An insider threat detection method based on CNN-LSTM algorithm

Abstract

The present invention discloses an internal threat detection method based on a CNN-LSTM algorithm, which relates to the field of network information security. The method comprises the following steps: obtaining user behavior data and preprocessing to obtain a user behavior feature sequence; inputting the behavior feature sequence into a trained CNN-LSTM model and outputting a threat behavior detection result; the CNN-LSTM model comprises an input layer, a CNN layer, an LSTM layer, and an output layer connected in sequence; the CNN layer extracts local features from the input behavior feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features from the input feature graph and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer that outputs the threat behavior detection result through a linear transformation. The present invention can effectively improve the efficiency and accuracy of internal threat detection in information security and data asset protection, thereby improving the security of enterprise information data.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and more particularly to an internal threat detection method based on a CNN-LSTM algorithm. Background Art

[0002] With the rapid development and widespread application of Internet technology, the information security and data asset protection issues of companies and enterprises have become increasingly prominent.

[0003] Compared to external threats, insider threats are often carried out by company insiders, resulting in significant losses to the enterprise once they occur. Therefore, insider threats have become a major concern in today's enterprise cybersecurity landscape. According to an insider threat survey, over 70% of organizations are extremely concerned about insider threats, with less than 5% being unconcerned. According to Gartner's "2023 Global Cost of Insider Risk Report," the average annual cost of insider risk per organization has grown to $16.2 million. Malicious insider incidents, once they occur, are by far the most expensive, with an average cost of $701,500 per incident. However, unlike external attacks, insider threats primarily originate from within the organization. Therefore, insider threats generally inflict greater losses than external threats, are more evasive, and feature a diverse array of attackers and methods. This results in deficiencies in the accuracy and efficiency of existing insider threat detection methods.

[0004] Therefore, how to improve the accuracy and efficiency of internal threat detection is an urgent problem that technical personnel in this field need to solve. Summary of the Invention

[0005] In view of this, the present invention provides an internal threat detection method based on the CNN-LSTM algorithm, which significantly improves the accuracy and efficiency of internal threat detection by combining the two deep learning technologies of CNN and LSTM.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] The present invention discloses an internal threat detection method based on the CNN-LSTM algorithm, which specifically includes the following steps:

[0008] Obtain user behavior data and preprocess it to obtain the user's behavior feature sequence;

[0009] Input the behavioral feature sequence into the trained CNN-LSTM model and output the threat behavior detection result;

[0010] The CNN-LSTM model includes an input layer, a CNN layer, an LSTM layer, and an output layer connected in sequence; the CNN layer extracts local features from the input behavioral feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features from the input feature map and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer that outputs threat behavior detection results through linear transformation.

[0011] Furthermore, the preprocessing includes: extracting time series features from file operations, email records, login logs, device records and network access logs through a sliding window mechanism, and timestamping the data and constructing behavior sequences.

[0012] Furthermore, the behavior feature sequence data is in the shape of {N, T, k}, where N is the batch size, T is the time step, and k is the number of features; the user's daily operation behavior features are expressed as Among them, S = {1, 2, 3, ..., g} represents the user's internal personnel set, and g is the total number of internal employees.

[0013] Furthermore, the CNN layer performs a convolution operation on the input behavioral features, and the output of the convolution kernel is:

[0014]

[0015] Among them, H i (t) represents the output of the i-th convolution kernel in the convolution layer at time step t, j represents the offset of the time step, l represents the dimension index of the feature, k represents the size of the convolution kernel, W i (j, l) represents the weight of the convolution kernel, X(t+j-1, l) represents the eigenvalue of the input data, b i Represents the bias term of the convolution kernel;

[0016] For the weights and biases of the i-th convolution kernel, the feature map shape generated at time step t is {N, T-k+1}, and the convolution layer output feature map shape is {N, T-k+1, F}, where F is the total number of convolution kernels.

[0017] Furthermore, the features output by the convolutional layer are processed using maximum pooling to reduce the dimensionality and obtain the final output of the CNN layer. The output formula is:

[0018] H pool (t)=max(H(t),H(t+1),…,H(t+p-1));

[0019] Among them, H pool(t) represents the output of the pooling operation at time step t, H(t) represents the output of the convolutional layer at time step t, and p represents the size of the pooling window; the output shape after pooling is

[0020] Furthermore, the parameter design of the LSTM unit in the LSTM layer includes:

[0021] Input gate weight: W i ∈R h×(D+h) ;

[0022] Forget gate weight: W f ∈R h×(D+h) ;

[0023] Output gate weight: W o ∈R h×(D+h) ;

[0024] Memory unit state weight: W c ∈R h×(D+h) ;

[0025] Input gate bias: b i ∈R h ;

[0026] Forget gate bias: b f ∈R h ;

[0027] Output gate bias: b o ∈R h ;

[0028] Memory cell state bias: b c ∈R h ;

[0029] Among them, R h×(D+h) is the LSTM weight matrix, R h is the bias matrix, h is the number of LSTM hidden units, and D is the input feature dimension;

[0030] The calculation formula of LSTM unit is:

[0031] Input gate: I t =σ(W i ·[H t-1 ,x t ]+b i );

[0032] Forget Gate: F t =σ(W f ·[H t-1 ,x t ]+b f );

[0033] Output gate: O t =σ(W o ·[H t-1 ,x t ]+b o );

[0034] Memory unit status update:

[0035] New memory cell state:

[0036] New hidden state: H t =O t *tanh(C t );

[0037] Among them, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, [H t-1 ,x t ] represents the hidden state H of the previous time step t-1 and the input x at the current time step t The concatenation of the hidden state h at the final time step T The shape is (N,h), where N is the batch size.

[0038] Furthermore, the fully connected layer maps the input feature vector to the output classification label space through linear transformation, and the formula is:

[0039] z=W·h T +b;

[0040] Where W∈R c×h is the weight matrix, c represents the number of output categories; b∈R c Represents the bias vector; z∈R N×c is the output matrix of the fully connected layer, with a shape of (N, c), which represents the score of each sample in each category;

[0041] The Softmax activation function is used to convert the linear transformation result z into a category probability distribution. The formula is:

[0042]

[0043] in, represents the predicted probability of class a, z a is the linear transformation output corresponding to the a-th category, z b is the linear transformation output corresponding to all categories; the final output of the fully connected layer is the probability distribution matrix The shape is (N,c), which represents the probability that each sample belongs to each category.

[0044] Furthermore, the CNN-LSTM model was optimized using the Adam optimizer, with the learning rate of the CNN layer set to 0.001, the convolution kernel sizes to 2, 3, and 4, the pooling window size to 2x2, and the dropout probability to 0.5; and the number of hidden units in the LSTM layer was set to 128.

[0045] Furthermore, the performance of the CNN-LSTM model was comprehensively evaluated using the accuracy, precision, recall rate, and AUC value under the ROC curve in combination with the cross-entropy loss function.

[0046] Through the above technical solution, it can be seen that compared with the existing technology, the present invention discloses a method for detecting internal threats based on the CNN-LSTM algorithm. By combining the two deep learning technologies of CNN and LSTM, the accuracy and efficiency of internal threat detection are significantly improved; combining the advantages of convolutional neural networks for local feature extraction and the advantages of long and short-term memory neural networks for time series processing, it has a good effect on training and detecting abnormal user behavior; compared with existing internal detection models, the feature selection process is simplified, the model accuracy and stability are improved, and compared with the single CNN or LSTM model, the CNN-LSTM model predicts less false alarm rate and accuracy. The present invention can effectively improve the detection efficiency and accuracy of internal threats in information security and data asset protection, thereby improving the security of enterprise information data. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0048] Figure 1 This is a schematic diagram of the overall structure of the CNN-LSTM model in an embodiment of the present invention.

[0049] Figure 2 Schematic diagram of the CNN layer structure of an embodiment of the present invention.

[0050] Figure 3 Schematic diagram of the LSTM unit structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] The embodiment of the present invention discloses an internal threat detection method based on the CNN-LSTM algorithm, and the specific steps are as follows:

[0053] Obtain user behavior data and preprocess it to obtain the user's behavior feature sequence;

[0054] Input the behavioral feature sequence into the trained CNN-LSTM model and output the threat behavior detection results;

[0055] like Figure 1 As shown in the figure, the CNN-LSTM model includes an input layer, a CNN layer, an LSTM layer, and an output layer connected in sequence; the CNN layer extracts local features from the input behavioral feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features from the input feature map and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer that outputs the threat behavior detection results through linear transformation.

[0056] In a specific embodiment, preprocessing includes extracting time series features from file operations, email records, login logs, device records, and network access logs using a sliding window mechanism, annotating the data with timestamps, and constructing behavioral sequences. User behavior data is processed using feature statistics and data preprocessing to construct behavioral feature sequences that can be input into the CNN layer for processing.

[0057] In a specific embodiment, the behavior feature sequence data shape is {N, T, k}, where N is the batch size, T is the time step, and k is the number of features; the user's daily operation behavior features are expressed as Among them, S = {1, 2, 3, ..., g} represents the user's internal personnel set, and g is the total number of internal employees.

[0058] Specifically, since user behavior logs contain multiple aspects of user operations, such as records of files, emails, devices, logins, etc., in order to more accurately capture abnormal user behavior operations, we construct time series features of user operation behaviors based on the day dimension, and construct the user's normal behavior, so as to capture abnormal user behavior. Construct the user's daily operation behavior features As shown in Table 1:

[0059] Table 1 User action behavior characteristics

[0060]

[0061] In a specific embodiment, the CNN layer structure is as follows: Figure 2 As shown in the figure, the CNN layer performs a convolution operation on the input behavioral features to more comprehensively obtain the local features and important features that affect user behavior. The output of the convolution kernel is:

[0062]

[0063] Among them, H i (t) represents the output of the i-th convolution kernel in the convolution layer at time step t, j represents the offset of the time step, l represents the dimension index of the feature, k represents the size of the convolution kernel, W i (j, l) represents the weight of the convolution kernel, X(t+j-1, l) represents the eigenvalue of the input data, b i Represents the bias term of the convolution kernel;

[0064] For the weights and biases of the i-th convolution kernel, the feature map shape generated at time step t is {N, T-k+1}, and the convolution layer output feature map shape is {N, T-k+1, F}, where F is the total number of convolution kernels.

[0065] In a specific embodiment, the features output by the convolutional layer are subjected to dimensionality reduction processing using maximum pooling to obtain the final output of the CNN layer. The output formula is:

[0066] H pool (t)=max(H(t),H(t+1),…,H(t+p-1));

[0067] Among them, H pool (t) represents the output of the pooling operation at time step t, H(t) represents the output of the convolutional layer at time step t, and p represents the size of the pooling window; the output shape after pooling is

[0068] In a specific embodiment, the LSTM layer structure is as follows: Figure 3 As shown in the figure, the LSTM layer continuously updates memory cells through judgment, and learns user behavior in a time dimension. The parameter design of the LSTM unit in the LSTM layer includes:

[0069] Input gate weight: W i ∈R h×(D+h) ;

[0070] Forget gate weight: W f ∈R h×(D+h) ;

[0071] Output gate weight: W o ∈R h×(D+h) ;

[0072] Memory unit state weight: W c ∈R h×(D+h) ;

[0073] Input gate bias: b i ∈R h ;

[0074] Forget gate bias: b f ∈R h ;

[0075] Output gate bias: b o ∈R h ;

[0076] Memory cell state bias: b c ∈R h ;

[0077] Among them, R h×(D+h) is the LSTM weight matrix, R h is the bias matrix with dimension h, where h is the number of LSTM hidden units, i.e. the dimension of the output vector at each time step, and D is the input feature dimension;

[0078] The calculation formula of LSTM unit is:

[0079] Input gate: I t =σ(W i ·[H t-1 ,x t ]+b i );

[0080] Forget Gate: F t =σ(W f ·[H t-1 ,x t ]+b f );

[0081] Output gate: O t =σ(W o ·[H t-1 ,x t ]+b o );

[0082] Memory unit status update:

[0083] New memory cell state:

[0084] New hidden state: H t =Ot *tanh(C t );

[0085] Among them, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, [H t-1 ,x t ] represents the hidden state H of the previous time step t-1 and the input x at the current time step t The concatenation of the hidden state h at the final time step T The shape is (N, h), where N represents the batch size, which represents the number of samples processed at a time.

[0086] In a specific embodiment, the fully connected layer maps the input feature vector to the output classification label space through a linear transformation, as follows:

[0087] z=W·h T +b;

[0088] Where W∈R c×h As the weight matrix, the hidden state h of the last time step of LSTM T Mapped to the output space; c represents the number of output categories, that is, the number of categories that need to be classified; b∈R c Represents the bias vector, with a shape of (c), which represents the bias of each category; z∈R N×c is the output matrix of the fully connected layer, with a shape of (N, c), which represents the score of each sample in each category;

[0089] The Softmax activation function is used to convert the linear transformation result z into a category probability distribution. The formula is:

[0090]

[0091] in, represents the predicted probability of class a, z a is the linear transformation output corresponding to the a-th category, z b It is the linear transformation output corresponding to all categories; the final output of the fully connected layer is the probability distribution matrix The shape is (N,c), which represents the probability that each sample belongs to each category.

[0092] In a specific embodiment, the CNN-LSTM model is optimized using the Adam optimizer, the learning rate of the CNN layer is set to 0.001, the convolution kernel sizes are 2, 3, and 4, the pooling window size is 2x2, and the dropout probability is 0.5; the number of hidden units in the LSTM layer is set to 128.

[0093] In a specific embodiment, the performance of the CNN-LSTM model is comprehensively evaluated using accuracy, precision, recall, and the AUC value under the ROC curve in combination with the cross-entropy loss function.

[0094] Specifically, before evaluating the CNN-LSTM model, you need to understand four core concepts:

[0095] True Positive (TP): refers to the situation where the classifier correctly identifies an actual positive example as a positive example;

[0096] True negative (TN): refers to the situation where the classifier correctly identifies an actual negative example as a negative example;

[0097] False positive (FP): refers to the situation where the classifier mistakenly identifies a negative example as a positive example;

[0098] False Negative (FN): This refers to the situation where the classifier mistakenly identifies a positive example as a negative example.

[0099] Based on the above four indicators, we can further calculate the three evaluation indicators of accuracy, precision, and recall. The model is comprehensively evaluated using the four indicators of loss, accuracy, precision, and recall, as well as the ROC curve.

[0100] a. Accuracy: This is used to measure the correctness of the model's prediction results. It represents the proportion of correctly predicted samples among all samples. The formula is:

[0101]

[0102] b. Precision: This mainly focuses on the positive predictions, indicating the proportion of samples that are actually positive among those predicted by the model. The formula is:

[0103]

[0104] c. Recall: This is a key indicator for evaluating the model's ability to identify positive samples. It represents the proportion of samples that are actually positive that the model correctly identifies as positive. The formula is:

[0105]

[0106] d. Loss is a key metric used in machine learning and deep learning models to measure the difference between the model's predicted results and the actual results. This technique uses the cross-entropy loss function to calculate the model's loss:

[0107]

[0108] Where n represents the number of samples; y i Indicates the true label of the i-th sample, which takes a value of 0 or 1; It represents the probability that the i-th sample is predicted to be a positive class, ranging from 0 to 1.

[0109] In a specific embodiment, the present invention can be implemented in intelligent systems involving the recording and use of internal operating systems. It can be applied to sectors with high data security requirements, such as finance, healthcare, and government agencies, to detect threats to network data and provide more sophisticated protection. It can be applied to various areas involving network information security, identifying and preventing internal personnel (such as employees and partners) from abusing permissions, stealing data, or damaging systems. By analyzing user behavior logs and monitoring abnormal behavior operations, it can protect sensitive information, maintain system security, and reduce internal security risks in intelligent systems.

[0110] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0111] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting internal threats based on the CNN-LSTM algorithm, characterized in that: The specific steps are as follows: Obtain user behavior data and preprocess it to obtain the user's behavior feature sequence; Input the behavioral feature sequence into the trained CNN-LSTM model and output the threat behavior detection result; The CNN-LSTM model includes an input layer, a CNN layer, an LSTM layer, and an output layer connected in sequence; the CNN layer extracts local features from the input behavioral feature sequence and outputs them to the LSTM layer; the LSTM layer extracts time dimension features from the input feature map and inputs the hidden state of the final time step into the output layer; the output layer is a fully connected layer that outputs threat behavior detection results through linear transformation; The behavior feature sequence data is in the shape of {N, T, n}, where N is the batch size, T is the time step, and n is the number of features. The user's daily operation behavior features are expressed as Among them, S = {1, 2, 3, ..., g} represents the user's internal personnel set, and g is the total number of internal employees; The CNN layer performs a convolution operation on the input behavioral features, and the output of the convolution kernel is: Among them, H i (t) represents the output of the i-th convolution kernel in the convolution layer at time step t, j represents the offset of the time step, l represents the dimension index of the feature, k represents the size of the convolution kernel, W i (j, l) represents the weight of the convolution kernel, X(t+j-1, l) represents the eigenvalue of the input data, b i Represents the bias term of the convolution kernel; For the weight and bias of the i-th convolution kernel, the feature map shape generated at time step t is {N, T-n+1}, and the convolution layer output feature map shape is {N, T-n+1, ​​F}, where F is the total number of convolution kernels; The features output by the convolutional layer are processed using maximum pooling to reduce the dimensionality and obtain the final output of the CNN layer. The output formula is: H pool (t)=max(H(t),H(t+1),…,H(t+p-1)); Among them, H pool (t) represents the output of the pooling operation at time step t, H(t) represents the output of the convolutional layer at time step t, and p represents the size of the pooling window; the output shape after pooling is 2. The internal threat detection method based on the CNN-LSTM algorithm according to claim 1 is characterized in that: The preprocessing includes: extracting time series features from file operations, email records, login logs, device records and network access logs through a sliding window mechanism, and timestamping the data and constructing behavior sequences.

3. The internal threat detection method based on the CNN-LSTM algorithm according to claim 1 is characterized in that: The parameter design of the LSTM unit in the LSTM layer includes: Input gate weight: W i ∈R h×(D+h) ; Forget gate weight: W f ∈R h×(D+h) ; Output gate weight: W o ∈R h×(D+h) ; Memory unit state weight: W c ∈R h×(D+h) ; Input gate bias: b i ∈R h ; Forget gate bias: b f ∈R h ; Output gate bias: b o ∈R h ; Memory cell state bias: b c ∈R h ; Among them, R h×(D+h) is the LSTM weight matrix, R h is the bias matrix, h is the number of LSTM hidden units, and D is the input feature dimension; The calculation formula of LSTM unit is: Input gate: I t =σ(W i ·[H t-1 ,x t ]+b i ); Forget Gate: F t =σ(W f ·[H t-1 ,x t ]+b f ); Output gate: O t =σ(W o ·[H t-1 ,x t ]+b o ); Memory unit status update: New memory cell state: New hidden state: H t =O t *tanh(C t ); Among them, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, [H t-1 ,x t ] represents the hidden state H of the previous time step t-1 and the input x at the current time step t The concatenation of the hidden state h at the final time step T The shape is (N,h), where N is the batch size.

4. The internal threat detection method based on the CNN-LSTM algorithm according to claim 3 is characterized in that: The fully connected layer maps the input feature vector to the output classification label space through linear transformation, the formula is: z=W·h T +b; Where W∈R c×h is the weight matrix, c represents the number of output categories; b∈R c Represents the bias vector; z∈R N×c is the output matrix of the fully connected layer, with a shape of (N, c), which represents the score of each sample in each category; The Softmax activation function is used to convert the linear transformation result z into a category probability distribution. The formula is: in, represents the predicted probability of class a, z a is the linear transformation output corresponding to the a-th category, z b is the linear transformation output corresponding to all categories; the final output of the fully connected layer is the probability distribution matrix The shape is (N,c), which represents the probability that each sample belongs to each category.

5. The internal threat detection method based on the CNN-LSTM algorithm according to claim 1 is characterized in that: The CNN-LSTM model was optimized using the Adam optimizer. The learning rate of the CNN layer was set to 0.001, the convolution kernel sizes were 2, 3, and 4, the pooling window size was 2x2, and the dropout probability was 0.

5. The number of hidden units in the LSTM layer was set to 128.

6. The internal threat detection method based on the CNN-LSTM algorithm according to claim 1 is characterized in that: The performance of the CNN-LSTM model was comprehensively evaluated using the accuracy, precision, recall rate, and AUC value under the ROC curve combined with the cross-entropy loss function.

Images