Transform-based remote desktop user behavior auditing method

Abstract

The invention relates to the technical field of network security and artificial intelligence, in particular to a Transform-based remote desktop user behavior auditing method, which comprises the following steps of: acquiring and caching image data through a time triggering and event triggering mechanism; collecting input data, restoring user input content, judging user operation classification through rules, and recording malicious input of a user; fusing the image data and the input data to generate user behavior characteristics; the behavior characteristics are coded through Transform, and user behavior characteristic codes are generated; important behavior codes are extracted from the behavior feature codes, global features of the behavior feature codes are captured through average pooling, the important behavior codes are pooled to the maximum extent, and the local features and the global features are fused; and analyzing the user behaviors, and classifying the user behaviors. The intelligent degree and the detection efficiency of the remote desktop user behavior auditing method are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security and artificial intelligence, and in particular to a remote desktop user behavior auditing method based on Transformer. Background Art

[0002] Remote desktop is a technology that allows users to access remotely from local devices through a network connection. When using remote desktop, users first enter specific instructions on the local device through peripherals such as keyboard and mouse, and then the locally entered instructions are transmitted to the remote computer via the remote desktop protocol. After receiving these instructions, the remote computer will quickly analyze and process them, and then transmit the corresponding screen images, audio and other content back to the local device in real time according to the request of the local device. As an important tool to improve work efficiency and flexibility, remote desktop technology has been widely recognized and highly valued in many key areas.

[0003] In some fields involving a large amount of sensitive information, extremely stringent requirements are placed on the security of remote desktops. To ensure the safe use of data, it is necessary to conduct security audits on the behavior of users using remote desktops, and promptly detect abnormal or suspicious behavior of users, so as to effectively prevent users from accessing and operating sensitive data and avoid potential data leakage risks.

[0004] At present, there are two main methods for remote desktop user behavior auditing. One is a remote desktop user behavior auditing method based on manual analysis, and the other is a remote desktop user behavior auditing method based on image recognition.

[0005] The remote desktop user behavior audit method based on manual analysis refers to the detailed and comprehensive recording, analysis and evaluation of the operation behavior of remote desktop users by manual means, so as to ensure that all user operations are compliant. The current manual audit method mainly collects and records the behavior session data of specific users, and then monitors and tracks the user's behavior by replaying the user's specific network operations to discover the user's abnormal behavior.

[0006] This process requires auditors to review and interpret user behavior data one by one. As the amount of remote desktop user behavior data continues to grow, this method is likely to consume a lot of time and manpower, and it may be difficult to achieve a comprehensive audit. Secondly, in manual audits, the judgment and experience of auditors often play a decisive role. Due to the influence of auditors' experience and skill level, there may be false positives or omissions, which will affect the effectiveness of the audit. Furthermore, during the manual analysis process, auditors may be exposed to users' sensitive information and privacy data. If not handled properly, it may lead to the leakage and abuse of user privacy.

[0007] The remote desktop user behavior audit method based on image recognition mainly relies on image recognition technology, especially optical character recognition (OCR) technology. At present, the image-based audit method mainly extracts information from the image, converts it into text information that can be processed by the computer, and then automatically recognizes and analyzes the user's specific behavior.

[0008] Image recognition technology itself is affected by many factors such as angles and obstructions. In remote desktop user behavior audits, if the user's operating interface is affected by these factors, it may lead to misidentification or omission of key information. Secondly, for some complex user behaviors, such as rapid keyboard input and multi-window switching, image recognition technology may be difficult to accurately capture and identify. These behaviors may be of great significance in audits, but they cannot be effectively identified due to technical limitations. Secondly, user audits based on image recognition are usually post-analysis, and image analysis itself usually requires a certain amount of processing time, which may affect the real-time nature of the audit results and fail to reflect the user's true behavior in a timely manner. Summary of the invention

[0009] In order to solve the problems of poor intelligence and low detection efficiency of remote desktop user behavior audit methods, the present invention provides a remote desktop user behavior audit method based on Transformer.

[0010] The present invention provides a remote desktop user behavior audit method based on Transformer, which adopts the following technical solution: A remote desktop user behavior audit method based on Transformer includes the following steps: Collect and cache image data through time-triggered and event-triggered mechanisms; Collect input data, restore user input content, determine user operation categories based on rules, and record user malicious input; Fusion of image data and input data to generate user behavior features; Encode the behavior features through Transformer to generate user behavior feature codes; Extract important behavior codes from behavior feature codes and fuse local features with global features through hybrid pooling; Analyze user behavior and classify user behavior.

[0011] In a specific implementation scheme, the event triggering mechanism includes: When the user's input data is collected abnormally, the triggering of the desktop image is started; When image data bursts, the collection, restoration and local storage of image data are triggered.

[0012] In a specific implementation scheme, fusing image data with input data to generate user behavior features includes the following steps: The received image data and its timestamp are two-dimensional vectors ,in, Indicates Group image data, Indicates The timestamp of the group image data; The received input data and its timestamp are two-dimensional vectors ,in, For the The abnormal judgment result of group input data; when the user inputs normally, , represents an all-zero vector, For the The timestamp of the group input data; when When Group input data and Group image data association, at this time The user behavior characteristics at the moment are expressed as ,in, is the preset threshold; when When only the image data changes and there is no input data, it is considered The user's input data at the moment is an all-zero matrix, and the behavior characteristics are expressed as , Represents a zero vector; if only the input data and image data do not change, The image data at the moment is an all-zero matrix, and the behavior characteristics are expressed as .

[0013] In a specific implementation scheme, encoding the behavior features through Transformer and generating the user behavior feature encoding includes the following steps: Each user behavior feature Enter a In the self-attention mechanism, each self-attention mechanism pays attention to the input user behavior features. Perform linear changes according to , and Represents the linearly changing weight vector, and obtains the query vector , key vector Sum value vector , query vector , key vector Sum value vector The calculation formula is as follows:

[0014]

[0015]

[0016] The calculation formula of the attention score matrix is:

[0017] In the above formula, Typically a factor of the model's feature size and the number of attention mechanisms; All attention scores are normalized by the softmax function to obtain the attention weight vector; Concatenate all attention weight vectors, and the concatenation result is consistent with the behavior characteristics. The product of is the user behavior feature code.

[0018] In a specific implementation scheme, extracting important behavior codes from behavior feature codes includes the following steps: Encoding behavioral traits , input index Indexes and alarm phase array phase as input, where the input index Indexes specifies the behavior feature encoding The candidate vectors in the alarm phase array phase correspond to the input index Indexes one by one, which is used to indicate the alarm phase of each candidate vector; Create an empty list imp to store the indexes of behaviors that are judged to be high priority; Iterate over each index in the input index Indexes , call the isImportant function to determine each index The corresponding alarm phase array phase[ ] is a pre-marked high priority behavior; if phase[ ] indicates a high priority behavior, then the index Add to imp list; Create an empty list Result to store the selected high-priority behavior encoding vectors; Iterate through each index in the imp list ,from Select the corresponding encoding vector from ; The encoding vector Add to the Result list; Use the Concat function to concatenate all the encoded vectors in the Result list into a new vector , That is the important behavior code.

[0019] In a specific implementation scheme, fusing local features with global features by hybrid pooling includes the following steps: Coding the complete behavior Use average pooling to generate global features of user behavior ; Coding important behaviors Max pooling operation to form local features of important behaviors ; Global Features and local features Splicing to get the final output .

[0020] In a specific implementation scheme, analyzing user behavior and classifying user behavior includes the following steps: Processing and predicting long-term dependencies in time series through long short-term memory networks; The probability of each classification is output through the softmax layer, and the category with the highest probability is selected as the judgment result of the user behavior.

[0021] In a specific implementation scheme, when collecting image data, the desktop image of the virtual machine is captured through the SPICE server. The SPICE protocol only calculates the changed area of ​​the desktop image and captures it. The graphic data is compressed by a compression algorithm and sent to the SPICE client.

[0022] In a specific possible implementation scheme, before collecting image data, the SPICE traffic is captured, the user's IP address in the traffic is extracted, and the remote SPICE client is identified by the IP address.

[0023] In summary, the present invention has the following beneficial effects: 1. By integrating the user desktop image and keyboard input multi-dimensional data as the user behavior feature input, a user behavior classification model is trained through Transformer to realize the audit of user behavior. Compared with the traditional user behavior audit method that relies on manual work, it can realize the automatic identification of user behavior features, which provides the possibility of supporting intelligent remote desktop user behavior audit. Compared with the user behavior audit method that relies on image features, the behavioral features of user input are added. By integrating the two types of remote desktop data, user input and desktop image, the breadth of user behavior discrimination is improved.

[0024] 2. A multi-head attention mechanism is adopted, and the key behaviors of remote desktop users are used as the keys of the attention mechanism to amplify the key behaviors of users. The hybrid pooling mechanism is used to achieve an organic combination of global user behavior feature encoding and important user behavior feature encoding, thereby enhancing the model's understanding of user behavior, enabling the audit model to effectively focus on important user behaviors and improving the accuracy of user behavior auditing. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a flowchart of the remote desktop user behavior audit method based on Transformer.

[0026] Figure 2 It is a flowchart of the remote desktop user behavior audit method based on Transformer. DETAILED DESCRIPTION

[0027] The following is combined with Figure 1-2 The present invention is described in further detail.

[0028] The remote desktop user behavior audit method based on Transformer includes the following steps: S100, remote desktop data acquisition.

[0029] Remote desktop data includes graphic data and input data. The input data is the commands entered by the user through the keyboard, and the image data is the desktop image of the virtual machine. Since the image data volume is large, it will occupy a lot of storage space. Therefore, by calculating the changes in the desktop image, the image of the changed area is captured, and the image is compressed using efficient compression algorithms such as JPEG, PNG, and H.264.

[0030] Specifically, the SPICE traffic is captured, the user's IP address in the traffic is extracted, and the remote SPICE client is identified by the IP address.

[0031] When collecting image data, the desktop image of the virtual machine is captured through the SPICE server. The SPICE protocol only calculates the area where the desktop image has changed and captures it. The image data is compressed by the compression algorithm and sent to the SPICE client. Since a large amount of image data will occupy the storage space of the SPICE server, a data caching mechanism combining time triggering and event triggering is adopted. Time triggering triggers image acquisition and file restoration according to a pre-defined time threshold, and stores the image data and files locally on the remote desktop server.

[0032] Event triggering includes two situations: 1. When the user's input data is collected abnormally, the triggering of the desktop image is started; 2. Since the remote desktop protocol transmits differential desktop images, when there is a burst of image data (i.e., a large amount of image protocol data is captured in a short period of time), the collection, restoration and local storage of image data are triggered.

[0033] When collecting input data, data collection and anomaly matching are performed in real time, that is, the user's operation behavior on the keyboard is restored according to the collected keyboard code (Key Scancode), thereby restoring the content input by the user; the content input by the user is matched using rules. If the rules are matched, it indicates that the user's operation is normal and it is classified as normal input; otherwise, it indicates that the user has abnormal behavior and it is classified as malicious input.

[0034] By recording the user's malicious input, the timestamp of the malicious input, and the image data and the timestamp of the image data, they are sent to the user behavior audit system.

[0035] S200, multi-dimensional data fusion.

[0036] Multidimensional data fusion is to fuse the input data and image data to generate user behavior features. The specific process is as follows: Set the received image data and its timestamp as a two-dimensional vector ,in, Indicates Group image data, Indicates The timestamp of the group image data.

[0037] Set the received input data and its timestamp to a two-dimensional vector ,in, For the The abnormal judgment result of group input data; when the user inputs normally, , represents an all-zero vector, For the The timestamp of the group input data.

[0038] By expanding the abnormality judgment results of the input data to a vector of the same dimension as the image data, the fusion of user input and image data is supported.

[0039] when When Group input data and Group image data association, at this time The user behavior characteristics at the moment are expressed as .in, is the preset threshold. When , there are two situations: only input data and image data do not change, and only image data changes and no input data. If only image data changes and no input data exists, it is considered The user's input data at the moment is an all-zero matrix, and the behavior characteristics are expressed as , Represents a zero vector; if only the input data and image data do not change, The image data at the moment is an all-zero matrix, and the behavior characteristics are expressed as .

[0040] Through the above method, the input data and image data are fused to obtain the user's behavior characteristics. .

[0041] S300, user behavior coding.

[0042] The Transformer encoder is used to encode the user's behavior characteristics within a time window. The Transformer model is a deep learning model based on the self-attention mechanism. It is based on the attention mechanism and has higher efficiency and performance when processing long sequences. The Transformer can perform weighted attention on each element of the input sequence according to other elements in the sequence. This mechanism can capture the relationship between long-distance words in the sequence, solving the difficulties of traditional time series models in modeling long-distance dependencies. The Transformer encoder can convert the input sequence information into a vector representation of a fixed size. The Transformer encoder has the ability to automatically learn the association between different elements in the input sequence, and supports learning the association between data at different times in the user behavior feature vector. The behavior of remote desktop users may last for a long time, requiring the model to have the ability to learn long-distance dependencies. The long-distance dependency learning ability of the Transformer encoder can well meet this demand.

[0043] The core structure of the Transformer encoder is based on a multi-head attention mechanism, which calculates a set of attention scores that allow the model to focus on the most relevant or influential vectors in the entire input sequence. Afterwards, these vectors are weighted and reorganized according to their attention scores to ensure that the model learns the most critical and valuable information in the input sequence.

[0044] For each user behavior characteristic ,Will Enter a In the self-attention mechanism, each self-attention mechanism pays attention to the input user behavior features. Through the following formula, we can , and Represents the linearly changing weight vector, and obtains the query vector , key vector Sum value vector .

[0045]

[0046]

[0047]

[0048] The attention score matrix is ​​calculated as:

[0049] By normalizing all attention scores using the softmax function, we can get the attention weight vector, where Typically a factor of the model's feature size and the number of attention mechanisms.

[0050] Finally, the outputs of all attention mechanisms are concatenated to form the final attention weight vector, which is consistent with the user input behavior characteristics. The product of is the user behavior feature encoding .

[0051] S400, key behavior self-attention.

[0052] Since the attention perspectives of the various attention mechanisms of the Transformer encoder are different, some attention mechanisms may focus on unimportant user behaviors, which is not the desired result. The goal of remote desktop user behavior is to discover anomalies or important behavioral changes of users. Therefore, a "key behavior amplification" method is proposed to correct the attention of the output of the Transformer encoder.

[0053] Furthermore, a hybrid pooling mechanism is designed to achieve an organic combination of global user behavior encoding and important user behavior encoding, so as to extract the global features of user behavior encoding while retaining the local features of important user behavior encoding, so as to enhance the model's understanding of user behavior.

[0054] Specifically, we first capture the global features encoded by user behavior through average pooling to provide a macro perspective for identifying user behavior. The average pooling technique effectively smooths the feature map to reduce the impact of noise while retaining the global information of the input features. Then, we use maximum pooling to analyze important alerts to obtain deeper local features and fuse them with global features. Maximum pooling helps to select the most important features for the model, enabling the model to capture the details and background of the attack, thereby more accurately determining the nature and type of the attack.

[0055] Obtaining important behavior codes The steps include: Encoding behavioral traits , input index Indexes and alarm phase array phase as input. The input index Indexes specifies the behavior feature encoding The candidate vectors in the alarm phase array phase correspond to the input index Indexes one by one, and are used to indicate the alarm phase of each candidate vector.

[0056] Create an empty list imp to store the indexes of actions that are judged to be high priority.

[0057] Iterate over each index in the input index Indexes , call the isImportant function to determine each index The corresponding alarm phase array phase[ ] is a high priority behavior. High priority behaviors are marked in advance during preprocessing. If phase[ ] indicates a high priority behavior, then the index Add to imp list.

[0058] Create an empty list Result to store the selected high-priority behavior encoding vectors.

[0059] Iterate through each index in the imp list ,from Select the corresponding encoding vector from . The encoded vector Add to the Result list.

[0060] Use the Concat function to concatenate all the encoded vectors in the Result list into a new vector Output That is the important behavior code.

[0061] Hybrid pooling includes the following steps: Coding the complete behavior Use average pooling to generate global features of user behavior (including noisy behavior) , encoding important behaviors Max pooling operation to form local features of important behaviors By adding the global feature and local features Splicing to get the final output , thereby obtaining a comprehensive extraction of user behavior characteristics.

[0062] Pooling is an effective method for reducing feature dimensions and improving model computing performance. Its basic idea is to abstract features into image expressions, also known as feature maps, divide the feature maps into several rectangular areas, and then perform statistical summaries on each sub-area. Average pooling and maximum pooling are two typical pooling methods. Average pooling refers to taking the average value within the pooling window as the output, which can smooth the input data and reduce the impact of noise; maximum pooling selects the maximum value within the pooling window as the output, which can extract the main features in the image.

[0063] S500, behavior classification.

[0064] The user behavior classification is realized by using the long short-term memory network (LSTM) and the softmax layer. LSTM is a method designed to solve the gradient vanishing and gradient exploding problems faced by traditional recurrent neural networks when processing long sequence data, so that it can better process and predict long-term dependencies in time series. The softmax layer is used to output the probability of each classification, and the category with the highest probability is selected as the judgment result of the user behavior.

[0065] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A remote desktop user behavior audit method based on Transformer, characterized by: The steps include: Collect and cache image data through time-triggered and event-triggered mechanisms; Collect input data, restore user input content, determine user operation categories based on rules, and record user malicious input; Fusion of image data and input data to generate user behavior features; Encode the behavior features through Transformer to generate user behavior feature codes; Extract important behavior codes from behavior feature codes and fuse local features with global features through hybrid pooling; Analyze user behavior and classify user behavior.

2. The Transformer-based remote desktop user behavior audit method according to claim 1 is characterized in that: Event triggering mechanisms include: When the user's input data is collected abnormally, the triggering of the desktop image is started; When image data bursts, the collection, restoration and local storage of image data are triggered.

3. The Transformer-based remote desktop user behavior audit method according to claim 1 is characterized in that: The steps of fusing image data with input data to generate user behavior features are as follows: The received image data and its timestamp are two-dimensional vectors ,in, Indicates Group image data, Indicates The timestamp of the group image data; The received input data and its timestamp are two-dimensional vectors ,in, For the The abnormal judgment result of group input data; when the user inputs normally, , represents an all-zero vector, For the The timestamp of the group input data; when When Group input data and Group image data association, at this time The user behavior characteristics at the moment are expressed as ,in, is the preset threshold; when When only the image data changes and there is no input data, it is considered The user's input data at the moment is an all-zero matrix, and the behavior characteristics are expressed as , Represents a zero vector; if only the input data and image data do not change, The image data at the moment is an all-zero matrix, and the behavior characteristics are expressed as .

4. The Transformer-based remote desktop user behavior auditing method according to claim 1 is characterized in that: Encoding the behavior features through Transformer and generating the user behavior feature encoding includes the following steps: Each user behavior feature Enter a In the self-attention mechanism, each self-attention mechanism pays attention to the input user behavior features. Perform linear changes according to , and Represents the linearly changing weight vector, and obtains the query vector , key vector Sum value vector , query vector , key vector Sum value vector The calculation formula is as follows: The calculation formula of the attention score matrix is: In the above formula, Typically a factor of the model's feature size and the number of attention mechanisms; All attention scores are normalized by the softmax function to obtain the attention weight vector; Concatenate all attention weight vectors, and the concatenation result is consistent with the behavior characteristics. The product of is the user behavior feature code.

5. The Transformer-based remote desktop user behavior auditing method according to claim 1 is characterized in that: Extracting important behavior codes from behavior feature codes includes the following steps: Encoding behavioral traits , input index Indexes and alarm phase array phase as input, where the input index Indexes specifies the behavior feature encoding The candidate vectors in the alarm phase array phase correspond to the input index Indexes one by one, which is used to indicate the alarm phase of each candidate vector; Create an empty list imp to store the indexes of behaviors that are judged to be high priority; Iterate over each index in the input index Indexes , call the isImportant function to determine each index The corresponding alarm phase array phase[ ] is a pre-marked high priority behavior; if phase[ ] indicates a high priority behavior, then the index Add to imp list; Create an empty list Result to store the selected high-priority behavior encoding vectors; Iterate through each index in the imp list ,from Select the corresponding encoding vector from ; The encoding vector Add to the Result list; Use the Concat function to concatenate all the encoded vectors in the Result list into a new vector , That is the important behavior code.

6. The Transformer-based remote desktop user behavior audit method according to claim 1, characterized in that: The fusion of local features and global features through hybrid pooling includes the following steps: Coding the complete behavior Use average pooling to generate global features of user behavior ; Coding important behaviors Max pooling operation to form local features of important behaviors ; Global Features and local features Splicing to get the final output .

7. The Transformer-based remote desktop user behavior audit method according to claim 1, characterized in that: Analyzing user behavior and classifying user behavior includes the following steps: Processing and predicting long-term dependencies in time series through long short-term memory networks; The probability of each classification is output through the softmax layer, and the category with the highest probability is selected as the judgment result of the user behavior.

8. The Transformer-based remote desktop user behavior audit method according to claim 1, characterized in that: When collecting image data, the desktop image of the virtual machine is captured through the SPICE server. The SPICE protocol only calculates the changed area of ​​the desktop image and captures it. The graphic data is compressed by the compression algorithm and sent to the SPICE client.

9. The Transformer-based remote desktop user behavior audit method according to claim 1, characterized in that: Before collecting image data, capture the SPICE traffic, extract the user's IP address in the traffic, and identify the remote SPICE client by the IP address.

Images