improves the integrity and comprehensiveness of data when obtaining file association data based on the current system log, the current system call monitoring data and the current user behavior data; extracts target features that are strongly related to the detection of file copying behavior from the file association data to obtain file association features, thereby improving the efficiency and accuracy of the file copying behavior recognition model in learning useful information; then, uses reasonable features that are suitable for the file copying behavior recognition model to encode the file association features to obtain file association output features, thereby improving the model's ability to recognize and understand features; finally, uses a pre-trained file copying behavior recognition model to process the file association output features to obtain a predicted behavior label for identifying file copying behavior, thereby improving the accuracy and reliability of identifying file copying behavior.

[0038] In some optional implementations of this embodiment, the method further includes: step S105, when the predicted behavior tag indicates the existence of file copy behavior, generating warning information, and presenting the warning information to the manager who identifies the file copy behavior.

[0039] In this implementation, when the file copy behavior recognition model gives a predicted behavior label based on the file association output features, indicating the existence of file copy behavior, the system will automatically trigger the early warning mechanism. The early warning information can contain key information, such as the time, source, destination, users or processes involved in the file copy behavior, so that managers can quickly understand the details of the event. The format of the early warning information can be text, email, SMS or system notification, etc., depending on the manager's preference and system configuration. The presentation method can be a real-time updated monitoring interface, instant messaging message, notification bar message, email notification, etc., to ensure that managers can receive early warning information in a timely manner.

[0040] The method for identifying file copying behavior in this implementation can greatly shorten the time from when managers receive warnings to when they respond by automatically generating and presenting warning information, thereby improving the accuracy and timeliness of identifying file copying behavior, reducing unnecessary alarms (false positives) and missing real threats (false negatives), and improving detection efficiency, so that managers can quickly take measures to prevent potential security risks and enhance the efficiency of security management.

[0041] In this embodiment, a training step of a file copy behavior recognition model in a method for recognizing file copy behavior is provided, which can be used in the above-mentioned computer system, etc., or other computer systems independent of the above-mentioned computer system. Figure 2 FIG. 1 is a flow chart of the training steps of the file copy behavior recognition model in the method for recognizing file copy behavior according to an embodiment of the present disclosure, such as Figure 2 As shown, the process includes the following steps:

[0042] Step S201, obtaining training sample data and its corresponding training sample labels.

[0043] In this embodiment, the training sample data can be obtained based on historical system logs, historical system call monitoring data and historical user behavior data. The training sample labels corresponding to the training sample data can include: file copy behavior labels and file non-copy behavior labels.

[0044] In some specific examples, historical system logs, historical system call monitoring data, and historical user behavior data may be collected first; then, the collected data may be normalized to convert data of different formats and ranges into a unified format to obtain training sample data to facilitate subsequent data processing.

[0045] Specifically, collecting system logs is to collect records of file access, copy and move operations from the audit logs recorded by the system monitoring tool. The records may include: timestamp, user, source file path, target file path and operation type. System call monitoring is to use tools to collect system call data related to file operations. Taking the Linux operating system as an example, the tool may be the tracking and analysis tool strace or bpftrace. The strace tool can be used to monitor the system calls and signals of the program; bpftrace can be used to comprehensively capture the behavior of the program, which is suitable for complex monitoring needs. Collecting user behavior data is to record the user's operation history, which includes file creation, reading, writing and deletion.

[0046] Step S202: extract target features from training sample data to obtain training sample features.

[0047] In this embodiment, the target features are features associated with detecting file copying behavior. That is, when these target features are detected, file copying behavior can usually be found. By extracting the target features from the training sample data, discrete training sample features can be obtained.

[0048] In some specific examples, the above target features may include one, two or more of the following: file operation frequency, file operation time interval, file size, file type, file operation type, number of bytes of file read and write operations, file time features, file user behavior features and file attributes. Among them, file operation types include: read, write and execute, and file time features are file operation time and file periodic activities.

[0049] Step S203: Encode the training sample features to obtain training sample output features.

[0050] In this embodiment, the format of the input data of the file copy behavior recognition model should be adapted to the type of the file copy behavior recognition model. Therefore, the encoding type used for the input data can be predetermined according to the type of the file copy behavior recognition model, in order to obtain a format of the input data that meets the requirements.

[0051] In some specific examples, if the file copy behavior recognition model is logistic regression, support vector machine (SVM), neural network, K-nearest neighbor (KNN) or some rule-based models and ensemble learning methods (such as some implementations in random forests), then when encoding the training sample features, one-hot encoding can be used as the input of the model, thereby avoiding the influence of the sequential relationship between category labels on the model and improving the accuracy of the model.

[0052] In other specific examples, if the file copy behavior recognition model is a decision tree, random forest or gradient boosting machine, label encoding can be used as the input of the model when encoding the training sample features, thereby improving the applicability of the model input and the model's data processing when there is a natural order between category labels.

[0053] After determining the encoding type, the determined encoding type can be used to encode the training sample features to obtain the training sample output features, thereby facilitating the file copying behavior recognition model to efficiently process data during the model training phase.

[0054] Step S204: input the output features of the training samples into the file copy behavior recognition model to obtain the training prediction labels output by the file copy behavior recognition model.

[0055] In this embodiment, the training prediction label may indicate the preset label category to which the training sample output feature belongs. For example, the prediction label category may include: file copy behavior label and file non-copy behavior label. When the prediction behavior label belongs to the file copy behavior label, it indicates that there is file copy behavior.

[0056] The file copy behavior recognition model can map the input data to a predefined category space, thereby realizing classification prediction of unknown data, and can be realized by using classification prediction models in existing technologies or technologies to be developed in the future, which is not limited by the present disclosure. For example, the file copy behavior recognition model can be realized by using logistic regression, support vector machine (SVM), neural network, K-nearest neighbor (KNN) or some rule-based models and ensemble learning methods (such as some implementations in random forests), or by using decision trees, random forests or gradient boosting machines.

[0057] It is understandable that, since the data representation of the above training sample output features is compatible with the file copy behavior recognition model, inputting the training sample output features into the pre-trained file copy behavior recognition model can efficiently and accurately obtain the predicted behavior labels for identifying file copy behavior.

[0058] Step S205: updating the parameters of the file copy behavior recognition model based on the difference between the training prediction label and the training sample label.

[0059] In this embodiment, the training prediction label is the prediction result of the file copy behavior recognition model on the training sample data, while the training sample label is a pre-labeled, real label. The difference between the two can reflect the performance of the file copy behavior recognition model in the current training state, that is, the prediction accuracy of the model.

[0060] When updating the parameters of the file copy behavior recognition model based on the difference between the training prediction label and the training sample label, it can be achieved through the back propagation algorithm and the optimizer. The back propagation algorithm calculates the gradient of the loss function with respect to the model parameters, and the optimizer updates the parameters of the model according to these gradients. In some specific examples, the optimizer may include: stochastic gradient descent (SGD), Adam, etc. The optimizer may update the parameters of the model according to the gradient information to reduce the difference between the predicted label and the true label.

[0061] It is understandable that the parameter update of the file copy behavior recognition model in this embodiment can be ended when the output of the trained file copy behavior recognition model meets the convergence condition. In some specific examples, the convergence condition can be: the loss function determined based on the difference is less than a preset threshold or the number of update iterations reaches a preset number.

[0062] In the training step of the file copy behavior recognition model in the method for identifying file copy behavior in this embodiment, the training sample data and its corresponding training sample labels are obtained based on historical system logs, historical system call monitoring data and historical user behavior data, thereby improving the integrity and comprehensiveness of the training sample data and its corresponding training sample labels; target features strongly related to the detection of file copy behavior are extracted from the training sample data to obtain training sample features, thereby improving the efficiency and accuracy of the file copy behavior recognition model in learning useful information; then, a reasonable feature encoding suitable for the file copy behavior recognition model is adopted to encode the training sample features to obtain the training sample output features, thereby improving the model's recognition and understanding capabilities of the training sample output features; then, the file copy behavior recognition model is adopted to predict the training sample output features to obtain the training prediction labels, thereby improving the accuracy and reliability of the training prediction labels; finally, based on the difference between the training prediction labels and the training sample labels, the parameters of the file copy behavior recognition model are updated; by continuously updating the model parameters to reduce the difference between the training prediction labels and the training sample labels, the prediction accuracy and reliability of the model can be gradually improved, and during the training process, the parameters are continuously updated to adapt to different data distributions and features, thereby improving the generalization ability of the model.

[0063] Please refer to Figure 3 , Figure 3 It is a flowchart of the training steps of a file copy behavior recognition model in another method for identifying file copy behavior according to an embodiment of the present disclosure.

[0064] like Figure 3 As shown, in some optional implementations of the above embodiment, in the above Figure 2 Based on the process of the training step of the file copying behavior recognition model shown, the process may also include:

[0065] Step S206, obtaining evaluation sample data and its corresponding evaluation sample label.

[0066] In this embodiment, the evaluation sample data can be obtained based on historical system logs, historical system call monitoring data and historical user behavior data. The evaluation sample labels corresponding to the evaluation sample data can include: file copy behavior labels and file non-copy behavior labels.

[0067] In some specific examples, historical system logs, historical system call monitoring data, and historical user behavior data may be collected first; then, the collected data may be normalized to convert data of different formats and ranges into a unified format to obtain evaluation sample data to facilitate subsequent data processing.

[0068] Specifically, collecting system logs is to collect records of file access, copy and move operations from the audit logs recorded by the system monitoring tool. The records may include: timestamp, user, source file path, target file path and operation type. System call monitoring is to use tools to collect system call data related to file operations. Taking the Linux operating system as an example, the tool may be the tracking and analysis tool strace or bpftrace. The strace tool can be used to monitor the system calls and signals of the program; bpftrace can be used to comprehensively capture the behavior of the program, which is suitable for complex monitoring needs. Collecting user behavior data is to record the user's operation history, which includes file creation, reading, writing and deletion.

[0069] When evaluating the file copy behavior recognition model, the holdout method, cross-validation method, bootstrap method, etc. can be used to divide the prepared data set into an evaluation sample set and a training sample set (sometimes also a validation sample set), and the "test error" of the evaluation set is used to approximate the generalization error of the model. In order to obtain better model generalization performance, the evaluation sample set and the training sample set can be mutually exclusive.

[0070] Step S207: extract target features from the evaluation sample data to obtain evaluation sample features.

[0071] In this embodiment, the target features are features associated with detecting file copying behavior. That is, when these target features are detected, file copying behavior can usually be found. By extracting the target features from the evaluation sample data, discrete evaluation sample features can be obtained.

[0072] In some specific examples, the above target features may include one, two or more of the following: file operation frequency, file operation time interval, file size, file type, file operation type, number of bytes of file read and write operations, file time features, file user behavior features and file attributes. Among them, file operation types include: read, write and execute, and file time features are file operation time and file periodic activities.

[0073] Step S208: Encode the evaluation sample features to obtain evaluation sample output features.

[0074] In this embodiment, the format of the input data of the file copy behavior recognition model should be adapted to the type of the file copy behavior recognition model. Therefore, the encoding type used for the input data can be predetermined according to the type of the file copy behavior recognition model, in order to obtain a format of the input data that meets the requirements.

[0075] In some specific examples, if the file copy behavior recognition model is logistic regression, support vector machine (SVM), neural network, K-nearest neighbor (KNN) or some rule-based models and ensemble learning methods (such as some implementations in random forests), then when encoding the evaluation sample features, one-hot encoding can be used as the input of the model, thereby avoiding the influence of the sequential relationship between category labels on the model and improving the accuracy of the model.

[0076] In other specific examples, if the file copy behavior recognition model is a decision tree, random forest, or gradient boosting machine, label encoding can be used as the input of the model when encoding the evaluation sample features, thereby improving the applicability of the model input and the model's data processing when there is a natural order between category labels.

[0077] After determining the encoding type, the determined encoding type can be used to encode the evaluation sample features to obtain the evaluation sample output features, thereby facilitating the file copying behavior recognition model to efficiently process data during the model training phase.

[0078] Step S209: input the output features of the evaluation sample into the file copy behavior recognition model to obtain the evaluation prediction label output by the file copy behavior recognition model.

[0079] In this embodiment, the evaluation prediction label may indicate the preset label category to which the evaluation sample output feature belongs. For example, the prediction label category may include: file copy behavior label and file non-copy behavior label. When the prediction behavior label belongs to the file copy behavior label, it indicates that there is file copy behavior.

[0080] The file copy behavior recognition model can map the input data to a predefined category space, thereby realizing classification prediction of unknown data, and can be realized by using classification prediction models in existing technologies or technologies to be developed in the future, which is not limited by the present disclosure. For example, the file copy behavior recognition model can be realized by using logistic regression, support vector machine (SVM), neural network, K-nearest neighbor (KNN) or some rule-based models and ensemble learning methods (such as some implementations in random forests), or by using decision trees, random forests or gradient boosting machines.

[0081] It can be understood that since the data representation method of the above-mentioned evaluation sample output features is compatible with the file copy behavior recognition model, inputting the evaluation sample output features into the pre-trained file copy behavior recognition model can efficiently and accurately obtain the predicted behavior label for identifying file copy behavior.

[0082] As shown in steps S206, S207, S208, and S209, they correspond to steps S201, S202, S203, and S204 respectively, and the processing steps adopted by the corresponding two steps are the same, and only the input data of the processing steps are different.

[0083] Step S210: Generate an evaluation index based on the evaluation prediction label and the evaluation sample label.

[0084] In this embodiment, the evaluation prediction label is the prediction result of the file copy behavior recognition model on the evaluation sample data, and the evaluation sample label is a pre-labeled, real label. Based on the evaluation prediction label and the evaluation sample label, a variety of evaluation indicators that can quantify the performance of the model can be calculated. The evaluation indicators can include one, two or more of the following: accuracy, recall rate, F1 score (F1-score), receiver operating characteristic curve (ROC) and area under the ROC curve (AUC).

[0085] Among them, accuracy is the ratio of correctly predicted evaluation samples to the total number of evaluation samples, and is the basic indicator for measuring the overall performance of the model. Recall is the ratio of all samples that are truly positive that are correctly predicted as positive by the model, reflecting the model's ability to identify positive samples. F1-score is the harmonic mean of accuracy and recall, which is used to balance the weight between the two, especially when there is a conflict between the two. The ROC curve (Receiver Operating Characteristic Curve) is drawn by the True Positive Rate (TPR) and the False Positive Rate (FPR) at different thresholds, and is used to evaluate the performance of the model at different thresholds. The AUC value (Area Under the Curve) is the area under the ROC curve, ranging from 0 to 1. The larger the AUC value, the better the model performance.

[0086] Step S211, optimizing the parameters of the file copy behavior recognition model based on the evaluation index.

[0087] In this embodiment, the strengths and weaknesses of the file copy behavior recognition model can be identified based on the evaluation indicators. For example, if the recall rate is low, the model parameters may need to be adjusted to increase the sensitivity to positive samples. Using cross-validation, grid search, random search and other techniques, combined with the evaluation indicators, the model parameters can be tuned to find the optimal parameter combination.

[0088] In the method for identifying file copying behavior in this embodiment, the training step of the file copying behavior identification model is as follows: Figure 2On the basis of the illustrated embodiment, by evaluating and optimizing the file copying behavior recognition model, the model's key indicators such as accuracy and recall rate in the file copying behavior recognition task can be significantly improved, thereby improving the model's practicality and reliability. Moreover, since evaluation sample data that is mutually exclusive with the training sample data is used for evaluation, it can be ensured that the model can maintain good performance on unseen data, thereby enhancing the model's generalization ability.

[0089] In some optional implementations of this embodiment, the file copy behavior recognition model is a decision tree model; the decision tree model recursively divides the input data according to the results of the target feature test corresponding to the nodes of the decision tree, and the parameters of the file copy behavior recognition model include: the maximum depth of the decision tree and the minimum number of samples.

[0090] In this implementation, the decision tree model is a machine learning model with a tree structure, each internal node represents a test on a feature, each branch represents a possible result of the test, and each leaf node represents a preset label category.

[0091] The decision tree model performs classification by dividing the data layer by layer. In the decision-making process, the decision tree does not care about the numerical value of the feature, but whether the value of the feature at a certain node can effectively divide the data into different categories. Therefore, the decision tree can directly process the feature data after label encoding.

[0092] In the file copying behavior identification task, the decision tree model recursively divides the input dataset into smaller subsets based on the selected features until a certain stopping condition is met (such as reaching the maximum depth, all samples in the subset belong to the same category, etc.).

[0093] In some examples, the machine learning libraries scikit-learn, TensorFlow, or PyTorch can be used to train the model. Scikit-learn is mainly used for classic machine learning algorithms, and its training process is relatively simple and direct. TensorFlow and PyTorch are mainly used for deep learning models.

[0094] When training or evaluating a file copy behavior recognition model, the parameters of the file copy behavior recognition model include: the maximum depth of the decision tree and the minimum number of samples. The maximum depth of the decision tree refers to the number of nodes on the longest path from the root node to the leaf node. Limiting the maximum depth can prevent the decision tree from being too deep, thereby avoiding overfitting. The minimum number of samples can include: the minimum number of sample splits and the minimum number of leaf node samples. The minimum number of sample splits is the number of samples that a node must contain. When the number of samples contained in the node reaches the minimum number of sample splits, it can be further divided. If the number of samples in the node is less than this value, the node will not be further divided. The minimum number of leaf node samples is the minimum number of samples that a leaf node must contain. If the number of samples in a subset obtained by division is less than this value, the division process will stop and the subset will become a leaf node.

[0095] The training steps of the file copying behavior recognition model in this implementation method clarify that the structure of the file copying behavior recognition model is a decision tree model, clarify the basis for the decision tree model to divide the input data, and clarify the parameters of the decision tree model including the maximum depth and minimum number of samples of the decision tree, so as to clarify which features are more important for the identification of file copying behavior. By adjusting the maximum depth and minimum number of samples of the model, the accuracy, generalization ability and computational efficiency of the model in the task of identifying file copying behavior can be improved while maintaining the interpretability of the model.

[0096] In some optional implementations of this embodiment, the training step of the file copy behavior recognition model also includes: compressing the decision tree model; wherein the model compression includes: model distillation or model pruning; and the model pruning includes: pre-check branch and post-pruning.

[0097] In this implementation, model compression refers to compression operations on the model, such as model distillation or pruning, so that it occupies fewer resources during execution and improves response speed. Hyperparameter optimization refers to comprehensive hyperparameter optimization of the model on an offline dataset to achieve the best performance in a real-time environment. Pruning refers to pre-pruning and post-pruning.

[0098] The specific steps for pre-pruning a decision tree are as follows: 1) Set pruning parameters: select appropriate stopping conditions and thresholds based on the specific circumstances of the data set and the problem; 2) Build a decision tree: During the process of building the decision tree, continuously check whether the stopping conditions are met. If so, stop the growth of the current branch and use the node as a leaf node; 3) Use evaluation sample data to evaluate the performance of the model.

[0099] The specific steps for post-pruning a decision tree are as follows: 1) Build a complete decision tree: First, build a fully grown decision tree without any pruning; 2) Calculate the cost complexity: For each non-leaf node, calculate the cost complexity after pruning. The cost complexity is usually a combination of the error rate and the complexity of the tree; 3) Find the pruning scheme with the lowest cost complexity; 4) Use evaluation sample data to evaluate the performance of the pruned model.

[0100] The training step of the file copy behavior recognition model in this implementation method can significantly reduce the size and computational complexity of the model and improve the operating efficiency of the model by compressing the decision tree model; by removing redundant branches and nodes, the risk of overfitting of the model can be reduced and the generalization ability of the model can be improved.

[0101] In the present embodiment, a device for identifying file copying behavior is also provided, and the device is used to implement the above-mentioned embodiment and preferred implementation mode, and the descriptions that have been made are not repeated here. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

[0102] This embodiment provides a device for identifying file copying behavior, such as Figure 4 As shown, the device comprises:

[0103] The associated data acquisition module 401 is used to acquire file associated data, where the file associated data is obtained based on the current system log, the current system call monitoring data and the current user behavior data;

[0104] A target feature extraction module 402 is used to extract target features from the file association data to obtain file association features, wherein the target features are features associated with detecting file copying behavior;

[0105] The association feature encoding module 403 is used to encode the file association feature to obtain the file association output feature;

[0106] The behavior label prediction module 404 is used to input the file-associated output features into a pre-trained file copy behavior recognition model to obtain a predicted behavior label for identifying the file copy behavior.

[0107] In some optional implementations of this embodiment, the device further includes:

[0108] The warning information presenting module 405 is used to generate warning information when the predicted behavior tag indicates the existence of file copying behavior, and present the warning information to the manager who identifies the file copying behavior.

[0109] In some optional implementations of this embodiment, the target features in the target feature extraction module include at least one of the following: file operation frequency, file operation time interval, file size, file type, file operation type, number of bytes of file read and write operations, file time features, file user behavior features and file attributes, wherein the file operation types include: read, write and execute, and the file time features are the file operation time and the file periodic activities.

[0110] In some optional implementations of the present embodiment, the training module of the file copy behavior recognition model in the behavior label prediction module includes (not shown in the figure): a training sample acquisition module, used to obtain training sample data and its corresponding training sample labels, the training sample data is obtained based on historical system logs, historical system call monitoring data and historical user behavior data, and the training sample labels include: file copy behavior labels and file non-copied behavior labels; a training sample extraction module, used to extract target features from the training sample data to obtain training sample features; a training sample encoding module, used to encode the training sample features to obtain training sample output features; a training label prediction module, used to input the training sample output features into the file copy behavior recognition model to obtain the training prediction labels output by the file copy behavior recognition model; a model parameter updating module, used to update the parameters of the file copy behavior recognition model based on the difference between the training prediction labels and the training sample labels.

[0111] In some optional implementations of the present embodiment, the training module of the file copy behavior recognition model in the behavior label prediction module also includes (not shown in the figure): an evaluation sample acquisition module, which is used to obtain evaluation sample data and its corresponding evaluation sample labels, the evaluation sample data is obtained based on historical system logs, historical system call monitoring data and historical user behavior data, and the evaluation sample labels include: file copy behavior labels and file non-copy behavior labels; an evaluation sample extraction module, which is used to extract target features from the evaluation sample data to obtain evaluation sample features; an evaluation sample encoding module, which is used to encode the evaluation sample features to obtain evaluation sample output features; an evaluation label prediction module, which is used to input the evaluation sample output features into the file copy behavior recognition model to obtain the evaluation prediction labels output by the file copy behavior recognition model; an evaluation indicator generation module, which is used to generate evaluation indicators based on the evaluation prediction labels and the evaluation sample labels, wherein the evaluation indicators include at least one of the following: accuracy, recall rate, F1 score (F1-score), receiver operating characteristic curve (ROC) and area value under the ROC curve (AUC value); a model parameter optimization module, which is used to optimize the parameters of the file copy behavior recognition model based on the evaluation indicators.

[0112] In some optional implementations of the present embodiment, the file copy behavior recognition model in the behavior label prediction module is a decision tree model; the decision tree model recursively divides the input data according to the results of the target feature test corresponding to the nodes of the decision tree, and the parameters of the file copy behavior recognition model include: the maximum depth of the decision tree and the minimum number of samples.

[0113] In some optional implementations of the present embodiment, the training module of the file copy behavior recognition model in the behavior label prediction module also includes (not shown in the figure): a model structure compression module, which performs model compression on the decision tree model; wherein the model compression includes: model distillation or model pruning; model pruning includes: pre-inspection branch and post-pruning.

[0114] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0115] The device for identifying file copying behavior in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0116] See also Figure 5 , Figure 5 1 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present disclosure, and the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0117] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0118] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0119] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0120] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0121] The computer device further includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means.

[0122] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0123] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0124] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0125] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for identifying file copying behavior, characterized in that: The method comprises: Acquire file association data, where the file association data is obtained based on current system logs, current system call monitoring data, and current user behavior data; Extracting a target feature from the file association data to obtain a file association feature, wherein the target feature is a feature associated with detecting file copying behavior; Encoding the file association feature to obtain a file association output feature; The file-associated output features are input into a pre-trained file copy behavior recognition model to obtain a predicted behavior label for identifying the file copy behavior.

2. The method according to claim 1, characterized in that The method further comprises: When the predicted behavior tag indicates the existence of file copy behavior, warning information is generated, and the warning information is presented to a manager who identifies the file copy behavior.

3. The method according to claim 1, characterized in that: The target feature includes at least one of the following: file operation frequency, file operation time interval, file size, file type, file operation type, number of bytes of file read and write operations, file time feature, file user behavior feature and file attribute, wherein the file operation type includes: read, write and execute, and the file time feature is the file operation time and the file periodic activity.

4. The method according to any one of claims 1 to 3, characterized in that: The training steps of the file copying behavior recognition model include: Acquire training sample data and its corresponding training sample labels, wherein the training sample data is obtained based on historical system logs, historical system call monitoring data, and historical user behavior data, and the training sample labels include: file copy behavior labels and file non-copy behavior labels; Extract target features from the training sample data to obtain training sample features; Encoding the training sample features to obtain training sample output features; Inputting the training sample output features into a file copy behavior recognition model to obtain a training prediction label output by the file copy behavior recognition model; Based on the difference between the training prediction label and the training sample label, the parameters of the file copying behavior recognition model are updated.

5. The method according to claim 4, characterized in that The training step of the file copying behavior recognition model also includes: Obtaining evaluation sample data and its corresponding evaluation sample labels, wherein the evaluation sample data is obtained based on historical system logs, historical system call monitoring data, and historical user behavior data, and the evaluation sample labels include: file copy behavior labels and file non-copy behavior labels; Extract target features from the evaluation sample data to obtain evaluation sample features; Encoding the evaluation sample features to obtain evaluation sample output features; Inputting the evaluation sample output feature into the file copy behavior recognition model to obtain the evaluation prediction label output by the file copy behavior recognition model; Based on the evaluation prediction label and the evaluation sample label, generating an evaluation index, wherein the evaluation index includes at least one of the following: accuracy, recall, F1 score (F1-score), receiver operating characteristic curve (ROC) and area under the ROC curve; Based on the evaluation index, the parameters of the file copying behavior recognition model are optimized.

6. The method according to claim 5, characterized in that The file copy behavior recognition model is a decision tree model; the decision tree model recursively divides the input data according to the results of the target feature test corresponding to the nodes of the decision tree, and the parameters of the file copy behavior recognition model include: the maximum depth of the decision tree and the minimum number of samples.

7. The method according to claim 6, characterized in that The training step of the file copying behavior recognition model also includes: The decision tree model is compressed; wherein the model compression includes: model distillation or model pruning; the model pruning includes: pre-check branches and post-pruning branches.

8. A device for identifying file copying behavior, characterized in that: The device comprises: A correlation data acquisition module, used to acquire file correlation data, wherein the file correlation data is obtained based on current system logs, current system call monitoring data and current user behavior data; A target feature extraction module, used to extract target features from the file association data to obtain file association features, wherein the target features are features associated with detecting file copying behavior; A correlation feature encoding module, used for encoding the file correlation feature to obtain a file correlation output feature; The behavior label prediction module is used to input the file-related output features into a pre-trained file copy behavior recognition model to obtain a predicted behavior label for identifying file copy behavior.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for identifying file copying behavior according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for identifying file copying behavior according to any one of claims 1 to 7.

Images