Network security behavior detection system

Abstract

The invention relates to a network security behavior detection system, in particular to the field of network security, and particularly comprises a data collection and preprocessing module, a behavior reference establishment module, a behavior analysis and anomaly detection module and a feedback and optimization module. By monitoring and analyzing behaviors of users, equipment and network traffic in real time, abnormal activities can be dynamically identified and responded, and the problem of hysteresis of a traditional security system in coping with novel and unknown attacks is solved; different from a signature-based detection method, the system does not depend on a fixed attack feature library, but accurately distinguishes normal and abnormal behaviors by establishing a personalized behavior baseline, so that the risk of false alarm and missing report is remarkably reduced; besides, the self-adaptive learning capability of the system enables the system to quickly adjust a defense strategy along with the change of an attack mode, so that the system can still operate efficiently in a large-scale and high-speed traffic environment, and continuous network security protection is provided.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically, to a network security behavior detection system. Background Art

[0002] With the continuous development of information technology and the widespread application of the Internet, network security issues have gradually become an important challenge faced by enterprises and organizations. Traditional network security defense methods mainly rely on signature-based detection methods, relying on pre-defined attack feature libraries to identify known attacks. However, this method has weak detection capabilities for new attacks, variant attacks, and zero-day vulnerabilities, and cannot effectively respond to ever-changing and evolving security threats. In recent years, more and more researchers and security vendors have begun to try to improve the effectiveness of network security protection through behavioral analysis methods. Behavioral analysis methods can identify possible security threats and abnormal behaviors by monitoring and analyzing the behaviors of users, devices, traffic, etc., and do not rely on fixed attack feature libraries, thereby improving the detection capabilities of unknown attacks to a certain extent.

[0003] Although the security detection methods based on behavioral analysis have improved over the traditional signature-based technologies, the existing behavior-driven detection systems still face some urgent problems. First, the existing behavior analysis systems often rely on learning a large amount of historical data, which may lead to poor real-time performance of the system and fail to respond to rapidly changing attacks in a timely manner. Secondly, since the behavior of each user or device has high individual differences, how to accurately distinguish between normal and abnormal behaviors remains a challenge, especially when dealing with complex and changing attack patterns, the probability of false positives and missed positives is high. In addition, large-scale and high-speed network traffic requires the behavior analysis system to process a large amount of data. The existing technology is prone to performance bottlenecks when facing large traffic, resulting in reduced detection effect. Finally, the existing behavior analysis models often lack sufficient flexibility and adaptability, and it is difficult to cope with changing attack strategies and new threats. Summary of the invention

[0004] In view of the technical problems existing in the prior art, the present invention provides a network security behavior detection system, which solves the problems raised in the above background technology through a data collection and preprocessing module, a behavior benchmark establishment module, a behavior analysis and anomaly detection module, and a feedback and optimization module.

[0005] The technical solution of the present invention to solve the above technical problems is as follows: specifically comprising: a data collection and preprocessing module, a behavior benchmark establishment module, a behavior analysis and anomaly detection module, and a feedback and optimization module;

[0006] Data collection and preprocessing module: collects relevant data from multiple data sources, performs data preprocessing on them, and transmits the preprocessed relevant data sets to the behavior analysis and anomaly detection module;

[0007] Behavior benchmark establishment module: Based on the relevant data types collected by the data collection and preprocessing module, a data set of normal behavior is collected from historical data, and a behavior benchmark model is established using the K-means clustering algorithm;

[0008] Behavior analysis and anomaly detection module: The module uses the acquired relevant data sets as input to the behavior benchmark model, analyzes new behavior data in real time, and uses the Euclidean distance formula to detect whether there is abnormal behavior, and automatically executes response measures based on the detection results;

[0009] Feedback and optimization module: collects historical detection results and uses the Q-learning algorithm in reinforcement learning to optimize the behavioral benchmark model and response strategy.

[0010] In a preferred embodiment, in the data collection and preprocessing module, the data sources include a user behavior data source, a device activity data source, and a network traffic data source, wherein the data obtained from the user behavior data source include user login records, operation logs, and access behaviors; the data obtained from the device activity data source include device startup and shutdown time, application usage, and hardware status; the data obtained from the network traffic data source include data packet transmission records, IP address access frequency, and protocol type.

[0011] In a preferred embodiment, in the data collection and preprocessing module, the preprocessing operations on the data obtained from the user behavior data source include denoising and filtering, standardization and missing value processing;

[0012] Preprocessing operations on data obtained from device activity data sources include removing redundant data, time synchronization, and data normalization;

[0013] The preprocessing operations on the data obtained from the network traffic data source include noise removal and traffic normalization.

[0014] In a preferred embodiment, the specific steps of establishing the behavior benchmark model are:

[0015] S1. Randomly select K data points from the collected normal behavior data set as the initial cluster centers C1, C2, ..., C K ;

[0016] S2, each data point x in the normal behavior dataset i Assign to the nearest cluster center c k ;

[0017] S3, update the cluster center according to the mean of the data points in each cluster;

[0018] S4, repeat S2 and S3 until the cluster center no longer changes;

[0019] S5. Each time a data point is assigned and the cluster center is updated, the objective function J(K) will be gradually reduced until convergence;

[0020] S6. After clustering is completed, K clusters will be obtained, and each cluster C k represents a normal behavior pattern where these clusters are represented by:

[0021] C={C1,C2,...,C k};

[0022] Among them, C k represents the kth cluster, which contains all the normal behavior data points belonging to this cluster, and C represents the clustering result;

[0023] S7. Use the clustering result C as the behavioral benchmark model.

[0024] In a preferred embodiment, after updating the cluster center, the calculation formula of the current objective function value is:

[0025]

[0026] in, represents the sum of all K clusters, For each cluster C k All data points x in i To sum, ||x i -c k || 2 Represents data point x i To cluster C k Centroid c k The square of the distance.

[0027] In a preferred embodiment, in the behavior analysis and anomaly detection module, the Euclidean distance calculation formula is:

[0028] d(x,c k )=||xc k ||;

[0029] Among them, C k represents the centroid of the kth cluster, and x represents a new data point in the related data set;

[0030] After calculating the distance from x to each cluster center, select the minimum distance value, that is, find the cluster center closest to x, and compare the selected minimum distance value with the preset threshold to determine whether x belongs to the known cluster in the behavioral benchmark model based on the comparison result.

[0031] In a preferred embodiment, the comparison process is as follows:

[0032] If d(x,c k )>M, then the data point x is considered abnormal;

[0033] If d(x,c k )≤M, the data point x is considered normal.

[0034] In a preferred embodiment, after the behavior analysis and anomaly detection module detects abnormal behavior, it automatically evaluates the severity of the abnormal behavior, and automatically executes corresponding response measures according to the severity of the abnormal behavior through pre-divided severity levels and customized response strategies. After the response measures are executed, the event is reviewed and analyzed.

[0035] In a preferred embodiment, the behavior analysis and anomaly detection module evaluates abnormal behavior as follows:

[0036] S1. Frequency: whether the abnormal behavior occurs frequently;

[0037] S2, Type: Is it a known attack pattern or unauthorized access?

[0038] S3, Scope of impact: whether the abnormal behavior affects the security of the system or the normal operation of the user;

[0039] S4. Historical data comparison: compare the normal behavior with the historical data to see how abnormal it is;

[0040] The severity levels are:

[0041] S1, low severity: minor anomaly, false trigger or a minor error;

[0042] S2, medium severity: There is a potential problem that needs to be monitored but does not immediately endanger the system;

[0043] S3, High Severity: Obvious attacks or system vulnerabilities have already jeopardized system security and immediate response measures are required.

[0044] In a preferred implementation, the response strategy is as follows:

[0045] S1, low severity exception

[0046] 1) Alarm notification: Send an alert to the administrator or security team, but do not take immediate blocking measures;

[0047] 2) Logging: Record detailed logs of abnormal behavior for subsequent review;

[0048] 3) Automatic correction: If the anomaly is caused by a configuration error or other problems, the system will automatically repair it;

[0049] S2, medium severity abnormality

[0050] 1) Restrict access: temporarily restrict access rights to the source of abnormal behavior, allowing the system to continue to operate while increasing monitoring efforts;

[0051] 2) Strengthen monitoring: Continuously monitor the behavior and analyze whether there is further evolution of malicious behavior;

[0052] 3) Send an alert: notify relevant personnel for further investigation;

[0053] S3, high severity exception

[0054] 1) Automatic blocking: Take immediate measures to block the source of abnormal behavior;

[0055] 2) Isolate devices or users: Isolate affected users or devices from the network to prevent potential attacks from spreading;

[0056] 3) Block the attack path: Block the attack path through firewalls and intrusion prevention systems;

[0057] 4) Notification and response: trigger system alarms and notify the security team for manual intervention and detailed investigation;

[0058] The specific steps for reviewing and analyzing an incident are:

[0059] Q1. Log analysis: Analyze logs of abnormal behavior to determine whether it is a false positive or a precursor to an attack.

[0060] Q2. Source tracing investigation: Determine the source of abnormal behavior and take subsequent preventive measures.

[0061] Q3. Improve defense mechanism: If the abnormal behavior exposes loopholes or weaknesses in the system, improve the security defense mechanism.

[0062] In a preferred embodiment, the feedback and optimization module generates a historical data set H by monitoring and recording each test result, including:

[0063] S1, False Alarm: Detected as abnormal behavior, but not actually an attack;

[0064] S2, false negatives: failure to detect actual attacks or anomalies;

[0065] S3, true positive examples: abnormal behaviors correctly detected;

[0066] S4, true negative examples: normal behavior is correctly identified as non-abnormal;

[0067] The calculation formula of Q-learning is:

[0068]

[0069] Among them, Q(s,a) represents the Q value of the current state s and action a, α represents the learning rate, which controls the learning rate of new information at each update, R represents the immediate reward, γ represents the discount factor, s′ represents the new state reached after executing action a, and a′ represents one of all actions that can be selected in the new state s′. represents the maximum Q value of all possible actions in the new state s′.

[0070] The beneficial effects of the present invention are as follows: the present invention adopts a behavior-driven defense approach, which can dynamically identify and respond to abnormal activities by real-time monitoring and analyzing the behaviors of users, devices and network traffic, thereby solving the lag problem of traditional security systems in dealing with new and unknown attacks; unlike signature-based detection methods, the system does not rely on a fixed attack feature library, but instead establishes a personalized behavior baseline to accurately distinguish between normal and abnormal behaviors, thereby significantly reducing the risk of false positives and missed positives; in addition, the system's adaptive learning ability enables it to quickly adjust defense strategies as attack patterns change, ensuring efficient operation in large-scale, high-speed traffic environments, and providing continuous network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 is a flow chart of the method of the present invention;

[0072] Figure 2 This is a system structure block diagram of the present invention. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0074] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0075] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0076] Example 1

[0077] This embodiment provides Figure 1-2 A network security behavior detection system is shown, which specifically includes: a data collection and preprocessing module, a behavior benchmark establishment module, a behavior analysis and anomaly detection module, and a feedback and optimization module;

[0078] Data collection and preprocessing module: collects relevant data from multiple data sources, performs data preprocessing on them, and transmits the preprocessed relevant data sets to the behavior analysis and anomaly detection module;

[0079] Behavior benchmark establishment module: Based on the relevant data types collected by the data collection and preprocessing module, a data set of normal behavior is collected from historical data, and a behavior benchmark model is established using the K-means clustering algorithm;

[0080] Behavior analysis and anomaly detection module: The module uses the acquired relevant data sets as input to the behavior benchmark model, analyzes new behavior data in real time, and uses the Euclidean distance formula to detect whether there is abnormal behavior, and automatically executes response measures based on the detection results;

[0081] Feedback and optimization module: collects historical detection results, uses the Q-learning algorithm in reinforcement learning to optimize the behavioral benchmark model and response strategy, and continuously adjusts its detection threshold and response strategy based on historical data feedback, thereby improving detection accuracy, reducing false positives and missed positives, and ultimately achieving a self-optimizing behavior-driven defense method. This optimization process not only makes the detection model more intelligent, but also enhances the system's adaptability when facing new attacks.

[0082] In this embodiment, the data collection and preprocessing module specifically needs to be explained, and the data sources include user behavior data source, device activity data source and network traffic data source, wherein the data obtained from the user behavior data source includes user login records, operation logs and access behaviors; the data obtained from the device activity data source includes the device startup and shutdown time, application usage and hardware status; the data obtained from the network traffic data source includes data packet transmission records, IP address access frequency and protocol type;

[0083] The preprocessing operations for data obtained from user behavior data sources include denoising and filtering, standardization, and missing value processing. Denoising and filtering are to remove irrelevant or abnormal behavior records, such as system errors or irrelevant operations; standardization is to standardize the behavior characteristics of different users to a unified range to ensure the consistency of subsequent analysis. The standardization method adopts Z-score standardization or Min-Max standardization; missing value processing is to fill in the missing behavior data to ensure data integrity;

[0084] In addition, according to the user login records, by calculating the number of times the user logs in within a certain time period, the activity frequency characteristics of a user within a given time window are extracted. The time period selection is determined and adjusted according to actual needs. The calculation formula is:

[0085]

[0086] According to the user's operation log, the probability of the pre-specified behavior in the sequence is calculated as the sequence feature of the user's behavior. The calculation formula is:

[0087]

[0088] According to the user's access behavior data, the number of times a user visits a website or page within a specified time period is calculated as the access frequency feature. The calculation formula is:

[0089]

[0090] The preprocessing operations for data obtained from the device activity data source include removing redundant data, time synchronization, and data normalization. Removing redundant data is to eliminate duplicate records and maintain the uniqueness and accuracy of data; time synchronization is to align device activity data with timestamps to ensure the correctness of event sequences; data normalization is to convert device activity information into a unified format to facilitate cross-device comparison and analysis;

[0091] In addition, according to the startup and shutdown time of the device, by counting the number of times the device is started or shut down, the usage frequency characteristics of the device are obtained. In this application, the number of times the device is started in a day is selected as the characteristic, and the calculation formula is:

[0092]

[0093] According to the application usage, the frequency of application usage on the device is counted as the application usage frequency feature. The calculation formula is:

[0094]

[0095] According to the hardware status, including running, standby, and shutdown, the time proportion of the device in each state is recorded as the device status feature. The calculation formula is:

[0096]

[0097] The preprocessing operations for obtaining data from the network traffic data source include denoising and traffic normalization. Denoising is to remove meaningless or low-frequency network activity data, such as some normal background traffic; traffic normalization is to standardize network traffic data and unify the data format to facilitate the comparison of traffic behavior patterns; traffic normalization adopts the Min-Max normalization method. In order to improve data quality and make subsequent analysis and model training more accurate and efficient, in the data preprocessing stage, this application does not perform the same processing on each data, but adopts different processing methods according to different data types and characteristics, and this differentiated processing method helps to improve the processing efficiency and analysis accuracy of the system;

[0098] In addition, according to the transmission records of data packets, the total data volume of network traffic within a certain time window is calculated to extract the traffic pattern characteristics. The calculation formula is:

[0099]

[0100] According to the access frequency of the IP address, the communication characteristics with a specific IP address are extracted. The calculation formula is:

[0101]

[0102] According to the protocol type, the data traffic ratio of each protocol type is calculated as a feature. The calculation formula is:

[0103]

[0104] In this embodiment, what needs to be explained specifically is the behavior benchmark establishment module. The specific steps of establishing the behavior benchmark model are:

[0105] S1. Randomly select K data points from the collected normal behavior data set as the initial cluster centers C1, C2, ..., C K ;

[0106] S2, each data point x in the normal behavior dataset i Assign to the nearest cluster center c k , that is, each point is assigned to a point such that ||x i -c k || 2 The smallest cluster;

[0107] S3, update the cluster center according to the mean of the data points in each cluster, that is This makes the cluster center as close as possible to all points in the cluster;

[0108] S4, repeat S2 and S3 until the cluster center no longer changes or the maximum number of iterations is reached;

[0109] S5. Each time data points are assigned and cluster centers are updated, the objective function J(K) will be gradually reduced until convergence. After the cluster centers are updated, the calculation formula for the current objective function value is:

[0110]

[0111] in, represents the sum of all K clusters, For each cluster C k All data points x in i Summing, ‖x i -c k ‖ 2 Represents data point x i To cluster C k Centroid c k The square of the distance is used to measure the difference between the data point and the centroid;

[0112] And check whether the value of the objective function is decreasing in each iteration. If the decrease is less than the set threshold or the maximum number of iterations is reached, the iteration can be stopped;

[0113] S6. After clustering is completed, K clusters will be obtained, and each cluster C krepresents a normal behavior pattern where these clusters are represented by:

[0114] C={C1,C2,...,C k};

[0115] Among them, C k represents the kth cluster, which contains all the normal behavior data points belonging to this cluster, and C represents the clustering result;

[0116] S7. Take the clustering result C as the behavioral benchmark model. Each cluster C k It represents a normal behavior pattern and can be used for subsequent anomaly detection. If the distance between a new behavior data point x and the center (centroid) of a cluster is far and does not fall within the threshold range of any cluster, then the behavior will be considered abnormal.

[0117] In this embodiment, what needs to be explained specifically is the behavior analysis and anomaly detection module, and the Euclidean distance calculation formula is:

[0118] d(x,c k )=||xc k ||;

[0119] Among them, C k represents the centroid of the kth cluster, and x represents a new data point in the related data set;

[0120] After calculating the distance from x to each cluster center, select the minimum distance value, that is, find the cluster center closest to x. If x belongs to a cluster, it will have the minimum distance to the centroid of the cluster. Compare the selected minimum distance value with the preset threshold to determine whether x belongs to a known cluster in the behavioral benchmark model based on the comparison result. The comparison process is as follows:

[0121] If d(x,c k )>M, the data point x is considered abnormal. In other words, the data point x is far away from the centroid of any cluster and cannot be classified into any existing cluster, so it is considered abnormal behavior.

[0122] If d(x,c k )≤M, then the data point x is considered normal and belongs to a certain cluster. The significance of judging a data point as abnormal is that when the distance between a data point and the center of all clusters is greater than the set threshold, it means that its behavior pattern is quite different from that of the existing clusters. This situation is usually considered to be an anomaly point. Such anomalies will represent an unrecognized behavior pattern, or because the data point itself has some abnormal characteristics (such as noise or irregular behavior) and cannot be classified into any cluster;

[0123] After the behavior analysis and anomaly detection module detects abnormal behavior, it automatically evaluates the severity of the abnormal behavior. According to the severity level divided in advance and the customized response strategy, it automatically executes the corresponding response measures according to the severity of the abnormal behavior. After the response measures are executed, the event is reviewed and analyzed.

[0124] The specific evaluation criteria for abnormal behavior are:

[0125] S1. Frequency: whether the abnormal behavior occurs frequently;

[0126] S2, Type: Is it a known attack pattern or unauthorized access?

[0127] S3, Scope of impact: whether the abnormal behavior affects the security of the system or the normal operation of the user;

[0128] S4. Historical data comparison: compare the normal behavior with the historical data to see how abnormal it is;

[0129] The severity levels are:

[0130] S1, low severity: minor anomaly, false trigger or a minor error;

[0131] S2, medium severity: There is a potential problem that needs to be monitored but does not immediately endanger the system;

[0132] S3, high severity: obvious attacks or system vulnerabilities have endangered system security and immediate response measures are required;

[0133] The response strategies are as follows:

[0134] S1, low severity abnormality (minor abnormality)

[0135] 1) Alarm notification: Send an alert to the administrator or security team, but do not take immediate blocking measures;

[0136] 2) Logging: Record detailed logs of abnormal behavior for subsequent review;

[0137] 3) Automatic correction: If the anomaly is caused by a configuration error or other problems, the system will automatically repair it;

[0138] S2, medium severity anomaly (potential threat)

[0139] 1) Restrict access: temporarily restrict access rights to the source of abnormal behavior, allowing the system to continue to operate while increasing monitoring efforts;

[0140] 2) Strengthen monitoring: Continuously monitor the behavior and analyze whether there is further evolution of malicious behavior;

[0141] 3) Send an alert: notify relevant personnel for further investigation;

[0142] S3, high severity anomaly (serious attack or vulnerability)

[0143] 1) Automatic blocking: Immediately take measures to block the source of abnormal behavior, such as blocking IP addresses and disabling accounts;

[0144] 2) Isolate devices or users: Isolate affected users or devices from the network to prevent potential attacks from spreading;

[0145] 3) Block the attack path: Block the attack path through firewalls and intrusion prevention systems;

[0146] 4) Notification and response: trigger system alarms and notify the security team for manual intervention and detailed investigation;

[0147] In addition, in high-severity cases, the system will take more stringent measures, such as suspending user accounts, suspending services, blocking attack sources, etc.;

[0148] The specific steps for reviewing and analyzing an incident are:

[0149] Q1. Log analysis: Analyze logs of abnormal behavior to determine whether it is a false positive or a precursor to an attack.

[0150] Q2. Source tracing investigation: Determine the source of abnormal behavior, such as the attacker’s IP address and source, and take subsequent preventive measures.

[0151] Q3. Improve defense mechanism: If the abnormal behavior exposes loopholes or weaknesses in the system, improve the security defense mechanism, such as updating rules, adjusting policies, and strengthening firewalls.

[0152] In this embodiment, the feedback and optimization module specifically needs to be explained, which generates a historical data set H by monitoring and recording each detection result, including:

[0153] S1, False Alarm: Detected as abnormal behavior, but not actually an attack;

[0154] S2, false negatives: failure to detect actual attacks or anomalies;

[0155] S3, true positive examples: abnormal behaviors correctly detected;

[0156] S4, true negative examples: normal behavior is correctly identified as non-abnormal;

[0157] The calculation formula of Q-learning is:

[0158]

[0159] Among them, Q(s,a) represents the Q value of the current state s and action a, which represents the expected reward of taking the action in this state. α represents the learning rate, which controls the learning rate of new information at each update, and its value range is usually between [0,1]. R represents the immediate reward, which represents the actual reward obtained after executing action a in state s, such as the quality of the current detection result of the detection model. γ represents the discount factor, which measures the importance of future rewards. Its value is usually between [0,1]. A larger γ value makes future rewards more important for decision making. s′ represents the new state reached after executing action a, and a′ represents one of all actions that can be selected in the new state s′. It represents the maximum Q value of all possible actions under the new state s′, that is, the reward of the best action under this state. It continuously adjusts its detection threshold and response strategy according to historical data feedback, thereby improving detection accuracy, reducing false positives and false negatives, and finally realizing a self-optimizing behavior-driven defense method. This optimization process not only makes the detection model more intelligent, but also enhances the system's adaptability when facing new attacks. In addition, in the optimization of the behavioral benchmark model, Q-learning can be used to adjust the model's behavioral strategy, for example:

[0160] S1. Adjust the detection threshold, for example, increase or decrease the sensitivity of the detection;

[0161] S2. Adjust the response strategy, for example, reduce false positives and increase the detection rate of missed negatives;

[0162] The reward system based on the detection results updates the Q value so that the system can learn the optimal detection and response strategy.

[0163] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0164] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0168] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0169] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network security behavior detection system, characterized in that: Specifically include: Data collection and preprocessing module, behavior benchmarking module, behavior analysis and anomaly detection module, and feedback and optimization module; Data collection and preprocessing module: collects relevant data from multiple data sources, performs data preprocessing on them, and transmits the preprocessed relevant data sets to the behavior analysis and anomaly detection module; Behavior benchmark establishment module: Based on the relevant data types collected by the data collection and preprocessing module, the normal behavior data set is collected from the historical data, and the behavior benchmark model is established using the K-means clustering algorithm; Behavior analysis and anomaly detection module: The module uses the acquired relevant data sets as input to the behavior benchmark model, analyzes new behavior data in real time, and uses the Euclidean distance formula to detect whether there is abnormal behavior, and automatically executes response measures based on the detection results; Feedback and optimization module: collects historical detection results and uses the Q-learning algorithm in reinforcement learning to optimize the behavioral benchmark model and response strategy.

2. A network security behavior detection system according to claim 1, characterized in that: In the data collection and preprocessing module, the data sources include user behavior data sources, device activity data sources, and network traffic data sources, wherein the data obtained from the user behavior data sources include user login records, operation logs, and access behaviors; The data obtained from the device activity data source includes the device startup and shutdown time, application usage, and hardware status; the data obtained from the network traffic data source includes data packet transmission records, IP address access frequency, and protocol type.

3. A network security behavior detection system according to claim 2, characterized in that: In the data collection and preprocessing module, the preprocessing operations for obtaining data from the user behavior data source include denoising and filtering, standardization, and missing value processing; Preprocessing operations on data obtained from device activity data sources include removing redundant data, time synchronization, and data normalization; The preprocessing operations on the data obtained from the network traffic data source include noise removal and traffic normalization.

4. A network security behavior detection system according to claim 3, characterized in that: The specific steps of establishing the behavior benchmark model are: S1. Randomly select K data points from the collected normal behavior data set as the initial cluster centers C1, C2, ..., C K ; S2, each data point x in the normal behavior dataset i Assign to the nearest cluster center c k ; S3, update the cluster center according to the mean of the data points in each cluster; S4, repeat S2 and S3 until the cluster center no longer changes; S5. Each time a data point is assigned and the cluster center is updated, the objective function J(K) will be gradually reduced until convergence; S6. After clustering is completed, K clusters will be obtained, and each cluster C k represents a normal behavior pattern where these clusters are represented by: C={C1,C2,...,C k }; Among them, C k represents the kth cluster, which contains all the normal behavior data points belonging to this cluster, and C represents the clustering result; S7. Use the clustering result C as the behavioral benchmark model.

5. A network security behavior detection system according to claim 4, characterized in that: After updating the cluster center, the calculation formula for the current objective function value is: in, represents the sum of all K clusters, For each cluster C k All data points x in i Summing, ‖x i -c k ‖ 2 Represents data point x i To cluster C k Centroid c k The square of the distance.

6. A network security behavior detection system according to claim 5, characterized in that: In the behavior analysis and anomaly detection module, the Euclidean distance calculation formula is: d(x,c k )=‖x-c k ‖; Among them, C k represents the centroid of the kth cluster, and x represents a new data point in the related data set; After calculating the distance from x to each cluster center, select the minimum distance value, that is, find the cluster center closest to x, and compare the selected minimum distance value with the preset threshold to determine whether x belongs to the known cluster in the behavioral benchmark model based on the comparison result.

7. A network security behavior detection system according to claim 6, characterized in that: The comparison process is as follows: If d(x,c k )>M, then the data point x is considered abnormal; If d(x,c k )≤M, the data point x is considered normal.

8. A network security behavior detection system according to claim 7, characterized in that: After the behavior analysis and anomaly detection module detects abnormal behavior, it automatically evaluates the severity of the abnormal behavior, and automatically executes corresponding response measures according to the severity of the abnormal behavior through the pre-classified severity levels and customized response strategies. After the response measures are executed, the event is reviewed and analyzed.

9. A network security behavior detection system according to claim 8, characterized in that: The behavior analysis and anomaly detection module evaluates abnormal behavior as follows: S1. Frequency: whether the abnormal behavior occurs frequently; S2, Type: Is it a known attack pattern or unauthorized access? S3, Scope of impact: whether the abnormal behavior affects the security of the system or the normal operation of the user; S4. Historical data comparison: compare the normal behavior with the historical data to see how abnormal it is; The severity levels are: S1, low severity: minor anomaly, false trigger or a minor error; S2, medium severity: There is a potential problem that needs to be monitored but does not immediately endanger the system; S3, high severity: obvious attacks or system vulnerabilities have endangered system security and immediate response measures are required; The response strategy is as follows: S1, low severity exception 1) Alarm notification: Send an alert to the administrator or security team, but do not take immediate blocking measures; 2) Logging: Record detailed logs of abnormal behavior for subsequent review; 3) Automatic correction: If the anomaly is caused by a configuration error or other problems, the system will automatically repair it; S2, medium severity abnormality 1) Restrict access: temporarily restrict access rights to the source of abnormal behavior, allowing the system to continue to operate while increasing monitoring efforts; 2) Strengthen monitoring: Continuously monitor the behavior and analyze whether there is further evolution of malicious behavior; 3) Send an alert: notify relevant personnel for further investigation; S3, high severity exception 1) Automatic blocking: Take immediate measures to block the source of abnormal behavior; 2) Isolate devices or users: Isolate affected users or devices from the network to prevent potential attacks from spreading; 3) Block the attack path: Block the attack path through firewalls and intrusion prevention systems; 4) Notification and response: trigger system alarms and notify the security team for manual intervention and detailed investigation; The specific steps for reviewing and analyzing an incident are: Q1. Log analysis: Analyze logs of abnormal behavior to determine whether it is a false positive or a precursor to an attack; Q2. Source tracing investigation: determine the source of abnormal behavior and take subsequent preventive measures; Q3. Improve defense mechanism: If the abnormal behavior exposes loopholes or weaknesses in the system, improve the security defense mechanism.

10. A network security behavior detection system according to claim 9, characterized in that: The feedback and optimization module generates a historical data set H by monitoring and recording each test result, including: S1, False Alarm: Detected as abnormal behavior, but not actually an attack; S2, false negatives: failure to detect actual attacks or anomalies; S3, true positive examples: abnormal behaviors correctly detected; S4, true negative examples: normal behavior is correctly identified as non-abnormal; The calculation formula of Q-learning is: Among them, Q(s,a) represents the Q value of the current state s and action a, α represents the learning rate, which controls the learning rate of new information at each update, R represents the immediate reward, γ represents the discount factor, s′ represents the new state reached after executing action a, and a′ represents one of all actions that can be selected in the new state s′. represents the maximum Q value of all possible actions in the new state s′.

Images