Software abnormal behavior dynamic analysis method based on non-uniform Markov chain

Abstract

The application discloses a software abnormal behavior dynamic analysis method based on a non-uniform Markov chain, which comprises the following steps: S1, collecting and preprocessing software log data; S2, dynamically dividing states by using K-means clustering to generate a preliminary state set and a transition relationship; S3, constructing an improved non-uniform Markov chain model; S4, performing abnormal detection by the improved non-uniform Markov chain model and calculating an abnormal score; S5, constructing an objective function and optimizing by using a grey wolf optimization algorithm; S6, feeding back the optimized parameters to S3 to update a time-varying transition probability matrix and the abnormal score calculation; S7, judging the abnormality according to the updated abnormal score and a warning threshold, outputting a warning signal and feeding back. The application realizes real-time and accurate detection and self-adaptive optimization of software abnormal behaviors by constructing an improved non-uniform Markov chain and a software abnormal behavior dynamic analysis method based on a grey wolf optimization algorithm, thereby significantly improving system security and stability.

Description

Technical Field

[0001] This invention relates to the field of intelligent anomaly detection and prediction technology, and in particular to a dynamic analysis method for software anomaly behavior based on non-uniform Markov chains. Background Technology

[0002] In the operation of modern software systems, the detection and analysis of abnormal behavior are crucial tasks for ensuring system stability and security. With increasing software complexity, traditional anomaly detection methods face numerous challenges, such as reliance on static rules, insufficient adaptability to environmental changes, and high false positive rates. Currently, common software anomaly detection methods mainly include rule-based methods, statistical methods, machine learning-based methods, and time-series modeling-based methods. However, these methods often struggle to achieve efficient and accurate anomaly detection in complex environments, especially in dynamically changing software operating environments, where traditional models cannot accurately characterize the system's state transition characteristics, thus limiting their detection effectiveness.

[0003] Rule-based matching methods rely on manually defined anomaly features or strategies to identify anomalies, such as threshold settings and blacklist mechanisms. These methods are applicable to known anomaly patterns and offer a degree of interpretability, but their main drawback is poor detection of unknown anomalies. Furthermore, the rules require manual maintenance and are difficult to adapt to dynamically changing software environments. If the software's operating mode changes, the original rules may become invalid, leading to a high false negative rate. In addition, rule-based matching methods perform poorly when handling complex, high-dimensional data and cannot fully uncover potential anomaly behavior patterns.

[0004] Statistical methods, such as time series analysis and probabilistic models, attempt to predict future behavior by modeling historical data and detect anomalies based on statistical biases. For example, Markov chain models and Hidden Markov Models (HMMs) have some applications in anomaly detection. Traditional Markov chain models assume that the system's state transitions follow a fixed probability distribution and train the state transition matrix based on historical data. However, the behavior of software systems is often dynamic, and a fixed state transition probability matrix cannot effectively reflect the time-varying characteristics of the system's state, leading to a decrease in the accuracy of anomaly detection. Furthermore, standard Markov chain models cannot adaptively adjust hyperparameters, are easily affected by the limitations of the training data, and struggle to maintain robustness across different scenarios.

[0005] In recent years, machine learning-based methods, such as Support Vector Machines (SVM), Random Forests (RF), and Deep Neural Networks (DNN), have been widely applied in anomaly detection. These methods, by learning patterns in data features, can improve the ability to identify complex anomalous behaviors to some extent. However, machine learning models typically require large amounts of training data and may suffer from overfitting when dealing with high-dimensional, non-linear data. Furthermore, the black-box nature of deep learning models makes anomaly detection results difficult to interpret, potentially limiting their application in security-sensitive software systems. Additionally, machine learning-based methods generally require significant computational resources, making it difficult to meet real-time requirements, especially in large-scale distributed software systems where computational overhead becomes a major factor affecting detection efficiency.

[0006] Temporal modeling methods offer a reasonable solution for addressing anomalous temporal behavior during software execution. For example, models based on Long Short-Term Memory (LSTM) networks and Temporal Convolutional Networks (TCNs) can learn from time-series data and predict future states. However, these methods still have some limitations. They rely heavily on historical data, cannot effectively incorporate the structural information of the software system itself, and suffer from high computational costs in applications with high real-time requirements, making it difficult to guarantee efficiency.

[0007] Therefore, how to provide a dynamic analysis method for software anomaly behavior based on non-uniform Markov chains is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0008] One objective of this invention is to propose a dynamic analysis method for software anomaly behavior based on non-uniform Markov chains. This invention fully utilizes an improved non-uniform Markov chain model and the Grey Wolf optimization algorithm. Through intelligent state partitioning of software runtime log data, dynamic construction of the state transition probability matrix, and accurate calculation of anomaly scores, it achieves real-time monitoring and prediction of software anomaly behavior. Specifically, this invention uses the K-means clustering algorithm to dynamically partition the preprocessed log data, constructing a preliminary state set. By introducing a time decay factor and a dynamic weighting factor, it innovatively constructs a time-varying transition probability matrix, thereby accurately describing the transition characteristics of software states within different time windows. Simultaneously, this invention combines the Grey Wolf optimization algorithm to globally adaptively optimize key parameters such as state partitioning granularity, time window length, dynamic weighting factor, and anomaly warning threshold, effectively improving the model's detection accuracy and robustness. This method not only captures anomaly behavior during software operation in real time but also has the advantages of fast response speed, high detection accuracy, and strong adaptability, significantly reducing the risk of false alarms and false negatives, thus providing a strong guarantee for the stable operation of the software system.

[0009] The dynamic analysis method for software anomaly behavior based on non-uniform Markov chains according to embodiments of the present invention includes the following steps:

[0010] S1. Collect software operation log data in real time and preprocess the software operation log data;

[0011] S2. The K-means clustering algorithm is used to dynamically divide the preprocessed software operation log data into states, generate a preliminary state set, and define the state transition relationship.

[0012] S3. Based on the initial state set, the transition frequency between each state is counted within a predetermined time window to generate a basic state transition matrix. Dynamic weighting factors are introduced based on historical data and real-time changes to form a non-uniform Markov chain model and a time-varying transition probability matrix.

[0013] S4. Use a non-uniform Markov chain model to detect anomalies in real-time data, and calculate anomaly scores based on the degree of deviation between real-time monitoring data and time-varying transition probability matrix.

[0014] S5. Construct the objective function and apply the Grey Wolf optimization algorithm to globally optimize the state partitioning granularity, time window length, dynamic weight factor and anomaly warning threshold parameters in the non-uniform Markov chain model.

[0015] S6. Feed the optimized parameters back to the non-uniform Markov chain model in step S3 to update the time-varying transition probability matrix and the anomaly score calculation method.

[0016] S7. Determine abnormal behavior based on the updated abnormal score and abnormal warning threshold, output a warning signal, and provide feedback on the warning result.

[0017] Optionally, S2 specifically includes:

[0018] S21. The preprocessed software runtime log data set is X = {x} i |i=1,…,n}, where x i ∈R m Where m is the dimension of the data features, n represents the total number of samples, R is the set of real numbers, and x represents the data sample of each software operation log. i The corresponding timestamp is t i ∈R;

[0019] S22. Let the predetermined number of states be k, and initialize the cluster centers and their corresponding average timestamps:

[0020] μ1,μ2,…,μ k ∈R m and τ1,τ2,…,τ k ∈R;

[0021] Where, μ k Let τ represent the k-th cluster center. k This represents the average timestamp corresponding to the j-th cluster center;

[0022] S23. For any software runtime log data sample x i and timestamp t i Assign it to state S j :

[0023]

[0024] Where, ||| represents the Euclidean norm, and λ is a preset time weighting coefficient. This indicates that among all values ​​of l, the value that minimizes the expression within the parentheses is selected, and j represents the minimum value for the software runtime log data sample x. i The index of the selected cluster center, where k represents the number of predefined states;

[0025] S24. Update μ for each cluster center. j and average timestamp τ j :

[0026]

[0027] Among them, S j Let S be the set of data samples in the j-th cluster. j | represents S j The number of data samples in the middle;

[0028] S25. Repeat steps S23 and S24 until the cluster centers and their corresponding timestamps converge or the preset number of iterations is reached. The resulting clustering results constitute a preliminary state set S = {S j |j=1,…,k}, where k is the predetermined number of states and j is the state index;

[0029] S26. Define a continuous data sample x i With x i+1 The state transition relationship is: if x i ∈S p And x i+1 ∈S q Then it is denoted as state transition S. p →S q , of which S p Let S represent the p-th state. q Indicates the q-th state;

[0030] Optionally, S3 specifically includes:

[0031] S31. The initial state set is S, and the predetermined time window is T;

[0032] S32, For each pair of states S p and S q The fundamental state transition frequency is calculated using the time decay method, and the fundamental state transition matrix is ​​constructed as follows:

[0033]

[0034] in, Indicates from state S p Transition to state S q The fundamental state transition frequency, x i Let x represent the i-th continuous data sample. i+1 Let t represent the (i+1)th consecutive data sample. i and t i+1 Representing data samples x respectively i With x i+1 The timestamp, β is the time decay parameter, I is the indicator function, and n is the total number of data samples;

[0035] S33, For each pair of states S p and S q Based on the transfer frequency sequence within the most recent N time windows and historical average transfer frequency Calculate the dynamic weighting factor ω pq :

[0036]

[0037] Where α is an adjustment parameter, and ∈ is a small positive constant to prevent division by zero;

[0038] S34. Using nonlinear mapping to adjust the fundamental state transition frequency With dynamic weighting factor ω pq Perform joint adjustments and calculate the weighted transfer frequency f′. pq :

[0039]

[0040] Where δ is the mapping scaling factor, θ is the threshold parameter, and exp is the exponential function;

[0041] S35. Construct a time-varying transition probability matrix P using weighted transition frequencies:

[0042]

[0043] Where κ is the regularization constant, γ is the scaling exponent, and k represents the total number of states;

[0044] S36. By combining the initial state set S with the time-varying transition probability matrix P, a non-uniform Markov chain model (S,P) is constructed.

[0045] Optionally, S4 specifically includes:

[0046] S41. Real-time acquisition of data generated during the operation of the software, forming a real-time data sequence containing sampled data at various time points;

[0047] S42. Map each data sample in the real-time data sequence to the corresponding state according to the pre-constructed state set to generate a real-time state sequence that reflects the changes in the software's running state.

[0048] S43. Statistically analyze the state transitions in the real-time state sequence, record the actual number of transitions between adjacent states, and form a transition data record describing the actual state transition situation.

[0049] S44. Using the constructed time-varying transition probability matrix, generate an expected state transition distribution corresponding to the expected transition probabilities between each state.

[0050] S45. Compare the actual state transition records with the expected state transition distribution, assess the degree of deviation between each state, and record the deviation between each transition item.

[0051] S46. Taking into account the deviations of all state transition terms, calculate the overall anomaly score and use this anomaly score as the output of real-time anomaly detection:

[0052]

[0053] Here, AS represents the overall anomaly score. In a real-time state sequence, starting from state S p to state S q The actual number of transfers, P pq In the constructed time-varying transition probability matrix, from state S p to state S q The expected transition probability, N obs denoted by , where k represents the total number of real-time state transitions, ∈ represents the total number of states in the state set S, and ∈ is a small positive constant to prevent division by zero.

[0054] Optionally, S5 specifically includes:

[0055] S51, Key Parameter Vector is Where k is the state partitioning granularity and T is the time window length. θ is the average value of the dynamic weighting factors, and θ is the anomaly warning threshold.

[0056] S52. Construct the objective function:

[0057]

[0058] Among them, AS i Let M be the anomaly score for the i-th sample, M be the total number of samples, and η and λ be the anomaly scores. o σ is the regularization coefficient. AS The standard deviation of the outlier scores;

[0059] S53. Randomly generate the initial positions of the gray wolf population in the parameter space:

[0060] {U i (0) | i = 1, ..., n};

[0061] Among them, U i (0) represents the parameter vector of the i-th gray wolf at the initial moment, where n is the population size;

[0062] S54. Calculate the objective function value F(U) for each individual gray wolf. i (t)), and sort the population, selecting the three individuals with the smallest objective function values ​​as the leader gray wolf U. α (t), Secondary Grey Wolf U β (t), Third Grey Wolf U δ (t);

[0063] S55. Update the position of each individual gray wolf:

[0064]

[0065] in, U is a random factor. i (t) represents the parameter vector of the i-th gray wolf at iteration time t, U i (t+1) represents the updated parameter vector of the i-th gray wolf at iteration time t+1;

[0066] S56. Repeat steps S54 and S55 until the preset convergence condition is met.

[0067] S57. Output the parameter vector corresponding to the gray wolf individual with the smallest objective function value to obtain the optimal parameter vector:

[0068]

[0069] Among them, U * Let k represent the optimal parameter vector. * T represents the granularity of the optimal state partitioning. * Indicates the optimal time window length. θ represents the average value of the optimal dynamic weighting factors. *This represents the optimal anomaly warning threshold, and the optimal parameter vector is fed back to the non-uniform Markov chain model to globally optimize the state partitioning, time window, dynamic weight factor, and anomaly warning threshold.

[0070] Optionally, S6 specifically includes:

[0071] S61. Receive and read the optimal parameter vector obtained by the Grey Wolf optimization algorithm, and store the optimal parameter vector as a new reference value in the system configuration;

[0072] S62. Using the key elements required for the constructed non-uniform Markov chain model, adjust the partitioning method of the initial state set according to the optimal parameter vector, and perform corresponding preprocessing on the historical data of state transitions.

[0073] S63. Based on the updated preliminary state set and the time window and dynamic weight factor in the optimal parameter vector, redefine the statistical rules for state transition frequency.

[0074] S64. Use new statistical rules to correct the time-varying transition probability matrix to reflect the constraint and guidance of the optimal parameter vector on the state transition characteristics;

[0075] S65. Upgrade the calculation method for anomaly scores, including adjusting the anomaly detection threshold, deviation measurement, and score synthesis strategy;

[0076] S66. Deploy the updated non-uniform Markov chain model into the actual operating environment, and continuously monitor and record the performance of the non-uniform Markov chain model during operation.

[0077] The beneficial effects of this invention are:

[0078] This invention achieves accurate dynamic analysis of abnormal software behavior by introducing an improved non-uniform Markov chain model and the Grey Wolf optimization algorithm. Utilizing the K-means clustering algorithm for intelligent state segmentation of software runtime logs, and combining this with innovative designs of time decay factors and dynamic weighting factors, this invention constructs a time-varying transition probability matrix that reflects the dynamic changes of software states over time. This method effectively overcomes the limitations of traditional fixed-state transition models in dealing with complex dynamic software behavior, enabling the model to capture abnormal state transitions during software operation in real time and accurately calculate anomaly scores.

[0079] Furthermore, this invention employs the Grey Wolf optimization algorithm to globally adaptively optimize key parameters in the model, automatically adjusting the state partitioning granularity, time window length, dynamic weighting factors, and anomaly warning threshold, thereby further improving the accuracy and robustness of anomaly detection. This optimization mechanism not only significantly reduces the risk of false positives and false negatives but also enhances the system's adaptability to environmental changes, ensuring efficient and stable detection performance under different software operating conditions. Through these technical measures, this invention achieves the goal of real-time and accurate monitoring of abnormal software behavior, providing a solid technical guarantee for the safe and stable operation of software systems, and has broad application prospects and significant practical benefits. Attached Figure Description

[0080] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0081] Figure 1 The flowchart shows the dynamic analysis method for software anomaly behavior based on non-uniform Markov chains proposed in this invention.

[0082] Figure 2 This diagram illustrates the construction of the basic state transition matrix and the calculation of dynamic weight factors for the dynamic analysis method of software anomaly behavior based on non-uniform Markov chains proposed in this invention. Detailed Implementation

[0083] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0084] refer to Figure 1 and Figure 2 A dynamic analysis method for software anomaly behavior based on non-uniform Markov chains includes the following steps:

[0085] S1. Collect software operation log data in real time and preprocess the software operation log data;

[0086] S2. The K-means clustering algorithm is used to dynamically divide the preprocessed software operation log data into states, generate a preliminary state set, and define the state transition relationship.

[0087] S3. Based on the initial state set, the transition frequency between each state is counted within a predetermined time window to generate a basic state transition matrix. Dynamic weighting factors are introduced based on historical data and real-time changes to form a non-uniform Markov chain model and a time-varying transition probability matrix.

[0088] S4. Use a non-uniform Markov chain model to detect anomalies in real-time data, and calculate anomaly scores based on the degree of deviation between real-time monitoring data and time-varying transition probability matrix.

[0089] S5. Construct the objective function and apply the Grey Wolf optimization algorithm to globally optimize the state partitioning granularity, time window length, dynamic weight factor and anomaly warning threshold parameters in the non-uniform Markov chain model.

[0090] S6. Feed the optimized parameters back to the non-uniform Markov chain model in step S3 to update the time-varying transition probability matrix and the anomaly score calculation method.

[0091] S7. Determine abnormal behavior based on the updated abnormal score and abnormal warning threshold, output a warning signal, and provide feedback on the warning result.

[0092] In this embodiment, S2 specifically includes:

[0093] S21. The preprocessed software runtime log data set is X = {x} i |i=1,…,n}, where x i ∈R m Where m is the dimension of the data features, n represents the total number of samples, R is the set of real numbers, and x represents the data sample of each software operation log. i The corresponding timestamp is t i ∈R;

[0094] S22. Let the predetermined number of states be k, and initialize the cluster centers and their corresponding average timestamps:

[0095] μ1,μ2,…,μ k ∈R m and τ1,τ2,…,τ k ∈R;

[0096] Where, μ k Let τ represent the k-th cluster center. k This represents the average timestamp corresponding to the j-th cluster center;

[0097] S23. For any software runtime log data sample x i and timestamp t i Assign it to state S j :

[0098]

[0099] Where, ||| represents the Euclidean norm, and λ is a preset time weighting coefficient. This indicates that among all values ​​of l, the value that minimizes the expression within the parentheses is selected, and j represents the minimum value for the software runtime log data sample x. i The index of the selected cluster center, where k represents the number of predefined states;

[0100] S24. Update μ for each cluster center. j and average timestamp τ j :

[0101]

[0102] Among them, S j Let S be the set of data samples in the j-th cluster. j | represents S j The number of data samples in the middle;

[0103] S25. Repeat steps S23 and S24 until the cluster centers and their corresponding timestamps converge or the preset number of iterations is reached. The resulting clustering results constitute a preliminary state set S = {S j |j=1,…,k}, where k is the predetermined number of states and j is the state index;

[0104] S26. Define a continuous data sample x i With x i+1 The state transition relationship is: if x i ∈S p And x i+1 ∈S q Then it is denoted as state transition S. p →S q , of which S p Let S represent the p-th state. q Indicates the q-th state;

[0105] In this embodiment, S3 specifically includes:

[0106] S31. The initial state set is S, and the predetermined time window is T;

[0107] S32, For each pair of states S p and S q The fundamental state transition frequency is calculated using the time decay method, and the fundamental state transition matrix is ​​constructed as follows:

[0108]

[0109] in, Indicates from state S p Transition to state S q The fundamental state transition frequency, x i Let x represent the i-th continuous data sample. i+1Let t represent the (i+1)th consecutive data sample. i and t i+1 Representing data samples x respectively i With x i+1 The timestamp, β is the time decay parameter, I is the indicator function, and n is the total number of data samples;

[0110] S33, For each pair of states S p and S q Based on the transfer frequency sequence within the most recent N time windows and historical average transfer frequency Calculate the dynamic weighting factor ω pq :

[0111]

[0112] Where α is an adjustment parameter, and ∈ is a small positive constant to prevent division by zero;

[0113] S34. Using nonlinear mapping to adjust the fundamental state transition frequency With dynamic weighting factor ω pq Perform joint adjustments and calculate the weighted transfer frequency f′. pq :

[0114]

[0115] Where δ is the mapping scaling factor, θ is the threshold parameter, and exp is the exponential function;

[0116] S35. Construct a time-varying transition probability matrix P using weighted transition frequencies:

[0117]

[0118] Where κ is the regularization constant, γ is the scaling exponent, and k represents the total number of states;

[0119] S36. By combining the initial state set S with the time-varying transition probability matrix P, a non-uniform Markov chain model (S,P) is constructed.

[0120] In this embodiment, S4 specifically includes:

[0121] S41. Real-time acquisition of data generated during the operation of the software, forming a real-time data sequence containing sampled data at various time points;

[0122] S42. Map each data sample in the real-time data sequence to the corresponding state according to the pre-constructed state set to generate a real-time state sequence that reflects the changes in the software's running state.

[0123] S43. Statistically analyze the state transitions in the real-time state sequence, record the actual number of transitions between adjacent states, and form a transition data record describing the actual state transition situation.

[0124] S44. Using the constructed time-varying transition probability matrix, generate an expected state transition distribution corresponding to the expected transition probabilities between each state.

[0125] S45. Compare the actual state transition records with the expected state transition distribution, assess the degree of deviation between each state, and record the deviation between each transition item.

[0126] S46. Taking into account the deviations of all state transition terms, calculate the overall anomaly score and use this anomaly score as the output of real-time anomaly detection:

[0127]

[0128] Here, AS represents the overall anomaly score. In a real-time state sequence, starting from state S p to state S q The actual number of transfers, P pq In the constructed time-varying transition probability matrix, from state S p to state S q The expected transition probability, N obs denoted by , where k represents the total number of real-time state transitions, ∈ represents the total number of states in the state set S, and ∈ is a small positive constant to prevent division by zero.

[0129] In this embodiment, S5 specifically includes:

[0130] S51, Key Parameter Vector is Where k is the state partitioning granularity and T is the time window length. θ is the average value of the dynamic weighting factors, and θ is the anomaly warning threshold.

[0131] S52. Construct the objective function:

[0132]

[0133] Among them, AS i Let M be the anomaly score for the i-th sample, M be the total number of samples, and η and λ be the anomaly scores. o σ is the regularization coefficient. AS The standard deviation of the outlier scores;

[0134] S53. Randomly generate the initial positions of the gray wolf population in the parameter space:

[0135] {U i (0) | i = 1, ..., n};

[0136] Among them, U i (0) represents the parameter vector of the i-th gray wolf at the initial moment, where n is the population size;

[0137] S54. Calculate the objective function value F(U) for each individual gray wolf. i (t)), and sort the population, selecting the three individuals with the smallest objective function values ​​as the leader gray wolf U. α (t), Secondary Grey Wolf U β (t), Third Grey Wolf U δ (t);

[0138] S55. Update the position of each individual gray wolf:

[0139]

[0140] in, U is a random factor. i (t) represents the parameter vector of the i-th gray wolf at iteration time t, U i (t+1) represents the updated parameter vector of the i-th gray wolf at iteration time t+1;

[0141] S56. Repeat steps S54 and S55 until the preset convergence condition is met.

[0142] S57. Output the parameter vector corresponding to the gray wolf individual with the smallest objective function value to obtain the optimal parameter vector:

[0143]

[0144] Among them, U * Let k represent the optimal parameter vector. * T represents the granularity of the optimal state partitioning. * Indicates the optimal time window length. θ represents the average value of the optimal dynamic weighting factors. * This represents the optimal anomaly warning threshold, and the optimal parameter vector is fed back to the non-uniform Markov chain model to globally optimize the state partitioning, time window, dynamic weight factor, and anomaly warning threshold.

[0145] In this embodiment, S6 specifically includes:

[0146] S61. Receive and read the optimal parameter vector obtained by the Grey Wolf optimization algorithm, and store the optimal parameter vector as a new reference value in the system configuration;

[0147] S62. Using the key elements required for the constructed non-uniform Markov chain model, adjust the partitioning method of the initial state set according to the optimal parameter vector, and perform corresponding preprocessing on the historical data of state transitions.

[0148] S63. Based on the updated preliminary state set and the time window and dynamic weight factor in the optimal parameter vector, redefine the statistical rules for state transition frequency.

[0149] S64. Use new statistical rules to correct the time-varying transition probability matrix to reflect the constraint and guidance of the optimal parameter vector on the state transition characteristics;

[0150] S65. Upgrade the calculation method for anomaly scores, including adjusting the anomaly detection threshold, deviation measurement, and score synthesis strategy;

[0151] S66. Deploy the updated non-uniform Markov chain model into the actual operating environment, and continuously monitor and record the performance of the non-uniform Markov chain model during operation.

[0152] Example 1:

[0153] To verify the feasibility of this invention in practice, it was applied to the core transaction system of a large financial institution. This system generates massive amounts of log data daily, involving various information such as transaction requests, response times, and system load. Due to the complex system environment and large load fluctuations, traditional anomaly detection methods often rely on fixed thresholds and static models, which are difficult to adapt to dynamically changing operating states, leading to frequent false positives and false negatives, thus posing significant risks to business continuity and security. To address these issues, this invention proposes a dynamic analysis method for software anomaly behavior based on non-uniform Markov chains. By constructing a time-varying state transition probability matrix and introducing the Grey Wolf optimization algorithm for global adaptive optimization of key parameters, it aims to achieve accurate dynamic detection of software anomaly behavior, thereby improving the overall stability and security of the system.

[0154] In practical applications, the system operation logs are first collected and preprocessed in real time, covering over 20 million log records from 90 consecutive days. After data cleaning, noise reduction, and normalization, key indicators related to the system state, such as transaction volume, response time, and system load, are extracted. Subsequently, K-means clustering is used to dynamically partition these indicator data into 10 non-overlapping states. An improved non-uniform Markov chain model is then used to model the transition patterns between states. This model introduces a time decay factor and a dynamic weighting factor to weight the state transitions within different time periods, constructing a time-varying transition probability matrix that reflects changes in the software's operating state. This allows the model to more accurately describe the changes in the system state over time.

[0155] Meanwhile, to further optimize the model's detection performance, this invention employs the Grey Wolf Optimization Algorithm to globally adaptively optimize key parameters such as state partitioning granularity, time window length, dynamic weight factor, and anomaly warning threshold. In actual operation, initial parameters were set using traditional empirical values, such as 10 states, a 5-minute time window, an average dynamic weight factor of 0.80, and an anomaly warning threshold of 0.65. After iterative updates and global search using the Grey Wolf Optimization Algorithm, the optimal parameters were finally adjusted to 9 states, a 4-minute time window, an average dynamic weight factor of 0.87, and an anomaly warning threshold of 0.70. This optimization process significantly improves the accuracy and robustness of anomaly detection, enabling the system to maintain efficient monitoring even in dynamically changing environments.

[0156] Table 1 Comparison of Software Abnormal Behavior Detection Data

[0157]

[0158] As can be seen from the data in Table 1, the method of this invention demonstrates significant advantages in detecting abnormal software behavior across different time periods. For example, during the period from 14:30 to 15:00 on May 15, 2024, the system's average anomaly score was 0.78, and the accuracy rate of detection using the method of this invention reached 94%, a significant improvement compared to the 87% of the traditional method. Simultaneously, the average response time was reduced from 3.2 seconds using the traditional method to 2.1 seconds, and the false positive rate and false negative rate decreased from 12% and 8% to 3.5% and 2.2%, respectively. This change reflects that the present invention is more sensitive and faster in capturing changes in abnormal states, enabling more timely identification of system anomalies. Further observation of the period from 09:00 to 09:30 on June 10, 2024, revealed a low average anomaly score of 0.42, indicating a relatively stable overall system. Despite this, the method of this invention maintained a high detection accuracy of 97%, compared to only 90% for traditional methods. Furthermore, the response time, false alarm rate, and false negative rate were also significantly lower, at 2.0 seconds, 2.9%, and 1.8%, respectively, fully validating the invention's superior detection capabilities and rapid response even under low-anomaly conditions. Overall, the data from multiple time periods in the table demonstrate the significant advantages of this invention's method in improving detection accuracy, reducing response time, and minimizing false alarms and false negatives. Comparative analysis shows that traditional methods exhibit higher risk levels across various metrics, while this invention effectively addresses these shortcomings, thus better ensuring the safe and stable operation of the system in practical applications. These data not only demonstrate the superiority of the dynamic analysis method based on non-uniform Markov chains and the Grey Wolf optimization algorithm but also indicate that the method maintains high robustness and adaptability under different operating conditions, providing strong technical support for real-time anomaly detection in complex software systems.

[0159] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A dynamic analysis method for software anomaly behavior based on non-uniform Markov chains, characterized in that, Includes the following steps: S1. Collect software operation log data in real time and preprocess the software operation log data; S2. The K-means clustering algorithm is used to dynamically divide the preprocessed software operation log data into states, generate a preliminary state set, and define the state transition relationship. S3. Based on the initial state set, the transition frequency between each state is counted within a predetermined time window to generate a basic state transition matrix. Dynamic weighting factors are introduced based on historical data and real-time changes to form a non-uniform Markov chain model and a time-varying transition probability matrix. S4. Use a non-uniform Markov chain model to detect anomalies in real-time data, and calculate anomaly scores based on the degree of deviation between real-time monitoring data and time-varying transition probability matrix. S5. Construct the objective function and apply the Grey Wolf optimization algorithm to globally optimize the state partitioning granularity, time window length, dynamic weight factor and anomaly warning threshold parameters in the non-uniform Markov chain model. S6. Feed the optimized parameters back to the non-uniform Markov chain model in step S3 to update the time-varying transition probability matrix and the anomaly score calculation method. S7. Determine abnormal behavior based on the updated abnormal score and abnormal warning threshold, output a warning signal, and provide feedback on the warning result.

2. The method for dynamic analysis of software anomaly behavior based on non-uniform Markov chains according to claim 1, characterized in that, S2 specifically includes: S21. The preprocessed software runtime log data set is X = {x} i |i=1,…,n}, where x i ∈R m Where m is the dimension of the data features, n represents the total number of samples, R is the set of real numbers, and x represents the data sample of each software operation log. i The corresponding timestamp is t i ∈R; S22. Let the predetermined number of states be k, and initialize the cluster centers and their corresponding average timestamps: μ1,μ2,…,μ k ∈R m and τ1,τ2,…,τ k ∈R; Where, μ k Let τ represent the k-th cluster center. k This represents the average timestamp corresponding to the j-th cluster center; S23. For any software runtime log data sample x i and timestamp t i Assign it to state S j : Where, ||| represents the Euclidean norm, and λ is a preset time weighting coefficient. This indicates that among all values ​​of l, the value that minimizes the expression within the parentheses is selected, and j represents the minimum value for the software runtime log data sample x. i The index of the selected cluster center, where k represents the number of predefined states; S24. Update μ for each cluster center. j and average timestamp τ j : Among them, S j Let |S| be the set of data samples in the j-th cluster. j | represents S j The number of data samples in the middle; S25. Repeat steps S23 and S24 until the cluster centers and their corresponding timestamps converge or the preset number of iterations is reached. The resulting clustering results constitute a preliminary state set S = {S j |j=1,…,k}, where k is the predetermined number of states and j is the state index; S26. Define a continuous data sample x i With x i+1 The state transition relationship is: if x i ∈S p And x i+1 ∈S q Then it is denoted as state transition S. p →S q , among which, S p Let S represent the p-th state. q This represents the q-th state.

3. The method for dynamic analysis of software anomaly behavior based on non-uniform Markov chains according to claim 1, characterized in that, S3 specifically includes: S31. The initial state set is S, and the predetermined time window is T; S32, For each pair of states S p and S q The fundamental state transition frequency is calculated using the time decay method, and the fundamental state transition matrix is ​​constructed as follows: in, Indicates from state S p Transition to state S q The fundamental state transition frequency, x i Let x represent the i-th continuous data sample. i+1 Let t represent the (i+1)th consecutive data sample. i and t i+1 Representing data samples x respectively i With x i+1 The timestamp, β is the time decay parameter, I is the indicator function, and n is the total number of data samples; S33, For each pair of states S p and S q Based on the transfer frequency sequence within the most recent N time windows and historical average transfer frequency Calculate the dynamic weighting factor ω pq : Where α is an adjustment parameter, and ∈ is a small positive constant to prevent division by zero; S34. Using nonlinear mapping to adjust the fundamental state transition frequency With dynamic weighting factor ω pq Perform joint adjustments and calculate the weighted transfer frequency f′. pq : Where δ is the mapping scaling factor, θ is the threshold parameter, and exp is the exponential function; S35. Construct a time-varying transition probability matrix P using weighted transition frequencies: Where κ is the regularization constant, γ is the scaling exponent, and k represents the total number of states; S36. By combining the initial state set S with the time-varying transition probability matrix P, a non-uniform Markov chain model (S,P) is constructed.

4. The method for dynamic analysis of software anomaly behavior based on non-uniform Markov chains according to claim 1, characterized in that, S4 specifically includes: S41. Real-time acquisition of data generated during the operation of the software, forming a real-time data sequence containing sampled data at various time points; S42. Map each data sample in the real-time data sequence to the corresponding state according to the pre-constructed state set to generate a real-time state sequence that reflects the changes in the software's running state. S43. Statistically analyze the state transitions in the real-time state sequence, record the actual number of transitions between adjacent states, and form a transition data record describing the actual state transition situation. S44. Using the constructed time-varying transition probability matrix, generate an expected state transition distribution corresponding to the expected transition probabilities between each state. S45. Compare the actual state transition records with the expected state transition distribution, assess the degree of deviation between each state, and record the deviation between each transition item. S46. Taking into account the deviations of all state transition terms, calculate the overall anomaly score and use this anomaly score as the output of real-time anomaly detection: Here, AS represents the overall anomaly score. In a real-time state sequence, starting from state S p to state S q The actual number of transfers, P pq In the constructed time-varying transition probability matrix, from state S p to state S q The expected transition probability, N obs denoted by , where k represents the total number of real-time state transitions, ∈ represents the total number of states in the state set S, and ∈ is a small positive constant to prevent division by zero.

5. The method for dynamic analysis of software anomaly behavior based on non-uniform Markov chains according to claim 1, characterized in that, S5 specifically includes: S51, Key Parameter Vector is Where k is the state partitioning granularity and T is the time window length. θ is the average value of the dynamic weighting factors, and θ is the anomaly warning threshold. S52. Construct the objective function: Among them, AS i Let M be the anomaly score for the i-th sample, M be the total number of samples, and η and λ be the anomaly scores. o σ is the regularization coefficient. AS The standard deviation of the outlier scores; S53. Randomly generate the initial positions of the gray wolf population in the parameter space: {U i (0)∣i=1,…,n}; Among them, U i (0) represents the parameter vector of the i-th gray wolf at the initial moment, where n is the population size; S54. Calculate the objective function value F(U) for each individual gray wolf. i (t)), and sort the population, selecting the three individuals with the smallest objective function values ​​as the leader gray wolf U. α (t), Secondary Grey Wolf U β (t), Third Grey Wolf U δ (t); S55. Update the position of each individual gray wolf: in, U is a random factor. i (t) represents the parameter vector of the i-th gray wolf at iteration time t, U i (t+1) represents the updated parameter vector of the i-th gray wolf at iteration time t+1; S56. Repeat steps S54 and S55 until the preset convergence condition is met. S57. Output the parameter vector corresponding to the gray wolf individual with the smallest objective function value to obtain the optimal parameter vector: Among them, U * Let k represent the optimal parameter vector. * T represents the granularity of the optimal state partitioning. * Indicates the optimal time window length. θ represents the average value of the optimal dynamic weighting factors. * This represents the optimal anomaly warning threshold, and the optimal parameter vector is fed back to the non-uniform Markov chain model to globally optimize the state partitioning, time window, dynamic weight factor, and anomaly warning threshold.

6. The method for dynamic analysis of software anomaly behavior based on non-uniform Markov chains according to claim 1, characterized in that, S6 specifically includes: S61. Receive and read the optimal parameter vector obtained by the Grey Wolf optimization algorithm, and store the optimal parameter vector as a new reference value in the system configuration; S62. Using the key elements required for the constructed non-uniform Markov chain model, adjust the partitioning method of the initial state set according to the optimal parameter vector, and perform corresponding preprocessing on the historical data of state transitions. S63. Based on the updated preliminary state set and the time window and dynamic weight factor in the optimal parameter vector, redefine the statistical rules for state transition frequency. S64. Use new statistical rules to correct the time-varying transition probability matrix to reflect the constraint and guidance of the optimal parameter vector on the state transition characteristics; S65. Upgrade the calculation method for anomaly scores, including adjusting the anomaly detection threshold, deviation measurement, and score synthesis strategy; S66. Deploy the updated non-uniform Markov chain model into the actual operating environment, and continuously monitor and record the performance of the non-uniform Markov chain model during operation.

Images