Internal threat detection method based on CNN-LSTM algorithm

Abstract

The invention discloses an internal threat detection method based on a CNN-LSTM algorithm, and relates to the field of network information security, and the method comprises the steps: obtaining user behavior data, and carrying out the preprocessing of the data, and obtaining a behavior feature sequence of a user; inputting the behavior feature sequence into a trained CNN-LSTM model, and outputting a threat behavior detection result; the CNN-LSTM model comprises an input layer, a CNN layer, an LSTM layer and an output layer which are connected in sequence; the CNN layer performs local feature extraction on the input behavior feature sequence and outputs the local feature to the LSTM layer; the LSTM layer performs time dimension feature extraction on the input feature map, and inputs the hidden state of the final time step into the output layer; and the output layer is a full-connection layer and outputs a threat behavior detection result through linear transformation. According to the method, the detection efficiency and precision of internal threats in information security and data asset protection can be effectively improved, so that the security of enterprise information data is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and more specifically to an internal threat detection method based on a CNN-LSTM algorithm. Background Art

[0002] With the rapid development and widespread application of Internet technology, the information security and data asset protection issues of companies and enterprises have become increasingly prominent.

[0003] Compared with external threats, since most internal threats are operated by internal personnel of the company, once they occur, they will cause significant losses to the company. Internal threats have become a major hidden danger in the field of enterprise network security today. According to the internal threat survey report, more than 70% of corporate organizations are very worried about internal threats, and less than 5% of corporate organizations do not care about internal threats. According to the "2023 Global Report on Insider Risk Costs" released by Gartner, the average annual total cost of insider risk for each organization has increased to US$16.2 million. Once a malicious insider incident occurs, it is the most expensive to date, with an average cost of US$701,500 per incident. However, unlike external attacks, the main attackers of internal threats come from within the organization, so internal threats generally have greater losses than external threats, are highly disguised, and have diversified methods of attackers and attackers, resulting in deficiencies in detection accuracy and efficiency of existing internal threat detection methods.

[0004] Therefore, how to improve the accuracy and efficiency of internal threat detection is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0005] In view of this, the present invention provides an internal threat detection method based on the CNN-LSTM algorithm, which significantly improves the accuracy and efficiency of internal threat detection by combining the two deep learning technologies of CNN and LSTM.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] The present invention discloses an internal threat detection method based on CNN-LSTM algorithm, and the specific steps are as follows:

[0008] Obtain user behavior data and preprocess it to obtain the user's behavior feature sequence;

[0009] Input the behavior feature sequence into the trained CNN-LSTM model and output the threat behavior detection result;

[0010] The CNN-LSTM model includes an input layer, a CNN layer, an LSTM layer and an output layer connected in sequence; the CNN layer extracts local features of the input behavior feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features of the input feature map and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer, which outputs the threat behavior detection result through linear transformation.

[0011] Furthermore, the preprocessing includes: extracting time series features from file operations, email records, login logs, device records and network access logs through a sliding window mechanism, and timestamping the data and constructing behavior sequences.

[0012] Furthermore, the behavior feature sequence data is in the shape of {N, T, k}, where N is the batch size, T is the time step, and k is the number of features; the user's one-day operation behavior feature is expressed as Among them, S = {1, 2, 3, ..., g} represents the user's internal personnel set, and g is the total number of internal employees.

[0013] Furthermore, the CNN layer performs a convolution operation on the input behavior features, and the output of the convolution kernel is:

[0014]

[0015] Among them, H i (t) represents the output of the i-th convolution kernel of the convolution layer at time step t, j represents the offset of the time step, l represents the dimension index of the feature, k represents the size of the convolution kernel, and W i (j,l) represents the weight of the convolution kernel, X(t+j-1,l) represents the eigenvalue of the input data, b i Represents the bias term of the convolution kernel;

[0016] For the weights and biases of the i-th convolution kernel, the feature map shape generated at time step t is {N, T-k+1}, and the convolution layer output feature map shape is {N, T-k+1, F}, where F is the total number of convolution kernels.

[0017] Furthermore, the features of the convolutional layer output are processed by maximum pooling to reduce the dimension and obtain the final output of the CNN layer. The output formula is:

[0018] H pool (t)=max(H(t),H(t+1),…,H(t+p-1));

[0019] Among them, H pool(t) represents the output of the pooling operation at time step t, H(t) represents the output of the convolutional layer at time step t, and p represents the size of the pooling window; the output shape after pooling is

[0020] Furthermore, the parameter design of the LSTM unit in the LSTM layer includes:

[0021] Input gate weight: W i ∈R h×(D+h) ;

[0022] Forget gate weight: W f ∈R h×(D+h) ;

[0023] Output gate weight: W o ∈R h×(D+h) ;

[0024] Memory unit state weight: W c ∈R h×(D+h) ;

[0025] Input gate bias: b i ∈R h ;

[0026] Forget gate bias: b f ∈R h ;

[0027] Output gate bias: b o ∈R h ;

[0028] Memory cell state bias: b c ∈R h ;

[0029] Among them, R h×(D+h) is the LSTM weight matrix, R h is the bias matrix, h is the number of LSTM hidden units, and D is the input feature dimension;

[0030] The calculation formula of LSTM unit is:

[0031] Input gate: I t =σ(W i ·[H t-1 ,x t ]+b i );

[0032] Forget Gate: F t =σ(W f ·[H t-1 ,x t ]+b f );

[0033] Output gate: O t =σ(W o ·[H t-1 ,x t ]+b o );

[0034] Memory unit status update:

[0035] New memory cell state:

[0036] New hidden state: H t =O t *tanh(C t );

[0037] Among them, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, [H t-1 ,x t ] represents the hidden state H of the previous time step t-1 and the input x at the current time step t The concatenation of the final hidden state h T The shape is (N,h), where N is the batch size.

[0038] Furthermore, the fully connected layer maps the input feature vector to the output classification label space through linear transformation, and the formula is:

[0039] z=W·h T +b;

[0040] Where W∈R c×h is the weight matrix, c represents the number of output categories; b∈R c Represents the bias vector; z∈R N×c is the output matrix of the fully connected layer, with a shape of (N,c), which represents the score of each sample in each category;

[0041] The Softmax activation function is used to convert the linear transformation result z into a category probability distribution. The formula is:

[0042]

[0043] in, represents the predicted probability of the a-th class, z a is the linear transformation output corresponding to the ath type, z b is the linear transformation output corresponding to all categories; the final output of the fully connected layer is the probability distribution matrix The shape is (N,c), which indicates the probability that each sample belongs to each category.

[0044] Furthermore, the CNN-LSTM model is optimized using the Adam optimizer, the learning rate of the CNN layer is set to 0.001, the convolution kernel size is 2, 3, 4, the pooling window size is 2x2, and the Dropout probability is 0.5; the number of hidden units of the LSTM layer is set to 128.

[0045] Furthermore, the accuracy, precision, recall rate and AUC value under the ROC curve are used in combination with the cross entropy loss function to comprehensively evaluate the performance of the CNN-LSTM model.

[0046] Through the above technical solutions, it can be known that compared with the prior art, the present invention discloses an internal threat detection method based on the CNN-LSTM algorithm, which significantly improves the accuracy and efficiency of internal threat detection by combining the two deep learning technologies of CNN and LSTM; combined with the advantages of convolutional neural networks for local feature extraction and the processing advantages of long short-term memory neural networks for time series, it has a good effect on training and detecting abnormal user behavior; compared with the existing internal detection model, it simplifies the feature selection process, improves the model accuracy and stability, and compared with a single CNN or LSTM model, the CNN-LSTM model predicts less false alarm rate and accuracy. The present invention can effectively improve the detection efficiency and accuracy of internal threats in information security and data asset protection, thereby improving the security of enterprise information data. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0048] Figure 1 Schematic diagram of the overall structure of the CNN-LSTM model of an embodiment of the present invention.

[0049] Figure 2 Schematic diagram of the CNN layer structure of an embodiment of the present invention.

[0050] Figure 3 Schematic diagram of the LSTM unit structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The embodiment of the present invention discloses an internal threat detection method based on a CNN-LSTM algorithm, and the specific steps are as follows:

[0053] Obtain user behavior data and preprocess it to obtain the user's behavior feature sequence;

[0054] Input the behavior feature sequence into the trained CNN-LSTM model and output the threat behavior detection results;

[0055] like Figure 1 As shown in the figure, the CNN-LSTM model includes an input layer, a CNN layer, an LSTM layer, and an output layer connected in sequence; the CNN layer extracts local features of the input behavior feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features of the input feature map and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer, which outputs the threat behavior detection results through linear transformation.

[0056] In a specific embodiment, preprocessing includes: extracting time series features from file operations, email records, login logs, device records and network access logs through a sliding window mechanism, and timestamping the data and constructing a behavior sequence. User behavior data is processed by using feature statistics methods and data preprocessing to construct a behavior feature sequence that can be input into the CNN layer for processing.

[0057] In a specific embodiment, the behavior feature sequence data shape is {N, T, k}, where N is the batch size, T is the time step, and k is the number of features; the user's one-day operation behavior feature is expressed as Among them, S = {1, 2, 3, ..., g} represents the user's internal personnel set, and g is the total number of internal employees.

[0058] Specifically, since the user behavior log contains multiple aspects of the user's operations, such as files, emails, devices, logins, etc., in order to more accurately capture the user's abnormal behavior operations, the user's operation behavior is time-series features constructed based on the day dimension to construct the user's normal behavior, so as to capture abnormal user behavior. Constructing the user's daily operation behavior features As shown in Table 1:

[0059] Table 1 User action behavior characteristics

[0060]

[0061] In a specific embodiment, the CNN layer structure is as follows: Figure 2 As shown in the figure, the CNN layer performs convolution operation on the input behavior features to more comprehensively obtain the local features and important features that affect user behavior. The output of the convolution kernel is:

[0062]

[0063] Among them, H i (t) represents the output of the i-th convolution kernel of the convolution layer at time step t, j represents the offset of the time step, l represents the dimension index of the feature, k represents the size of the convolution kernel, and W i (j,l) represents the weight of the convolution kernel, X(t+j-1,l) represents the eigenvalue of the input data, b i Represents the bias term of the convolution kernel;

[0064] For the weights and biases of the i-th convolution kernel, the feature map shape generated at time step t is {N, T-k+1}, and the convolution layer output feature map shape is {N, T-k+1, F}, where F is the total number of convolution kernels.

[0065] In a specific embodiment, the features output by the convolutional layer are subjected to dimensionality reduction processing using maximum pooling to obtain the final output of the CNN layer. The output formula is:

[0066] H pool (t)=max(H(t),H(t+1),…,H(t+p-1));

[0067] Among them, H pool (t) represents the output of the pooling operation at time step t, H(t) represents the output of the convolutional layer at time step t, and p represents the size of the pooling window; the output shape after pooling is

[0068] In a specific embodiment, the LSTM layer structure is as follows: Figure 3 As shown in the figure, the LSTM layer continuously updates memory cells through judgment and performs memory learning of user behavior in a time dimension. The parameter design of the LSTM unit in the LSTM layer includes:

[0069] Input gate weight: W i ∈R h×(D+h) ;

[0070] Forget gate weight: W f ∈R h×(D+h) ;

[0071] Output gate weight: W o ∈R h×(D+h) ;

[0072] Memory unit state weight: W c ∈R h×(D+h) ;

[0073] Input gate bias: b i ∈R h ;

[0074] Forget gate bias: b f ∈R h ;

[0075] Output gate bias: b o ∈R h ;

[0076] Memory cell state bias: b c ∈R h ;

[0077] Among them, R h×(D+h) is the LSTM weight matrix, R h is the bias matrix with dimension h, where h is the number of LSTM hidden units, i.e. the dimension of the output vector at each time step, and D is the input feature dimension;

[0078] The calculation formula of LSTM unit is:

[0079] Input gate: I t =σ(W i ·[H t-1 ,x t ]+b i );

[0080] Forget Gate: F t =σ(W f ·[H t-1 ,x t ]+b f );

[0081] Output gate: O t =σ(W o ·[H t-1 ,x t ]+b o );

[0082] Memory unit status update:

[0083] New memory cell state:

[0084] New hidden state: H t =Ot *tanh(C t );

[0085] Among them, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, [H t-1 ,x t ] represents the hidden state H of the previous time step t-1 and the input x at the current time step t The concatenation of the final hidden state h T The shape is (N, h), where N is the batch size, which represents the number of samples processed at a time.

[0086] In a specific embodiment, the fully connected layer maps the input feature vector to the output classification label space through a linear transformation, and the formula is:

[0087] z=W·h T +b;

[0088] Where W∈R c×h is the weight matrix, and the hidden state h of the last time step of LSTM is T Mapped to the output space; c represents the number of output categories, that is, the number of categories that need to be classified; b∈R c Represents the bias vector, with shape (c), representing the bias of each category; z∈R N×c is the output matrix of the fully connected layer, with a shape of (N,c), which represents the score of each sample in each category;

[0089] The Softmax activation function is used to convert the linear transformation result z into a category probability distribution. The formula is:

[0090]

[0091] in, represents the predicted probability of the a-th class, z a is the linear transformation output corresponding to the ath type, z b It is the linear transformation output corresponding to all categories; the final output of the fully connected layer is the probability distribution matrix The shape is (N,c), which indicates the probability that each sample belongs to each category.

[0092] In a specific embodiment, the CNN-LSTM model is optimized using the Adam optimizer, the learning rate of the CNN layer is set to 0.001, the convolution kernel size is 2, 3, 4, the pooling window size is 2x2, and the Dropout probability is 0.5; the number of hidden units of the LSTM layer is set to 128.

[0093] In a specific embodiment, the performance of the CNN-LSTM model is comprehensively evaluated using the accuracy, precision, recall and AUC value under the ROC curve in combination with the cross entropy loss function.

[0094] Specifically, before evaluating the CNN-LSTM model, you need to understand four core concepts:

[0095] True Positive (TP): refers to the situation where the classifier correctly identifies an actual positive example as a positive example;

[0096] True Negative (TN): refers to the situation where the classifier correctly identifies an actual negative example as a negative example;

[0097] False Positive (FP): refers to the situation where the classifier mistakenly identifies a negative example as a positive example;

[0098] False Negative (FN): refers to the situation where the classifier mistakenly identifies a positive example as a negative example.

[0099] Based on the above four indicators, we can further calculate the accuracy, precision, and recall. The model is comprehensively evaluated using the loss, accuracy, precision, and recall indicators and the ROC curve.

[0100] a. Accuracy: It is used to measure the correctness of the model's prediction results. It indicates the proportion of correctly predicted samples among all samples. The formula is:

[0101]

[0102] b. Precision: It mainly focuses on the prediction of positive class, which means the proportion of samples predicted as positive class by the model to samples actually in the positive class. The formula is:

[0103]

[0104] c. Recall: It is a key indicator for evaluating the model's ability to identify positive samples. It indicates the proportion of samples that are actually positive that the model correctly identifies as positive. The formula is:

[0105]

[0106] d. Loss is a key indicator used in machine learning and deep learning models to measure the difference between the model's predicted results and the actual results. This technology uses the cross-entropy loss function to calculate the model's loss value:

[0107]

[0108] Where n represents the number of samples; y i Represents the true label of the i-th sample, which takes a value of 0 or 1; It represents the probability that the i-th sample is predicted to be a positive class, ranging from 0 to 1.

[0109] In a specific embodiment, the present invention can be run in the part of the intelligent system that involves the operation system record and use by internal personnel. It can be applied to fields with high data security requirements such as finance, medical care, and government agencies, and perform threat detection on network data to provide more precise protection. It can be applied to various fields involving network information security, and can identify and prevent internal personnel (such as employees, partners, etc.) from abusing authority, stealing data, or destroying the system. By analyzing user behavior logs and monitoring abnormal behavior operations, sensitive information is protected, system security is maintained, and internal security risks of intelligent systems are reduced.

[0110] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0111] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An internal threat detection method based on CNN-LSTM algorithm, characterized in that: The specific steps are as follows: Obtain user behavior data and preprocess it to obtain the user's behavior feature sequence; Input the behavior feature sequence into the trained CNN-LSTM model and output the threat behavior detection result; The CNN-LSTM model includes an input layer, a CNN layer, an LSTM layer and an output layer connected in sequence; the CNN layer extracts local features of the input behavior feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features of the input feature map and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer, which outputs the threat behavior detection result through linear transformation.

2. According to claim 1, the internal threat detection method based on the CNN-LSTM algorithm is characterized in that: The preprocessing includes: extracting time series features from file operations, email records, login logs, device records and network access logs through a sliding window mechanism, and timestamping the data and constructing behavior sequences.

3. The internal threat detection method based on the CNN-LSTM algorithm according to claim 1 is characterized in that: The behavior feature sequence data is in the shape of {N, T, n}, where N is the batch size, T is the time step, and n is the number of features. The user's one-day operation behavior feature is expressed as Among them, S = {1, 2, 3, ..., g} represents the user's internal personnel set, and g is the total number of internal employees.

4. The internal threat detection method based on the CNN-LSTM algorithm according to claim 3 is characterized in that: The CNN layer performs a convolution operation on the input behavior features, and the output of the convolution kernel is: Among them, H i (t) represents the output of the i-th convolution kernel of the convolution layer at time step t, j represents the offset of the time step, l represents the dimension index of the feature, k represents the size of the convolution kernel, and W i (j, l) represents the weight of the convolution kernel, X(t+j-1, l) represents the eigenvalue of the input data, and b i Represents the bias term of the convolution kernel; For the weights and biases of the i-th convolution kernel, the feature map shape generated at time step t is {N, T-n+1}, and the convolution layer output feature map shape is {N, T-n+1, ​​F}, where F is the total number of convolution kernels.

5. The internal threat detection method based on CNN-LSTM algorithm according to claim 4 is characterized in that: The features of the convolutional layer output are processed by maximum pooling to reduce the dimension and obtain the final output of the CNN layer. The output formula is: H pool (t)=max(H(t),H(t+1),...,H(t+p-1)); Among them, H pool (t) represents the output of the pooling operation at time step t, H(t) represents the output of the convolutional layer at time step t, and p represents the size of the pooling window; the output shape after pooling is 6. The internal threat detection method based on CNN-LSTM algorithm according to claim 1 is characterized in that: The parameter design of the LSTM unit in the LSTM layer includes: Input gate weight: W i ∈R h×(D+h) ; Forget gate weight: W f ∈R h×(D+h) ; Output gate weight: W o ∈R h×(D+h) ; Memory unit state weight: W c ∈R h×(D+h) ; Input gate bias: b i ∈R h ; Forget gate bias: b f ∈R h ; Output gate bias: b o ∈R h ; Memory cell state bias: b c ∈R h ; Among them, R h×(D+h) is the LSTM weight matrix, R h is the bias matrix, h is the number of LSTM hidden units, and D is the input feature dimension; The calculation formula of LSTM unit is: Input gate: I t =σ(W i ·[H t-1 , x t ]+b i ); Forget Gate: F t =σ(W f ·[H t-1 , x t ]+b f ); Output gate: O t =σ(W o ·[H t-1 , x t ]+b o ); Memory unit status update: New memory cell state: New hidden state: H t =O t *tanh(C t ); Among them, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, [H t-1 , x t ] represents the hidden state H of the previous time step t-1 and the input x at the current time step t The concatenation of the final hidden state h T The shape is (N, h), where N is the batch size.

7. The internal threat detection method based on CNN-LSTM algorithm according to claim 6 is characterized in that: The fully connected layer maps the input feature vector to the output classification label space through linear transformation, and the formula is: z=W·h T +b; Where W∈R c×h is the weight matrix, c represents the number of output categories; b∈R c Represents the bias vector; z∈R N×c is the output matrix of the fully connected layer, with a shape of (N, c), representing the score of each sample in each category; The Softmax activation function is used to convert the linear transformation result z into a category probability distribution. The formula is: in, represents the predicted probability of the a-th class, z a is the linear transformation output corresponding to the ath type, z b is the linear transformation output corresponding to all categories; the final output of the fully connected layer is the probability distribution matrix The shape is (N, c), which indicates the probability that each sample belongs to each category.

8. The internal threat detection method based on CNN-LSTM algorithm according to claim 1 is characterized in that: The CNN-LSTM model was optimized using the Adam optimizer. The learning rate of the CNN layer was set to 0.001, the convolution kernel sizes were 2, 3, and 4, the pooling window size was 2x2, and the Dropout probability was 0.

5. The number of hidden units in the LSTM layer was set to 128.

9. The internal threat detection method based on CNN-LSTM algorithm according to claim 1 is characterized in that: The accuracy, precision, recall rate and AUC value under the ROC curve are used in combination with the cross entropy loss function to comprehensively evaluate the performance of the CNN-LSTM model.

Images