Abnormal connection evaluation method for terminal access authentication

Abstract

The invention relates to the technical field of communication, in particular to an abnormal connection evaluation method for terminal access authentication. The method comprises the steps of obtaining a neighborhood structure similarity assessment value of a to-be-assessed connection, obtaining a neighborhood distribution position assessment value of the to-be-assessed connection according to a probability density of an embedded vector corresponding to the to-be-assessed connection in an embedded vector corresponding to a neighborhood historical connection, and obtaining a neighborhood distribution position assessment value of the to-be-assessed connection according to variances of the embedded vectors corresponding to all the neighborhood historical connections. Obtaining a behavior evaluation value of the to-be-evaluated connection, and obtaining an evaluation factor of the to-be-evaluated connection according to the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value and the behavior evaluation value; obtaining a target abnormal evaluation value of the to-be-evaluated connection according to the evaluation factor of the to-be-evaluated connection and the initial abnormal evaluation value of the to-be-evaluated connection, and performing abnormal connection evaluation on the to-be-evaluated connection according to the target abnormal evaluation value; according to the invention, the accuracy of abnormal connection identification of the to-be-evaluated connection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an abnormal connection evaluation method for terminal access authentication. Background Art

[0002] Currently, in order to block malicious access behaviors and reduce system security risks, it is necessary to evaluate abnormal connections such as illegal access attempts, abnormal device operations or identity forgery on terminals connected to the system.

[0003] In the existing technology, the evaluation of abnormal connections is usually only based on the CBLOF algorithm. For example, for the abnormal connection evaluation of the public security system, the log sequence obtained in any connection process is generally first encoded by the Transformer model to obtain the embedding vector corresponding to any connection, and then the CBLOF algorithm is used to obtain the abnormal connection score of the real-time connection. However, this abnormal connection evaluation strategy lacks relevance to the scenario, resulting in low credibility of the abnormal connection evaluation results. For example, for the public security system, there will be complex connection scenarios such as mobile office or frequent switching of multiple devices, and the connection authentication process in these complex connection scenarios may be different from the standard connection authentication process. The difference from the standard connection authentication process may cause the connection behavior in the complex connection scenario to be identified as outlier behavior or abnormal connection behavior, resulting in recognition errors. Therefore, how to improve the credibility of abnormal connection evaluation has become an urgent problem to be solved. Summary of the Invention

[0004] In order to solve the above problems, the present invention provides a method for evaluating abnormal connections for terminal access authentication. The technical solutions adopted are as follows: An embodiment of the present invention provides a method for evaluating abnormal connections for terminal access authentication, comprising the following steps: Obtaining a log sequence and an embedding vector corresponding to the connection to be evaluated, and a historical log sequence and an embedding vector corresponding to a neighborhood historical connection of the connection to be evaluated, wherein the connection to be evaluated and the neighborhood historical connection are processes of accessing the target system; Obtaining a neighborhood structure similarity evaluation value of the connection to be evaluated based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the log sequence to be evaluated, and the historical log sequence; obtaining a neighborhood distribution position evaluation value of the connection to be evaluated based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the neighborhood historical connection; obtaining a behavior evaluation value of the connection to be evaluated based on the variance of the embedding vectors corresponding to all neighborhood historical connections; and obtaining an evaluation factor of the connection to be evaluated based on the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value, and the behavior evaluation value; A target abnormality evaluation value of the connection to be evaluated is obtained according to the evaluation factor of the connection to be evaluated and the initial abnormality evaluation value of the connection to be evaluated, and abnormal connection evaluation is performed on the connection to be evaluated according to the target abnormality evaluation value.

[0005] Beneficial effects: The present invention first obtains the log sequence and embedding vector to be evaluated corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the neighborhood historical connection of the connection to be evaluated; then, based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the log sequence to be evaluated and the historical log sequence, a neighborhood structure similarity evaluation value of the connection to be evaluated is obtained; based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the neighborhood historical connection, a neighborhood distribution position evaluation value of the connection to be evaluated is obtained; based on the variance of the embedding vectors corresponding to all neighborhood historical connections, a behavior evaluation value of the connection to be evaluated is obtained; based on the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value and the behavior evaluation value, an evaluation factor of the connection to be evaluated is obtained; then, based on the evaluation factor of the connection to be evaluated and the initial abnormal evaluation value of the connection to be evaluated, a target abnormal evaluation value of the connection to be evaluated is obtained; finally, an abnormal connection evaluation is performed on the connection to be evaluated based on the target abnormal evaluation value; and the target abnormal evaluation value obtained by combining the evaluation factor and the initial abnormal evaluation value of the connection to be evaluated can improve the accuracy of abnormal connection identification for the connection to be evaluated. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0007] Figure 1 The present invention is a flowchart of a method for evaluating abnormal connections for terminal access authentication. DETAILED DESCRIPTION

[0008] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field fall within the scope of protection of the embodiments of the present invention.

[0009] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0010] This embodiment provides a method for evaluating abnormal connections for terminal access authentication, which is described in detail as follows: like Figure 1 As shown, the abnormal connection evaluation method for terminal access authentication includes the following steps: Step S001: Obtain a log sequence and an embedding vector corresponding to the connection to be evaluated, and a historical log sequence and an embedding vector corresponding to a neighborhood historical connection of the connection to be evaluated.

[0011] This embodiment improves the credibility of abnormal connection assessment by optimizing the abnormal assessment value obtained by using the existing algorithm. In addition, for ease of understanding and analysis, this embodiment will be described using the abnormal connection assessment process of the public security system as an example. That is, the connection or access described later in this embodiment refers to the connection between the terminal and the public security system, and this embodiment records the public security system as the target system.

[0012] Since this embodiment is a real-time evaluation, it is necessary to first obtain terminals that are currently connected to the target system or are attempting to access the target system, and record them as terminals to be evaluated; then, the process from the beginning of any terminal to be evaluated attempting to access the target system to the current moment is recorded as the connection to be evaluated corresponding to the terminal to be evaluated; subsequently, abnormal connections will be identified for the connection to be evaluated, and since the process of identifying abnormal connections for all terminals to be evaluated is the same, this embodiment will subsequently describe the process of identifying abnormal connections for any terminal to be evaluated, that is, all connections to be evaluated that appear subsequently are the same connection to be evaluated.

[0013] After obtaining the connection to be evaluated and the log sequence to be evaluated corresponding to the connection to be evaluated, all connection processes with the target system in the access time period before the current moment are obtained, and are all recorded as historical connections before the connection to be evaluated, or as historical connections before the connection time of the connection to be evaluated. The set consisting of all historical connections before the connection time of the connection to be evaluated is recorded as a historical set, and the set consisting of all historical connections before the connection time of the connection to be evaluated and the connection to be evaluated is recorded as a comprehensive set. For example, if there is a terminal Q, and the entire process from the beginning of terminal Q's attempt to access the target system to the end of access is before the current moment, then the entire process from the beginning of terminal Q's attempt to access the target system to the end of access is a historical connection before the connection to be evaluated, and the terminal corresponding to the historical connection is terminal Q, that is, a historical connection refers to the process from the beginning of the terminal corresponding to the historical connection's attempt to access the target system to the end of access.

[0014] Furthermore, in the terminal access authentication scenario, the target system will generate a large number of structured or semi-structured operation logs in multiple stages such as terminal access, authentication, operation, and logout. Therefore, this embodiment can obtain all logs generated by each connection process, that is, this embodiment can obtain all logs generated by the connection process to be evaluated and all logs generated by the historical connection process. Then, all logs generated by the connection process to be evaluated are arranged in the order of generation time, and the arranged sequence is recorded as the log sequence to be evaluated corresponding to the connection to be evaluated. All logs generated by any historical connection process are arranged in the order of generation time, and the arranged sequence is recorded as the historical log sequence corresponding to the historical connection. That is, the log sequence to be evaluated corresponding to the connection to be evaluated refers to a sequence of all logs related to the terminal corresponding to the connection to be evaluated generated during the connection time period corresponding to the connection to be evaluated, arranged in chronological order of generation time. The connection time period corresponding to the connection to be evaluated refers to the time period from the beginning of the terminal corresponding to the connection to be evaluated attempting to access the target system to the current moment. The log sequence to be evaluated corresponding to any historical connection refers to a sequence of all logs related to the terminal corresponding to the historical connection generated during the connection time period corresponding to that historical connection, arranged in chronological order of generation time. The connection time period corresponding to the historical connection refers to the time period from the beginning of the terminal corresponding to the corresponding historical connection attempting to access the target system to the end of the access. In addition, each log in the log sequence corresponding to any connection in this embodiment captures information such as the timestamp, user identity, source IP, connection protocol, and event type of the terminal corresponding to the corresponding connection. Therefore, each log in the log sequence to be evaluated is a log related to the terminal corresponding to the connection to be evaluated, and each log in the historical log sequence corresponding to any historical connection is a log related to the terminal corresponding to the corresponding historical connection.

[0015] The information recorded in each log in this embodiment includes but is not limited to the timestamp of the terminal connection, user identity, source IP, connection protocol, event type, etc., but the type of information recorded in each log in this embodiment is required to be consistent. For example, if the information recorded in a log is the timestamp, user identity, source IP, connection protocol, and event type of a terminal connection, then each log in this embodiment is composed of the timestamp, user identity, source IP, connection protocol, and event type of the terminal connection, and the information recorded in the log is the core data source for evaluating whether the access behavior is legal and reasonable; in addition, due to the complexity of the content in the log, the target system generally reduces the log text to a structured template event through formatting, noise cleaning and field extraction, and log template matching, and generally uses the Drain algorithm and LogSig algorithm for log template matching; it should be noted that the system generally collects original operation log data related to terminal authentication through an access authentication gateway, a log collection agent, or a terminal-side sensor module.

[0016] After obtaining the connection to be evaluated, all historical connections before the connection time of the connection to be evaluated, the log sequence to be evaluated corresponding to the connection to be evaluated, and the historical log sequence corresponding to the historical connection, it is necessary to obtain the neighborhood historical connections of the connection to be evaluated. The purpose of obtaining the neighborhood historical connections of the connection to be evaluated is to enable the subsequent evaluation results of the connection to be evaluated to be combined with the scene or context information, thereby improving the accuracy of the abnormal connection evaluation of the connection to be evaluated. The specific acquisition process of the neighborhood historical connections of the connection to be evaluated is: first, the starting time in the connection time period corresponding to the connection to be evaluated is recorded as t1, and all historical connections whose connection time period is within the time interval [t1-T, t1] are recorded as the neighborhood historical connections corresponding to the connection to be evaluated, and T is the preset time length; and in specific applications, the implementer needs to set the preset time length according to actual conditions, experimental statistics, etc. For example, in this embodiment, the preset time length can be set to one month or half a month.

[0017] After obtaining all neighboring historical connections of the connection to be evaluated, the embedding vectors corresponding to each historical connection in the comprehensive set and the embedding vector corresponding to the connection to be evaluated are obtained. The reason for obtaining the embedding vectors is to facilitate the calculation of subsequent evaluation factors, initial anomaly evaluation values, etc. The process of obtaining the embedding vectors is as follows: using the Transformer Encoder to encode all logs in the log sequence to be evaluated corresponding to the connection to be evaluated, and recording the encoding result as the embedding vector corresponding to the connection to be evaluated; using the Transformer Encoder to encode all logs in the historical log sequence corresponding to any historical connection, and recording the encoding result as the embedding vector corresponding to the historical connection. The Transformer Encoder is one of the core components of the Transformer model, mainly responsible for converting the input sequence (such as text, image, etc.) into a feature table containing neighborhood information. The Transformer model is a deep learning architecture based on the self-attention mechanism, and the output of the Transformer model is a vector. Since the process of converting the input sequence into a vector by the Transformer model is well known, it will not be described in this embodiment.

[0018] Therefore, this embodiment can obtain the log sequence and embedding vector to be evaluated corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the neighborhood historical connection of the connection to be evaluated through the above process; it should be noted that, for the public security system, the user terminal (such as the law enforcement tablet or police APP used by public security police) establishes a connection with the U shield device through the Bluetooth protocol to complete the remote triggering of key functions including certificate loading, key call, identity authentication, etc. During the whole process, the system will record the Bluetooth connection and disconnection behavior in real time, and upload the operation log to the background platform for management. The connection or disconnection can be triggered manually by the user, or passively triggered by the user leaving the effective Bluetooth communication range. The system realizes traceability management of the entire life cycle of device access through the correlation between Bluetooth events and certificate behaviors, thereby providing key technical support for the operational compliance, security audit and responsibility traceability of the public security system.

[0019] Step S002: Obtain a neighborhood structure similarity evaluation value of the connection to be evaluated based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the log sequence to be evaluated, and the historical log sequence; obtain a neighborhood distribution position evaluation value of the connection to be evaluated based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the neighborhood historical connection; obtain a behavior evaluation value of the connection to be evaluated based on the variance of the embedding vectors corresponding to all neighborhood historical connections; and obtain an evaluation factor of the connection to be evaluated based on the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value, and the behavior evaluation value.

[0020] In the public security system or other terminal access authentication scenarios with high security requirements, the device establishes a connection with the digital certificate USB shield via Bluetooth, performs identity authentication, and completes the command operation. During the whole process, multiple operation logs will be continuously generated. In order to conduct security assessments on these terminal operation behaviors, the log behavior modeling and clustering assessment methods are currently commonly used to identify abnormal connections or potential risk access behaviors. However, the CBLOF algorithm is usually used directly to obtain the abnormal connection score of the embedding vector corresponding to the connection to be evaluated, so as to achieve the identification of abnormal connections or potential risk access behaviors. However, the existing abnormal connection assessment strategy lacks relevance to the scenario, which leads to low credibility of the abnormal connection assessment results. For example, for the public security system, there will be complex connection scenarios such as mobile office or frequent switching of multiple devices. The connection authentication process in these complex connection scenarios may be different from the standard connection authentication process. For example, compared with the standard authentication process, some unnecessary processes may be missing. This difference from the standard connection authentication process may cause the connection behavior in the complex connection scenario to be identified as outlier behavior or abnormal connection behavior. That is, this difference from the standard connection authentication process may cause the connection behavior in the complex connection scenario to be corresponding to the abnormal connection behavior. The distance between the embedding vector and the cluster center is large, resulting in recognition errors or scoring errors. In order to improve the credibility and accuracy of the abnormal connection evaluation, this embodiment will subsequently combine the log sequence and embedding vector corresponding to the connection to be evaluated and the historical log sequence and embedding vector corresponding to the neighborhood historical connection of the connection to be evaluated to obtain an evaluation factor. The evaluation factor can reflect the possibility that the connection to be evaluated is an abnormal connection or abnormal access in the current scenario. Then, the obtained evaluation factor and the abnormal score value of the embedding vector corresponding to the connection to be evaluated obtained by the CBLOF algorithm are combined to obtain the final abnormal connection score, and the abnormal connection is accurately identified based on the final obtained abnormal connection score. Therefore, based on the above analysis, it can be seen that this embodiment needs to first obtain the evaluation factor of the connection to be evaluated. In order to ensure the reliability of the evaluation factor, this embodiment will determine the evaluation factor based on a multivariate fusion approach. That is, the evaluation factor of the connection to be evaluated in this embodiment is determined by three evaluation values: the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value, and the behavior evaluation value. Therefore, this embodiment needs to first obtain the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value, and the behavior evaluation value.

[0021] In this embodiment, first, based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the log sequence to be evaluated, and the historical log sequence corresponding to the neighborhood historical connection of the connection to be evaluated, the neighborhood structure similarity evaluation value of the connection to be evaluated is obtained. The neighborhood structure similarity evaluation value can reflect the possibility that the connection to be evaluated is an abnormal connection. The specific process of obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated is: First, according to the log event type in the log sequence to be evaluated, the event transition probability matrix corresponding to the connection to be evaluated is obtained. According to the log event type in the historical log sequence corresponding to the neighborhood historical connection, the event transition probability matrix corresponding to the neighborhood historical connection is obtained. The event transition probability matrix is mainly used to obtain the neighborhood structure similarity evaluation value. The neighborhood structure similarity evaluation value is an important parameter for determining the evaluation factor. In this embodiment, the method for obtaining the event transition probability matrix corresponding to all connections is the same. For ease of understanding, the specific acquisition process of the event transition probability matrix corresponding to any neighborhood historical connection P of the connection to be evaluated will be described as an example. Then the specific acquisition process of the event transition probability matrix corresponding to the neighborhood historical connection P is: First, obtain the combination sequence corresponding to each connection in the comprehensive set, and each combination in the combination sequence corresponding to any connection in the comprehensive set is composed of the event types of two adjacent historical logs in the log sequence corresponding to the connection. For example, the first event type in the bth combination in the combination sequence corresponding to any historical connection is the event type of the bth log in the historical log sequence corresponding to the historical connection, the second event type in the bth combination in the combination sequence corresponding to the historical connection is the event type of the b+1th log in the historical log sequence corresponding to the historical connection, the first event type in the b+1th combination in the combination sequence corresponding to the historical connection is the event type of the b+1th log in the historical log sequence corresponding to the historical connection, and the second event type in the b+1th combination in the combination sequence corresponding to the historical connection is the event type of the b+2th log in the historical log sequence corresponding to the historical connection, and the combination sequence corresponding to the connection to be evaluated and the neighborhood historical connection pair of the connection to be evaluated. The acquisition process of the corresponding combination sequence is consistent with the acquisition process of the combination sequence corresponding to the historical connection, so it will not be described in detail; then all combination types appearing in the combination sequence corresponding to all connections in the comprehensive set are counted, and the set constructed by all combination types appearing in the combination sequence corresponding to all connections in the comprehensive set is recorded as the combination type set, that is, if all combinations in the combination sequence corresponding to all connections in the comprehensive set are combination B1, combination B2 and combination B3, where the first event type in combination B1 is the device starts connecting and the second event type is successful connection, the first event type in combination B2 is digital certificate verification and the second event type is successful verification, and the first event type in combination B3 is the device starts connecting and the second event type is successful connection, then combination B1 and combination B3 belong to the same combination type, and combination B2 does not belong to the same combination type as combination B1 and combination B3, and the combination types obtained at this time are (device starts connecting, connection is successful) and (digital certificate verification, successful verification) respectively.After obtaining the combination type set, in the combination sequence corresponding to the neighborhood historical connection P, obtain the normalized value of the frequency of occurrence of each combination type in the combination type set, and record it as the transition probability of the corresponding combination type under the neighborhood historical connection P, and record the matrix composed of the transition probabilities of each combination type in the combination type set under the neighborhood historical connection P as the event transition probability matrix corresponding to the neighborhood historical connection P; and in the combination sequence corresponding to the neighborhood historical connection P, obtain the normalized value of the frequency of occurrence of each combination type in the combination type set as follows: in the combination sequence corresponding to the neighborhood historical connection P, obtain the number of combinations in which the first event type in the combination is the same as the first event type in the qth combination type, and record it as the normalized parameter of the qth combination type under the neighborhood historical connection P, and record the ratio of the frequency of occurrence of the qth combination type in the combination type set under the neighborhood historical connection P to the normalized parameter of the qth combination type under the neighborhood historical connection P as the neighborhood historical connection P. The normalized value of the frequency of occurrence of the qth combination type in the combination type set under the historical connection P, that is, the transition probability of the qth combination type in the combination type set under the neighborhood historical connection P refers to the probability density of the first event type in the qth combination type under the neighborhood historical connection P transferring to the second event type in the qth combination type; in addition, if the qth combination type is (F1, F2), F1 is the first event type in the qth combination type, and F2 is the second event type in the qth combination type, then if in the combination sequence corresponding to the neighborhood historical connection P, there are N combinations in which the first event type is F1, then the normalized parameter of the qth combination type under the neighborhood historical connection P is N; and if the frequency of occurrence of a certain combination type in the combination sequence corresponding to the neighborhood historical connection P is 0, then the transition probability of the combination type under the neighborhood historical connection P can be directly recorded as 0, and there is no need to calculate the normalized parameter of the combination type under the neighborhood historical connection P.

[0022] In addition, it should be noted that the elements in the same position in the event transition probability matrix corresponding to any connection in this embodiment are all transition probabilities of the same combination type under the corresponding connection, that is, if the element in the xth row and yth column of the event transition probability matrix corresponding to the i-th historical connection is the transition probability of the qth combination type in the combination type set under the i-th historical connection, then the element in the xth row and yth column of the event transition probability matrix corresponding to all connections is the transition probability of the qth combination type under the corresponding connection.

[0023] After obtaining the event transition probability matrix, the position mark value of each log in the log sequence is obtained, and the position mark value of the j-th log in any log sequence is j. The position mark value is used to subsequently obtain the position deviation degree representation value, and the position deviation degree representation value is an important parameter for determining the neighborhood structure similarity evaluation value. For example, the position mark value of the j-th log in the log sequence to be evaluated is j, and the position mark value of the j-th log in any historical log sequence is also j.

[0024] After obtaining the position mark value of each log in the log sequence, the neighborhood structure similarity evaluation value of the connection to be evaluated is obtained according to the event transition probability matrix corresponding to the connection to be evaluated, the event transition probability matrix corresponding to the neighborhood historical connection, the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the position mark value of the log in the log sequence to be evaluated, and the position mark value of the log in the historical log sequence. And according to the event transition probability matrix corresponding to the connection to be evaluated, the event transition probability matrix corresponding to the neighborhood historical connection, the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the position mark value of the log in the log sequence to be evaluated, and the position mark value of the log in the historical log sequence, the specific process of obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated is as follows: First, the set constructed by all neighborhood historical connections of the connection to be evaluated is recorded as the neighborhood historical connection set, and the set constructed by the embedding vectors corresponding to all neighborhood historical connections in the neighborhood historical connection set is recorded as the neighborhood embedding vector set. Then, the average matrix of the event transition probability matrices corresponding to all neighborhood historical connections in the neighborhood historical connection set is obtained and recorded as the neighborhood transition probability matrix corresponding to the connection to be evaluated. The process of obtaining the average matrix of multiple matrices with the same dimension is a well-known technique. Then, the JS divergence between the neighborhood transition probability matrix corresponding to the connection to be evaluated and the event transition probability matrix corresponding to the connection to be evaluated is obtained and recorded as the first structural index value. The process of obtaining the JS divergence between any two transition probability matrices is a well-known technique. The JS divergence is a measurement method for measuring the similarity between two probability distributions. The smaller the JS divergence between the two probability matrices, the more similar the probability distributions of the two probability matrices are. Conversely, when the JS divergence between the two probability matrices is larger, the more dissimilar the probability distributions of the two probability matrices are. Then, a vector similarity set corresponding to the connection to be evaluated is obtained, and the mth vector similarity in the vector similarity set is the cosine similarity between the embedding vector corresponding to the connection to be evaluated and the mth embedding vector in the neighborhood embedding vector set, that is, the number of data in the vector similarity set is consistent with the number of embedding vectors in the neighborhood embedding vector set, and the result of subtracting the mean normalized value of the vector similarity set from the preset first constant is recorded as the second structural indicator value, and the larger the cosine similarity value, the more similar the two vectors are, and conversely, the smaller the cosine similarity value, the more dissimilar the two vectors are. Then, continue to obtain the position deviation degree characterization value of each log in the log sequence to be evaluated corresponding to the connection to be evaluated, and record the average of the position deviation degree characterization values of all logs in the log sequence to be evaluated corresponding to the connection to be evaluated as the third structure index value. The smaller the position deviation degree characterization value, the smaller the difference between the access process of the terminal corresponding to the connection to be evaluated and the terminal access process of the historical connection in its neighborhood. The larger the position deviation degree characterization value, the greater the difference between the access process of the terminal corresponding to the connection to be evaluated and the terminal access process of the historical connection in its neighborhood. Finally, negative correlation mapping is performed on the result obtained by adding the obtained first structure index value, second structure index value and third structure index value, and the negative correlation mapping result is used as the neighborhood structure similarity evaluation value of the connection to be evaluated. The larger the neighborhood structure similarity evaluation value, the more similar the terminal access process of the connection to be evaluated is in structure to the terminal access process of the historical connection in its neighborhood, and the greater the possibility that the connection to be evaluated is a legal or normal connection.

[0025] In this embodiment, the specific process of obtaining the position deviation degree characterization value is as follows: for the cth log in the log sequence to be evaluated: first, in the historical log sequence corresponding to all neighborhood historical connections in the neighborhood historical connection set, all historical logs belonging to the same event type as the cth log are obtained, and the set constructed by all the obtained historical logs belonging to the same event type as the cth log is recorded as the historical log set of the cth log, the average of the position mark values of each historical log in the historical log set of the cth log is recorded as the neighborhood mark value of the cth log, and the result of subtracting the neighborhood mark value of the cth log from the position mark value of the cth log is recorded as is the characteristic position difference value of the c-th log; then the characteristic position difference value of each historical log in the historical log set of the c-th log is obtained, and the average of the characteristic position difference values of all historical logs in the historical log set of the c-th log is recorded as the historical difference average value of the c-th log, and the square value of the difference between the characteristic position difference value of the c-th log and the historical difference average value of the c-th log is recorded as the position deviation degree representation value of the c-th log, and the method for obtaining the characteristic position difference value of each historical log in the historical log set of the c-th log is the same as the method for obtaining the characteristic position difference value of the c-th log, so it will not be described in detail.

[0026] The specific expression for obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated is:

[0027] in, is the neighborhood structure similarity evaluation value of the connection to be evaluated, T0 is the event transition probability matrix corresponding to the connection to be evaluated, T1 is the neighborhood transition probability matrix corresponding to the connection to be evaluated, is the JS divergence between the neighborhood transition probability matrix corresponding to the connection to be evaluated and the event transition probability matrix corresponding to the connection to be evaluated, which is also the first structure indicator value. M is the number of embedding vectors in the neighborhood embedding vector set. R0 is the embedding vector corresponding to the connection to be evaluated. is the mth embedding vector in the neighborhood embedding vector set, is the cosine similarity between the embedding vector corresponding to the connection to be evaluated and the mth embedding vector in the set of neighborhood embedding vectors, is the second structure index value, Norm() is the normalization function, C is the number of logs in the log sequence to be evaluated, is the position deviation degree representation value of the cth log in the log sequence to be evaluated, is the third structural index value, exp() is an exponential function with a constant e as the base, c1 is a preset first constant, and the value of the preset first constant must be consistent with the maximum value of the normalization function for normalizing the mean of the vector similarity set. Since the normalization interval of the normalization function Norm() in this embodiment is 0 to 1, the value of the preset first constant is 1.

[0028] In addition, when The smaller it is, the more consistent the event transfer between the log sequence to be evaluated corresponding to the connection to be evaluated and the historical log sequence corresponding to the historical connection of the neighborhood to be evaluated is, or the more similar the probability distribution between the event transfer probability matrix corresponding to the connection to be evaluated and the neighborhood transfer probability matrix corresponding to the connection to be evaluated is, which indicates that the terminal access process of the connection to be evaluated is structurally similar to the terminal access process of the historical connection in its neighborhood. It also indicates that the possibility that the connection to be evaluated is an abnormal or illegal connection behavior is smaller, and the possibility that it is a normal or legal connection behavior is greater. When When is larger, it indicates that the embedding vector corresponding to the connection to be evaluated is more similar to each embedding vector in the neighborhood embedding vector set, or the semantic features between the connection to be evaluated and the historical connections in the neighborhood of the connection to be evaluated are more similar, which indicates that the terminal access process of the connection to be evaluated is more similar in structure to the terminal access process of the historical connections in its neighborhood. It also indicates that the possibility that the connection to be evaluated is an abnormal or illegal connection behavior is smaller, and the possibility that it is a normal or legal connection behavior is greater. When The smaller the value, the more similar the position of the same event type in the log sequence corresponding to the connection to be evaluated is to the position in the historical log sequence corresponding to the historical connection of the neighborhood of the connection to be evaluated. This indicates that the difference between the terminal access process of the connection to be evaluated and the terminal access process of the historical connection of its neighborhood is smaller, and it also indicates that the possibility that the connection to be evaluated is an abnormal or illegal connection behavior is smaller, and the possibility that it is a normal or legal connection behavior is greater. Based on the above description, it can be seen that when The smaller, The bigger, The smaller the value, the smaller the difference between the terminal access process of the connection to be evaluated and the terminal access process of the historical connection in its neighborhood. In other words, the more similar the structural topology, semantic features and position offset between the terminal access process of the connection to be evaluated and the historical connection in its neighborhood are, the greater the possibility that the connection to be evaluated is a legitimate or normal connection behavior. The smaller, The bigger, The smaller the time, The bigger, so when The larger the value, the greater the possibility that the connection to be evaluated is legal or normal. The smaller the value, the greater the difference between the terminal access process of the connection to be evaluated and the terminal access process of historical connections in the neighborhood, and the greater the possibility that the connection to be evaluated is illegal or abnormal. Furthermore, this embodiment uses the neighborhood structure similarity evaluation value as an important parameter for determining the evaluation factor, which can improve the accuracy of subsequent abnormal connection identification.

[0029] Therefore, based on the above analysis, it can be seen that the reason for obtaining similar evaluation values of the neighborhood structure of the connection to be evaluated is that there are differences in the connection processes in different scenarios, which will cause the overall structure of the connection to change. This change will cause the occurrence of abnormal connection misjudgment. For example, the connection during the day shift usually includes a complete connection, authentication and data signing process, but the night shift may only include the connection and authentication process due to factors such as system load, and some unnecessary connection operations will be skipped. This phenomenon of skipping some unnecessary connection operations will change the overall structure of the log sequence. Although the above operations themselves are legal and normal, their structure no longer matches the original standard execution connection and authentication process, and the misjudgment of abnormal connections will occur. However, by combining the connection process of its neighborhood connections, the occurrence of abnormal connection misjudgment can be reduced.

[0030] After completing the neighborhood structure similarity evaluation, in order to improve the accuracy of the subsequent abnormal connection evaluation, the probability density of the embedded vector in the neighborhood embedded vector is immediately introduced, so that the probability density is taken into account when the evaluation factor is subsequently determined to improve the accuracy of the abnormal connection evaluation, that is, by calculating the probability density, the possibility of whether the connection is a common connection or a rare connection can be evaluated, thereby further improving the reliability of the subsequent construction of the clustering model and the accuracy of the subsequent abnormal connection identification; therefore, after obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated, this embodiment uses the kernel density estimation method to obtain the probability density of the embedded vector corresponding to the connection to be evaluated in the neighborhood embedded vector set, and the normalized value of the probability density of the embedded vector corresponding to the connection to be evaluated in the neighborhood embedded vector set is recorded as the neighborhood distribution position evaluation value of the connection to be evaluated, and when the probability density of the embedded vector corresponding to the connection to be evaluated in the neighborhood embedded vector set is greater, it indicates that the frequency of the embedded vector corresponding to the connection to be evaluated in the neighborhood embedded vector set is greater, then the probability that the connection to be evaluated is a common connection behavior is greater, and when the probability density of the embedded vector corresponding to the connection to be evaluated in the neighborhood embedded vector set is smaller, it indicates that the embedded vector corresponding to the connection to be evaluated is rare. The less the frequency of the quantity appearing in the neighborhood embedding vector set, the greater the probability that the connection to be evaluated is a rare connection behavior, and the frequency of abnormal connection behavior is usually lower than the frequency of common connection behavior. Therefore, when the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set is smaller, that is, the smaller the neighborhood distribution position evaluation value of the connection to be evaluated is, the greater the possibility that the connection to be evaluated is an illegal or abnormal connection behavior, and when the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set is larger, that is, the larger the neighborhood distribution position evaluation value of the connection to be evaluated is, the greater the possibility that the connection to be evaluated is a legal or normal connection behavior; and the normalized value of the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set refers to the ratio of the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set to the maximum probability density of the neighborhood corresponding to the connection to be evaluated, and the maximum probability density of the neighborhood corresponding to the connection to be evaluated refers to the maximum value of the probability density of each embedding vector in the neighborhood embedding vector set obtained by the kernel density estimation method in the neighborhood embedding vector set; since the process of calculating the probability density using the kernel density estimation method is a well-known technology, it will not be described in detail.

[0031] This embodiment uses probability density, that is, the distribution position evaluation value, as an important parameter for adjusting the original clustering metric distance, which can improve subsequent vigilance against rare connection behaviors, thereby also improving the sensitivity and accuracy of subsequent abnormal connection identification. If the probability density is not considered, the subsequent abnormality score obtained based only on the CBLOF algorithm may identify common connection behaviors as abnormal connection behaviors, and abnormal connection behaviors as normal connection behaviors.

[0032] Furthermore, in actual applications, if the connection scenario and connection process of a terminal or user are fixed or stable (such as an access controller or a duty computer), then once a significant connection change occurs, the user or terminal is more likely to have abnormal connection behavior. On the other hand, if the connection scenario and connection process of a terminal or user are frequent (such as a patrol law enforcement terminal or a remote access node), then when a significant connection change occurs, the user or terminal is more likely to have normal connection behavior. Based on this, this embodiment will obtain a behavior evaluation value of the connection to be evaluated by analyzing changes in historical connections of the access terminal connected to the connection to be evaluated and the differences between the connection to be evaluated and the access terminal to be evaluated in historical connections. Obtaining the behavior evaluation value of the connection to be evaluated can further improve the sensitivity and accuracy of abnormal connection identification based on the connection behavior habits of the terminal or user. The specific process for obtaining the behavior evaluation value of the connection to be evaluated is as follows: First, the access terminal of the connection to be evaluated or the terminal to be evaluated corresponding to the connection to be evaluated is recorded as the target terminal. Then, from all historical connections before the connection time of the connection to be evaluated, that is, in the historical set, all historical connections with the same access terminal and the target terminal are obtained and recorded as the historical connections to be analyzed. For example, if there is a terminal Q, and the connection to be evaluated refers to the access process between terminal Q and the target system, and there is another historical connection, and this historical connection also refers to the access process between terminal Q and the target system, then the access terminal of this historical connection is the same as the target terminal, and this historical connection is the historical connection to be analyzed. Then, the negative correlation mapping value of the variance of the embedding vectors corresponding to all historical connections to be analyzed is obtained and recorded as the change representation value, and the change representation value is exp(-σ), σ is the variance of the embedding vectors corresponding to all historical connections to be analyzed, and the smaller the variance of the embedding vectors corresponding to all historical connections to be analyzed, the more stable the connection behavior habits of the target terminal are. When the variance of the embedding vectors corresponding to all historical connections to be analyzed is larger, it indicates that the connection behavior habits of the target terminal are more unstable. The variance of multiple embedding vectors is calculated by the Euclidean distance variance method, and the process of obtaining multiple vectors by the Euclidean distance variance method is: first calculate the average vector of multiple embedding vectors, and then obtain the distance between each embedding vector and the average vector. The square of the Euclidean distance is calculated, and the mean of the squares of the Euclidean distances between all embedding vectors and the average vector is used as the variance of multiple embedding vectors; then the Euclidean distance between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to each historical connection to be analyzed is obtained, and recorded as the difference value between the connection to be evaluated and the corresponding historical connection to be analyzed, and then the set of difference values between the connection to be evaluated and each historical connection to be analyzed is recorded as a difference value set, and the mean of the difference value set is recorded as a difference representation value, and then the result of multiplying the change representation value and the difference representation value and then performing negative correlation mapping is obtained, and recorded as the behavior evaluation value of the connection to be evaluated; and the specific calculation expression of the behavior evaluation value of the connection to be evaluated is:

[0033] in, is the behavior evaluation value of the connection to be evaluated, H is the change representation value, and V is the difference representation value; When the value is larger, it indicates that the connection behavior or connection habits of the connection to be evaluated have changed significantly when the connection behavior habits of the target terminal are relatively stable. In this case, the possibility that the connection to be evaluated is illegal or abnormal is greater. The bigger it is, The smaller, so when The smaller the value, the greater the possibility that the connection to be evaluated is illegal or abnormal. On the contrary, when The larger the value, the more likely the connection to be evaluated is legitimate or has normal connection behavior. Furthermore, there may be situations where there are no historical connections to be analyzed. When there are no historical connections to be analyzed, the behavior evaluation value cannot be calculated. Therefore, this embodiment does not calculate the behavior evaluation value of the connection to be evaluated when there are no historical connections to be analyzed. Furthermore, the behavior evaluation value of the connection to be evaluated is not included in the subsequent evaluation factor acquisition.

[0034] Therefore, this embodiment obtains the behavior evaluation value of the connection to be evaluated through the above process, and the addition of the behavior evaluation value can take into account the connection behavior habits of the user or terminal when subsequently identifying connection anomalies, thereby further improving the sensitivity and accuracy of subsequent abnormal connection identification.

[0035] After obtaining the neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value and behavior evaluation value, the obtained neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value and behavior evaluation value are fused and analyzed, and an evaluation factor is obtained based on the fusion analysis result. Subsequently, the obtained evaluation factor and the initial abnormal evaluation value of the connection to be evaluated are combined to determine the final abnormal evaluation value, that is, the target abnormal evaluation value. Then, according to the neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value and behavior evaluation value, the specific process of obtaining the evaluation factor of the connection to be evaluated is: weighted summing the neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value and behavior evaluation value of the connection to be evaluated, and taking the inverse mapping value of the result obtained by the weighted summing as the evaluation factor of the connection to be evaluated, and the larger the evaluation factor of the connection to be evaluated, the greater the possibility that the connection to be evaluated is illegal or abnormal connection behavior, and the smaller the evaluation factor of the connection to be evaluated, the smaller the possibility that the connection to be evaluated is illegal or abnormal connection behavior; and the formula for obtaining the inverse mapping value of the result obtained by weighted summing the neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value and behavior evaluation value of the connection to be evaluated is The formula for weighted summation of the neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value, and behavior evaluation value of the connection to be evaluated is: , where Z is the weighted sum of the neighborhood structure similarity evaluation value, neighborhood distribution position evaluation value, and behavior evaluation value of the connection to be evaluated, and c2 is the preset second constant. is the first weight value, is the second weight value, is the third weight value, is the neighborhood structure similarity evaluation value of the connection to be evaluated, is the neighborhood distribution location evaluation value of the connection to be evaluated, is the behavior evaluation value of the connection to be evaluated; and c2 is to prevent the denominator from being 0, but not to affect the evaluation result. This embodiment requires that the value of the preset second constant is small and greater than 0 but not greater than 1. For example, this embodiment can set the value of the preset second constant to be 0.1. In this embodiment, the implementer needs to set the weight value according to the actual situation or the importance of the recognition result. For example, the neighborhood structure similarity evaluation value of the connection to be evaluated is more important than that of the connection to be evaluated, so this embodiment requires the first weight value to be larger. Therefore, this embodiment can set Set to 0.4, Set to 0.3, Set to 0.3.

[0036] Therefore, this embodiment obtains the evaluation factor of the connection to be evaluated through the above process.

[0037] Step S003: obtaining a target abnormality assessment value of the connection to be assessed according to the assessment factor of the connection to be assessed and the initial abnormality assessment value of the connection to be assessed, and performing abnormal connection assessment on the connection to be assessed according to the target abnormality assessment value.

[0038] After obtaining the evaluation factor of the connection to be evaluated, the target abnormality evaluation value of the connection to be evaluated is obtained according to the evaluation factor of the connection to be evaluated and the initial abnormality evaluation value of the connection to be evaluated. The specific process of obtaining the target abnormality evaluation value of the connection to be evaluated is as follows: The CBLOF algorithm is used to obtain the anomaly score of the embedding vector corresponding to the connection to be evaluated, and the anomaly score of the embedding vector corresponding to the connection to be evaluated is recorded as the initial anomaly evaluation value of the connection to be evaluated; then the result obtained by multiplying the evaluation factor of the connection to be evaluated by the initial anomaly evaluation value of the connection to be evaluated is obtained, and the normalization function Norm() is used to normalize the result obtained by multiplying the evaluation factor of the connection to be evaluated by the initial anomaly evaluation value of the connection to be evaluated, and the normalization result is used as the target anomaly evaluation value of the connection to be evaluated. The larger the target anomaly evaluation value, the greater the possibility that the connection to be evaluated is illegal or an abnormal connection behavior; and the process of obtaining the anomaly score of the embedding vector corresponding to the connection to be evaluated by the CBLOF algorithm is as follows: the set consisting of the embedding vectors corresponding to all connections in the comprehensive set is recorded as the set to be clustered, first all the embedding vectors in the clustering set are clustered using the K-means clustering algorithm, and the cluster cluster obtained by clustering is recorded as the target cluster cluster, and after obtaining the target cluster cluster and the embedding vector corresponding to the connection to be evaluated After the target cluster to which the connection to be evaluated belongs is determined, whether each target cluster belongs to a large cluster or a small cluster is determined. If the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs is a large cluster, the Euclidean distance between the embedding vector corresponding to the connection to be evaluated and the cluster center of the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs is multiplied by the total number of embedding vectors in the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs, and the result is recorded as the abnormality score of the embedding vector corresponding to the connection to be evaluated. If the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs is a small cluster, the large cluster whose cluster center is closest to the embedding vector corresponding to the connection to be evaluated is obtained and recorded as the nearest neighbor cluster of the embedding vector corresponding to the connection to be evaluated. The Euclidean distance between the embedding vector corresponding to the connection to be evaluated and the cluster center of the nearest neighbor cluster of the embedding vector corresponding to the connection to be evaluated is multiplied by the total number of embedding vectors in the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs, and the result is recorded as the abnormality score of the embedding vector corresponding to the connection to be evaluated. The higher the abnormality score, the greater the possibility that the connection to be evaluated is an abnormal connection or illegal connection behavior. In addition, the process of judging whether the target cluster belongs to a large cluster or a small cluster is as follows: sort all target clusters in order of the number of embedded vectors in the cluster from large to small to obtain a target cluster sequence. If the ratio of the cumulative sum of the number of embedded vectors in the first n-1 target clusters in the target cluster sequence to the total number of embedded vectors in the set to be clustered is not greater than the preset proportion threshold, and the ratio of the cumulative sum of the number of embedded vectors in the first n target clusters in the target cluster sequence to the total number of embedded vectors in the set to be clustered is greater than the preset proportion threshold, then the first n target clusters in the target cluster sequence are all recorded as large clusters, and the remaining target clusters are all recorded as small clusters. The preset proportion threshold is an empirical value, and the preset proportion threshold is generally set to ninety percent.

[0039] After obtaining the target abnormality evaluation value of the connection to be evaluated, an abnormal connection evaluation is performed on the connection to be evaluated according to the target abnormality evaluation value of the connection to be evaluated. Specifically, it is determined whether the target abnormality evaluation value of the connection to be evaluated is greater than a preset abnormality judgment threshold. If so, it indicates that the connection to be evaluated is an abnormal connection or an illegal connection behavior, and therefore the terminal access authentication of the connection to be evaluated is marked as an abnormal connection authentication. Otherwise, it indicates that the connection to be evaluated is a normal connection or a legal connection behavior, and therefore the terminal access authentication of the connection to be evaluated is marked as a normal connection authentication. In specific applications, the implementer needs to set the preset abnormality judgment threshold according to the value range of the target abnormality evaluation value, the meaning represented by the size of the abnormality evaluation value, and experimental statistics. For example, in this embodiment, the preset abnormality judgment threshold can be set to 0.6.

[0040] So far, this embodiment has completed the identification or evaluation of abnormal connections for the connection to be evaluated, and the identification or evaluation result obtained by this embodiment in combination with the scenario of the connection to be evaluated has high accuracy.

[0041] To summarize, this embodiment first obtains the log sequence and embedding vector to be evaluated corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the neighborhood historical connection of the connection to be evaluated; then, based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the log sequence to be evaluated and the historical log sequence, the neighborhood structure similarity evaluation value of the connection to be evaluated is obtained; based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the neighborhood historical connection, the neighborhood distribution position evaluation value of the connection to be evaluated is obtained; based on the variance of the embedding vectors corresponding to all neighborhood historical connections, the behavior evaluation value of the connection to be evaluated is obtained; based on the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value and the behavior evaluation value, the evaluation factor of the connection to be evaluated is obtained; then, based on the evaluation factor of the connection to be evaluated and the initial abnormal evaluation value of the connection to be evaluated, the target abnormal evaluation value of the connection to be evaluated is obtained; finally, the abnormal connection evaluation is performed on the connection to be evaluated based on the target abnormal evaluation value; and the target abnormal evaluation value obtained by combining the evaluation factor and the initial abnormal evaluation value of the connection to be evaluated in this embodiment can improve the accuracy of abnormal connection identification for the connection to be evaluated.

[0042] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A method for evaluating abnormal connections for terminal access authentication, characterized in that: The method comprises the following steps: Obtaining a log sequence and an embedding vector corresponding to the connection to be evaluated, and a historical log sequence and an embedding vector corresponding to a neighborhood historical connection of the connection to be evaluated, wherein the connection to be evaluated and the neighborhood historical connection are processes of accessing the target system; Obtaining a neighborhood structure similarity evaluation value of the connection to be evaluated based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the log sequence to be evaluated, and the historical log sequence; obtaining a neighborhood distribution position evaluation value of the connection to be evaluated based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the neighborhood historical connection; obtaining a behavior evaluation value of the connection to be evaluated based on the variance of the embedding vectors corresponding to all neighborhood historical connections; and obtaining an evaluation factor of the connection to be evaluated based on the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value, and the behavior evaluation value; A target abnormality evaluation value of the connection to be evaluated is obtained according to the evaluation factor of the connection to be evaluated and the initial abnormality evaluation value of the connection to be evaluated, and abnormal connection evaluation is performed on the connection to be evaluated according to the target abnormality evaluation value.

2. The abnormal connection evaluation method for terminal access authentication according to claim 1, characterized in that: The embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection refer to the vectors obtained by encoding the log sequence to be evaluated and the historical log sequence corresponding to the neighborhood historical connection using the Transformer model, respectively. The neighborhood historical connection of the connection to be evaluated refers to the historical connection behavior within a preset time length of the connection time of the connection to be evaluated.

3. The abnormal connection evaluation method for terminal access authentication according to claim 1, characterized in that: The method for obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated includes: According to the log event type in the log sequence to be evaluated, the event transition probability matrix corresponding to the connection to be evaluated is obtained. According to the log event type in the historical log sequence corresponding to the neighborhood historical connection, the event transition probability matrix corresponding to the neighborhood historical connection is obtained. The event transition probability matrix corresponding to the neighborhood historical connection is obtained in the same manner as the event transition probability matrix corresponding to the connection to be evaluated. The position mark value of each log in any log sequence is obtained, and the position mark value of the j-th log in any log sequence is j. According to the event transition probability matrix corresponding to the connection to be evaluated, the event transition probability matrix corresponding to the neighborhood historical connection, the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the position mark value of the log in the log sequence to be evaluated, and the position mark value of the log in the historical log sequence, the neighborhood structure similarity evaluation value of the connection to be evaluated is obtained.

4. The abnormal connection evaluation method for terminal access authentication according to claim 3, characterized in that: The method for obtaining the event transition probability matrix corresponding to the neighborhood history connection includes: Record the set consisting of all historical connections and the connection to be evaluated that precedes the connection time of the connection to be evaluated as a comprehensive set. Obtain the combination sequence corresponding to each connection in the comprehensive set. The first event type and the second event type in the bth combination in the combination sequence corresponding to any connection are respectively the event type of the bth log and the event type of the b+1th log in the log sequence corresponding to the corresponding connection. Record the set constructed from all combination types that appear in the combination sequences corresponding to all connections in the comprehensive set as a combination type set. In the combination sequence corresponding to any neighborhood historical connection P, obtain the normalized value of the frequency of occurrence of each combination type in the combination type set, and record it as the transition probability of the corresponding combination type under the neighborhood historical connection P; record the matrix composed of the transition probabilities of each combination type in the combination type set under the neighborhood historical connection P as the event transition probability matrix corresponding to the neighborhood historical connection P.

5. The abnormal connection evaluation method for terminal access authentication according to claim 3, characterized in that: A method for obtaining a neighborhood structure similarity evaluation value of a connection to be evaluated based on an event transition probability matrix corresponding to a connection to be evaluated, an event transition probability matrix corresponding to neighborhood historical connections, similarities between an embedding vector corresponding to the connection to be evaluated and an embedding vector corresponding to neighborhood historical connections, position marking values of logs in a log sequence to be evaluated, and position marking values of logs in a historical log sequence, including: Record the set constructed by all neighborhood historical connections of the connection to be evaluated as the neighborhood historical connection set, record the set constructed by the embedding vectors corresponding to all neighborhood historical connections in the neighborhood historical connection set as the neighborhood embedding vector set, obtain the average matrix of the event transition probability matrices corresponding to all neighborhood historical connections in the neighborhood historical connection set, and record it as the neighborhood transition probability matrix corresponding to the connection to be evaluated, obtain the JS divergence between the neighborhood transition probability matrix corresponding to the connection to be evaluated and the event transition probability matrix corresponding to the connection to be evaluated, and record it as the first structure indicator value; Obtain a vector similarity set corresponding to the connection to be evaluated, where the mth vector similarity in the vector similarity set is the cosine similarity between the embedding vector corresponding to the connection to be evaluated and the mth embedding vector in the neighborhood embedding vector set, and record the result of subtracting the mean normalized value of the vector similarity set from a preset first constant as a second structure indicator value; Obtaining a deviation degree representation value of each log in the log sequence to be evaluated, and recording the average of the position deviation degree representation values of all logs in the log sequence to be evaluated as the third structure index value; A negative correlation mapping value of a result obtained by adding the first structure index value, the second structure index value, and the third structure index value is used as a neighborhood structure similarity evaluation value of the connection to be evaluated.

6. The abnormal connection evaluation method for terminal access authentication according to claim 5, characterized in that: The method for obtaining the position deviation degree representation value includes: For the cth log in the log sequence to be evaluated corresponding to the connection to be evaluated; in the historical log sequences corresponding to all neighborhood historical connections in the neighborhood historical connection set, obtain all historical logs belonging to the same event type as the cth log, and record the set constructed by all the historical logs belonging to the same event type as the cth log as the historical log set of the cth log, record the average of the position mark values of each historical log in the historical log set as the neighborhood mark value of the cth log, and record the result of subtracting the neighborhood mark value of the cth log from the position mark value of the cth log as is the characteristic position difference value of the c-th log; obtain the characteristic position difference value of each historical log in the historical log set of the c-th log, the method for obtaining the characteristic position difference value of each historical log in the historical log set of the c-th log is the same as the method for obtaining the characteristic position difference value of the c-th log, and the mean of the characteristic position difference values of all historical logs in the historical log set is recorded as the historical difference average value of the c-th log, and the square value of the difference between the characteristic position difference value of the c-th log and the historical difference average value of the c-th log is recorded as the position deviation degree representation value of the c-th log.

7. The abnormal connection evaluation method for terminal access authentication according to claim 5, characterized in that: The neighborhood distribution position evaluation value of the connection to be evaluated is a normalized value of the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set.

8. The abnormal connection evaluation method for terminal access authentication according to claim 1, characterized in that: The method for obtaining the behavior evaluation value of the connection to be evaluated includes: Among all historical connections located before the connection time of the connection to be evaluated, all historical connections with the same access terminal as the connection to be evaluated are obtained and recorded as the historical connections to be analyzed. The negative correlation mapping value of the variance of the embedding vectors corresponding to all the historical connections to be analyzed is recorded as the change representation value. The Euclidean distance between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the historical connection to be analyzed is recorded as the difference value between the connection to be evaluated and the corresponding historical connection to be analyzed. The average of the difference values between the connection to be evaluated and all the historical connections to be analyzed is recorded as the difference representation value. The result of multiplying the change representation value by the difference representation value and then performing negative correlation mapping is recorded as the behavior evaluation value of the connection to be evaluated.

9. The abnormal connection evaluation method for terminal access authentication according to claim 1, characterized in that: The evaluation factor of the connection to be evaluated is an inverse mapping value of a result obtained by weighted summation of a neighborhood structure similarity evaluation value, a neighborhood distribution position evaluation value, and a behavior evaluation value of the connection to be evaluated.

10. The abnormal connection evaluation method for terminal access authentication according to claim 1, characterized in that: The method for obtaining the target anomaly evaluation value of the connection to be evaluated includes: The CBLOF algorithm is used to obtain the anomaly score of the embedding vector corresponding to the connection to be evaluated, and the anomaly score of the embedding vector corresponding to the connection to be evaluated is recorded as the initial anomaly evaluation value of the connection to be evaluated; The normalized value of the result obtained by multiplying the evaluation factor of the connection to be evaluated by the initial abnormality evaluation value of the connection to be evaluated is used as the target abnormality evaluation value of the connection to be evaluated.

Images