User behavior detection method and system

Abstract

The embodiment of the invention discloses a user behavior detection method and system. The method comprises the following steps: acquiring network traffic data of a network key node through a traffic acquisition module, and determining target traffic data based on a preset screening condition and the network traffic data; determining a target network protocol and a target protocol type corresponding to the target network protocol based on a protocol analysis engine and the received target traffic data through a protocol analysis module, and performing feature extraction on the target network protocol based on the target protocol type to determine a protocol feature vector corresponding to the target network protocol; determining a first user behavior detection result based on the received protocol feature vector and a first classification model through a model identification module, converting the protocol feature vector into a protocol feature map, and determining a second user behavior detection result based on the protocol feature map and a second classification model, therefore, the classification results of the first classification model and the second classification model are integrated, accurate judgment of the user behavior is realized, and the accuracy of user behavior detection is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a user behavior detection method and system. Background Art

[0002] With the acceleration of globalization and digitalization, the Internet has been deeply integrated into people's lives and work, but it has also brought many security challenges. Abnormal user behavior, such as illegal and irregular cross-border behavior, has become more hidden and difficult to detect with the help of encrypted virtual private network technology. At present, most of the existing network monitoring methods focus on monitoring plaintext network protocols and known applications, and their ability to parse encrypted communications is extremely limited. In addition, when faced with disguised or mutated encryption protocols, existing monitoring methods often cannot accurately judge their true intentions, resulting in the inability to accurately identify or detect whether user behavior is abnormal. For example, some simple port blocking strategies lose their effect when faced with new encryption protocols that use non-standard ports for communication. It can be seen that there is an urgent need for a way to accurately identify or detect whether user behavior is abnormal. Summary of the invention

[0003] The embodiments of the present invention provide a user behavior detection method and system to integrate the classification results of a first classification model and a second classification model, thereby achieving accurate judgment of user behavior and improving the accuracy of user behavior detection.

[0004] In a first aspect, an embodiment of the present invention provides a user behavior detection method, comprising:

[0005] The traffic collection module collects network traffic data of key network nodes based on a preset collection strategy, and filters the network traffic data based on preset screening conditions to determine the target traffic data corresponding to the current collection cycle, and sends the target traffic data to the protocol analysis module;

[0006] The protocol analysis module performs network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and extracts features of the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and sends the protocol feature vector to the model recognition module;

[0007] A first user behavior detection result is determined based on the received protocol feature vector and the first classification model through the model identification module, and the protocol feature vector is converted into a protocol feature graph based on a preset format conversion method, and a second user behavior detection result is determined based on the protocol feature graph and the second classification model, and a target user behavior detection result is determined based on the first user behavior detection result and the second user behavior detection result.

[0008] Optionally, the method also includes: if it is detected through the protocol analysis module that the target protocol type is an unencrypted protocol type, then unencrypted feature extraction is performed on the target network protocol to determine a first protocol feature vector corresponding to the target network protocol; the first protocol feature vector includes: at least one of a protocol request method, access information and a port number; if it is detected through the protocol analysis module that the target protocol type is an encrypted protocol type, then encrypted feature extraction is performed on the target network protocol to determine a second protocol feature vector corresponding to the target network protocol; the second protocol feature vector includes: at least one of a cryptographic suite and a certificate fingerprint.

[0009] Optionally, the method further includes: converting the protocol feature vector into an image format through a model recognition module based on a preset deep learning algorithm or a preset format conversion model to obtain a converted protocol feature graph.

[0010] Optionally, the method also includes: the first classification model is a pre-trained machine learning model; the second classification model is a pre-trained deep learning model.

[0011] Optionally, the method also includes: inputting the protocol feature map into a second classification model through a model recognition module, performing image feature extraction on the protocol feature map in the second classification model to obtain protocol image features, and performing classification prediction based on the protocol image features to determine a classification prediction result; and determining a second user behavior detection result based on the output of the second classification model through the model recognition module.

[0012] Optionally, the method also includes: if it is detected through the model identification module that the first user behavior detection result and the second user behavior detection result are consistent, the consistent result is determined as the target user behavior detection result; if it is detected through the model identification module that the first user behavior detection result and the second user behavior detection result are inconsistent, the target user behavior detection result is determined based on the first classification weight corresponding to the first classification model, the second classification weight corresponding to the second classification model, the first user behavior detection result and the second user behavior detection result.

[0013] Optionally, the method also includes: sending the protocol feature vector to the behavior analysis module through the protocol analysis module; sending the target user behavior detection result to the behavior analysis module through the model recognition module; obtaining the network DNS message corresponding to the network traffic data through the DNS monitoring module, and parsing the network DNS message to determine the message parsing information, and comparing the message parsing information with a preset knowledge base to determine the comparison result, and marking the access request information in the network DNS message based on the comparison result, and sending the access request information to the behavior analysis module; constructing a target user portrait based on the received protocol feature vector, the target user behavior detection result and the access request information through the behavior analysis module, and determining the correlation between behaviors based on the target user portrait and data mining technology, and determining the user behavior based on the correlation between behaviors to determine the target determination result of the user behavior.

[0014] Optionally, the method further includes: if the behavior analysis module detects that the target judgment result is abnormal user behavior, triggering an alarm and recording user information, and updating a preset knowledge base based on the protocol feature vector corresponding to the target judgment result, the target user behavior detection result and the access request information.

[0015] Optionally, the method also includes: acquiring multiple current intelligence data based on a preset acquisition method through an intelligence acquisition module, cross-validating the multiple current intelligence data to determine reference intelligence data, extracting key information from the reference intelligence data, and storing the extracted key information in a preset knowledge base.

[0016] In a second aspect, an embodiment of the present invention further provides a user behavior detection system, the system comprising: a traffic collection module, a protocol analysis module and a model identification module;

[0017] The traffic collection module is used to collect network traffic data of key network nodes based on a preset collection strategy, and to filter the network traffic data based on preset filtering conditions to determine the target traffic data corresponding to the current collection period, and to send the target traffic data to the protocol analysis module;

[0018] The protocol analysis module is used to perform network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and to perform feature extraction on the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and send the protocol feature vector to the model identification module;

[0019] A model identification module is used to determine a first user behavior detection result based on a received protocol feature vector and a first classification model, and convert the protocol feature vector into a protocol feature graph based on a preset format conversion method, and determine a second user behavior detection result based on the protocol feature graph and a second classification model, and determine a target user behavior detection result based on the first user behavior detection result and the second user behavior detection result.

[0020] The technical solution of the embodiment of the present invention is to collect network traffic data of key network nodes based on a preset collection strategy through a traffic collection module, and filter the network traffic data based on preset filtering conditions to determine the target traffic data corresponding to the current collection period, and send the target traffic data to a protocol analysis module; the protocol analysis module performs network protocol analysis on the received target traffic data based on a protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and extracts features of the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and sends the protocol feature vector to a model recognition module; the model recognition module determines a first user behavior detection result based on the received protocol feature vector and a first classification model, and converts the protocol feature vector into a protocol feature graph based on a preset format conversion method, and determines a second user behavior detection result based on the protocol feature graph and the second classification model, and determines the target user behavior detection result based on the first user behavior detection result and the second user behavior detection result, thereby combining the classification results of the first classification model and the second classification model, that is, the first user behavior detection result and the second user behavior detection result, to achieve accurate judgment of user behavior, thereby improving the accuracy of user behavior detection.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a user behavior detection method provided in Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of a user behavior detection method provided by Embodiment 2 of the present invention;

[0025] Figure 3 It is a structural diagram of a user behavior detection system provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 A flowchart of a user behavior detection method is provided for the first embodiment of the present invention. This embodiment can be applied to detecting whether there is abnormality in user behavior on the network. The method can be executed by a user behavior detection system, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0030] S110. The traffic collection module collects network traffic data of key network nodes based on a preset collection strategy, and filters the network traffic data based on preset filtering conditions to determine target traffic data corresponding to the current collection cycle, and sends the target traffic data to the protocol analysis module.

[0031] Among them, the preset collection strategy may refer to a preset data collection strategy. For example, the preset collection strategy may include but is not limited to the number of times per second that the collection frequency can be set to capture data packets, and the collection range can be limited to a specific IP segment or port range. Key network nodes may refer to pre-arranged network nodes that need to be monitored. For example, key network nodes may include but are not limited to Internet gateways, large data centers, and enterprise network boundaries. Network traffic data may refer to data packets passing through key network nodes. Preset filtering conditions may refer to pre-set conditions for filtering out data that you want to pay attention to. For example, preset filtering conditions may include but are not limited to preset IP address ranges and preset port numbers. The preset IP address ranges and preset port numbers may be IP addresses and port numbers with a higher probability of abnormal user behavior based on a preset knowledge base or expert experience.

[0032] Specifically, the traffic collection module uses high-performance network packet capture technology at key network nodes to capture network traffic data according to preset collection strategies to ensure data integrity and accuracy. The traffic collection module performs multi-dimensional preliminary processing on network traffic data to remove invalid data packets, such as damaged data packets, data packets whose length does not meet protocol specifications, etc., and compares key features of data packets such as source IP, destination IP, port number and timestamp to determine whether the data is repeated, thereby removing duplicate data, and filtering the traffic data of interest according to preset screening conditions, such as preset IP address range and preset port number, to obtain the target traffic data corresponding to the current collection cycle, and send the target traffic data to the protocol analysis module. The preset IP address range can be set to focus on a specific country or region, and the preset port number can be used to filter ports used for common abnormal applications (such as illegal cross-border applications), thereby improving data processing efficiency.

[0033] It should be noted that before sending the target traffic data to the protocol analysis module, the target traffic data can also be format converted into a data format suitable for the protocol analysis module, such as the PCAP file format, and the target traffic data after format conversion can be cleaned and normalized, such as unifying the time format and parsing the header data packet information, and the normalized target traffic data can be sent to the protocol analysis module.

[0034] S120. Perform network protocol analysis on the received target traffic data based on the protocol parsing engine through the protocol analysis module to determine the target network protocol and the target protocol type corresponding to the target network protocol, perform feature extraction on the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and send the protocol feature vector to the model recognition module.

[0035] The target network protocol may refer to the network protocol used in the target traffic data transmission process. The target protocol type may include an unencrypted protocol type and an encrypted protocol type. The protocol feature vector may refer to the key features of the target network protocol. The protocol feature vector may be used to determine whether the user behavior is abnormal.

[0036] Specifically, after receiving the target traffic data, the protocol analysis module uses an efficient protocol analysis engine to deeply analyze various network protocols to obtain the target network protocol and the target protocol type corresponding to the target network protocol. Different feature extraction methods are used for different types of target network protocols to extract features, obtain target protocol features, and quantize and encode the extracted target network protocols to obtain protocol feature vectors, which are then sent to the model recognition module. The storage structure of the protocol feature vector can also be optimized to reduce data storage space and transmission overhead.

[0037] On the basis of the above technical solution, "extracting features of the target network protocol based on the target protocol type through the protocol analysis module to determine the protocol feature vector corresponding to the target network protocol" may include: if the protocol analysis module detects that the target protocol type is an unencrypted protocol type, then performing unencrypted feature extraction on the target network protocol to determine the first protocol feature vector corresponding to the target network protocol; the first protocol feature vector includes: at least one of the protocol request mode, access information and port number; if the protocol analysis module detects that the target protocol type is an encrypted protocol type, then performing encrypted feature extraction on the target network protocol to determine the second protocol feature vector corresponding to the target network protocol; the second protocol feature vector includes: at least one of the cryptographic suite and the certificate fingerprint.

[0038] Among them, the target network protocol of the unencrypted protocol type may include but is not limited to HTTP and FTP. The protocol request method may be the request method GET or POST in the HTTP protocol. The access information may be used to determine the website or resource accessed. The access information may be a web page address (Universal Resource Locator, URL). The port number may be the port used by the application. The target network protocol of the encrypted protocol type may include but is not limited to a virtual private network (Virtual Private Network, VPN) protocol and an encrypted mail protocol. The cipher suite and certificate fingerprint may be used to identify the encryption algorithm and the certificate authority to determine the encryption configuration.

[0039] Specifically, for the target network protocol of the unencrypted protocol type, the protocol parsing engine can directly identify the first protocol feature vector. For the target network protocol of the encrypted protocol type, the protocol parsing engine calculates the randomness of the message, such as judging the encryption strength and randomness by entropy calculation, thereby judging whether it has been encrypted and the encryption strength and method, and extracting the TLS cipher suite and certificate fingerprint according to the judged encryption strength and method to obtain the second protocol feature vector.

[0040] It should be noted that TLS cipher suite fingerprint technology can accurately extract the combined features of cipher suites in the TLS protocol, just like configuring a unique "fingerprint" identifier for each VPN protocol. TLS certificate fingerprint technology analyzes the characteristic information of the certificate in detail, including key elements such as the certificate authority, validity period, and public key.

[0041] S130. Determine a first user behavior detection result based on the received protocol feature vector and the first classification model through a model identification module, convert the protocol feature vector into a protocol feature graph based on a preset format conversion method, determine a second user behavior detection result based on the protocol feature graph and the second classification model, and determine a target user behavior detection result based on the first user behavior detection result and the second user behavior detection result.

[0042] Among them, the first classification model is a pre-trained machine learning model. The second classification model is a pre-trained deep learning model. The first classification model can be a classification model constructed using a machine learning algorithm such as a support vector machine or a random forest. Using transfer learning technology, the model is trained based on a general data set (such as a public network traffic data set), and then fine-tuned for the task of this system (abnormal user behavior detection task), so as to adjust some parameters of the model so that the model can adapt to specific encryption protocols and application monitoring needs. It is also possible to use adversarial generative networks to expand training data, generate virtual data similar to real data, increase the diversity of training samples, and enhance the generalization ability of the model. The classification model has the ability to automatically learn and adapt, and can automatically update the model as encryption technology develops, so that it can quickly respond to new encryption protocols and applications, reduce manual maintenance costs, and improve monitoring and recognition efficiency. For example, newly emerging quantum encryption technology derivative protocols can be included in the recognition scope in a timely manner, improve the system's intelligence level, and ensure the continuous monitoring capability of abnormal user behaviors such as illegal cross-border behaviors. The user behavior detection result may refer to the result of determining whether there is abnormal user behavior in the network traffic data. The protocol feature map may refer to a protocol feature vector in image format. For example, abnormal user behavior may be, but is not limited to, illegal cross-border behavior using encrypted virtual private networks (VPNs) and applications.

[0043] Specifically, the received protocol feature vector is preprocessed by the model recognition module, including data normalization, so as to map data of different ranges to specific intervals, such as normalizing numerical features to the interval [0,1] to improve the convergence speed and accuracy of the algorithm, and outlier processing, so as to identify and correct or delete obviously abnormal data points, and obtain the preprocessed protocol feature vector. The preprocessed protocol feature vector is input into the first classification model for feature screening, so as to remove redundant or irrelevant features of user behavior to reduce the data dimension, and the screening result is used for classification prediction to determine the first user behavior detection result. The preprocessed protocol feature vector is converted into a protocol feature graph based on a preset format conversion method. The preprocessed protocol feature vector is input into the second classification model for classification prediction to determine the second user behavior detection result, and the target user behavior detection result is determined based on the first user behavior detection result and the second user behavior detection result.

[0044] On the basis of the above technical solution, "converting the protocol feature vector into a protocol feature graph based on a preset format conversion method through a model recognition module" may include: converting the protocol feature vector into an image format based on a preset deep learning algorithm or a preset format conversion model through a model recognition module to obtain a converted protocol feature graph.

[0045] The protocol feature map may be, but is not limited to, a grayscale image.

[0046] Specifically, the protocol feature vector is converted into a grayscale image through a model recognition module based on a preset deep learning algorithm or a preset format conversion model, wherein the data byte value is mapped to the pixel grayscale value.

[0047] On the basis of the above technical solution, "determining the second user behavior detection result based on the protocol feature map and the second classification model through the model recognition module" may include: inputting the protocol feature map into the second classification model through the model recognition module, extracting image features of the protocol feature map in the second classification model to obtain protocol image features, and performing classification prediction based on the protocol image features to determine the classification prediction result; determining the second user behavior detection result based on the output of the second classification model through the model recognition module.

[0048] The protocol image feature may refer to a feature related to user behavior, such as an encryption algorithm or application behavior. The protocol image feature may include, but is not limited to, image texture and image pattern. The image pattern may be a specific byte sequence pattern or a data packet size distribution pattern. The image texture may be a specific texture.

[0049] Specifically, the protocol feature graph is input into the second classification model through the model recognition module, and the local features are extracted by using the multi-layer convolution layer in the second classification model, and the data dimension is reduced by using the pooling layer to reduce the amount of calculation, and the feature information is integrated by using the fully connected layer, so as to obtain the protocol image features, and the protocol image features are used for classification prediction to determine the classification prediction result. The second user behavior detection result is determined based on the output of the second classification model through the model recognition module.

[0050] On the basis of the above technical solution, "determining the target user behavior detection result based on the first user behavior detection result and the second user behavior detection result through the model identification module" may include: if it is detected through the model identification module that the first user behavior detection result and the second user behavior detection result are consistent, then the consistent result is determined as the target user behavior detection result; if it is detected through the model identification module that the first user behavior detection result and the second user behavior detection result are inconsistent, then based on the first classification weight corresponding to the first classification model, the second classification weight corresponding to the second classification model, the first user behavior detection result and the second user behavior detection result, the target user behavior detection result is determined.

[0051] The first classification weight may be a weight determined by the historical performance of the first classification model, such as a weight determined by the accuracy rate, recall rate, and other indicators of the first classification model in previous tests. The second classification weight may be a weight determined by the historical performance of the second classification model, such as a weight determined by the accuracy rate, recall rate, and other indicators of the second classification model in previous tests.

[0052] Specifically, if the model recognition module detects that the first user behavior detection result and the second user behavior detection result are inconsistent, the prediction probability corresponding to the inconsistent user behavior in the first user behavior detection result is weighted using the first classification weight to obtain a first weighted result, and the prediction probability corresponding to the inconsistent user behavior in the second user behavior detection result is weighted using the second classification weight to obtain a second weighted result, and the first weighted result and the second weighted result are averaged, thereby determining the target user behavior detection result based on the average processing result. Among them, a complete access traffic data can be understood as a user behavior.

[0053] The technical solution of the embodiment of the present invention is to collect network traffic data of key network nodes based on a preset collection strategy through a traffic collection module, and filter the network traffic data based on preset filtering conditions to determine the target traffic data corresponding to the current collection period, and send the target traffic data to the protocol analysis module; the protocol analysis module performs network protocol analysis on the received target traffic data based on a protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and extracts features of the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and sends the protocol feature vector to the model recognition module; the model recognition module determines a first user behavior detection result based on the received protocol feature vector and a first classification model, and converts the protocol feature vector into a protocol feature graph based on a preset format conversion method, and determines a second user behavior detection result based on the protocol feature graph and the second classification model, and determines the target user behavior detection result based on the first user behavior detection result and the second user behavior detection result, thereby combining the classification results of the first classification model and the second classification model, that is, the first user behavior detection result and the second user behavior detection result, to achieve accurate judgment of user behavior, thereby improving the accuracy of user behavior detection.

[0054] Embodiment 2

[0055] Figure 2 This is a flowchart of a user behavior detection method provided in the second embodiment of the present invention. Based on the above embodiment, this embodiment adds a DNS monitoring module and a behavior analysis module, and describes the execution process in detail. The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here. Figure 2 As shown, the method includes:

[0056] S210. The traffic collection module collects network traffic data of key network nodes based on a preset collection strategy, and filters the network traffic data based on preset filtering conditions to determine target traffic data corresponding to the current collection cycle, and sends the target traffic data to the protocol analysis module.

[0057] S220. The protocol analysis module performs network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and performs feature extraction on the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and sends the protocol feature vector to the model identification module and the behavior analysis module.

[0058] S230. Determine a first user behavior detection result based on the received protocol feature vector and the first classification model through a model identification module, convert the protocol feature vector into a protocol feature graph based on a preset format conversion method, determine a second user behavior detection result based on the protocol feature graph and the second classification model, determine a target user behavior detection result based on the first user behavior detection result and the second user behavior detection result, and send the target user behavior detection result to the behavior analysis module.

[0059] S240. Obtain the network DNS message corresponding to the network traffic data through the DNS monitoring module, parse the network DNS message to determine the message parsing information, compare the message parsing information with a preset knowledge base to determine the comparison result, mark the access request information in the network DNS message based on the comparison result, and send the access request information to the behavior analysis module.

[0060] Among them, DNS may refer to Domain Name System. DNS can be used to serve TCP / IP networks. DNS converts human-readable domain names into machine-readable IP addresses, allowing users to access websites and other online services by entering domain names without having to remember complex IP addresses. Message resolution information may include but is not limited to domain names, IP addresses, and access types. Domain names can be used to determine the websites or services accessed by users. IP addresses can be used to track data flows. Query types can be used to understand the purpose of DNS requests. The comparison results may include feature information related to VPN services or suspected VPN service-related features in DNS messages. Access request information may include but is not limited to source IP addresses and request time.

[0061] Specifically, the network DNS message corresponding to the network traffic data is obtained through the DNS monitoring module, and the multi-threaded parallel parsing technology is used to accurately extract key information such as domain name, IP address and query type, so as to start multiple threads to process different DNS messages at the same time and improve the parsing speed. At the same time, the cache mechanism is used to cache the resolved DNS records to reduce repeated parsing and improve the parsing efficiency. The message parsing information is compared with the VPN service-related features in the preset knowledge base to determine the comparison result. For example, an efficient string matching algorithm, such as the KMP algorithm, the Boyer-Moore algorithm, etc., is used to quickly find matching items in the preset knowledge base, that is, suspected VPN service-related features, such as specific domain name patterns (domain name keywords, suffixes, etc. related to known VPN services), abnormal query frequency (a large number of DNS queries of the same type in a short period of time), etc. Based on the comparison results, the access request information in the network DNS message is marked, such as the source IP address and the request time. The initiator of the behavior is determined by the source IP address, and the behavior time pattern is analyzed by the request time. The integrity and reliability of data transmission are ensured by a reliable transmission protocol, such as the TCP protocol, and the access request information is fed back to the behavior analysis module in a timely manner, providing an important basis for behavior analysis.

[0062] For example, on the other hand, the DNS monitoring module can also accurately extract the characteristic information related to VPN services in the DNS protocol by conducting comprehensive and in-depth packet capture and protocol analysis on mainstream cross-border VPN software, and build a knowledge base resource specifically for VPN and DNS resolution. In the packet capture process, professional network analysis tools are used to capture complex DNS messages and perform in-depth analysis on them to extract key characteristic information such as specific domain name resolution patterns (including frequent resolution of dynamically generated domain names, use of specific top-level domain names or subdomain name structures), DNS query time interval rules (such as a large number of DNS queries of the same type in a short period of time), and domain name suffixes related to known VPN services. Based on the knowledge base resources constructed with these characteristic information, in actual monitoring, by real-time monitoring of the DNS service during VPN communication, the captured DNS request and response information is quickly compared with the characteristics in the knowledge base resources. Once a matching suspected VPN cross-border service feature is found, the target DNS resolution domain name information is immediately sent for further verification, and the massive DNS log data is deeply processed in combination with big data analysis technology (such as data clustering, association rule mining, etc.), and the detailed behavior data such as the number of VPN users' resolutions of VPN resources, frequency, and the type of VPN application to which they belong are accurately obtained, so as to timely discover VPN cross-border service behavior.

[0063] S250. Build a target user portrait based on the received protocol feature vector, target user behavior detection results and access request information through the behavior analysis module, determine the correlation between behaviors based on the target user portrait and data mining technology, and determine the target determination result of the user behavior based on the correlation between behaviors.

[0064] Among them, the target user profile can be used to comprehensively describe the user's network behavior characteristics. The association relationship between behaviors can refer to the association relationship between the target user profile and the user's historical behavior and the association relationship between the target user profile and other users' abnormal behaviors. The target determination result can refer to the determination result of whether a single user's behavior is abnormal. For example, the target determination result can be, but is not limited to, the user uses overseas social applications or performs special payment behaviors after connecting to a VPN.

[0065] Specifically, the behavior analysis module integrates the information transmitted by the protocol analysis module, the model recognition module, and the DNS monitoring to construct a target user portrait. For example, by associating the same user's network connection (such as tracking the user's network connection status at different times and in different applications), application usage (analyzing the various types of applications used by the user and their behavior patterns) and DNS query records (combining DNS resolution information to determine the purpose of the user's network activities), the target user portrait is constructed to fully understand the user's network behavior characteristics. Use data mining techniques (such as association rule mining, cluster analysis, etc.) to explore the correlation between behaviors, such as the association between VPN connections and the use of overseas social applications or special payment behaviors, so as to determine whether the user has performed illegal social or financial transactions after using VPN, that is, abnormal behavior.

[0066] Targeted judgment operations can be performed for different abnormal behaviors. For example, for the judgment of the use of overseas social applications, targeted analysis technology is used according to the different types of VPN connection protocols. For the TLS encryption protocol, advanced fingerprint recognition technology is used to deeply analyze the extended fields, certificate information and feature sequences of the application layer protocol in the TLS handshake to build a detailed fingerprint feature library. Through precise matching with the feature library, the use of overseas social applications can be accurately identified. For example, applications such as Facebook and Twitter have unique feature identifiers in the TLS handshake, which can be accurately judged. For TCP / UDP encryption protocols, an algorithm model is built with the help of TADK, and through deep packet detection and behavior analysis of network traffic, the feature patterns of the application layer protocol are extracted, such as data packet size distribution, port usage rules, communication frequency, etc., and compared with the predefined overseas social application feature model, the use of overseas social applications can be effectively determined. For example, in terms of identification and judgment based on special payment behavior, for domestic accounts using WeChat payment or Alipay payment, by carefully comparing the traffic characteristics before and after payment, including data packet flow, port usage, data content changes, etc., unknown traffic is marked and key traffic analysis is performed on suspected VPN users. When foreign accounts use PayPal to pay or purchase payment links at specific websites, the system deeply analyzes the relevant traffic information, verifies the purpose and source of payment, and combines other behavioral characteristics of the user (such as whether the VPN is connected at the same time, whether there is a large amount of overseas data transmission, etc.) to comprehensively determine illegal and irregular cross-border behavior, and achieve in-depth monitoring and analysis of specific behaviors from multiple dimensions, effectively combating related illegal and irregular behaviors.

[0067] It should be noted that the user behavior detection system may also include a console interface. The console interface can be used to view the detection status in real time, including network traffic data, detection progress, system resource usage and other information, as well as detailed user behavior detection results and user behavior determination results, such as the type of abnormal user behavior such as illegal cross-border behavior, the IP addresses involved, applications, etc., so as to keep abreast of network dynamics.

[0068] The technical solution of the embodiment of the present invention is to send the protocol feature vector to the behavior analysis module through the protocol analysis module; send the target user behavior detection result to the behavior analysis module through the model recognition module; obtain the network DNS message corresponding to the network traffic data through the DNS monitoring module, and parse the network DNS message to determine the message parsing information, and compare the message parsing information with a preset knowledge base to determine the comparison result, and mark the access request information in the network DNS message based on the comparison result, and send the access request information to the behavior analysis module; build a target user portrait based on the received protocol feature vector, the target user behavior detection result and the access request information through the behavior analysis module, and determine the correlation between behaviors based on the target user portrait and data mining technology, and determine the user behavior based on the correlation between behaviors to determine the target determination result of the user behavior. The behavior analysis module integrates information from multiple modules, including protocol feature vectors, target user behavior detection results, and access request information to perform behavior analysis and judgment, thereby accurately identifying abnormal user behaviors in various encryption protocols and applications, such as illegal cross-border behaviors. It covers a variety of common and emerging protocols and application scenarios, such as encrypted communications in the fields of social networking, file transfer, and financial transactions, effectively solving the problem of difficult discovery and governance of related abnormal behaviors, greatly improving the effectiveness of network information security supervision, and further improving the accuracy of user behavior judgments.

[0069] Based on the above technical solution, the method also includes: if the behavior analysis module detects that the target judgment result is abnormal user behavior, an alarm is triggered and user information is recorded, and a preset knowledge base is updated based on the protocol feature vector corresponding to the target judgment result, the target user behavior detection result and the access request information.

[0070] Specifically, if the behavior analysis module detects that the target judgment result is abnormal user behavior, an alarm will be triggered (real-time alarm notification will be sent to the administrator), and the user identity (name, account number and device ID) will be recorded in detail, and the time will be recorded with accuracy to seconds, and the application name (the illegal cross-border application involved) will be recorded, thereby providing a complete chain of evidence for subsequent investigation, evidence collection and processing.

[0071] Based on the above technical solution, the method also includes: acquiring multiple current intelligence data based on a preset acquisition method through an intelligence acquisition module, cross-validating the multiple current intelligence data to determine reference intelligence data, extracting key information from the reference intelligence data, and storing the extracted key information in a preset knowledge base.

[0072] Among them, current intelligence data may refer to intelligence data related to abnormal user behavior within the effective period. For example, current intelligence data may be, but is not limited to, intelligence data related to cross-border behavior. The intelligence acquisition module can timely grasp the dynamic trend of abnormal user behavior such as illegal cross-border behavior, and can quickly adjust the monitoring strategy to achieve source strikes, block the spread of resources and technology, and effectively ensure network security.

[0073] Specifically, the intelligence acquisition module obtains current intelligence data through a variety of technical means. For example, WEB crawling starts from high-quality URLs (such as well-known network security forums, technical blogs, etc.), searches for relevant web pages according to depth-first and breadth-first strategies, simulates real browser behavior (including setting reasonable user agents, accepting languages, cookies, etc. to avoid being blocked by websites), sets access intervals (randomizes access time intervals to simulate normal human browsing behavior) and uses proxy server pools (accesses websites in turn through multiple proxy servers to hide real IP addresses) to deal with anti-crawling mechanisms, obtains web pages, parses and extracts text (extracts text content from web pages for analysis), links (discovers new potential sources of intelligence) and other information, and uses natural language processing technology (such as text classification, entity recognition, semantic analysis, etc.) to analyze semantics and filter to obtain current intelligence data. For example, the email subscription engine monitors emails in real time based on keyword filters (filtering rules are set based on keywords related to illegal and irregular cross-border behaviors), performs virus scanning after downloading eligible emails (to ensure system security and prevent malware intrusion), and uses natural language processing technology to extract entities (such as VPN service names, website domain names, user accounts, etc.), relationships (such as subscription relationships and payment relationships between users and VPN services, etc.) and events (such as VPN service promotion activities, cross-border fund transfer events, etc.) in the content, and converts them into structured current intelligence data. For example, the simulation sandbox simulates multiple operating system environments (such as Windows, Linux, Android, etc., covering common system platforms). When suspected illegal and irregular cross-border software is running in it, the system-level hook technology (intercepts operations at key system call points in software operation and obtains detailed information) intercepts system calls, and the memory monitoring technology (real-time monitoring of memory usage during software operation and detection of abnormal memory operations) analyzes memory usage, records software behavior (including software startup process, network communication behavior, file operations, etc.), and the behavior recording and playback function (convenient for security researchers to repeatedly view and analyze software behavior) assists security researchers in forensic analysis and obtains current intelligence data. Cross-validate multiple current intelligence data (compare the same or similar intelligence obtained from different sources to ensure accuracy), extract key information according to predefined templates and rules (set templates and rules according to intelligence type and analysis requirements), and store them in the preset knowledge base after classification. At the same time, update cross-border application samples (update newly discovered cross-border application programs or version information to the sample library, which can be used for subsequent monitoring and identification).

[0074] Exemplarily, an embodiment of the present invention also provides a user behavior detection system composed of a multi-technology module collaborative operation architecture. Among them, the system integrates multiple advanced technology modules such as traffic collection module, protocol analysis module, model recognition module, DNS monitoring module, behavior analysis module and intelligence acquisition module to build an organic collaborative work architecture. The traffic collection module is like a keen catcher of network data, which widely and accurately obtains network traffic data, providing a rich data source for subsequent analysis. The protocol analysis module deeply analyzes various network protocols, whether it is a common protocol (unencrypted protocol) or a complex encryption protocol, and can analyze its internal structure and characteristics like peeling off silk and cocoon, laying a solid foundation for accurate identification. The model recognition module relies on the powerful computing power of machine learning and deep learning algorithms or models to conduct in-depth mining and intelligent analysis of massive traffic data, automatically identify potential illegal cross-border behavior patterns and determine whether the traffic is illegal cross-border. The DNS monitoring module focuses on the dynamics of DNS data in the network, and through the careful monitoring and analysis of DNS requests and responses, it keenly captures clues of abnormal activities related to VPN services. The behavior analysis module organically integrates the information from various modules, and builds a comprehensive and detailed user behavior portrait by correlating multiple behavioral information such as the user's network connection, application usage, and DNS query records, so as to accurately judge the legality of the behavior. The intelligence acquisition module takes the initiative to use a variety of cutting-edge technical means to widely collect cross-border related intelligence from the massive information on the Internet, providing timely and valuable external information support for the entire system, and realizing comprehensive monitoring and identification of illegal and irregular cross-border behaviors of encrypted virtual private networks and applications.

[0075] The following is an embodiment of a user behavior detection system provided in an embodiment of the present invention. The system and the user behavior detection methods in the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the user behavior detection system, please refer to the embodiment of the above-mentioned user behavior detection method.

[0076] Embodiment 3

[0077] Figure 3 This is a schematic diagram of the structure of a user behavior detection system provided by Embodiment 3 of the present invention. Figure 3 As shown, the system includes: a traffic collection module 310, a protocol analysis module 320 and a model identification module 330;

[0078] Among them, the traffic collection module 310 is used to collect network traffic data of key network nodes based on a preset collection strategy, and filter the network traffic data based on preset filtering conditions to determine the target traffic data corresponding to the current collection cycle, and send the target traffic data to the protocol analysis module 320; the protocol analysis module 320 is used to perform network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and perform feature extraction on the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and send the protocol feature vector to the model identification module 330; the model identification module 330 is used to determine the first user behavior detection result based on the received protocol feature vector and the first classification model, and convert the protocol feature vector into a protocol feature graph based on a preset format conversion method, and determine the second user behavior detection result based on the protocol feature graph and the second classification model, and determine the target user behavior detection result based on the first user behavior detection result and the second user behavior detection result.

[0079] The technical solution of the embodiment of the present invention is to collect network traffic data of key network nodes based on a preset collection strategy through the traffic collection module 310, and filter the network traffic data based on preset filtering conditions to determine the target traffic data corresponding to the current collection period, and send the target traffic data to the protocol analysis module 320; the protocol analysis module 320 performs network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and extracts features of the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and sends the protocol feature vector to the model identification module 330; the model identification module 330 determines the first user behavior detection result based on the received protocol feature vector and the first classification model, and converts the protocol feature vector into a protocol feature graph based on a preset format conversion method, and determines the second user behavior detection result based on the protocol feature graph and the second classification model, and determines the target user behavior detection result based on the first user behavior detection result and the second user behavior detection result, so as to comprehensively classify the classification results of the first classification model and the second classification model, that is, the first user behavior detection result and the second user behavior detection result, so as to achieve accurate judgment of user behavior, thereby improving the accuracy of user behavior detection.

[0080] On the basis of the above technical solution, the protocol analysis module 320 is also used to perform unencrypted feature extraction on the target network protocol to determine the first protocol feature vector corresponding to the target network protocol if it is detected that the target protocol type is an unencrypted protocol type; the first protocol feature vector includes: at least one of the protocol request method, access information and port number; the protocol analysis module 320 is also used to perform encrypted feature extraction on the target network protocol to determine the second protocol feature vector corresponding to the target network protocol if it is detected that the target protocol type is an encrypted protocol type; the second protocol feature vector includes: at least one of the cryptographic suite and the certificate fingerprint.

[0081] On the basis of the above technical solution, the model identification module 330 is also used to convert the protocol feature vector into an image format based on a preset deep learning algorithm or a preset format conversion model to obtain a converted protocol feature graph.

[0082] Based on the above technical solution, the first classification model is a pre-trained machine learning model; the second classification model is a pre-trained deep learning model.

[0083] On the basis of the above technical solution, the model identification module 330 is also used to input the protocol feature map into the second classification model, extract image features of the protocol feature map in the second classification model to obtain protocol image features, and perform classification prediction based on the protocol image features to determine the classification prediction result; the model identification module 330 is also used to determine the second user behavior detection result based on the output of the second classification model.

[0084] On the basis of the above technical solution, the model identification module 330 is also used to determine the consistent result as the target user behavior detection result if it is detected that the first user behavior detection result and the second user behavior detection result are consistent; the model identification module 330 is also used to determine the target user behavior detection result based on the first classification weight corresponding to the first classification model, the second classification weight corresponding to the second classification model, the first user behavior detection result and the second user behavior detection result if it is detected that the first user behavior detection result and the second user behavior detection result are inconsistent.

[0085] On the basis of the above technical solution, the system also includes: a DNS monitoring module and a behavior analysis module;

[0086] Among them, the protocol analysis module 320 is also used to send the protocol feature vector to the behavior analysis module; the model identification module 330 is also used to send the target user behavior detection result to the behavior analysis module; the DNS monitoring module is used to obtain the network DNS message corresponding to the network traffic data, and parse the network DNS message to determine the message parsing information, and compare the message parsing information with the preset knowledge base to determine the comparison result, and mark the access request information in the network DNS message based on the comparison result, and send the access request information to the behavior analysis module; the behavior analysis module is used to build a target user portrait based on the received protocol feature vector, the target user behavior detection result and the access request information, and determine the correlation between behaviors based on the target user portrait and data mining technology, and determine the user behavior based on the correlation between behaviors to determine the target judgment result of the user behavior.

[0087] Based on the above technical solution, the behavior analysis module is also used to trigger an alarm and record user information if it detects that the target judgment result is abnormal user behavior, and update the preset knowledge base based on the protocol feature vector corresponding to the target judgment result, the target user behavior detection result and the access request information.

[0088] On the basis of the above technical solution, the intelligence acquisition module is also used to acquire multiple current intelligence data based on a preset acquisition method, cross-validate multiple current intelligence data to determine reference intelligence data, extract key information from the reference intelligence data, and store the extracted key information in a preset knowledge base.

[0089] Exemplarily, the traffic collection module 310 can be installed on the traffic collection device. The protocol analysis module 320, the model recognition module 330, the DNS monitoring module, the behavior analysis module and the intelligence acquisition module can be installed on the server side. In terms of the hardware environment, the traffic collection device is deployed at the key nodes of the network, and equipped with a high-performance network interface card (such as a 10 Gigabit Ethernet interface card) and a large-capacity storage device (such as a hard disk array) for capturing and temporarily storing network traffic data. In addition, the server side can use a high-performance computing server with a multi-core processor, a large-capacity memory, a high-speed data bus and a GPU accelerator card. In terms of the software environment, the server side can support mainstream operating systems such as Windows Server 2012 and above, Linux, etc. The storage function can use MySQL 8.0 and above or Oracle 12c and above to store monitoring data, intelligence information and preset knowledge bases.

[0090] Before executing the user behavior detection method, the user behavior detection system needs to be configured. For example, traffic collection equipment is deployed at key nodes of the network, and the collection strategy is carefully configured according to the network topology and monitoring requirements, such as setting the collection start time, collection cycle, data storage path and other parameters to ensure that the collection equipment operates normally and can accurately capture the target network traffic. On the server side, the various functional modules of the system are installed and configured in sequence, including the protocol analysis module (configure protocol parsing rules, feature extraction algorithm parameters, etc.), the model recognition module (load pre-trained models, set model update strategies, etc.), the DNS monitoring module (initialize DNS parsing library, set monitoring thresholds, etc.), the behavior analysis module (establish behavior analysis models, set association rules, etc.), and the intelligence acquisition module (configure crawler parameters, mail filter rules, etc.) and the knowledge base module (import initial monitoring rules, intelligence data, etc.) to ensure the compatibility and collaborative working ability between the modules. Load the pre-trained classification model parameters (to ensure that the model has the initial recognition ability), the monitoring rules in the preset knowledge base (to provide the system with judgment basis) and the initial intelligence data (to provide reference information for monitoring), complete the initialization settings of the system, start the system and make it enter a stable operating state, and prepare to start real-time monitoring of network traffic data.

[0091] The user behavior detection system provided in the embodiment of the present invention can execute the user behavior detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the user behavior detection method.

[0092] It is worth noting that in the above-mentioned embodiment of user behavior detection, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0093] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0094] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A user behavior detection method, characterized in that: include: The traffic collection module collects network traffic data of key network nodes based on a preset collection strategy, and filters the network traffic data based on preset screening conditions to determine the target traffic data corresponding to the current collection cycle, and sends the target traffic data to the protocol analysis module; The protocol analysis module performs network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and extracts features of the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and sends the protocol feature vector to the model recognition module; A first user behavior detection result is determined based on the received protocol feature vector and the first classification model through the model identification module, and the protocol feature vector is converted into a protocol feature graph based on a preset format conversion method, and a second user behavior detection result is determined based on the protocol feature graph and the second classification model, and a target user behavior detection result is determined based on the first user behavior detection result and the second user behavior detection result.

2. The method according to claim 1, characterized in that The protocol analysis module extracts the characteristics of the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, including: If the target protocol type is detected as an unencrypted protocol type by the protocol analysis module, unencrypted feature extraction is performed on the target network protocol to determine a first protocol feature vector corresponding to the target network protocol; the first protocol feature vector includes: at least one of a protocol request mode, access information, and a port number; If the protocol analysis module detects that the target protocol type is an encryption protocol type, encryption feature extraction is performed on the target network protocol to determine a second protocol feature vector corresponding to the target network protocol; the second protocol feature vector includes: at least one of a cryptographic suite and a certificate fingerprint.

3. The method according to claim 1, characterized in that The protocol feature vector is converted into a protocol feature graph based on a preset format conversion method by a model identification module, including: The protocol feature vector is converted into an image format through a model recognition module based on a preset deep learning algorithm or a preset format conversion model to obtain a converted protocol feature graph.

4. The method according to claim 1, characterized in that: The first classification model is a pre-trained machine learning model; the second classification model is a pre-trained deep learning model.

5. The method according to claim 1, characterized in that: Determining a second user behavior detection result based on the protocol feature graph and the second classification model by a model identification module includes: The protocol feature graph is input into a second classification model through a model recognition module, image feature extraction is performed on the protocol feature graph in the second classification model to obtain protocol image features, and classification prediction is performed based on the protocol image features to determine a classification prediction result; A second user behavior detection result is determined based on the output of the second classification model through the model recognition module.

6. The method according to claim 1, characterized in that Determining a target user behavior detection result based on the first user behavior detection result and the second user behavior detection result by a model recognition module includes: If the model recognition module detects that the first user behavior detection result and the second user behavior detection result are consistent, the consistent result is determined as the target user behavior detection result; If the model identification module detects that the first user behavior detection result and the second user behavior detection result are inconsistent, the target user behavior detection result is determined based on the first classification weight corresponding to the first classification model, the second classification weight corresponding to the second classification model, the first user behavior detection result and the second user behavior detection result.

7. The method according to claim 1, characterized in that The method further comprises: Sending the protocol feature vector to the behavior analysis module through the protocol analysis module; The target user behavior detection results are sent to the behavior analysis module through the model recognition module; Obtaining a network DNS message corresponding to the network traffic data through a DNS monitoring module, parsing the network DNS message to determine message parsing information, comparing the message parsing information with a preset knowledge base to determine a comparison result, marking access request information in the network DNS message based on the comparison result, and sending the access request information to a behavior analysis module; A target user profile is constructed based on the received protocol feature vector, the target user behavior detection result and the access request information through the behavior analysis module, and the correlation between behaviors is determined based on the target user profile and data mining technology, and user behavior judgment is performed based on the correlation between behaviors to determine the target judgment result of the user behavior.

8. The method according to claim 7, characterized in that The method further comprises: If the behavior analysis module detects that the target determination result is abnormal user behavior, an alarm is triggered and user information is recorded, and a preset knowledge base is updated based on the protocol feature vector corresponding to the target determination result, the target user behavior detection result and the access request information.

9. The method according to claim 7, characterized in that: The method further comprises: The intelligence acquisition module acquires multiple current intelligence data based on a preset acquisition method, cross-validates the multiple current intelligence data to determine reference intelligence data, extracts key information from the reference intelligence data, and stores the extracted key information in a preset knowledge base.

10. A user behavior detection system, characterized in that: include: Traffic collection module, protocol analysis module and model identification module; The traffic collection module is used to collect network traffic data of key network nodes based on a preset collection strategy, and to filter the network traffic data based on preset filtering conditions to determine the target traffic data corresponding to the current collection period, and to send the target traffic data to the protocol analysis module; The protocol analysis module is used to perform network protocol analysis on the received target traffic data based on the protocol analysis engine to determine the target network protocol and the target protocol type corresponding to the target network protocol, and to perform feature extraction on the target network protocol based on the target protocol type to determine the protocol feature vector corresponding to the target network protocol, and send the protocol feature vector to the model identification module; A model identification module is used to determine a first user behavior detection result based on a received protocol feature vector and a first classification model, and convert the protocol feature vector into a protocol feature graph based on a preset format conversion method, and determine a second user behavior detection result based on the protocol feature graph and a second classification model, and determine a target user behavior detection result based on the first user behavior detection result and the second user behavior detection result.

Images