A Transformer-based Remote Desktop User Behavior Auditing Method

Abstract

The present invention relates to the technical fields of network security and artificial intelligence, and particularly relates to a method for auditing remote desktop user behavior based on Transformer, which comprises the following steps: collecting and caching image data through a time-triggered and event-triggered mechanism; collecting input data, restoring the user input content, classifying the user operations through rules, and recording malicious inputs of the user; fusing the image data and the input data to generate user behavior features; encoding the behavior features through Transformer to generate user behavior feature encodings; extracting important behavior encodings from the behavior feature encodings, capturing the global features of the behavior feature encodings through average pooling, maximizing the pooling of the important behavior encodings, and fusing the local features and the global features; analyzing the user behavior and classifying the user behavior. The present invention improves the intelligence level and detection efficiency of the remote desktop user behavior auditing method.

Description

Technical Field

[0001] The present invention relates to the technical fields of network security and artificial intelligence, and in particular to a method for auditing remote desktop user behavior based on Transformer. Background Art

[0002] Remote desktop is a technology that allows users to remotely access a device from a local device via a network connection. When using a remote desktop, the user first inputs specific instructions through peripherals such as a keyboard and mouse on the local device, and then the instructions input locally are transmitted to the remote computer via the remote desktop protocol. After receiving these instructions, the remote computer quickly analyzes and processes them, and then, according to the request of the local device, transmits the corresponding screen images, audio, and other content back to the local device in real time. As an important tool for improving work efficiency and flexibility, remote desktop technology has been widely recognized and highly valued in many key fields.

[0003] In some fields involving a large amount of sensitive information, extremely stringent requirements are imposed on the security of remote desktops. To ensure the secure use of data, it is necessary to conduct a security audit of the behavior of users using remote desktops, promptly discover abnormal or suspicious behaviors of users, thereby effectively preventing users from accessing and operating sensitive data, and avoiding potential data leakage risks.

[0004] Currently, there are mainly two methods for auditing remote desktop user behavior. One is the method for auditing remote desktop user behavior based on manual analysis, and the other is the method for auditing remote desktop user behavior based on image recognition.

[0005] The method for auditing remote desktop user behavior based on manual analysis refers to the detailed, comprehensive recording, analysis, and evaluation of the operation behaviors of remote desktop users in a manual manner to ensure that all operations of users are compliant. Currently, the manual auditing method mainly collects and records the behavior session data of specific users, and then monitors and tracks the behaviors of users by playing back the specific network operations of users to discover abnormal behaviors of users.

[0006] This process requires auditors to view and interpret user behavior data item by item. As the behavior data of remote desktop users continues to grow, this method is likely to consume a large amount of time and manpower and may be difficult to achieve comprehensive auditing. Secondly, in manual auditing, the judgment and experience of auditors often play a decisive role. Due to the influence of the experience and skill level of auditors, there may be false positives or false negatives, thus affecting the auditing effect. Moreover, during the process of manual analysis, auditors may come into contact with sensitive information and privacy data of users. If not handled properly, it may lead to the leakage and abuse of user privacy.

[0007] The remote desktop user behavior auditing method based on image recognition mainly relies on image recognition technology, especially Optical Character Recognition (OCR) technology. Currently, the image-based auditing method mainly extracts the information in the image, converts it into text information that can be processed by a computer, and then automatically recognizes and analyzes the specific behaviors of users.

[0008] Image recognition technology itself is affected by various factors such as angles and occlusions. In the auditing of remote desktop user behaviors, if the user's operation interface is affected by these factors, it may lead to misrecognition or omission of key information. Secondly, for some complex user behaviors, such as rapid keyboard input and multi-window switching, image recognition technology may be difficult to accurately capture and recognize. These behaviors may be of great significance in auditing, but cannot be effectively recognized due to technical limitations. Secondly, user auditing based on image recognition is usually post-analysis, and image analysis itself usually requires a certain amount of processing time, which may affect the real-time nature of the audit results and cannot reflect the true behaviors of users in a timely manner. Summary of the Invention

[0009] In order to solve the problems of poor intelligence and low detection efficiency of the remote desktop user behavior auditing method, the present invention provides a remote desktop user behavior auditing method based on Transformer.

[0010] The present invention provides a remote desktop user behavior auditing method based on Transformer, adopting the following technical solutions:

[0011] A remote desktop user behavior auditing method based on Transformer includes the following steps:

[0012] Collect and cache image data through time-triggered and event-triggered mechanisms;

[0013] Collect input data, restore the user input content, judge the user operation classification through rules, and record the malicious input of the user;

[0014] Fuse the image data and the input data to generate user behavior features;

[0015] Encode the behavior features through Transformer to generate user behavior feature encodings;

[0016] Extract important behavior encodings from the behavior feature encodings, and fuse local features and global features through hybrid pooling;

[0017] Analyze the user behavior and classify the user behavior.

[0018] In a specific feasible implementation, the event trigger mechanism includes:

[0019] When abnormal input data of the user is collected, trigger the desktop image.

[0020] When image data bursts, trigger the acquisition, restoration, and local storage of the image data.

[0021] In a specific feasible implementation, fusing the image data and the input data to generate user behavior characteristics includes the following steps:

[0022] The received image data and its timestamp are a two-dimensional vector , where represents the th group of image data, represents the th timestamp of the group of image data;

[0023] The received input data and its timestamp are a two-dimensional vector , where is the abnormal determination result of the th group of input data; when the user inputs normally, , representing a zero vector, is the th timestamp of the group of input data;

[0024] When , it is considered that the th group of input data is associated with the th group of image data. At this time, the user behavior characteristic at is represented as , where is a preset threshold;

[0025] When , if only the image data changes and there is no input data, it is considered that the input data of the user at is a zero vector, and the behavior characteristic is represented as , representing a zero vector; if there is only input data and the image data does not change, the image data at is a zero vector, and the behavior characteristic is represented as .

[0026] In a specific feasible implementation, encoding the behavior characteristics through a Transformer to generate user behavior characteristic encoding includes the following steps:

[0027] Input each user behavior characteristic into a container containing In the head self-attention mechanism, each self-attention mechanism performs a linear transformation on the input user behavior features and, according to , and the weight vectors representing the linear transformations, obtains the query vector , the key vector and the value vector . The calculation formulas for the query vector , the key vector and the value vector are as follows:

[0028]

[0029]

[0030]

[0031] The calculation formula for the attention score matrix is:

[0032]

[0033] In the above formula, is usually the factor of the model feature scale and the number of attention mechanisms;

[0034] Normalize all attention scores through the softmax function to obtain the attention weight vector;

[0035] Concatenate all attention weight vectors, and the product of the concatenated result and the behavior features is the user behavior feature encoding.

[0036] In a specific implementable solution, extracting important behavior encodings from the behavior feature encoding includes the following steps:

[0037] Use the behavior feature encoding , the input index Indexes and the alarm phase array phase as inputs, where the input index Indexes specifies the candidate vectors in the behavior feature encoding , and the alarm phase array phase corresponds one-to-one with the input index Indexes and is used to represent the alarm phase where each candidate vector is located;

[0038] Create an empty list imp to store the indexes determined to be high-priority behaviors;

[0039] Traverse each index in the input index Indexes , and call the isImportant function to judge each index The corresponding alarm phase array phase[ ] is a pre-marked high-priority behavior; if phase[ ] indicates a high priority behavior, then the index Add to imp list;

[0040] Create an empty list Result to store the selected high-priority behavior encoding vectors;

[0041] Iterate over each index in the imp list ,from Select the corresponding encoding vector ; The encoding vector Add to the Result list;

[0042] Use the Concat function to concatenate all the encoded vectors in the Result list into a new vector , That is the important behavior code.

[0043] In a specific implementation scheme, fusing local features with global features through hybrid pooling includes the following steps:

[0044] Coding the complete behavior Use average pooling to generate global features of user behavior ;

[0045] Encoding important behaviors Max pooling operation to form local features of important behaviors ;

[0046] Global Features and local features Splicing to get the final output .

[0047] In a specific implementation plan, analyzing user behavior and classifying user behavior includes the following steps:

[0048] Processing and predicting long-term dependencies in time series through long short-term memory networks;

[0049] The probability of each classification is output through the softmax layer, and the category with the highest probability is selected as the judgment result of user behavior.

[0050] In a specific implementation scheme, when collecting image data, the desktop image of the virtual machine is captured through the SPICE server. The SPICE protocol only calculates the changed areas of the desktop image and captures them. The graphic data is compressed through a compression algorithm and sent to the SPICE client.

[0051] In a specific implementable embodiment, before collecting image data, the traffic of SPICE is captured, the IP address of the user in the traffic is extracted, and the remote SPICE client is identified by the IP address.

[0052] In summary, the present invention includes the following beneficial effects:

[0053] 1. By fusing the user desktop image and the multi-dimensional data of keyboard input as the input of user behavior characteristics, a user behavior classification model is trained through Transformer to realize the auditing of user behavior. Compared with the traditional manual user behavior auditing method, it can realize the automatic identification of user behavior characteristics, providing the possibility for supporting intelligent remote desktop user behavior auditing. Compared with the user behavior auditing method relying on image features, the behavior characteristics of user input are added, and by fusing the two types of remote desktop data of user input and desktop image, the breadth of user behavior discrimination is improved.

[0054] 2. The multi-head attention mechanism is adopted, and the key behaviors of remote desktop users are used as the keys of the attention mechanism to amplify the key behaviors of users, and the hybrid pooling mechanism is used to realize the organic combination of global user behavior feature encoding and important user behavior feature encoding, thereby enhancing the model's understanding of user behavior, enabling the auditing model to effectively focus on important user behaviors, and improving the accuracy of user behavior auditing. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is a flowchart of a method for auditing remote desktop user behavior based on Transformer.

[0056] Figure 2 is a flowchart of a method for auditing remote desktop user behavior based on Transformer. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0057] The following further describes the present invention in detail Figure 1-2 with reference to the accompanying drawings.

[0058] The method for auditing remote desktop user behavior based on Transformer includes the following steps:

[0059] S100, remote desktop data collection.

[0060] Remote desktop data includes graphic data and input data. The input data is instructions input by the user through the keyboard, etc., and the image data is the desktop image of the virtual machine. Since the amount of image data is large and will occupy a large amount of storage space, therefore, by calculating the changes in the desktop image, intercepting the image of the changed area, and using efficient compression algorithms such as JPEG, PNG, and H.264 to compress the pictures.

[0061] Specifically, capture the traffic of SPICE, extract the user's IP address in the traffic, and identify the remote SPICE client through the IP address.

[0062] When collecting image data, the desktop image of the virtual machine is captured through the SPICE server. The SPICE protocol only calculates the changed area of the desktop image and intercepts and captures it. After compressing the graphic data through the compression algorithm, it is sent to the SPICE client. Since a large amount of image data will occupy the storage space of the SPICE server, a data caching mechanism combining time trigger and event trigger is adopted. Time trigger means triggering the collection and file restoration of images according to the predefined time threshold, and storing the graphic data and files locally on the remote desktop server.

[0063] Event trigger includes two situations:

[0064] 1. When an abnormality is detected in the collection of the user's input data, trigger the desktop image.

[0065] 2. Since the remote desktop protocol transfers differential desktop pictures, when there is a burst of image data (that is, a large amount of image protocol data is captured in a short period), trigger the collection, restoration, and local storage of the image data.

[0066] When collecting input data, data collection and anomaly matching are carried out in real time, that is, the user's operation behavior on the keyboard is restored according to the captured keyboard scancode, so as to restore the content input by the user; use rules to match the content input by the user. If the rules are matched, it indicates that the user's operation is normal and is classified as normal input; otherwise, it indicates that the user has abnormal behavior and is classified as malicious input.

[0067] By recording the user's malicious input, the timestamp of the malicious input, as well as the image data and the timestamp of the image data, send it to the user behavior auditing system.

[0068] S200, multi-dimensional data fusion.

[0069] Multi-dimensional data fusion means fusing the input data and the image data to generate user behavior characteristics. The specific process is as follows:

[0070] Set the received image data and its timestamp as a two-dimensional vector , where, Represents the group of image data,

[0071] Represents the timestamp of the group of image data.

[0072] Set the received input data and its timestamp as a two-dimensional vector , where is the abnormal determination result of the group of input data; when the user inputs normally, , representing a zero vector,

[0073] is the timestamp of the group of input data.

[0074] By extending the abnormal determination result of the input data to a vector with the same dimension as the image data, it supports the fusion of user input and image data.

[0075] When , it is considered that the group of input data is associated with the group of image data. At this time, the user behavior feature at is represented as . Among them, is a preset threshold. When , there are two situations: only the input data changes and the image data remains unchanged, and only the image data changes and there is no input data. If only the image data changes and there is no input data, it is considered that the input data of the user at is a zero vector, and the behavior feature is represented as , representing a zero vector; if only the input data changes and the image data remains unchanged, the image data at is a zero vector, and the behavior feature is represented as .

[0076] Through the above method, the input data and the image data are fused to obtain the user behavior feature .

[0077] S300, User behavior encoding.

[0078] Encode the user's behavioral features within a certain time window through a Transformer encoder. The Transformer model is a deep learning model based on the self-attention mechanism. Based on the attention mechanism, it has higher efficiency and performance when dealing with long sequences. Transformer can, when processing each element of the input sequence, pay weighted attention according to other elements in the sequence. This mechanism can capture the relationships between distant words in the sequence and solve the difficulties of traditional time series models in modeling long-distance dependencies. The encoder of Transformer can transform the input sequence information into a fixed-size vector representation. The ability of the Transformer encoder to automatically learn the correlation relationships between different elements in the input sequence supports learning the correlations between data at different times in the user behavior feature vector. The duration of the behavior of remote desktop users may span a long time, and the model needs to have the ability to learn long-distance dependencies. The long-distance dependency learning ability of the Transformer encoder can well meet this requirement.

[0079] The core structure of the Transformer encoder is based on the multi-head attention mechanism. By calculating a set of attention scores, these scores can enable the model to focus on the most relevant or influential vectors in the entire input sequence. Then, these vectors are weighted and reorganized according to their attention scores to ensure that the model learns the most critical and valuable information in the input sequence.

[0080] For each user behavior feature , input into a self-attention mechanism with heads. Each self-attention mechanism linearly transforms the input user behavior feature . Through the following formula, according to , and representing the weight vectors of the linear transformation, obtain the query vector , the key vector and the value vector .

[0081]

[0082]

[0083]

[0084] The calculation method of the attention score matrix is:

[0085]

[0086] After normalizing all attention scores using the softmax function, the attention weight vector can be obtained. In the above formula, is usually a factor of the model feature scale and the number of attention mechanisms.

[0087] Finally, the outputs of all attention mechanisms are concatenated to form the final attention weight vector, and the product of this vector and the user input behavior features is the encoding of user behavior features .

[0088] S400, Key Behavior Self-Attention.

[0089] Since the attention perspectives of each attention mechanism in the Transformer encoder are different, some attention mechanisms may focus on unimportant user behaviors, which is not the desired result. The goal of remote desktop user behavior is to discover anomalies or important behavior changes of users. Therefore, the "Key Behavior Amplification" method is proposed to correct the attention of the output of the Transformer encoder.

[0090] Furthermore, a hybrid pooling mechanism is designed to achieve an organic combination of global user behavior encoding and important user behavior encoding, so as to retain the local features of important user behavior encoding while extracting the global features of user behavior encoding, in order to enhance the model's understanding of user behavior.

[0091] Specifically, first, the global features of user behavior encoding are captured through average pooling, providing a macroscopic perspective for identifying user behavior. The average pooling technique effectively smooths the feature map to reduce the influence of noise while retaining the global information of the input features. Then, maximum pooling is used to analyze important alerts to obtain more in-depth local features and fuse them with the global features. Maximum pooling helps the model capture the details and background of attacks by selecting the most important features for the model, so as to more accurately determine the nature and type of attacks.

[0092] Obtain important behavior encoding including the following steps:

[0093] Take the behavior feature encoding , input index Indexes, and alarm phase array phase as inputs. Among them, the input index Indexes specifies the candidate vectors in the behavior feature encoding , and the alarm phase array phase corresponds one-to-one with the input index Indexes, and is used to represent the alarm phase where each candidate vector is located.

[0094] Create an empty list imp to store the indexes determined as high-priority behaviors.

[0095] Traverse each index in the input index Indexes and call the isImportant function to judge each index for whether the corresponding alarm phase array phase is a high-priority behavior. High-priority behaviors have been pre-marked during the preprocessing. If phase represents a high-priority behavior, add the index to the imp list.

[0096] Create an empty list Result to store the selected high-priority behavior encoding vectors.

[0097] Traverse each index in the imp list and select the corresponding encoding vector from . Add the encoding vector to the Result list.

[0098] Concatenate all the encoding vectors in the Result list into a new vector through the Concat function . The output is the important behavior encoding.

[0099] Hybrid pooling includes the following steps:

[0100] Perform average pooling operation on the complete behavior encoding to generate the global features of the user behaviors (including noise behaviors) , and perform max pooling operation on the important behavior encoding to form the local features of the important behaviors . By concatenating the global features and the local features , the final output is obtained, thus achieving a comprehensive extraction of the user behavior features.

[0101] Pooling is an effective method for reducing the feature dimension and improving the model operation performance. Its basic idea is to abstract the features into an image expression, also known as a feature map, divide the feature map into several rectangular regions, and then perform statistical aggregation on each sub-region. Average pooling and max pooling are two typical pooling methods. Among them, average pooling means taking the average value within the pooling window as the output, which can smooth the input data and reduce the influence of noise; max pooling is to select the maximum value within the pooling window as the output, which can extract the main features in the image.

[0102] S500, Behavior classification.

[0103] The classification of user behaviors is implemented using a Long Short-Term Memory (LSTM) network and a softmax layer. The LSTM is designed to address the problems of vanishing gradients and exploding gradients faced by traditional recurrent neural networks when processing long sequence data, enabling better handling and prediction of long-term dependencies in time series. The softmax layer is used to output the probability of each classification, and the category with the highest probability is selected as the determination result of the user behavior.

[0104] The above are all preferred embodiments of the present invention. The protection scope of the present invention is not limited thereby. Therefore, all equivalent changes made according to the structure, shape, and principle of the present invention shall be covered within the protection scope of the present invention.

Claims

1. A method for auditing remote desktop user behavior based on Transformer, characterized in that: It includes the following steps: Collect and cache image data through time-triggered and event-triggered mechanisms; Collect input data, restore the user input content, classify the user operations through rules, and record the malicious input of the user; Fuse the image data and the input data to generate user behavior features; Encode the user behavior features through a Transformer to generate user behavior feature encodings; Extract important behavior encodings from the behavior feature encodings, and fuse local features and global features through hybrid pooling; Analyze the user behavior and classify the user behavior; The input data is the instruction input by the user through the keyboard, and the image data is the desktop image of the virtual machine; The steps for fusing the image data and the input data to generate user behavior features include: The received image data and its timestamp are two-dimensional vectors , where represents the group of image data, represents the timestamp of the group of image data; The received input data and its timestamp are two-dimensional vectors , where is the abnormal determination result of the th group of input data; when the user inputs normally, , indicating a zero vector, is the timestamp of the th group of input data; When it is considered that the th group of input data is associated with the th group of image data. At this time, the user behavior feature at the moment is represented as , where is a preset threshold value. When If only the image data changes and there is no input data, it is considered that the input data of the user at the moment is a zero vector, and the behavior feature is represented as , indicating a zero vector; if there is only input data and the image data does not change, the image data at the moment is a zero vector, and the behavior feature is represented as ; The steps for fusing local features and global features through hybrid pooling include: Encode the complete behavior Use the average pooling operation to generate the global features of the user behavior ; Encode important behaviors Max pooling operation to form local features of important behaviors ; Concatenate the global features and the local features to obtain the final output .

2. The method for auditing remote desktop user behavior based on Transformer according to claim 1, characterized in that: The event-triggered mechanism includes: When the user's input data is abnormal, trigger the desktop image; When the image data bursts, trigger the collection, restoration, and local storage of the image data.

3. The method for auditing remote desktop user behavior based on Transformer according to claim 1, characterized in that: The steps for encoding the behavior features through a Transformer to generate user behavior feature encodings include: Input each user behavior feature into a self-attention mechanism containing heads. Each self-attention mechanism performs a linear transformation on the input user behavior feature and obtains a query vector , a key vector , and a value vector according to the weight vectors representing the linear transformations of , , and . The calculation formulas for the query vector , the key vector , and the value vector are as follows: The calculation formula for the attention score matrix is: In the above formula, is usually a factor of the model feature scale and the number of attention mechanisms; Normalize all attention scores through the softmax function to obtain the attention weight vector; Concatenate all attention weight vectors, and the product of the concatenated result and the behavior feature is the user behavior feature encoding.

4. The method for auditing remote desktop user behavior based on Transformer according to claim 1, wherein: The steps for extracting important behavior encodings from the behavior feature encodings include: Encode behavioral features Take the input index Indexes and the alarm phase array phase as inputs, where the input index Indexes specifies the candidate vectors in the behavioral feature encoding. The alarm phase array phase corresponds one-to-one with the input index Indexes and is used to represent the alarm phase of each candidate vector; Create an empty list imp to store the indices of the behaviors determined to be of high priority; Traverse each index in the input index Indexes , call the isImportant function to judge each index corresponding alarm phase array phase whether it is a pre-labeled high-priority behavior; if phase represents a high-priority behavior, then add the index to the imp list; Create an empty list Result to store the selected high-priority behavior encoding vectors; Traverse each index in the imp list , select the corresponding encoding vector from ; add the encoding vector to the Result list; Add it to the Result list; Concatenate all the encoded vectors in the Result list into a new vector through the Concat function , which is the important behavior encoding.

5. The method for auditing remote desktop user behavior based on Transformer according to claim 1, characterized in that: The steps for analyzing the user behavior and classifying the user behavior include: Process and predict the long-term dependencies in the time series through a long short-term memory network; Output the probability of each classification through the softmax layer, and select the category with the highest probability as the determination result of the user behavior.

6. The method for auditing remote desktop user behavior based on Transformer according to claim 1, characterized in that: When collecting image data, capture the desktop image of the virtual machine through the SPICE server. The SPICE protocol only calculates the changed areas of the desktop image and intercepts and captures them, and sends the graphic data to the SPICE client after compressing it through a compression algorithm.

7. The method for auditing remote desktop user behavior based on Transformer according to claim 1, characterized in that: Before collecting image data, capture the SPICE traffic, extract the user's IP address in the traffic, and identify the remote SPICE client through the IP address.

Images