Internal threat behavior detection method based on few-sample learning

Abstract

The invention relates to the technical field of network security, in particular to an internal threat behavior detection method based on few-sample learning, and the method comprises the steps: cleaning and normalizing an original data set, and removing interference information composed of noise, missing items and abnormal values; performing feature extraction and dimension reduction operation on the data, and converting the data into a time sequence form; the processed time sequence data are input into a Diffusion-TS model to be trained; gradually adding noise to the time sequence data, denoising in a reverse process to generate high-quality time sequence data, and retaining time sequence dynamic characteristics by using a trend decomposition module; mixing the generated threat behavior data with an original data set to obtain a data set with positive and negative samples tending to be balanced; performing threat detection on the enhanced data set by using an LSTM-DWFCN model; and an output result of the fusion module is spliced, the model is further subjected to nonlinear transformation through an activation function, finally classification information is obtained, and accurate recognition of a complex threat behavior mode is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly to an internal threat behavior detection method based on few-shot learning. Background Art

[0002] With the continuous improvement of the informatization level, traditional security protection mechanisms mainly focus on resisting external attackers, such as hacker intrusion, malware propagation, phishing, etc. However, recent research and actual cases have shown that the security threats faced by organizations not only come from outside the system boundary, but more serious hidden dangers often originate from within the system. An internal threat refers to an internal person such as an employee, contractor, or partner who has a legal identity and access rights. Once they carry out destructive behaviors out of malice or negligence, it will bring deeper harm to the system and is also more difficult to detect. Generally, an internal threat to network security refers to an individual using their authorized access to organizational data and resources to damage the company's equipment, information, network, and system.

[0003] In the "Internal Threat Cybersecurity Report 2024", in the past year, 60% of the respondents suffered internal attacks, and 8% of the respondents even suffered more than 20 attacks; at the same time, compared with external attacks, 48% of the respondents believed that internal attacks were more difficult to detect and prevent. Different from traditional external intrusion behaviors, internal attacks are often difficult to distinguish from legitimate operations in terms of behavior performance. For example, operations such as accessing sensitive files, exporting databases, and installing programs are normal behaviors within a specific permission range, but when these behaviors occur at unexpected times, with abnormal frequencies, or are inconsistent with user responsibilities, they may hide malicious intentions. This ambiguity makes detection methods based on static rules or simple strategies ineffective and increases the difficulty of identifying malicious behaviors. In addition, the manifestations of internal threats are extremely diverse, including but not limited to data leakage, privilege abuse, implanting logic bombs, deleting or modifying critical files, deliberately causing system failures, etc. These attack behaviors may be motivated by economic reasons, revenge, or coercion by external forces. The diversity of attack methods further increases the complexity of the detection system design, requiring the model to not only be able to identify known attack patterns, but also have the ability to adapt to and generalize to unknown threats.

[0004] Therefore, in view of the concealment and diversity of internal threats, it is necessary to construct a detection model that can adaptively identify malicious user behaviors, which will help capture abnormal behaviors, block potential risks, and thus reduce the losses caused by security incidents to the organization. In the actual scenario of internal threat detection, compared with a large number of normal behaviors, the number of malicious behaviors is scarce, resulting in an imbalance between positive and negative samples in the dataset. This affects the accuracy and generalization ability of the trained detection model, leading to an excessively high false negative rate in the actual application of internal threat detection and making it impossible to effectively discover potential internal threats; the time-series correlation of user behavior feature data and the uncertainty of the duration of malicious behaviors result in such time-series data usually showing characteristics of high-dimensionality, non-linearity, and complex dynamic changes. Traditional analysis methods often have difficulty effectively modeling its internal structure, posing a great technical challenge to threat detection. Therefore, how to capture the time-series complexity and periodic characteristics of internal threat behaviors and integrate these characteristics globally is an important challenge. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for detecting internal threat behaviors based on few-shot learning, aiming to solve the problem that in the actual scenario of internal threat detection, compared with a large number of normal behaviors, the number of malicious behaviors is scarce, resulting in an imbalance between positive and negative samples in the dataset. This affects the accuracy and generalization ability of the trained detection model, leading to an excessively high false negative rate in the actual application of internal threat detection and making it impossible to effectively discover potential internal threats.

[0006] To achieve the above purpose, the present invention provides a method for detecting internal threat behaviors based on few-shot learning, including the following steps: [[ID=IO]]

[0007] Clean and normalize the original dataset, and remove the interference information composed of noise, missing items, and outliers;

[0008] Extract features and perform dimensionality reduction on the data, and transform it into a time-series form;

[0009] Input the processed time-series data into the Diffusion-TS model for training;

[0010] Gradually add noise to the time-series data and denoise it in the reverse process to generate high-quality time-series data, and use the trend decomposition module to retain the time-series dynamic features;

[0011] Mix the generated threat behavior data with the original dataset to obtain a dataset with balanced positive and negative samples;

[0012] Use the LSTM-DWFCN model to detect threats on the enhanced dataset;

[0013] The output of the splicing and fusion module is further subjected to a non-linear transformation by the activation function of the model, and finally the classification information is obtained.

[0014] Among them, feature extraction and dimensionality reduction operations are performed on the data and it is converted into a time series form. The steps also include:

[0015] Converting the data in time series form into a multi-variable time series data format.

[0016] Among them, the processed time series data is input into the Diffusion-TS model for training. The steps also include:

[0017] The Diffusion-TS network model includes a diffusion framework, a Transformer architecture, a trend decomposition module, and a Fourier loss.

[0018] Among them, the diffusion framework includes:

[0019] In the forward and reverse processes of the diffusion model, samples in the data distribution x0~q(x) are gradually noisy into standard Gaussian noise x T ~N(0,1), where the conversion parameter is q(x t |x t-1 ) = N(x t ; (1-β t )x t-1 ,β t I), β t ∈(0,1) is used as the noise addition amount of the diffusion step t. Then, the neural network gradually learns the inverse process p θ (x t-1 |x t ) = N(x t-1 ; μ θ (x t ,t),Σ θ (x t ,t)) of denoising the samples through the reverse conversion. An approximator is established through the reverse diffusion process to parameterize μ θ (x t ,t) for all t, so that the output is as close as possible to the input. The specific formula is as follows:

[0020]

[0021] Among them, μ(x t ,x0) is the mean of the posterior q(x t-1 |x0,x t ), and μ θ (x t ,t) represents the value of μ in the reverse diffusion (denoising) process from xt Inferred x t-1 The mean value used when

[0022] Among them, the Transformer architecture includes:

[0023] When the encoder in the Transformer encoder-decoder architecture performs positional encoding on the information of the entire noise sequence, the self-attention mechanism is used to extract global information, and the specific formula is as follows:

[0024]

[0025] Where the input is the noise time series and the output is the compressed global time series feature.

[0026] Among them, the trend decomposition module includes:

[0027] The input of the trend decomposition module is defined as Where i ∈ 1,..., N, t is the diffusion step, i is the decoder block number, and the trend decomposition module includes a trend term synthesis layer and a Fourier synthesis layer;

[0028] In the trend term synthesis layer, the trend component describes the smooth underlying average of the internal threat behavior data, and its purpose is to simulate slow-changing behaviors. In order to generate a reasonable trend component, polynomial regression is used to model the trend term, and the formula is as follows:

[0029]

[0030] Where Is the trend term finally obtained at the diffusion step t, c is the polynomial coefficient, Is the bias term related to the trend.

[0031] The Fourier synthesis layer is used to capture the seasonal terms in the internal threat behavior data, so as to identify the seasonal patterns, and then select the top K bases in the frequency domain and use the Fourier series to represent the seasonal terms. The formula of the Fourier synthesis layer is as follows:

[0032]

[0033] Where argTopK is to obtain the top K amplitudes, Are the phase and amplitude of the Kth frequency after the discrete Fourier transform F respectively, f K Represents the Fourier frequency corresponding to the index K, S i,t Is the seasonal term finally obtained at the diffusion step t.

[0034] Among them, the trend decomposition module further includes:

[0035] The Transformer decoder gradually recovers a clear time series with the help of the trend decomposition module. The decoder is used to generate the time series by combining the trend decomposition module. The specific formula is as follows:

[0036]

[0037] where represents the "clean" time series predicted from the noise state x t at the t-th step by the network parameters θ, is the trend term, R is the error term, is the seasonal term, and each term S i,t can be understood as the periodic component corresponding to a seasonal fundamental frequency.

[0038] Among them, the Fourier loss includes:

[0039] The Fourier transform is a mathematical operation that converts a finite-length time-domain signal into its frequency-domain representation. The loss term based on Fourier is beneficial to the accurate reconstruction of time series signals. The specific formula is as follows:

[0040]

[0041] where is the coefficient for weighting the loss at the t-th step, FFT represents the fast Fourier transform, and λ1, λ2 are the weights for balancing the two losses.

[0042] Among them, the LSTM-DWFCN model also includes:

[0043] LSTM introduces an input gate, a forget gate, and an output gate, and has a cell state that runs through the entire sequence. These mechanisms enable LSTM to effectively handle long-term dependencies in the sequence.

[0044] The forget gate is used to determine which information in the cell state should be retained and which should be discarded. The calculation formula of the forget gate is as follows:

[0045] f t = σ(W f · [h t-1 , x t + b f )

[0046] where the current input x t and the hidden state h t-1 at the previous moment are used as inputs, and W f and b f are the weight matrix and bias vector of the forget gate respectively.

[0047] The input gate is responsible for controlling how much information in the current input will be updated into the cell state. The calculation formula of the input gate is as follows:

[0048] i t =σ(W i ·[h t-1 ,x t +b i )

[0049]

[0050] Among them, x t and h t-1 are used as inputs, and W i , b i , W c and b C are the relevant weight matrix and bias vector of the input gate respectively. The cell state is updated according to the results of the forget gate and the input gate. The specific formula is as follows:

[0051]

[0052] Among them, ⊙ represents element-wise multiplication.

[0053] The output gate determines which information in the cell state will be output as the hidden state at the current moment. The calculation formula of the output gate is as follows:

[0054] o t =σ(W o ·[h t-1 ,x t +b o )

[0055] h t =o t ⊙tanh(C t )

[0056] Among them, it receives the hidden state h t-1 at the previous moment and the input x t at the current moment as inputs, and W o and b o are the weight matrix and bias vector of the output gate respectively.

[0057] The core idea of FCN is to replace the fully connected layer with a convolutional layer, so that the model can output a feature map with the same size as the input image, realizing the classification of each pixel. In order to achieve pixel-level prediction consistent with the original image size, it is necessary to perform an upsampling operation on the extracted feature map. Through the transposed convolution operation, a feature map with the same resolution as the input is obtained. The transposed convolution formula is as follows:

[0058] y(i,j,k) = Σ(m)Σ(p,q)ω((m,k,p,q)*f((i + pr) / r,(j + qr) / r,m)

[0059] Where y is the upsampled feature map, i and j represent the spatial positions of the generated feature map y, k represents the depth or number of channels of the feature map, m represents the channels traversed by the convolutional kernel during the convolution operation, ω is the deconvolution kernel parameter, r is the upsampling factor, p is the index position of the convolutional kernel in the height direction (vertical direction), and q is the index position of the convolutional kernel in the width direction (horizontal direction).

[0060] DWConv performs well in processing heterogeneous data (such as different types of input data or features of different scales) and can effectively extract multi-scale information. DWConv can perform spatial convolution on each channel of the input tensor separately without mixing channel information. The calculation formula for each output channel is as follows:

[0061]

[0062] Where the input channel tensor is The depth convolutional kernel is The output shape is The same as the number of input channels.

[0063] An internal threat behavior detection method based on few-shot learning of the present invention obtains the behavior data of internal users, cleans and normalizes the original data, performs feature extraction and dimensionality reduction operations, and converts it into a time series form; constructs a time series diffusion generation model Diffusion-TS to perform data augmentation on the processed time series data; uses the LSTM-DWFCN internal threat detection model to perform threat detection on the augmented data set. This patent solves the problem of unbalanced positive and negative sample data in the data set by improving the features and diversity of the original data samples. In the detection module, a new internal threat detection model is constructed by combining long short-term memory networks, deep convolutional networks, and fully convolutional networks. This model can fully focus on the temporal correlation of user behaviors, can fully mine temporal dependencies, local features, and effectively integrate global behavior information, and realizes the accurate recognition of complex threat behavior patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art.

[0065] Figure 1 It is a step diagram of the internal threat behavior detection method based on few-shot learning of the present invention.

[0066] Figure 2It is the architecture diagram of the internal threat behavior detection method based on few-shot learning of the present invention.

[0067] Figure 3 It is the network architecture diagram of Diffusion-TS of the present invention.

[0068] Figure 4 It is the flow chart of the internal threat behavior data augmentation method based on Diffusion-TS of the present invention.

[0069] Figure 5 It is the architecture diagram of the internal threat detection method based on LSTM-DWFCN of the present invention.

[0070] Figure 6 It is the implementation flow chart of the internal threat behavior detection method based on LSTM-DWFCN of the present invention. Detailed implementation manners

[0071] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the drawings. The embodiments described below by referring to the drawings are exemplary and are intended to explain the present invention, and should not be construed as a limitation to the present invention.

[0072] The first embodiment of the present application is as follows:

[0073] Please refer to Figure 1 and Figure 6 where Figure 1 is the step diagram of the internal threat behavior detection method based on few-shot learning of the present invention. Figure 2 is the architecture diagram of the internal threat behavior detection method based on few-shot learning of the present invention. Figure 3 is the network architecture diagram of Diffusion-TS of the present invention. Figure 4 is the flow chart of the internal threat behavior data augmentation method based on Diffusion-TS of the present invention. Figure 5 is the architecture diagram of the internal threat detection method based on LSTM-DWFCN of the present invention. Figure 6 is the implementation flow chart of the internal threat behavior detection method based on LSTM-DWFCN of the present invention.

[0074] The present invention provides an internal threat behavior detection method based on few-shot learning, including the following steps:

[0075] S101: Clean and normalize the original data set, and eliminate the interference information composed of noise, missing items and outliers;

[0076] S102: Extract and reduce the dimensions of the data, and convert it into a time series form;

[0077] S103: The processed time series data is input into the Diffusion-TS model for training;

[0078] S104: gradually adding noise to the time series data and denoising it in the reverse process to generate high-quality time series data, and using the trend decomposition module to preserve the dynamic characteristics of the time series;

[0079] S105: Mixing the generated threat behavior data with the original dataset to obtain a dataset with a balanced positive and negative samples;

[0080] S106: Use the LSTM-DWFCN model to perform threat detection on the enhanced dataset;

[0081] S107: The output results of the splicing and fusion modules are further transformed nonlinearly by the model through the activation function to finally obtain the classification information.

[0082] First, the data is preprocessed, and then the Diffusion-TS network model is used to enhance the threat behavior data, increasing the number and diversity of data set samples. Then, the LSTM-DWFCN internal threat behavior detection model is used to capture the long-term temporal dependency of the data, extract fine-grained local features, and enhance the nonlinear expression ability to fuse features, thereby enhancing the recognition effect of complex threat behavior patterns. The architecture of this method is as follows Figure 1 shown.

[0083] The architecture of this method can be described as follows:

[0084] (1) In the data preprocessing stage, the original dataset was first cleaned and normalized to remove common interference information such as noise, missing items, and outliers. The data was then subjected to feature extraction and dimensionality reduction operations and converted into a time series format. Since the time series feature scales of different datasets may vary, in order to adapt to the input format of the diffusion model, the time series data was converted into a multivariate time series data format to accommodate the training of the diffusion model.

[0085] (2) In the data enhancement phase, the processed time series data is input into the Diffusion-TS model for training. Noise is gradually added to the time series data through the forward process, and denoised in the reverse process to generate high-quality time series data. The trend decomposition module is used to preserve the dynamic characteristics of the time series. The model combines time series decomposition, Transformer structure, and Fourier loss to improve the quality of data generation. The generated threat behavior data is mixed with the original dataset to obtain a dataset with a balanced positive and negative samples.

[0086] (3) Use the enhanced dataset for threat detection using the LSTM-DWFCN model. Among them, LSTM captures the long-term temporal dependencies in the data, DWConv extracts local spatial features, and FCN further extracts local temporal-spatial features and enhances the non-linear expression ability. By splicing and fusing the output results of these modules, the model further performs non-linear transformation through the activation function, and finally obtains classification information, so as to accurately identify and predict internal threat behaviors.

[0087] Furthermore, the processing flow of this internal threat behavior detection method based on few-shot learning consists of three parts: data preprocessing, data augmentation, and threat behavior detection. These modules will be introduced one by one below:

[0088] (1) Original data.

[0089] The original data is sourced from the CMU-CERT4.2 dataset, which contains about 3.22 million logs, of which 7,423 are malicious operation logs, recording the login, device, file, HTTP, and email behavior logs of 1,000 employees within 18 months, comprehensively reflecting the activities of employees in various aspects. The specific overview of the dataset is as follows:

[0090] 1) Login logs: Login logs have 5 fields: ID, date, employee, PC, activity (login / logout). The date field contains the date and timestamp of the login or logout activity performed by each employee;

[0091] 2) Device usage logs: Device logs have 5 fields: ID, date, employee, PC, activity (connect / disconnect). The date field contains the date and timestamp of connecting or disconnecting any removable media activity performed by each employee;

[0092] 3) File usage logs: File logs have 6 fields: ID, date, employee, PC, file name, content. The date field contains the date and timestamp of the employee accessing the file. The file name is stored with 5 different types of file extensions (.doc,.txt,.jpeg,.pdf,.zip.exe);

[0093] 4) Network access logs: Network access logs have 6 fields: ID, date, employee, PC, URL, content. The date field contains the date and timestamp of the URL accessed by each employee;

[0094] 5) Email sending logs: Email sending logs have 10 fields: date, employee, PC, recipient, CC, BC, sender, size, attachment, content. The date field contains the date and timestamp of the email sending or receiving activity performed by each employee.

[0095] (2) Dataset preprocessing

[0096] In the field of internal threat detection, high-quality data is considered the core foundation for building effective models. It directly affects the training quality and detection accuracy of the models. In reality, due to interference factors such as common noise, missing values, and outliers in the data, directly using this low-quality data may greatly affect the training effect of the models. At the same time, such datasets usually have the characteristics of high-dimensional sparsity caused by high dimensions and a vast feature space, which poses challenges to feature extraction and pattern mining.

[0097] Regarding data quality issues, it is first necessary to carefully clean and preprocess the original data. For noisy data, some outlier detection and correction techniques can be adopted, such as removing outliers based on statistical distributions. For missing values, attempts can be made to repair them using mean filling, median filling, interpolation methods, etc.

[0098] In addition to data quality issues, the high-dimensional sparse characteristics of internal threat datasets also pose challenges to model training. The feature values of a large number of dimensions are close to 0 or missing, and this sparsity makes it difficult for traditional machine learning algorithms to effectively learn meaningful patterns from the data. Therefore, by using dimensionality reduction techniques (such as principal component analysis PCA) or feature selection algorithms to retain the features that have the greatest impact on the target variable, the computational complexity can be effectively reduced and the generalization ability of the model can be improved.

[0099] Another important issue is that the original data mostly exists in the form of logs or audit records, ignoring the inherent temporal nature and context relevance of the data, lacking sufficient utilization of time dimension information, and unable to effectively capture the potential temporal dependencies in behavior patterns. To solve this problem, we rearrange the original data according to timestamps and event sequences and convert it into a time series data format. This can not only retain the temporal attributes of the data but also utilize some feature engineering techniques specifically for time series, such as sliding window feature extraction.

[0100] For the construction and evaluation of an employee behavior anomaly detection model, a specific time window parameter is set, that is, a continuous 28-day period is used as the observation cycle. Accordingly, the devices are divided into exclusive devices, shared devices, and other people's devices according to 3 relationships between the operating devices and users. Each operation corresponds to 3 encodings. Then, based on these 3 encodings, the user's login information, device connection information, network access information, file usage information, and email sending and receiving information, etc., are extracted, and the daily behavior characteristics of the user's behavior are encoded into a 50-dimensional feature vector. The processed single-day features are shown in Table 1.

[0101] Table 1 Behavior Features

[0102]

[0103]

[0104] After extracting the daily behavioral characteristics of each user, a multivariate time series data format of (1000, 545, 50) is obtained, which represents the user behaviors of 1000 employees over 545 days, where the user behaviors are encoded as 50-dimensional feature vectors. To capture the temporal dependencies of user behaviors, a period of 28 days is used. Finally, when performing detection, the data input into the model specifically presents as a matrix structure of 28 rows multiplied by 50 columns.

[0105] (3) Data augmentation

[0106] The data augmentation module of this patent adopts an improved variant Diffusion-TS of the diffusion model. The Diffusion-TS model combines time series decomposition technology with the denoising diffusion model and is implemented through an objective function based on Fourier loss and the embedding of the Transformer architecture. Its architecture includes four main parts: the diffusion framework, the Transformer architecture, the trend decomposition module, and the Fourier loss. The specific architecture of this model is as Figure 2 shown. The following is an overview of the basic principle and key formula of Diffusion-TS:

[0107] (1) Basic principle:

[0108] 1) Diffusion framework

[0109] The diffusion model gradually adds noise to the real data through the forward process until the data completely becomes Gaussian noise; while in the reverse process, a neural network is used to gradually remove the noise and reconstruct samples approximating the original data. Different from traditional methods that only predict noise, Diffusion-TS directly predicts the clean time series, making it easier to recover complex temporal characteristics during the generation process.

[0110] 2) Transformer encoder-decoder

[0111] Diffusion-TS uses a Transformer-based encoder-decoder architecture. The encoder performs positional encoding on the information of the entire noise sequence, which can enhance the model's ability to capture global correlations and time series patterns, thereby handling long sequence dependencies and improving time series modeling capabilities. The decoder gradually recovers a clear time series with the help of the trend decomposition module.

[0112] 3) Trend decomposition module

[0113] The trend decomposition module decomposes the user behavior time series into a trend term, a seasonal term, and an error term, and then captures high-frequency fluctuations, random noise, or more complex periodicities beyond trends and seasonality, so that the generated user behavior time series can match the real data both macroscopically and be closer to the real data in local details.

[0114] 4) Fourier loss

[0115] The Fourier transform is a mathematical operation that converts a finite-length time-domain signal into its frequency-domain representation. In the reverse denoising process, the Fourier loss compares the differences between the original signal and the predicted signal in the frequency domain, further improving the model's ability to capture periodicities and local details.

[0116] (2) Key formulas:

[0117] 1) In the forward and reverse processes of the diffusion model, samples in the data distribution x0 ∼ q(x) are gradually noise-added to the standard Gaussian noise x T ∼ N(0, 1), where the conversion parameter is q(x t |x t-1 ) = N(x t ; (1 - β t )x t-1 , β t I), β t ∈(0, 1) as the noise addition amount for the diffusion step t. Then the neural network learns to gradually denoise the samples through the reverse conversion p θ (x t-1 |x t ) = N(x t-1 ; μ θ (x t , t), Σ θ (x t , t)). An approximator is established through learning in the reverse diffusion process to parameterize μ θ (x t , t) for all t, making the output as close as possible to the input. The specific formula is as follows:

[0118]

[0119] where μ(x t , x0) is the mean of the posterior q(x t-1 |x0, x t ), and μ θ (x t , t) represents the mean used to infer x t from x t-1 during the reverse diffusion (denoising) process.

[0120] 2) When the encoder in the Transformer encoder-decoder architecture performs positional encoding on the information of the entire noise sequence, it uses the self-attention mechanism to extract global information. The specific formula is as follows:

[0121]

[0122] where the input is the noise time series and the output is the compressed global time series features.

[0123] 3) The input of the trend decomposition module is defined as where \(i\in1,\cdots,N\), \(t\) is the diffusion step, and \(i\) is the decoder block number. The trend decomposition module includes a trend term synthesis layer and a Fourier synthesis layer.

[0124] In the trend term synthesis layer, the trend component describes the smooth underlying average of the internal threat behavior data, and its purpose is to simulate the slowly changing behavior. To generate a reasonable trend component, polynomial regression is used to model the trend term. The formula is as follows:

[0125]

[0126] where is the trend term finally obtained at the diffusion step \(t\), \(c\) is the polynomial coefficient, is the bias term related to the trend.

[0127] The Fourier synthesis layer is used to capture the seasonal term in the internal threat behavior data, so as to identify the seasonal pattern, and then select the top \(K\) bases in the frequency domain and use the Fourier series to represent the seasonal term. The formula of the Fourier synthesis layer is as follows:

[0128]

[0129] where \(\text{argTopK}\) is to obtain the top \(K\) amplitudes, are the phase and amplitude of the \(K\)th frequency after the discrete Fourier transform \(F\) respectively, \(f\) K represents the Fourier frequency corresponding to the index \(K\), and \(S\) i,t is the seasonal term finally obtained at the diffusion step \(t\).

[0130] 4) The Transformer decoder gradually recovers a clear time series with the help of the trend decomposition module. The decoder is used to generate the time series by combining the trend decomposition module. The specific formula is as follows:

[0131]

[0132] where represents the value at the \(t\)th step, which is obtained from the noise state \(x\) by the network parameters \(\theta\) at the tThe "clean" time series obtained by forecasting, is the trend term, R is the error term, is the seasonal term, each S i,t It can be understood as the periodic component corresponding to a seasonal fundamental frequency.

[0133] 5) Fourier transform is a mathematical operation that converts a finite-length time-domain signal into its frequency-domain representation. Fons et al. [3] showed that Fourier-based loss terms are beneficial for the accurate reconstruction of time series signals. The specific formula is as follows:

[0134]

[0135] in is the coefficient for weighting the loss of the t-th step, FFT represents fast Fourier transform, and λ1 and λ2 are the weights for balancing the two losses.

[0136] (3) Implementation of data enhancement method based on Diffusion-TS

[0137] Further, see Figure 3 According to the above method principle, the process of Diffusion-TS data enhancement technology is described as follows:

[0138] (1) Fully preprocess the original data set, remove redundant data, and eliminate noise interference factors;

[0139] (2) According to a specific strategy, key features are extracted from the standardized data and the data set is processed by mean-variance normalization;

[0140] (3) Convert the original data into a time series structure to suit the training of the diffusion model;

[0141] (4) In order to adapt the input format of the diffusion model, the time series data is converted into a multivariate time series data format, and finally the feature-extracted data and its labels are input into the Diffusion-TS network training;

[0142] (5) Determine whether the number of iterations is met, and if not, continue training;

[0143] (6) Output the generated data.

[0144] Algorithm 1 gives the pseudo code for implementing the data enhancement method based on Diffusion-TS:

[0145]

[0146]

[0147] In Algorithm 1, the collective meaning of some pseudocode is as follows:

[0148] Line 1: Initialize the diffusion step size T and network parameters θ;

[0149] Line 3: Randomly sample a data of size batch_size from the training set D;

[0150] Line 4: Generate Gaussian noise ε;

[0151] Line 5: Gradually add noise to the original data;

[0152] Line 9: Reverse diffusion sampling from the standard normal distribution x T ;

[0153] Line 11: Obtain the trend term through the trend synthesis layer Line 12: Obtain the seasonal term S through the Fourier synthesis layer i,t ;

[0154] Line 13: The residual information error term R automatically learned through the last encoding layer;

[0155] Line 14: Generate a "clean sequence" by summing the trend term, seasonal term, and error term

[0156] Line 15: According to the (clean data) predicted by the model and the current noisy data x t , to obtain the next x t-1 ;

[0157] Line 16: By comparing the generated and the original data x0, combined with the Fourier objective function, guide the model to better reconstruct the original time series data during reverse diffusion;

[0158] Line 18: After all reverse steps, add the finally obtained x0 to the synthetic dataset S.

[0159] (4) Internal threat behavior detection

[0160] The threat behavior detection module of this patent adopts an internal behavior threat detection method based on LSTM-DWFCN. This method combines long short-term memory network, deep convolutional network, and fully convolutional neural network to achieve efficient internal threat behavior detection. Among them, LSTM captures the long-term time series dependencies in the data, DWConv extracts local spatial features, and FCN further extracts local time series spatial features and enhances the non-linear expression ability. The architecture of this method mainly includes two main modules: data preprocessing, internal threat behavior detection. The specific architecture is as Figure 4As shown below, the following is an overview of the basic principles and key formulas of LSTM-DWFCN:

[0161] (1) Basic principles:

[0162] 1) Data processing stage: First, clean the original dataset by removing noise, missing values, and outliers, and fill in the missing values using interpolation. Then, perform normalization to unify the features into a standard range and avoid the impact of feature scale differences on the model. Subsequently, perform feature extraction and dimensionality reduction to select key features and remove redundant information, improving the learning efficiency of the model. Finally, reorder the data according to timestamps or event sequences and convert it into a time series format to meet the input requirements of deep learning models.

[0163] 2) Internal threat behavior detection stage: Input the extracted time series data into the LSTM-DWFCN model. LSTM mainly captures the long-term dependencies in the time series data, identifies the regular behaviors during normal working hours, and detects abnormal behaviors that do not conform to the time series pattern. DWConv can discover sudden operation changes by extracting local features and identify local abnormal behaviors. The FCN module is used to further process the local time series features extracted by DWConv, enhancing the non-linear expression ability and spatial integration ability of the features, providing richer representation information for the subsequent feature fusion with the LSTM branch, and finally outputting normal or abnormal behaviors through the classification layer by splicing the output results of these modules. In this way, the model can comprehensively consider time series, local, and global features, accurately distinguish normal behaviors and potential threat behaviors, and improve the accuracy and robustness of internal threat detection.

[0164] (2) Key formulas:

[0165] 1) LSTM is a deep learning model commonly used to process sequence data. Compared with traditional recurrent neural networks, LSTM introduces three gates (input gate, forget gate, output gate) and has a cell state that runs through the entire sequence. These mechanisms enable LSTM to effectively handle long-term dependencies in the sequence.

[0166] The forget gate is used to determine which information in the cell state should be retained and which should be discarded. It receives the current input x t and the hidden state h t-1 from the previous moment as inputs, and maps them to values between 0 and 1 through a Sigmoid activation function. Values close to 0 indicate that the corresponding cell state information will be forgotten, and values close to 1 indicate that the information will be retained. The calculation formula for the forget gate is as follows:

[0167] f t =σ(W f ·[h t-1 ,xt ]+b f )

[0168] Among them, W f and b f are the weight matrix and bias vector of the forget gate respectively.

[0169] The input gate is responsible for controlling how much information in the current input will be updated into the cell state. It also receives x t and h t-1 As input, an update ratio is calculated through the Sigmoid function, and the current input is transformed through a Tanh activation function, and then the two are multiplied to obtain the information that needs to be updated to the cell state. The calculation formula of the input gate is as follows:

[0170] i t =σ(W i ·[h t-1 ,x t ]+b i )

[0171]

[0172] Among them, W i 、b i 、W c and b C The cell state is updated based on the results of the forget gate and the input gate. The specific formula is as follows:

[0173]

[0174] Where ⊙ represents element-wise multiplication.

[0175] The output gate determines which information in the cell state will be output as the hidden state at the current moment. It receives the hidden state h at the previous moment. t-1 and the current input x t As input, the output ratio is first calculated through the Sigmoid function and multiplied by the cell state after Tanh activation to generate the hidden state of the current time step. The calculation formula of the output gate is as follows:

[0176] o t =σ(W o ·[h t-1 ,x t ]+b o )

[0177] h t =o t ⊙tanh(C t )

[0178] Among them, W o and b o are the weight matrix and bias vector of the output gate respectively.

[0179] 2) The core idea of FCN is to replace the fully connected layer with a convolutional layer, so that the model can output a feature map with the same size as the input image, realizing the classification of each pixel. In order to achieve pixel-level prediction consistent with the original image size, it is necessary to perform an upsampling operation on the extracted feature map. Through the transposed convolution operation, a feature map with the same resolution as the input is obtained. The transposed convolution formula is as follows:

[0180] y(i,j,k) = Σ(m)Σ(p,q) ω((m,k,p,q) * f((i + pr) / r, (j + qr) / r, m)

[0181] Among them, y is the upsampled feature map, i and j represent the spatial positions of the generated feature map y, k represents the depth or number of channels of the feature map, m represents the channels traversed by the convolutional kernel during the convolution operation, ω is the transposed convolution kernel parameter, r is the upsampling factor, p is the index position of the convolutional kernel in the height direction (vertical direction), and q is the index position of the convolutional kernel in the width direction (horizontal direction).

[0182] 3) DWConv performs well in processing heterogeneous data (such as different types of input data or features of different scales), and can effectively extract multi-scale information. DWConv can perform spatial convolution on each channel of the input tensor separately without mixing channel information. The calculation formula for each output channel is:

[0183]

[0184] Among them, the input channel tensor is The depth convolutional kernel is The output shape is The same as the number of input channels.

[0185] (3) Implementation of the internal threat behavior detection method based on LSTM - DWFCN.

[0186] Furthermore, please refer to Figure 5 , based on the above method principle, the process of the LSTM - DWFCN internal threat behavior detection method is described as follows:

[0187] (1) Collect the original behavior data generated by users from the system;

[0188] (2) Perform operations such as cleaning, format conversion, missing value filling, and normalization on the collected original data to lay a foundation for subsequent modeling;

[0189] (3) Extract key features reflecting users' operation habits and behavior patterns from the preprocessed data to provide meaningful inputs for model training;

[0190] (4) Convert the extracted features into a time series format for input into the deep learning model to capture the dynamic characteristics of users' behaviors over time, and divide the training set and the test set;

[0191] (5) Input the divided training behavior data into the LSTM-DWFCN neural network to start the model training. During the training process, the model gradually learns and captures the threat behavior patterns contained in the data;

[0192] (6) Determine whether the current model has reached the predetermined number of training rounds or meets the convergence condition, and decide whether to continue training. If not, continue training; otherwise, jump out of the training loop;

[0193] (7) After completing the predetermined number of training iterations, input the divided test set into the trained model for verification to evaluate the model's recognition ability on unseen samples and generate the corresponding output results.

[0194] The pseudo-code implementation of the internal threat behavior detection method based on LSTM-DWFCN is shown in Algorithm 2:

[0195]

[0196]

[0197] The specific meanings of the pseudo-code of Algorithm 2 are as follows:

[0198] (1) Line 1: First, set the number of training times n and the initial configuration of the relevant network model to ensure that the model matches the input data format;

[0199] (2) Line 3: Input the training set X into the model for training, and continuously update the network parameters through multiple rounds of iteration to make the model gradually converge and learn the features in the time series;

[0200] (3) Line 5: Input the test set Y into the trained LSTM-DWFCN detection model to obtain the detection result S.

[0201] This patent proposes a method for detecting internal threat behaviors based on few-shot learning. By improving the features and diversity of the original data samples, the problem of data imbalance between positive and negative samples in the dataset is solved. In the detection module, a new internal threat detection model is constructed by combining long short-term memory network, deep convolutional network and fully convolutional network. This model can fully focus on the temporal correlation of user behaviors, can fully mine temporal dependencies, local features and effectively integrate global behavior information, and realizes the accurate recognition of complex threat behavior patterns.

[0202] The above disclosure is only one or more preferred embodiments of the present application, and cannot be used to limit the scope of rights of the present application. Those of ordinary skill in the art can understand all or part of the processes of implementing the above embodiments, and the equivalent changes made according to the claims of the present application still fall within the scope covered by the present application.

Claims

1. A method for detecting internal threat behaviors based on few-shot learning, characterized in that, It includes the following steps: The original dataset is cleaned and normalized, and the interference information composed of noise, missing items and outliers is removed; Feature extraction and dimensionality reduction operations are performed on the data, and it is converted into a time series form; The processed time series data is input into the Diffusion-TS model for training; Noise is gradually added to the time series data, and denoising is performed in the reverse process to generate high-quality time series data. The trend decomposition module is used to retain the dynamic features of the time series; The generated threat behavior data is mixed with the original dataset to obtain a dataset with balanced positive and negative samples; The enhanced dataset is used in the LSTM-DWFCN model for threat detection; The output results of the splicing fusion module are concatenated, and the model further performs a non-linear transformation through an activation function to finally obtain classification information.

2. The internal threat behavior detection method based on few-shot learning according to claim 1, wherein, Feature extraction and dimensionality reduction operations are performed on the data, and it is converted into a time series form. The steps also include: The time series data in time series form is converted into a multivariate time series data format.

3. The method for detecting internal threat behavior based on few-shot learning according to claim 1, wherein, The processed time series data is input into the Diffusion-TS model for training. The steps also include: The Diffusion-TS network model includes a diffusion framework, a Transformer architecture, a trend decomposition module and a Fourier loss.

4. The internal threat behavior detection method based on few-shot learning according to claim 3, wherein The diffusion framework includes: In the forward and reverse processes of the diffusion model, samples in the data distribution x0 ∼ q(x) are gradually corrupted by noise into standard Gaussian noise x T ∼ N(0, 1), where the transformation parameter is q(x t |x t-1 ) = N(x t ; (1 - β t )x t-1 , β t I), β t ∈(0, 1) is the amount of noise added at diffusion step t. Then the neural network learns the inverse process p θ (x t-1 |x t ) = N(x t-1 ; μ θ (x t , t), Σ θ (x t , t)) through the reverse transformation. An approximator is built through learning the reverse diffusion process to parameterize μ θ (x t , t) for all t, such that the output is as close as possible to the input. The specific formula is as follows: where, μ(x t , x0) is the mean of the posterior q(x t-1 |x0, x t ), μ θ (x t , t) represents the mean used to infer x t from x t-1 during the reverse diffusion (denoising) process.

5. The method for detecting internal threat behavior based on few-shot learning according to claim 3, characterized in that, The Transformer architecture includes: When the encoder in the Transformer encoder-decoder architecture performs positional encoding on the information of the entire noise sequence, the self-attention mechanism is used to extract global information. The specific formula is as follows: Where the input is the noise time series and the output is the compressed global time series feature.

6. The method for detecting internal threat behaviors based on few-shot learning according to claim 5, wherein, The trend decomposition module includes: The input of the trend decomposition module is defined as where \(i\in1,\cdots,N\), \(t\) is the diffusion step, \(i\) is the decoder block number, and the trend decomposition module includes a trend term synthesis layer and a Fourier synthesis layer; In the trend term synthesis layer, the trend component describes the smooth underlying average of the internal threat behavior data. Its purpose is to simulate slowly changing behaviors. In order to generate a reasonable trend component, polynomial regression is used to model the trend term. The formula is as follows: where is the trend term finally obtained at diffusion step t, c is the polynomial coefficient, is the bias term related to the trend. The Fourier synthesis layer is used to capture the seasonal terms in the internal threat behavior data, so as to identify the seasonal patterns. Then, the top K bases are selected in the frequency domain, and the Fourier series is used to represent the seasonal terms. The formula of the Fourier synthesis layer is as follows: where argTopK is to obtain the top K amplitudes, which are the phase and amplitude of the K-th frequency after the discrete Fourier transform F, respectively, and f K represents the Fourier frequency corresponding to the index K, and S i,t is the seasonal term finally obtained at the diffusion step t.

7. The method for detecting internal threat behavior based on few-shot learning according to claim 4, wherein, The trend decomposition module also includes: The Transformer decoder gradually recovers a clear time series with the help of the trend decomposition module. The decoder is used to generate a time series by combining the trend decomposition module. The specific formula is as follows: where represents the "clean" time series predicted from the noise state x at the t-th step by the network parameter θ t , is the trend term, R is the error term, is the seasonal term, and each term S i,t can be understood as the periodic component corresponding to a seasonal fundamental frequency.

8. The method for detecting internal threat behavior based on few-shot learning according to claim 3, wherein The Fourier loss includes: The Fourier transform is a mathematical operation that converts a finite-length time-domain signal into its frequency-domain representation. The Fourier-based loss term is beneficial to the accurate reconstruction of time series signals. The specific formula is as follows: where is the coefficient for weighting the loss at the t-th step, FFT represents the fast Fourier transform, and λ1, λ2 are the weights for balancing the two losses.

9. The method for detecting internal threat behaviors based on few-shot learning according to claim 6, wherein, The LSTM-DWFCN model also includes: LSTM introduces an input gate, a forget gate and an output gate, and has a cell state that runs through the entire sequence. These mechanisms enable LSTM to effectively handle long-term dependencies in the sequence. The forget gate is used to judge which information should be retained and which information should be discarded in the cell state. The calculation formula of the forget gate is as follows: f t = σ(W f · [h t-1 , x t + b f ) Among them, Current input x t and the hidden state h at the previous moment t-1 are used as inputs, where W f and b f are the weight matrix and bias vector of the forget gate respectively. The input gate is responsible for controlling how much information in the current input will be updated into the cell state. The calculation formula of the input gate is as follows: i t = σ(W i · [h t-1 , x t + b i ) Among them, x t and h t-1 are used as inputs, and W i , b i , W c and b C are the relevant weight matrix and bias vector of the input gate respectively. The cell state is updated by updating the cell state according to the results of the forget gate and the input gate. The specific formula is as follows: Among them, ⊙ represents element-wise multiplication. The output gate determines which information in the cell state will be output as the hidden state at the current moment. The calculation formula of the output gate is as follows: o t = σ(W o · [h t-1 , x t + b o ) h t = o t ⊙tanh(C t ) Among them, the hidden state h at the previous moment is received t-1 and the input x at the current moment t are used as inputs, where W o and b o are the weight matrix and bias vector of the output gate respectively. The core idea of FCN is to replace the fully connected layer with a convolutional layer, so that the model can output a feature map with the same size as the input image, achieving the classification of each pixel. In order to achieve pixel-level prediction consistent with the original image size, it is necessary to perform an upsampling operation on the extracted feature map. Through the transposed convolution operation, a feature map with the same resolution as the input is obtained. The transposed convolution formula is as follows: y(i,j,k)=Σ(m)Σ(p,q)ω((m,k,p,q)*f((i+pr) / r,(j+qr) / r,m) Where y is the upsampled feature map, i and j represent the spatial positions of the generated feature map y, k represents the depth or number of channels of the feature map, m represents the channels traversed by the convolutional kernel during the convolution operation, ω is the transposed convolution kernel parameter, r is the upsampling factor, p is the index position of the convolutional kernel in the height direction (vertical direction), and q is the index position of the convolutional kernel in the width direction (horizontal direction). DWConv performs well in processing heterogeneous data (such as different types of input data or features of different scales) and can effectively extract multi-scale information. DWConv can perform spatial convolution on each channel of the input tensor separately without mixing channel information. The calculation formula for each output channel is: Among them, the input channel tensor is The depth convolution kernel is The output shape is The same as the number of input channels.

Images