Method for identifying malicious behaviors of information system based on machine learning

Abstract

The invention discloses a method for identifying malicious behaviors of an information system based on machine learning. The method comprises the following steps: step 1, collecting and preprocessing data; 2, constructing a training data set; 3, training a machine learning model; 4, evaluating and optimizing the model; step 5, malicious behavior identification; and step 6, responding and defending. The method has the beneficial effects that the method has higher detection accuracy and adaptability; the recognition reliability and efficiency can be improved; and a corresponding response and defense mechanism is perfected.

Description

Technical Field

[0001] The present invention relates to the field of information system security, and particularly to a method for identifying malicious behaviors of an information system based on machine learning. Background Art

[0002] In the digital age, information systems have been deeply integrated into all aspects of social economy. From the daily operation and management of enterprises, to the real-time processing of financial transactions, and then to the storage and invocation of medical data, the wide application of information systems has greatly improved work efficiency and life convenience. However, along with it comes the increasingly severe network security problem, and the security of information systems faces unprecedented challenges.

[0003] At present, network security threats show a diversified and complex trend. Network attack means emerge in an endless stream. For example, distributed denial of service (DDoS) attacks control a large number of botnets to send a huge number of requests to the target server, causing the server to crash and normal users to be unable to access the service; SQL injection attacks take advantage of the vulnerability of insufficient verification of user input in Web applications to maliciously inject SQL statements, and then illegally obtain, tamper with or even delete key data in the database. Data tampering behaviors are also common. Lawbreakers invade the system to tamper with important information such as enterprise financial data and medical records to seek improper benefits, seriously affecting the authenticity and integrity of data. In addition, the spread of malicious software is extremely rampant. For example, ransomware, once infecting the user's device, will encrypt important files, forcing the victim to pay a ransom to obtain the decryption key, causing huge losses to individuals, enterprises and even the whole society.

[0004] Traditional malicious behavior detection methods mainly rely on rule bases or feature matching. The rule base method is to preset a series of rules for known malicious behaviors. When the detected behavior matches the rules in the rule base, it is determined as a malicious behavior. Feature matching is to extract the features of known malicious programs or behaviors and identify malicious behaviors by comparing the features. However, with the rapid development of network technology, attack means are constantly evolving and new attacks emerge frequently. These new attacks often do not conform to the existing rules or features, making it difficult for traditional methods to effectively respond, and there are significant problems such as low detection accuracy and poor adaptability. For example, zero-day vulnerability attacks use system vulnerabilities that have not been publicly disclosed or repaired for attacks. Traditional detection methods cannot detect them in time because they lack corresponding rules and features. In the face of constantly changing network security threats, traditional detection methods can no longer meet the high requirements for security protection of current information systems, and there is an urgent need for a more advanced and efficient malicious behavior identification method. Summary of the Invention

[0005] To solve the above problems, especially the deficiencies existing in the prior art, the present invention provides a method for identifying malicious behaviors of an information system based on machine learning, which can solve the above problems.

[0006] To achieve the above object, the present invention adopts the following technical means:

[0007] A method for identifying malicious behaviors of an information system based on machine learning, comprising the following steps:

[0008] Step 1: Data collection and preprocessing

[0009] Collect security data from the information system and perform preprocessing on the security data. The preprocessing includes data cleaning, feature extraction, and normalization processing;

[0010] Step 2: Construct a training data set

[0011] Adopt the method of stratified sampling to divide the data preprocessed in Step 1 into a training set and a test set. Organize professional security personnel to manually label the data in the training set according to the pre-established behavior classification criteria, and clearly label normal behaviors and malicious behaviors;

[0012] Step 3: Train a machine learning model

[0013] Use the random forest algorithm to construct a classification model. During the training process, use the data in the training set in Step 2 to iteratively train the model. Through cross-validation technology, continuously optimize the model parameters to improve the classification accuracy;

[0014] Step 4: Model evaluation and optimization

[0015] Use the test set in Step 2 to evaluate the model trained in Step 3, and calculate the model evaluation indicators of the model; optimize the model according to the model evaluation indicators, that is, if the model performance does not meet the expectations, the parameters of the random forest can be adjusted or the amount of training data can be increased, and re-training and evaluation can be carried out;

[0016] Step 5: Malicious behavior identification

[0017] Collect information system data in real time, preprocess the new data according to the process of data collection, cleaning, feature extraction, and normalization processing, input the preprocessed new data into the optimized model in Step 4, and the model outputs the recognition result based on the learned feature patterns, determines whether there is a malicious behavior, and classifies the malicious behavior types according to the predefined malicious behavior classification rules;

[0018] Step 6: Response and defense

[0019] According to the recognition result in Step 5, trigger the corresponding defense mechanism.

[0020] A further solution of the present invention is that in step 1, the security data includes network traffic data, system log data, and user behavior data.

[0021] A further solution of the present invention is that in step 1, collecting security data from the information system includes: using a network packet capture tool to capture the network traffic of the information system in real time to obtain network traffic data; regularly collecting system log data through the system's built-in log collection module, covering operating system logs and application program logs; using user behavior monitoring software to record the operations of users in the information system to obtain user behavior data.

[0022] A further solution of the present invention is that in step 1, the features extracted include network traffic features, system log features, and user behavior features.

[0023] A further solution of the present invention is that in step 1, data cleaning includes: using a data deduplication algorithm to identify and delete exactly the same duplicate data records in the security data; detecting and correcting incorrect data through data verification rules, such as data that does not conform to the data format specification; for incomplete data, using a data filling algorithm to fill in the missing values according to the statistical characteristics or correlation relationships of the data;

[0024] Feature extraction includes: in terms of network traffic feature extraction, using a sliding window algorithm to calculate the mean and variance of the traffic size, counting the number of connections within a unit time, and analyzing the frequency distribution of port usage; for system log features, matching the log level through a regular expression, extracting operation type keywords, and parsing timestamp information; for user behavior features, using a sequence mining algorithm to extract user login frequencies and operation sequence patterns.

[0025] Standardization processing includes: passing the extracted feature data through a normalization algorithm to make the data have a zero mean and unit variance to eliminate the influence of the dimension between different features.

[0026] A further solution of the present invention is that in step 2, the preprocessed data is divided into a 70% training set and a 30% test set; an automated annotation tool is used to assist professional security personnel in annotation.

[0027] A further solution of the present invention is that in step 3, the number of trees of the random forest is initialized to 100, the maximum depth is set to 10 layers, and the feature selection method uses the Gini impurity as a metric.

[0028] A further solution of the present invention is that in step 4, the model evaluation metrics include accuracy, recall rate, F1 value, precision, ROC curve, and AUC value.

[0029] A further solution of the present invention is that in step 5, the types of malicious behaviors include network attacks, data leakage, and malware.

[0030] A further solution of the present invention is that in step 6, the defense mechanisms include blocking malicious IPs, isolating infected devices, and sending alarm messages;

[0031] Blocking malicious IPs means that the system automatically calls the API interface of the firewall device, adds the malicious IP to the blacklist, and blocks its network connection;

[0032] Isolating infected devices means that through the network management system, the device is isolated from the current network;

[0033] Sending alarm messages means that using the SMS notification interface or email sending service, an alarm message is sent to the system administrator, detailing the type of malicious behavior, the occurrence time, and the device information involved.

[0034] Advantages of the present invention:

[0035] 1. The present invention has higher detection accuracy and adaptability: By adopting machine learning technology, the present invention can effectively learn and identify malicious behavior patterns in information systems. Compared with traditional rule-based and feature-matching methods, it has higher detection accuracy and better adaptability, and can detect new types of attack behaviors in a timely manner. Because the machine learning model can continuously learn new data to adapt to the evolution of network attack means, unlike traditional methods that are limited by existing rules and features.

[0036] 2. The present invention can improve the recognition reliability and efficiency: Comprehensively collect security data, covering network traffic data, system log data, and user behavior data, and perform preprocessing, including data cleaning, feature extraction, and standardization processing. At the same time, construct a high-quality training data set, and use appropriate algorithms such as the random forest algorithm to construct a classification model and optimize it. These measures improve the reliability and efficiency of malicious behavior recognition, ensuring that malicious behaviors can be accurately and quickly recognized.

[0037] 3. The present invention improves the corresponding response and defense mechanisms: After identifying malicious behaviors, it can timely trigger measures such as blocking malicious IPs, isolating infected devices, and sending alarm messages, effectively reducing security risks, protecting the safe and stable operation of information systems, and minimizing the damage caused by malicious behaviors to information systems. Description of the Drawings

[0038] Figure 1 It is a flowchart of a method for identifying malicious behaviors in an information system based on machine learning according to an embodiment of the present invention. Detailed Embodiments

[0039] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0040] Embodiment 1

[0041] As Figure 1 shown, a method for identifying malicious behaviors of an information system based on machine learning includes the following steps:

[0042] Step 1: Data collection and preprocessing: Collect security data from the information system. The security data includes network traffic data, system log data, and user behavior data. Use a network packet capture tool to capture the network traffic of the information system in real time to obtain network traffic data; regularly collect system log data through the system's built-in log collection module, covering operating system logs and application logs; with the help of user behavior monitoring software, record the operations of users in the information system to obtain user behavior data. Preprocess the security data, and the preprocessing includes data cleaning, feature extraction, and normalization processing. Data cleaning uses a data deduplication algorithm to identify and delete duplicate data records that are exactly the same in the security data; through data verification rules, detect and correct error data, such as data that does not conform to the data format specification; for incomplete data, use a data filling algorithm to fill in the missing values according to the statistical characteristics or correlation relationships of the data. The features extracted include but are not limited to network traffic features, system log features, and user behavior features. In terms of network traffic feature extraction, use a sliding window algorithm to calculate the mean and variance of the traffic size, count the number of connections within a unit time, and analyze the frequency distribution of port usage; for system log features, match the log level through regular expressions, extract operation type keywords, and parse timestamp information; for user behavior features, use a sequence mining algorithm to extract user login frequency and operation sequence patterns. Normalization processing maps the extracted feature data through a normalization algorithm, such as Min-Max normalization, to map the data to the [0,1] interval, or use Z-Score normalization to make the data have zero mean and unit variance to eliminate the influence of different dimensions between features.

[0043] Step 2: Construct a training data set: Using the method of stratified sampling, divide the data preprocessed in Step 1 into a training set and a test set, and divide the preprocessed data into a 70% training set and a 30% test set. Organize professional security personnel, and based on the pre-established behavior classification criteria, use an automated annotation tool to assist professional security personnel to manually annotate the data in the training set to clearly label normal behaviors and malicious behaviors.

[0044] Step 3: Train the machine learning model: Construct a classification model using the random forest algorithm. Initialize the number of trees in the random forest to 100, set the maximum depth to 10 layers, and use the Gini impurity as the metric for feature selection. During the training process, use the training set data in Step 2 to iteratively train the model. Through cross-validation techniques, continuously optimize the model parameters to improve the classification accuracy.

[0045] Step 4: Model evaluation and optimization: Use the test set in Step 2 to evaluate the model trained in Step 3, and calculate the model evaluation metrics. The model evaluation metrics include accuracy, recall, F1 value, precision, ROC curve, and AUC value. Optimize the model according to the model evaluation metrics. That is, if the model performance does not meet the expectations, the parameters of the random forest can be adjusted or the amount of training data can be increased, and then retrain and evaluate.

[0046] Step 5: Malicious behavior recognition: Real-time collect information system data, preprocess the new data according to the process of data collection, cleaning, feature extraction, and standardization processing, input the preprocessed new data into the optimized model in Step 4. The model outputs the recognition result based on the learned feature patterns, determines whether there is malicious behavior, and classifies the malicious behavior types according to the predefined malicious behavior classification rules. The malicious behavior types include network attacks, data leaks, and malware.

[0047] Step 6: Response and defense: Trigger the corresponding defense mechanism according to the recognition result in Step 5. The defense mechanisms include blocking malicious IPs, isolating infected devices, and sending warning messages. Blocking malicious IPs is for the system to automatically call the API interface of the firewall device, add the malicious IP to the blacklist, and block its network connection; isolating infected devices is to isolate the device from the current network through the network management system; sending warning messages is to use the SMS notification interface or email sending service to send warning messages to the system administrator, detailing information such as the malicious behavior type, occurrence time, and involved devices.

[0048] Example 2

[0049] Application of the e-commerce information system

[0050] A method for identifying malicious behaviors of an information system based on machine learning, including the following steps:

[0051] Data collection and preprocessing:

[0052] Collection: Use network packet capture tools to capture the network traffic data of e-commerce platforms, covering the traffic generated by user operations such as browsing products, placing orders, and making payments. Collect server operating system logs and e-commerce application logs through the system log module, including records such as user logins and product inventory changes. With the self-developed user behavior monitoring software, record user behavior data such as clicks, browsing durations, and adding items to the shopping cart on the e-commerce platform.

[0053] Preprocessing: Apply data deduplication algorithms to remove duplicate network traffic records. For example, 2000 completely identical product browsing request records were found and deleted. Through data verification rules, 1000 order log data with incorrect formats were corrected. For the missing browsing product time information in user behavior data, an association relationship filling algorithm based on user browsing habits was used to fill 500 missing values. In terms of feature extraction, the sliding window algorithm was used to calculate that the average network traffic in the past 10 minutes was 200Mbps, and the variance was 15Mbps 2 , the number of access connections to the product details page per unit time was 100, and the usage frequency of port 443 was 60%. 150 logs with the level of "WARN" were matched in the system logs through regular expressions, and the operation type keyword "out of stock" appeared 30 times. The sequence mining algorithm was used to extract the common operation sequence pattern of users as "search product - browse product - add to shopping cart - settlement". Finally, all feature data was standardized through the Z-Score algorithm to make it have zero mean and unit variance.

[0054] Construct the training dataset:

[0055] Divide the preprocessed data into a training set and a test set according to the ratio of 70% and 30%. Organize 10 e-commerce security experts to use an automated annotation tool to annotate 20,000 pieces of data in the training set, among which 14,000 pieces are marked as normal behaviors and 6,000 pieces are marked as malicious behaviors. Malicious behaviors include malicious order brushing, illegal acquisition of user information, etc.

[0056] Train the machine learning model:

[0057] Use the random forest algorithm to construct a classification model. Initialize the number of trees to 120, set the maximum depth to 12 layers, and use the Gini impurity as the metric for feature selection. During the training process, after 8 rounds of cross-validation, continuously adjust the model parameters, and finally make the classification accuracy of the model on the training set reach 92%.

[0058] Model evaluation and optimization:

[0059] The trained model is evaluated using a test set, and the calculated accuracy is 88%, the recall rate is 85%, the F1 value is 86.5%, the precision is 87%, and the area under the ROC curve (AUC value) is 0.90. Since the model performance did not reach the expected accuracy of 95%, the number of trees in the random forest is adjusted to 150, and training and evaluation are performed again. Finally, the accuracy of the model on the test set is improved to 93%.

[0060] Malicious behavior recognition:

[0061] During the operation of the e-commerce system, new data is collected in real time. After data collection, cleaning, feature extraction, and normalization, the preprocessed new data is input into the optimized model. The model outputs the recognition result, determines that there is malicious behavior, and according to the predefined malicious behavior classification rules, determines that the type of malicious behavior is malicious order brushing, which is manifested as a large number of false order requests from the same IP address within a short period of time.

[0062] Response and defense:

[0063] When the model identifies malicious behavior, the system automatically calls the API interface of the firewall device, adds the malicious IP to the blacklist, and blocks its network connection. Through the management system of the e-commerce platform, the accounts involved in malicious order brushing are blocked. At the same time, an alarm message is sent to the operation team of the e-commerce platform using the email sending service, detailing information such as the type of malicious behavior being malicious order brushing, the occurrence time being 14:00 on February 1, 2025, and the involved IP address being 10.10.10.10, etc.

[0064] Example 3

[0065] Application of financial information system

[0066] A method for identifying malicious behavior of an information system based on machine learning includes the following steps:

[0067] Data collection and preprocessing:

[0068] Collection: Capture the network traffic data of the financial trading system through professional network traffic monitoring devices, including the traffic generated by operations such as user login, transfer, and balance query. Use the system's built-in log collection tool to regularly collect the operating system logs and transaction application logs of the financial trading system, such as transaction records and user authentication logs. Deploy user behavior monitoring software to record the operation behaviors of users in the financial trading system, such as transaction amount, transaction frequency, and login location.

[0069] Preprocessing: Using a data deduplication algorithm, 1500 duplicate network traffic records of transfer requests were deleted. Through data verification rules, 800 pieces of transaction log data with incorrect formats were corrected. For the missing login location information in user behavior data, a statistical feature filling algorithm based on the user's historical login locations was used to fill 300 missing values. In terms of feature extraction, the sliding window algorithm was used to calculate that the average network traffic in the past 15 minutes was 300 Mbps, and the variance was 20 Mbps. 2 , the number of transaction connections per unit time was 80, and the usage frequency of port 8080 was 50%. By using regular expressions to match, 200 logs with the level of "ERROR" were found in the system logs, and the operation type keyword "transaction failed" appeared 40 times. The sequence mining algorithm was used to extract the common operation sequence pattern of users as "login - query balance - transfer". Finally, all feature data was mapped to the [0, 1] interval through the Min - Max normalization algorithm.

[0070] Constructing the training dataset:

[0071] The preprocessed data was divided into a training set and a test set at a ratio of 70% and 30%. Fifteen financial security experts were organized to use an automated annotation tool to annotate 30000 pieces of data in the training set, among which 21000 pieces were annotated as normal behaviors and 9000 pieces were annotated as malicious behaviors. Malicious behaviors include fraudulently swiping cards, illegal transfers, etc.

[0072] Training the machine learning model:

[0073] A classification model was constructed using the random forest algorithm. The initial number of trees was set to 100, the maximum depth was set to 10 layers, and the Gini impurity was used as the metric for feature selection. During the training process, after 6 rounds of cross - validation, the model parameters were continuously adjusted, and finally the classification accuracy of the model on the training set reached 93%.

[0074] Model evaluation and optimization:

[0075] The trained model was evaluated using the test set. The calculated accuracy was 90%, the recall rate was 88%, the F1 value was 89%, the precision was 89.5%, and the area under the ROC curve, the AUC value, was 0.92. Since the model performance did not reach the expected accuracy of 95%, the training data volume was increased. 10000 pieces of data were collected and annotated again and added to the training set, and training and evaluation were carried out again. Finally, the accuracy of the model on the test set was improved to 94%.

[0076] Malicious behavior identification:

[0077] During the operation of the financial transaction system, new data is collected in real time. After data collection, cleaning, feature extraction, and standardization processing, the preprocessed new data is input into the optimized model. The model outputs the recognition result, determines that there is malicious behavior, and according to the predefined malicious behavior classification rules, determines that the type of malicious behavior is card skimming, which is manifested as multiple large-value transactions in different locations within a short period of time and does not conform to the user's historical transaction behavior pattern.

[0078] Response and Defense:

[0079] When the model identifies malicious behavior, the system automatically calls the API interface of the firewall device, adds the malicious IP to the blacklist, and blocks its network connection. Through the management module of the financial transaction system, the account funds involved in card skimming are frozen. At the same time, the SMS notification interface is used to send warning messages to the users and the security management department of the financial institution, specifying in detail that the type of malicious behavior is card skimming, the occurrence time is 9:30 on March 15, 2025, and the account information involved, etc.

[0080] Example 4

[0081] Application of Medical Information System

[0082] A method for identifying malicious behavior of an information system based on machine learning includes the following steps:

[0083] Data Collection and Preprocessing:

[0084] Collection: Use network packet capture tools to capture the network traffic data of the hospital information system, including the traffic generated by operations such as doctors querying patient medical records, nurses entering patient vital signs, and patients making online appointments. Through the system's built-in log collection module, regularly collect the operating system logs and medical application logs of the hospital information system, such as medical record modification records, device usage logs, etc. Deploy user behavior monitoring software to record the operation behaviors of medical staff and patients in the hospital information system, such as the number of times doctors view medical records, the login time of patients, etc.

[0085] Preprocessing: Apply the data deduplication algorithm to remove 1200 duplicate medical record query network traffic records. Through the data verification rules, correct 600 device usage log data with incorrect formats. For the missing doctor's medical record viewing time information in the user behavior data, use the correlation relationship filling algorithm based on the working time rules of the department to fill 250 missing values. In terms of feature extraction, use the sliding window algorithm to calculate that the average network traffic in the past 30 minutes is 150 Mbps and the variance is 10 Mbps 2, the number of medical record query connections per unit time is 60, and the usage frequency of port 9090 is 40%. 180 logs with the level of "WARN" are matched in the system logs through regular expressions, and the operation type keyword "medical record locking" appears 35 times. The common operation sequence pattern of doctors is extracted by the sequence mining algorithm as "login - patient list - view medical record - issue doctor's advice". Finally, all feature data is standardized by the Z-Score standardization algorithm to make it have zero mean and unit variance.

[0086] Construct the training data set:

[0087] The preprocessed data is divided into a training set and a test set according to the ratio of 70% and 30%. 12 medical information security experts are organized to use an automated annotation tool to annotate 25,000 pieces of data in the training set, among which 17,500 pieces are marked as normal behaviors and 7,500 pieces are marked as malicious behaviors. Malicious behaviors include illegally obtaining patient medical records, tampering with medical records, etc.

[0088] Train the machine learning model:

[0089] A classification model is constructed using the random forest algorithm. The initial number of trees is 130, the maximum depth is set to 11 layers, and the Gini impurity is used as the metric for feature selection. During the training process, after 7 rounds of cross-validation, the model parameters are continuously adjusted, and finally the classification accuracy of the model on the training set reaches 91%.

[0090] Model evaluation and optimization:

[0091] The trained model is evaluated using the test set. The calculated accuracy is 87%, the recall rate is 84%, the F1 value is 85.5%, the precision rate is 86%, and the area under the ROC curve AUC value is 0.89. Since the model performance does not reach the expected accuracy of 95%, the maximum depth of the random forest is adjusted to 13 layers, and training and evaluation are carried out again. Finally, the accuracy of the model on the test set is improved to 92%.

[0092] Malicious behavior recognition:

[0093] During the operation of the hospital information system, new data is collected in real time. After data collection, cleaning, feature extraction, and standardization processing, the preprocessed new data is input into the optimized model. The model outputs the recognition result, determines that there is a malicious behavior, and according to the predefined malicious behavior classification rules, determines that the type of this malicious behavior is illegally obtaining patient medical records, manifested as unauthorized personnel frequently attempting to access sensitive patient medical record information.

[0094] Response and defense:

[0095] After the model identifies malicious behavior, the system automatically calls the API interface of the firewall device, adds the malicious IP to the blacklist, and blocks its network connection. Through the management system of the hospital information system, the accounts involved in illegal operations are frozen. At the same time, warning messages are sent to the hospital information security management department and relevant medical staff using the email sending service, specifying in detail that the type of malicious behavior is illegal access to patient medical records, the occurrence time is 16:00 on April 20, 2025, and the account information involved, etc.

[0096] The examples given in the present invention are illustrative rather than restrictive of the embodiments. For those of ordinary skill in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to enumerate all the embodiments here, and the obvious changes or modifications derived therefrom are still within the protection scope of the present invention.

Claims

1. A method for identifying malicious behaviors of an information system based on machine learning, characterized in that It includes the following steps: Step 1: Data collection and preprocessing Collect security data from the information system and perform preprocessing on the security data. The preprocessing includes data cleaning, feature extraction, and normalization; Step 2: Construct a training dataset Using the method of stratified sampling, divide the data preprocessed in Step 1 into a training set and a test set. Organize professional security personnel to manually label the data in the training set according to the pre-established behavior classification criteria, and clearly label normal behaviors and malicious behaviors; Step 3: Train a machine learning model Use the random forest algorithm to construct a classification model. During the training process, use the data in the training set in Step 2 to iteratively train the model. Through cross-validation techniques, continuously optimize the model parameters to improve the classification accuracy; Step 4: Model evaluation and optimization Use the test set in Step 2 to evaluate the model trained in Step 3 and calculate the model evaluation metrics of the model; optimize the model according to the model evaluation metrics. That is, if the model performance does not meet the expectations, the parameters of the random forest can be adjusted or the amount of training data can be increased, and then retrain and evaluate; Step 5: Malicious behavior identification Collect information system data in real time, preprocess the new data according to the process of data collection, cleaning, feature extraction, and normalization, input the preprocessed new data into the optimized model in Step 4. The model outputs the recognition result based on the learned feature patterns, judges whether there is malicious behavior, and classifies the malicious behavior types according to the predefined malicious behavior classification rules; Step 6: Response and defense Trigger the corresponding defense mechanism according to the recognition result in Step 5.

2. The recognition method of malicious behavior of an information system based on machine learning according to claim 1, characterized in that In the above Step 1, the security data includes network traffic data, system log data, and user behavior data.

3. The recognition method of malicious behavior of an information system based on machine learning according to claim 2, characterized in that, In the above Step 1, collecting security data from the information system includes: using a network packet capture tool to capture the network traffic of the information system in real time to obtain network traffic data; regularly collecting system log data through the system's built-in log collection module, covering operating system logs and application logs; using user behavior monitoring software to record the operations of users in the information system to obtain user behavior data.

4. A method for identifying malicious behaviors of an information system based on machine learning according to claim 1, characterized in that, In the above Step 1, the features extracted include network traffic features, system log features, and user behavior features.

5. The recognition method of malicious behavior of an information system based on machine learning according to claim 4, characterized in that, In the above Step 1, the data cleaning includes: using a data deduplication algorithm to identify and delete duplicate data records that are exactly the same in the security data; detecting and correcting incorrect data through data verification rules, such as data that does not conform to the data format specification; for incomplete data, using a data filling algorithm to fill in the missing values according to the statistical characteristics or correlation relationships of the data; The feature extraction includes: in terms of network traffic feature extraction, using a sliding window algorithm to calculate the mean and variance of the traffic size, count the number of connections within a unit time, and analyze the frequency distribution of port usage; for system log features, matching the log level through regular expressions, extracting operation type keywords, and parsing timestamp information; for user behavior features, using a sequence mining algorithm to extract user login frequency and operation sequence patterns. The standardization process includes: passing the extracted feature data through a normalization algorithm to make the data have zero mean and unit variance, so as to eliminate the influence of the dimension between different features.

6. The identification method of malicious behavior of an information system based on machine learning according to claim 1, characterized in that, In step 2, the preprocessed data is divided into a 70% training set and a 30% test set; an automated annotation tool is used to assist professional security personnel in annotation.

7. The recognition method for malicious behavior of an information system based on machine learning according to claim 1, characterized in that In step 3, the number of trees in the random forest is initialized to 100, the maximum depth is set to 10 layers, and the Gini impurity is used as the metric for feature selection.

8. The identification method of malicious behavior of an information system based on machine learning according to claim 1, characterized in that, In step 4, the model evaluation metrics include accuracy, recall rate, F1 value, precision rate, ROC curve, and AUC value.

9. A method for identifying malicious behaviors of an information system based on machine learning according to claim 1, characterized in that, In step 5, the types of malicious behaviors include network attacks, data breaches, and malware.

10. The recognition method of malicious behavior of an information system based on machine learning according to claim 1, characterized in that, In step 6, the defense mechanism includes blocking malicious IPs, isolating infected devices, and sending alarm messages; Blocking malicious IPs means: the system automatically calls the API interface of the firewall device, adds the malicious IP to the blacklist, and blocks its network connection; Isolating infected devices means: isolating the device from the current network through the network management system; Sending alarm messages means: using the SMS notification interface or email sending service to send alarm messages to the system administrator, detailing the type of malicious behavior, the occurrence time, and the device information involved.

Images