An abnormal connection evaluation method for terminal access authentication

Abstract

The application relates to the technical field of communication, in particular to an abnormal connection evaluation method for terminal access authentication. The method comprises the following steps: obtaining a neighborhood structure similarity evaluation value of a to-be-evaluated connection; obtaining a neighborhood distribution position evaluation value of the to-be-evaluated connection according to the probability density of the embedding vector corresponding to the to-be-evaluated connection in the embedding vector corresponding to a neighborhood historical connection; obtaining a behavior evaluation value of the to-be-evaluated connection according to the variance of the embedding vector corresponding to all neighborhood historical connections; obtaining an evaluation factor of the to-be-evaluated connection according to the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value and the behavior evaluation value; obtaining a target abnormal evaluation value of the to-be-evaluated connection according to the evaluation factor of the to-be-evaluated connection and an initial abnormal evaluation value of the to-be-evaluated connection; and performing abnormal connection evaluation on the to-be-evaluated connection according to the target abnormal evaluation value. The application can improve the precision of abnormal connection identification of the to-be-evaluated connection.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically to an abnormal connection evaluation method for terminal access authentication. Background Technology

[0002] Currently, in order to block malicious access and reduce system security risks, it is necessary to conduct abnormal connection assessments on terminals accessing the system, such as unauthorized access attempts, abnormal device operations, or identity forgery.

[0003] In existing technologies, abnormal connection assessment is typically based solely on the CBLOF algorithm. For example, in the case of abnormal connection assessment in public security systems, existing methods generally involve first encoding the log sequence obtained during any connection process using a Transformer model to obtain the embedding vector corresponding to each connection, and then using the CBLOF algorithm to obtain the abnormal connection score for the real-time connection. However, this abnormal connection assessment strategy lacks contextual relevance, resulting in low reliability of the assessment results. For instance, public security systems may encounter complex connection scenarios such as mobile office work or frequent switching between multiple devices. The connection authentication process in these complex connection scenarios may differ from the standard connection authentication process. These differences may lead to connection behaviors in complex connection scenarios being identified as outliers or abnormal connection behaviors, resulting in misidentification. Therefore, improving the reliability of abnormal connection assessment has become an urgent problem to be solved. Summary of the Invention

[0004] To address the aforementioned problems, this invention provides an abnormal connection assessment method for terminal access authentication, the specific technical solution of which is as follows:

[0005] One embodiment of the present invention provides an abnormal connection evaluation method for terminal access authentication, comprising the following steps:

[0006] Obtain the log sequence and embedding vector corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the neighboring historical connections of the connection to be evaluated. The connection to be evaluated and the neighboring historical connections are the process of accessing the target system.

[0007] Based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the historical connections in the neighborhood, the log sequence to be evaluated, and the historical log sequence, a neighborhood structure similarity evaluation value for the connection to be evaluated is obtained; based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the historical connections in the neighborhood, a neighborhood distribution location evaluation value for the connection to be evaluated is obtained; based on the variance of the embedding vectors corresponding to all historical connections in the neighborhood, a behavioral evaluation value for the connection to be evaluated is obtained; and based on the neighborhood structure similarity evaluation value, the neighborhood distribution location evaluation value, and the behavioral evaluation value, an evaluation factor for the connection to be evaluated is obtained.

[0008] The target anomaly evaluation value of the connection to be evaluated is obtained based on the evaluation factor of the connection to be evaluated and the initial anomaly evaluation value of the connection to be evaluated. Anomaly connection evaluation is then performed on the connection to be evaluated based on the target anomaly evaluation value.

[0009] Beneficial effects: This invention first obtains the log sequence and embedding vector corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the historical connections in the neighborhood of the connection to be evaluated. Then, based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the historical connections in the neighborhood, and the log sequence to be evaluated and the historical log sequence, a neighborhood structure similarity evaluation value for the connection to be evaluated is obtained. Based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the historical connections in the neighborhood, a neighborhood distribution location evaluation value for the connection to be evaluated is obtained. Based on the variance of the embedding vectors corresponding to all historical connections in the neighborhood, a behavioral evaluation value for the connection to be evaluated is obtained. Based on the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavioral evaluation value, an evaluation factor for the connection to be evaluated is obtained. Then, based on the evaluation factor and the initial abnormal evaluation value of the connection to be evaluated, a target abnormal evaluation value for the connection to be evaluated is obtained. Finally, an abnormal connection evaluation is performed on the connection to be evaluated based on the target abnormal evaluation value. Moreover, the target abnormal evaluation value obtained by combining the evaluation factor and the initial abnormal evaluation value of the connection to be evaluated can improve the accuracy of abnormal connection identification for the connection to be evaluated. Attached Figure Description

[0010] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of an abnormal connection evaluation method for terminal access authentication according to the present invention. Detailed Implementation

[0012] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the protection scope of the embodiments of the present invention.

[0013] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art.

[0014] This embodiment provides a method for evaluating abnormal connections for terminal access authentication, which is described in detail below:

[0015] like Figure 1 As shown, the abnormal connection evaluation method for terminal access authentication includes the following steps:

[0016] Step S001: Obtain the log sequence and embedding vector corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the neighboring historical connections of the connection to be evaluated.

[0017] This embodiment improves the reliability of abnormal connection assessment by optimizing the abnormal assessment values ​​obtained using existing algorithms. In addition, for ease of understanding and analysis, this embodiment will use the abnormal connection assessment process of the public security system as an example for subsequent descriptions. That is, the connection or access described in this embodiment refers to the connection between the terminal and the public security system, and the public security system is referred to as the target system in this embodiment.

[0018] Since this embodiment is a real-time evaluation, it first needs to obtain the terminals that are currently connected to the target system or are currently attempting to access the target system, and record them as terminals to be evaluated. Then, the process from the start of attempting to access the target system to the current moment for any terminal to be evaluated is recorded as the connection to be evaluated corresponding to that terminal. Subsequently, abnormal connections will be identified for the connection to be evaluated. Since the process of identifying abnormal connections for all terminals to be evaluated is the same, this embodiment will describe the abnormal connection identification process for any terminal to be evaluated as an example. That is, all subsequent connections to be evaluated are the same connection to be evaluated.

[0019] After obtaining the connection to be evaluated and the corresponding log sequence to be evaluated, all connection processes with the target system before the current time are obtained and recorded as historical connections before the connection to be evaluated, or as historical connections before the connection time of the connection to be evaluated. The set of all historical connections before the connection time of the connection to be evaluated is called the historical set, and the set of all historical connections before the connection time of the connection to be evaluated and the connection to be evaluated is called the comprehensive set. For example, if there is a terminal Q, and the entire process of terminal Q from the start of attempting to access the target system to the end of access is before the current time, then the entire process of terminal Q from the start of attempting to access the target system to the end of access is a historical connection before the connection to be evaluated, and the terminal corresponding to this historical connection is terminal Q. That is, a historical connection refers to the process of the terminal corresponding to the historical connection from the start of attempting to access the target system to the end of access.

[0020] Furthermore, in terminal access authentication scenarios, the target system generates a large number of structured or semi-structured operation logs during multiple stages such as terminal access, authentication, operation, and logout. Therefore, this embodiment can obtain all logs generated in each connection process. That is, this embodiment can obtain all logs generated in the connection process to be evaluated and all logs generated in historical connection processes. Then, all logs generated in the connection process to be evaluated are arranged in chronological order of generation time, and the arranged sequence is recorded as the log sequence to be evaluated corresponding to the connection to be evaluated. Similarly, all logs generated in any historical connection process are arranged in chronological order of generation time, and the arranged sequence is recorded as the historical log sequence corresponding to that historical connection. The log sequence to be evaluated for a connection to be evaluated refers to the sequence of all logs related to the terminal corresponding to the connection to be evaluated generated within the connection time period corresponding to the connection to be evaluated, arranged in chronological order of their generation time. The connection time period corresponding to the connection to be evaluated refers to the time period from when the terminal corresponding to the connection to be evaluated starts attempting to access the target system to the current time. The log sequence to be evaluated for any historical connection refers to the sequence of all logs related to the terminal corresponding to that historical connection generated within the connection time period corresponding to that historical connection, arranged in chronological order of their generation time. The connection time period corresponding to the historical connection refers to the time period from when the terminal corresponding to the corresponding historical connection starts attempting to access the target system to when the access ends. In addition, each log in the log sequence corresponding to any connection in this embodiment captures information such as the timestamp of the connection, user identity, source IP, connection protocol, and event type of the terminal corresponding to the corresponding connection. Therefore, each log in the log sequence to be evaluated is a log related to the terminal corresponding to the connection to be evaluated, and each log in the historical log sequence corresponding to any historical connection is a log related to the terminal corresponding to the corresponding historical connection.

[0021] Furthermore, the information recorded in each log entry in this embodiment includes, but is not limited to, the terminal connection timestamp, user identity, source IP, connection protocol, and event type. However, it is required that the information types recorded in each log entry in this embodiment are consistent. For example, if the information recorded in a certain log entry is the timestamp of a terminal connection, user identity, source IP, connection protocol, and event type, then each log entry in this embodiment consists of the timestamp of the terminal connection, user identity, source IP, connection protocol, and event type. Moreover, the information recorded in the log is the core data source for evaluating whether the access behavior is legal and reasonable. In addition, due to the complexity of the log content, the target system generally uses methods such as formatting, noise cleaning and field extraction, and log template matching to reduce the log text to structured template events, and generally uses the Drain algorithm and LogSig algorithm for log template matching. It should be noted that the system generally collects the raw operation log data related to terminal authentication through access authentication gateways, log collection agents, or terminal-side sensor modules.

[0022] After obtaining the connection to be evaluated, all historical connections preceding the connection time of the connection to be evaluated, the log sequence corresponding to the connection to be evaluated, and the historical log sequences corresponding to the historical connections, the next step is to obtain the neighboring historical connections of the connection to be evaluated. The purpose of obtaining the neighboring historical connections of the connection to be evaluated is to combine the evaluation results of the connection to be evaluated with the information of the scenario or context, thereby improving the accuracy of abnormal connection evaluation for the connection to be evaluated. The specific process of obtaining the neighboring historical connections of the connection to be evaluated is as follows: First, the start time of the connection time period corresponding to the connection to be evaluated is recorded as t1. All historical connections within the time interval [t1-T, t1] of the connection time period are recorded as the neighboring historical connections corresponding to the connection to be evaluated, where T is the preset time length. In specific applications, the implementer needs to set the preset time length according to the actual situation, experimental statistics, etc. For example, in this embodiment, the preset time length can be set to one month or half a month.

[0023] After obtaining all the neighboring historical connections of the connection to be evaluated, the embedding vectors corresponding to each historical connection in the comprehensive set and the embedding vectors corresponding to the connection to be evaluated are obtained. The reason for obtaining the embedding vectors is to facilitate the subsequent calculation of evaluation factors, initial anomaly evaluation values, etc. The process of obtaining the embedding vectors is as follows: the Transformer Encoder encodes all logs in the log sequence to be evaluated corresponding to the connection to be evaluated, and the encoding result is recorded as the embedding vector corresponding to the connection to be evaluated. The Transformer Encoder encodes all logs in the historical log sequence corresponding to any historical connection, and the encoding result is recorded as the embedding vector corresponding to that historical connection. The Transformer Encoder is one of the core components of the Transformer model, which is mainly responsible for transforming the input sequence (such as text, images, etc.) into a feature table containing neighborhood information. The Transformer model is a deep learning architecture based on a self-attention mechanism. The output of the Transformer model is a vector. Since the process of the Transformer model transforming the input sequence into a vector is well known, it will not be described in this embodiment.

[0024] Therefore, this embodiment can obtain the log sequence and embedding vector corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the neighboring historical connections of the connection to be evaluated, through the above process. It should be noted that, for the public security system, the user terminal (such as the law enforcement tablet or police APP used by the police) establishes a connection with the U-shield device through the Bluetooth protocol to complete the remote triggering of key functions such as certificate loading, key invocation, and identity verification. Throughout the process, the system will record the Bluetooth connection and disconnection behavior in real time and upload the operation log to the background platform for management. The connection or disconnection can be manually triggered by the user or passively triggered by the user leaving the effective Bluetooth communication range. Furthermore, the system realizes the traceability management of the entire life cycle of device access through the correlation between Bluetooth events and certificate behavior, thereby providing key technical support for the operational compliance, security audit, and accountability traceability of the public security system.

[0025] Step S002: Based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the historical connections in the neighborhood, the log sequence to be evaluated, and the historical log sequence, obtain the neighborhood structure similarity evaluation value of the connection to be evaluated; based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the historical connections in the neighborhood, obtain the neighborhood distribution location evaluation value of the connection to be evaluated; based on the variance of the embedding vectors corresponding to all historical connections in the neighborhood, obtain the behavior evaluation value of the connection to be evaluated; based on the neighborhood structure similarity evaluation value, the neighborhood distribution location evaluation value, and the behavior evaluation value, obtain the evaluation factor of the connection to be evaluated.

[0026] In public security systems or other high-security terminal access authentication scenarios, devices establish connections with digital certificate U-shields via Bluetooth, perform identity authentication, and complete command operations. This process continuously generates multiple operation logs. To assess the security of these terminal operations, current methods commonly employ log behavior modeling and clustering to identify abnormal connections or potentially risky access behaviors. However, current methods typically use the CBLOF algorithm to obtain the abnormal connection score of the embedding vector corresponding to the connection being evaluated, thus identifying abnormal connections or potentially risky access behaviors. However, existing abnormal connection assessment strategies lack contextual relevance, leading to low reliability of the assessment results. For example, public security systems may encounter complex connection scenarios such as mobile work or frequent switching between multiple devices. The connection authentication process in these complex scenarios may differ from the standard connection authentication process, perhaps lacking unnecessary steps. This difference from the standard authentication process may cause connection behaviors in complex scenarios to be identified as outliers or abnormal connections. In other words, this difference from the standard authentication process can lead to different interpretations of connection behaviors in complex scenarios. The embedding vector is far from the cluster center, which may lead to identification or scoring errors. To improve the reliability and accuracy of abnormal connection evaluation, this embodiment will combine the log sequence and embedding vector of the connection to be evaluated, as well as the historical log sequence and embedding vector of the historical connections in the neighborhood of the connection to be evaluated, to obtain evaluation factors. These evaluation factors reflect the possibility that the connection to be evaluated is an abnormal connection or abnormal access in the current scenario. Then, the obtained evaluation factors and the abnormal score value of the embedding vector of the connection to be evaluated obtained by the CBLOF algorithm are combined to obtain the final abnormal connection score. Based on the final abnormal connection score, the abnormal connection is accurately identified. Therefore, based on the above analysis, this embodiment needs to obtain the evaluation factors of the connection to be evaluated first. In order to ensure the reliability of the evaluation factors, this embodiment will determine the evaluation factors based on a multi-evaluation method. That is, the evaluation factors of the connection to be evaluated in this embodiment are determined by three evaluation values: neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value. Therefore, this embodiment needs to obtain the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value first.

[0027] In this embodiment, firstly, based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the historical connections in the neighborhood, the log sequence to be evaluated, and the historical log sequence corresponding to the historical connections in the neighborhood of the connection to be evaluated, a neighborhood structure similarity evaluation value for the connection to be evaluated is obtained. This neighborhood structure similarity evaluation value reflects the probability that the connection to be evaluated is an anomalous connection. The specific process for obtaining the neighborhood structure similarity evaluation value for the connection to be evaluated is as follows:

[0028] First, based on the log event types in the log sequence to be evaluated, the event transition probability matrix corresponding to the connection to be evaluated is obtained. Then, based on the log event types in the historical log sequences corresponding to the neighboring historical connections, the event transition probability matrix corresponding to the neighboring historical connections is obtained. This event transition probability matrix is ​​mainly used to obtain the neighborhood structure similarity evaluation value, which is an important parameter for determining the evaluation factor. In this embodiment, the method for obtaining the event transition probability matrix corresponding to all connections is the same. For ease of understanding, the following description will take the specific process of obtaining the event transition probability matrix corresponding to any neighboring historical connection P of the connection to be evaluated as an example. The specific process of obtaining the event transition probability matrix corresponding to the neighboring historical connection P is as follows:

[0029] First, obtain the combination sequences corresponding to each connection in the synthesis set. Each combination in the combination sequence corresponding to any connection in the synthesis set consists of the event types of two adjacent historical logs in the log sequence corresponding to that connection. For example, the first event type in the b-th combination in the combination sequence corresponding to any historical connection is the event type of the b-th log in the historical log sequence corresponding to that historical connection; the second event type in the b-th combination is the event type of the (b+1)-th log in the historical log sequence corresponding to that historical connection; the first event type in the (b+1)-th combination is the event type of the (b+1)-th log in the historical log sequence corresponding to that historical connection; and the second event type in the (b+1)-th combination is the event type of the (b+2)-th log in the historical log sequence corresponding to that historical connection. The combination sequence corresponding to the connection to be evaluated and the neighboring historical connection pairs of the connection to be evaluated are also considered. The process of obtaining the corresponding combination sequence is the same as that of obtaining the combination sequence corresponding to the current historical connection, so it will not be described in detail again. Then, all combination types appearing in the combination sequences corresponding to all connections in the comprehensive set are counted, and the set constructed by all combination types appearing in the combination sequences corresponding to all connections in the comprehensive set is denoted as the combination type set. That is, if all combinations in the combination sequences corresponding to all connections in the comprehensive set are combination B1, combination B2, and combination B3, where the first event type of combination B1 is device start connection and the second event type is connection success, the first event type of combination B2 is digital certificate verification and the second event type is verification success, and the first event type of combination B3 is device start connection and the second event type is connection success, then combination B1 and combination B3 belong to the same combination type, and combination B2 does not belong to the same combination type as combination B1 and combination B3. The combination types obtained at this time are (device start connection, connection success) and (digital certificate verification, verification success), respectively.After obtaining the set of combination types, the normalized value of the frequency of each combination type in the set of combination types is obtained in the combination sequence corresponding to the neighborhood historical connection P, and recorded as the transition probability of the corresponding combination type under the neighborhood historical connection P. The matrix formed by the transition probabilities of each combination type in the set of combination types under the neighborhood historical connection P is recorded as the event transition probability matrix corresponding to the neighborhood historical connection P. The process of obtaining the normalized value of the frequency of each combination type in the set of combination types in the combination sequence corresponding to the neighborhood historical connection P is as follows: In the combination sequence corresponding to the neighborhood historical connection P, the number of combinations in which the first event type in the combination is the same as the first event type in the qth combination type is obtained, and recorded as the normalized parameter of the qth combination type under the neighborhood historical connection P. The ratio of the frequency of the qth combination type in the set of combination types under the neighborhood historical connection P to the normalized parameter of the qth combination type under the neighborhood historical connection P is recorded as the neighborhood historical connection P. The normalized value of the frequency of the q-th combination type in the set of combination types under historical connection P is the transition probability of the q-th combination type in the set of combination types under the neighborhood historical connection P. It refers to the probability density of the first event type in the q-th combination type under the neighborhood historical connection P transitioning to the second event type in the q-th combination type. In addition, if the q-th combination type is (F1, F2), where F1 is the first event type in the q-th combination type and F2 is the second event type in the q-th combination type, then if there are N combinations in the combination sequence corresponding to the neighborhood historical connection P where the first event type is F1, then the normalized parameter of the q-th combination type under the neighborhood historical connection P is N. Furthermore, if the frequency of a certain combination type in the combination sequence corresponding to the neighborhood historical connection P is 0, then the transition probability of that combination type under the neighborhood historical connection P can be directly recorded as 0, and there is no need to calculate the normalized parameter of that combination type under the neighborhood historical connection P.

[0030] Additionally, it should be noted that in this embodiment, the elements at the same position in the event transition probability matrix corresponding to any connection are the transition probabilities of the same combination type under the corresponding connection. That is, if the element in the x-th row and y-th column of the event transition probability matrix corresponding to the i-th historical connection is the transition probability of the q-th combination type in the combination type set under the i-th historical connection, then the element in the x-th row and y-th column of the event transition probability matrix corresponding to all connections is the transition probability of the q-th combination type under the corresponding connection.

[0031] After obtaining the event transition probability matrix, the position marker value of each log in the log sequence is obtained, and the position marker value of the j-th log in any log sequence is j. The position marker value is used to obtain the position deviation characterization value, which is an important parameter for determining the neighborhood structure similarity evaluation value. For example, the position marker value of the j-th log in the log sequence to be evaluated is j, and the position marker value of the j-th log in any historical log sequence is also j.

[0032] After obtaining the position marker values ​​of each log in the log sequence, the neighborhood structure similarity evaluation value of the connection to be evaluated is obtained based on the event transition probability matrix corresponding to the connection to be evaluated, the event transition probability matrix corresponding to the neighboring historical connections, the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighboring historical connections, the position marker values ​​of the logs in the log sequence to be evaluated, and the position marker values ​​of the logs in the historical log sequence. The specific process of obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated based on the event transition probability matrix corresponding to the connection to be evaluated, the event transition probability matrix corresponding to the neighboring historical connections, the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighboring historical connections, the position marker values ​​of the logs in the log sequence to be evaluated, and the position marker values ​​of the logs in the historical log sequence is as follows:

[0033] First, the set of all historical neighborhood connections of the connection to be evaluated is denoted as the neighborhood historical connection set, and the set of embedding vectors corresponding to all historical neighborhood connections in the neighborhood historical connection set is denoted as the neighborhood embedding vector set. Then, the average matrix of the event transition probability matrices corresponding to all historical neighborhood connections in the neighborhood historical connection set is obtained and denoted as the neighborhood transition probability matrix corresponding to the connection to be evaluated. The process of obtaining the average matrix of multiple matrices with the same dimension is a well-known technique. Next, the JS divergence between the neighborhood transition probability matrix and the event transition probability matrix corresponding to the connection to be evaluated is obtained and denoted as the first structural index value. The process of obtaining the JS divergence between any two transition probability matrices is a well-known technique. JS divergence is a measure of the similarity between two probability distributions; the smaller the JS divergence between the two probability matrices, the more similar the probability distributions of the two probability matrices are; conversely, the larger the JS divergence between the two probability matrices, the less similar the probability distributions of the two probability matrices are. Next, obtain the vector similarity set corresponding to the connection to be evaluated. The similarity of the m-th vector in the vector similarity set is the cosine similarity between the embedding vector corresponding to the connection to be evaluated and the m-th embedding vector in the neighborhood embedding vector set. That is, the number of data in the vector similarity set is the same as the number of embedding vectors in the neighborhood embedding vector set. The result of subtracting the mean normalization value of the vector similarity set from the preset first constant is recorded as the second structural index value. The larger the cosine similarity value, the more similar the two vectors are. Conversely, the smaller the cosine similarity value, the less similar the two vectors are. Next, the position deviation characterization value of each log in the log sequence corresponding to the connection to be evaluated is obtained. The mean of the position deviation characterization values ​​of all logs in the log sequence corresponding to the connection to be evaluated is recorded as the third structural index value. The smaller the position deviation characterization value, the smaller the difference between the access process of the terminal corresponding to the connection to be evaluated and the terminal access process of the historical connection in its neighborhood. The larger the position deviation characterization value, the greater the difference between the access process of the terminal corresponding to the connection to be evaluated and the terminal access process of the historical connection in its neighborhood. Finally, the obtained first structural index value, second structural index value and third structural index value are negatively correlated and mapped. The negative correlation mapping result is used as the neighborhood structural similarity evaluation value of the connection to be evaluated. The larger the neighborhood structural similarity evaluation value, the more similar the terminal access process of the connection to be evaluated is to the terminal access process of the historical connection in its neighborhood in terms of structure. This also indicates that the connection to be evaluated is more likely to be a legitimate or normal connection.

[0034] In this embodiment, the specific process for obtaining the position deviation characterization value is as follows: For the c-th log in the log sequence to be evaluated: First, in the historical log sequences corresponding to all neighborhood historical connections in the neighborhood historical connection set, obtain all historical logs belonging to the same event type as the c-th log, and denote the set of all historical logs belonging to the same event type as the c-th log as the historical log set of the c-th log. The average position tag value of each historical log in the historical log set of the c-th log is denoteed as the neighborhood tag value of the c-th log. The result of subtracting the neighborhood tag value of the c-th log from its position tag value is denoteed as... Let the characteristic position difference value of the c-th log be denoted as . Then, obtain the characteristic position difference values ​​of each historical log in the historical log set of the c-th log, and record the average of the characteristic position difference values ​​of all historical logs in the historical log set of the c-th log as the historical difference average value of the c-th log. The squared difference between the characteristic position difference value of the c-th log and the historical difference average value of the c-th log is recorded as the position deviation characterization value of the c-th log. The method for obtaining the characteristic position difference values ​​of each historical log in the historical log set of the c-th log is the same as the method for obtaining the characteristic position difference value of the c-th log, so it will not be described in detail.

[0035] Furthermore, the specific expression for obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated is as follows:

[0036]

[0037] in, T1 represents the neighborhood structural similarity evaluation value of the connection to be evaluated, T0 is the event transition probability matrix corresponding to the connection to be evaluated, and T1 is the neighborhood transition probability matrix corresponding to the connection to be evaluated. denoted as JS divergence between the neighborhood transition probability matrix and the event transition probability matrix of the connection to be evaluated, which is also the first structural index value; M is the number of embedding vectors in the neighborhood embedding vector set; and R0 is the embedding vector corresponding to the connection to be evaluated. Let m be the m-th embedding vector in the set of neighborhood embedding vectors. Let cosine similarity be the cosine similarity between the embedding vector corresponding to the connection to be evaluated and the m-th embedding vector in the set of neighboring embedding vectors. Here, C represents the second structural metric value, Norm() is the normalization function, and C is the number of logs in the log sequence to be evaluated. Let c be the position deviation value of the c-th log in the log sequence to be evaluated. The third structural index value is exp(), which is an exponential function with a base of constant e, and c1 is a preset first constant. The value of the preset first constant must be consistent with the maximum value of the normalization function when normalizing the mean of the vector similarity set. Since the normalization interval of the normalization function Norm() in this embodiment is from 0 to 1, the value of the preset first constant is 1.

[0038] In addition, when The smaller the value, the more consistent the event transitions are between the log sequence of the connection to be evaluated and the historical log sequences of neighboring historical connections, or the more similar the probability distributions are between the event transition probability matrix of the connection to be evaluated and the transition probability matrix of its neighboring connections. This indicates that the terminal access process of the connection to be evaluated is structurally more similar to the terminal access process of its neighboring historical connections, thus indicating a lower probability that the connection to be evaluated is an abnormal or illegal connection and a higher probability that it is a normal or legal connection. When A larger value indicates greater similarity between the embedding vector corresponding to the connection to be evaluated and the various embedding vectors in the neighborhood embedding vector set, or greater semantic similarity between the connection to be evaluated and its neighboring historical connections. This suggests that the terminal access process of the connection to be evaluated is structurally more similar to the terminal access process of its neighboring historical connections, thus indicating a lower probability of the connection to be evaluated being an abnormal or illegal connection, and a higher probability of it being a normal or legal connection. When... The smaller the value, the more similar the position of the same event type in the log sequence corresponding to the connection to be evaluated is to the position in the historical log sequence corresponding to the neighboring historical connections of the connection to be evaluated. This indicates that the difference between the terminal access process of the connection to be evaluated and the terminal access process of its neighboring historical connections is smaller, which also indicates that the connection to be evaluated is less likely to be an abnormal or illegal connection and more likely to be a normal or legal connection. Based on the above description, when The smaller The larger, The smaller the value, the smaller the difference between the terminal access process of the connection to be evaluated and the terminal access processes of historical connections in its neighborhood. In other words, the more similar the terminal access process of the connection to be evaluated and the historical connections in its neighborhood are in terms of structural topology, semantic features, and positional offset, the greater the likelihood that the connection to be evaluated is a legitimate or normal connection behavior. Furthermore, because when... The smaller The larger, The smaller, The larger, therefore when The larger the value, the greater the likelihood that the connection being evaluated is a legitimate or normal connection behavior. The smaller the value, the greater the difference between the terminal access process of the connection to be evaluated and the terminal access process of historical connections in the neighborhood, and the greater the likelihood that the connection to be evaluated is an illegal or abnormal connection. Furthermore, this embodiment uses the neighborhood structure similarity evaluation value as an important parameter for determining subsequent evaluation factors, which can improve the accuracy of subsequent abnormal connection identification.

[0039] Therefore, based on the above analysis, the reason for obtaining the evaluation value of the neighborhood structure similarity of the connection to be evaluated is that the connection process differs in different scenarios, which will cause the overall structure of the connection to change. This change will cause the occurrence of misjudgment of abnormal connections. For example, the connection during the day shift usually includes the complete connection, authentication and data signing process, but during the night shift, due to factors such as system load, the connection during the night shift may only include the connection and authentication process, skipping some unnecessary connection operations. This phenomenon of skipping some unnecessary connection operations will change the overall structure of the log sequence. Although the above operations themselves are legal and normal, their structure no longer matches the original standard execution of the connection and authentication process, which will lead to the phenomenon of misjudgment of abnormal connections. However, by combining the connection process of its neighboring connections, the occurrence of misjudgment of abnormal connections can be reduced.

[0040] After completing the neighborhood structure similarity assessment, to improve the accuracy of subsequent abnormal connection assessment, the probability density of the embedding vector in the neighborhood embedding vector is introduced. This allows the probability density to be considered when determining subsequent assessment factors, thereby improving the accuracy of abnormal connection assessment. Specifically, by calculating the probability density, the likelihood of a connection being a common or rare connection can be assessed, further improving the reliability of the subsequent clustering model and the accuracy of subsequent abnormal connection identification. Therefore, in this embodiment, after obtaining the neighborhood structure similarity assessment value of the connection to be assessed, the kernel density estimation method is used to obtain the probability density of the embedding vector corresponding to the connection to be assessed in the neighborhood embedding vector set. The normalized value of the probability density of the embedding vector corresponding to the connection to be assessed in the neighborhood embedding vector set is denoted as the neighborhood distribution position assessment value of the connection to be assessed. A higher probability density of the embedding vector corresponding to the connection to be assessed in the neighborhood embedding vector set indicates a higher frequency of occurrence of the embedding vector in the neighborhood embedding vector set, thus increasing the probability that the connection to be assessed is a common connection. Conversely, a lower probability density of the embedding vector corresponding to the connection to be assessed indicates a lower probability of occurrence of the embedding vector in the neighborhood embedding vector set. The less frequently a vector appears in the neighborhood embedding vector set, the higher the probability that the connection to be evaluated is a rare connection behavior. Abnormal connection behaviors typically occur less frequently than common connection behaviors. Therefore, the smaller the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set (i.e., the smaller the neighborhood distribution position evaluation value of the connection to be evaluated), the greater the likelihood that the connection to be evaluated is an illegal or abnormal connection behavior. Conversely, the larger the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set (i.e., the larger the neighborhood distribution position evaluation value of the connection to be evaluated), the greater the likelihood that the connection to be evaluated is a legal or normal connection behavior. Furthermore, the normalized value of the probability density of the embedding vector corresponding to the connection to be evaluated in the neighborhood embedding vector set is the ratio of the probability density of the embedding vector corresponding to the connection to be evaluated to the maximum probability density of the neighborhood embedding vector corresponding to the connection to be evaluated. The maximum probability density of the neighborhood embedding vector corresponding to the connection to be evaluated is the maximum value among the probability densities of each embedding vector in the neighborhood embedding vector set obtained using the kernel density estimation method. Since the process of calculating the probability density using the kernel density estimation method is a well-known technique, it will not be described in detail here.

[0041] In this embodiment, the probability density, i.e. the distribution location evaluation value, is used as an important parameter to adjust the distance of the original clustering metric. This can improve the vigilance for rare connection behaviors and thus improve the sensitivity and accuracy of subsequent abnormal connection identification. If the probability density is not considered, the anomaly score obtained solely based on the CBLOF algorithm may identify common connection behaviors as abnormal connection behaviors and abnormal connection behaviors as normal connection behaviors.

[0042] Furthermore, in practical applications, if a terminal or user's connection scenario and process are fixed or stable (such as access control controllers or duty computers), then a significant change in connection is more likely to indicate abnormal connection behavior. Conversely, if a terminal or user's connection scenario and process are frequent (such as patrol and law enforcement terminals or remote access nodes), then a significant change in connection is more likely to indicate normal connection behavior. Based on this, this embodiment will next analyze the changes in the historical connections of the access terminal to be evaluated and the differences between the historical connections of the two access terminals to be evaluated to obtain the behavioral evaluation value of the connection to be evaluated. Obtaining the behavioral evaluation value of the connection to be evaluated can further improve the sensitivity and accuracy of abnormal connection identification by understanding the connection behavior habits of the terminal or user. The specific process for obtaining the behavioral evaluation value of the connection to be evaluated is as follows:

[0043] First, identify the access terminal of the connection to be evaluated, or the terminal corresponding to the connection to be evaluated, and denote it as the target terminal. Then, in all historical connections prior to the connection time of the connection to be evaluated, i.e., in the historical set, obtain all historical connections where the access terminal and the target terminal are the same, and denote them as historical connections to be analyzed. For example, if there is a terminal Q, and the connection to be evaluated refers to the access process between terminal Q and the target system, and there is also a historical connection that also refers to the access process between terminal Q and the target system, then the access terminal of this historical connection is the same as the target terminal, and this historical connection is the historical connection to be analyzed. Next, the negative correlation mapping value of the variance of the embedding vectors corresponding to all historical connections to be analyzed is obtained and denoted as the change characterization value, which is exp(-σ), where σ is the variance of the embedding vectors corresponding to all historical connections to be analyzed. The smaller the variance of the embedding vectors corresponding to all historical connections to be analyzed, the more stable the connection behavior of the target terminal is. Conversely, the larger the variance of the embedding vectors corresponding to all historical connections to be analyzed, the more unstable the connection behavior of the target terminal is. The variances of multiple embedding vectors are calculated using the Euclidean distance variance method. The process of obtaining multiple vectors using the Euclidean distance variance method is as follows: first, calculate the average vector of multiple embedding vectors, and then obtain the variance between each embedding vector and the average vector. The square of the Euclidean distance is used as the mean of the squared Euclidean distances between all embedding vectors and the average vector, which is then used as the variance of the multiple embedding vectors. Next, the Euclidean distance between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to each historical connection to be analyzed is obtained and recorded as the difference value between the connection to be evaluated and its corresponding historical connection to be analyzed. The set of difference values ​​between the connection to be evaluated and each historical connection to be analyzed is then recorded as the difference value set, and the mean of the difference value set is recorded as the difference representation value. Finally, the change representation value and the difference representation value are multiplied and then negatively correlated, and the result is recorded as the behavioral evaluation value of the connection to be evaluated. The specific calculation expression for the behavioral evaluation value of the connection to be evaluated is as follows:

[0044]

[0045] in, H represents the behavioral evaluation value of the connection to be evaluated, and V represents the value of change and the value of difference. A larger value indicates a significant change in the connection behavior or habits of the connection being evaluated, assuming the target terminal's connection behavior is relatively stable. This suggests a higher likelihood that the connection being evaluated is an illegal or abnormal connection. Conversely, when... When it is larger, The smaller, so when The smaller the value, the greater the likelihood that the connection being evaluated is an illegal or abnormal connection; conversely, when... A larger value indicates a greater likelihood that the connection to be evaluated is a legitimate or normal connection behavior. Additionally, there may be cases where no historical connections exist to be analyzed. When no historical connections exist, the behavior evaluation value cannot be calculated. Therefore, in this embodiment, when no historical connections exist, the behavior evaluation value of the connection to be evaluated is not calculated, and it is also required that the behavior evaluation value of the connection to be evaluated is not included in subsequent acquisition of evaluation factors.

[0046] Therefore, this embodiment obtains the behavior evaluation value of the connection to be evaluated through the above process. The addition of the behavior evaluation value can take into account the connection behavior habits of the user or terminal when identifying abnormal connections, thereby further improving the sensitivity and accuracy of subsequent abnormal connection identification.

[0047] After obtaining the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value, a fusion analysis is performed on these values. Based on the fusion analysis results, evaluation factors are obtained. Subsequently, the final abnormal evaluation value, i.e., the target abnormal evaluation value, is determined by combining the obtained evaluation factors with the initial abnormal evaluation value of the connection to be evaluated. The specific process for obtaining the evaluation factor of the connection to be evaluated based on the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value is as follows: The neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value of the connection to be evaluated are weighted and summed. The inverse mapping value of the weighted sum is used as the evaluation factor of the connection to be evaluated. A larger evaluation factor indicates a higher probability that the connection is illegal or exhibits abnormal behavior, while a smaller evaluation factor indicates a lower probability. The formula for obtaining the inverse mapping value of the weighted sum of the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value of the connection to be evaluated is as follows: The formula for weighted summation of the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value of the connection to be evaluated is as follows: Where Z is the weighted sum of the neighborhood structure similarity evaluation value, neighborhood distribution location evaluation value, and behavior evaluation value of the connection to be evaluated, and c2 is a preset second constant. As the first weight value, As the second weight value, As the third weight value, The neighborhood structure similarity evaluation value of the connection to be evaluated. The evaluation value is the neighborhood distribution location of the connection to be evaluated. The evaluation value is the behavioral value of the connection to be evaluated; and c2 is to prevent the denominator from being 0, so as not to affect the evaluation result. In this embodiment, the value of the preset second constant is required to be small and greater than 0 but not greater than 1. For example, in this embodiment, the value of the preset second constant can be set to 0.1. In this embodiment, the implementer needs to set the weight value according to the actual situation or the importance of the recognition result. For example, the evaluation value of the similarity of the neighborhood structure of the connection to be evaluated is more important. Therefore, this embodiment requires the first weight value to be larger. Therefore, this embodiment can... Set to 0.4, Set to 0.3, Set it to 0.3.

[0048] Therefore, this embodiment obtains the evaluation factor of the connection to be evaluated through the above process.

[0049] Step S003: Obtain the target abnormality evaluation value of the connection to be evaluated based on the evaluation factor of the connection to be evaluated and the initial abnormality evaluation value of the connection to be evaluated, and perform abnormal connection evaluation on the connection to be evaluated based on the target abnormality evaluation value.

[0050] After obtaining the evaluation factors of the connection to be evaluated, the target anomaly evaluation value of the connection to be evaluated is obtained based on the evaluation factors and the initial anomaly evaluation value of the connection to be evaluated. The specific process for obtaining the target anomaly evaluation value of the connection to be evaluated is as follows:

[0051] The CBLOF algorithm is used to obtain the anomaly scores of the embedding vectors corresponding to the links to be evaluated, and these scores are recorded as the initial anomaly evaluation values ​​of the links to be evaluated. Then, the evaluation factor of the link to be evaluated is multiplied by the initial anomaly evaluation value, and the result is normalized using the normalization function Norm(). This normalized result is used as the target anomaly evaluation value for the link to be evaluated. The larger the target anomaly evaluation value, the greater the likelihood that the link to be evaluated is an illegal or anomalous connection. The process of obtaining the anomaly scores of the embedding vectors corresponding to the links to be evaluated using the CBLOF algorithm is as follows: the set of embedding vectors corresponding to all links in the composite set is denoted as the set to be clustered. First, the K-means clustering algorithm is used to cluster all embedding vectors in the set to be clustered, and the resulting clusters are denoted as the target clusters. Then, the target clusters and the embedding vectors corresponding to the links to be evaluated are obtained. After identifying the target cluster, determine whether each target cluster belongs to a large cluster or a small cluster. If the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs is a large cluster, the Euclidean distance between the embedding vector to be evaluated and the cluster center of the target cluster to which the embedding vector belongs is multiplied by the total number of embedding vectors in the target cluster to which the embedding vector belongs, and the result is recorded as the anomaly score of the embedding vector to which the connection to be evaluated belongs. If the target cluster to which the embedding vector corresponding to the connection to be evaluated belongs is a small cluster, obtain the large cluster whose cluster center is closest to the embedding vector to which the connection to be evaluated belongs, and record it as the nearest neighbor cluster of the embedding vector to which the connection to be evaluated belongs. The Euclidean distance between the embedding vector to be evaluated and the cluster center of the nearest neighbor cluster to which the embedding vector belongs is multiplied by the total number of embedding vectors in the target cluster to which the embedding vector belongs, and the result is recorded as the anomaly score of the embedding vector to which the connection to be evaluated belongs. The higher the anomaly score, the greater the possibility that the connection to be evaluated is an abnormal connection or an illegal connection. Furthermore, the process of determining whether a target cluster belongs to a large cluster or a small cluster is as follows: Sort all target clusters in descending order of the number of embedded vectors within the cluster to obtain a target cluster sequence. If the ratio of the sum of the number of embedded vectors in the first n-1 target clusters in the target cluster sequence to the total number of embedded vectors in the set to be clustered is not greater than a preset percentage threshold, while the ratio of the sum of the number of embedded vectors in the first n target clusters in the target cluster sequence to the total number of embedded vectors in the set to be clustered is greater than the preset percentage threshold, then the first n target clusters in the target cluster sequence are all recorded as large clusters, and the remaining target clusters are all recorded as small clusters. The preset percentage threshold is an empirical value, generally set to 90%.

[0052] After obtaining the target anomaly evaluation value of the connection to be evaluated, the connection to be evaluated is evaluated for anomalies based on the target anomaly evaluation value. Specifically, it is determined whether the target anomaly evaluation value of the connection to be evaluated is greater than a preset anomaly judgment threshold. If so, it indicates that the connection to be evaluated is an anomaly or illegal connection behavior, and the terminal access authentication of the connection to be evaluated is marked as an anomaly connection authentication. Otherwise, it indicates that the connection to be evaluated is a normal or legal connection behavior, and the terminal access authentication of the connection to be evaluated is marked as a normal connection authentication. In specific applications, the implementer needs to set the preset anomaly judgment threshold according to the value range of the target anomaly evaluation value, the meaning represented by the size of the anomaly evaluation value, and experimental statistics. For example, in this embodiment, the preset anomaly judgment threshold can be set to 0.6.

[0053] Thus, this embodiment completes the identification or evaluation of abnormal connections for the connection to be evaluated, and the identification or evaluation results obtained by this embodiment in combination with the scenario of the connection to be evaluated are highly accurate.

[0054] In summary, this embodiment first obtains the log sequence and embedding vector corresponding to the connection to be evaluated, as well as the historical log sequence and embedding vector corresponding to the historical connections in the neighborhood of the connection to be evaluated. Then, based on the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the historical connections in the neighborhood, and the log sequence to be evaluated and the historical log sequence, a neighborhood structure similarity evaluation value for the connection to be evaluated is obtained. Based on the probability density of the embedding vector corresponding to the connection to be evaluated in the embedding vector corresponding to the historical connections in the neighborhood, a neighborhood distribution location evaluation value for the connection to be evaluated is obtained. Based on the variance of the embedding vectors corresponding to all historical connections in the neighborhood, a behavioral evaluation value for the connection to be evaluated is obtained. Based on the neighborhood structure similarity evaluation value, the neighborhood distribution location evaluation value, and the behavioral evaluation value, an evaluation factor for the connection to be evaluated is obtained. Then, based on the evaluation factor and the initial abnormal evaluation value of the connection to be evaluated, a target abnormal evaluation value for the connection to be evaluated is obtained. Finally, an abnormal connection evaluation is performed on the connection to be evaluated based on the target abnormal evaluation value. Moreover, the target abnormal evaluation value obtained by combining the evaluation factor and the initial abnormal evaluation value of the connection to be evaluated in this embodiment can improve the accuracy of abnormal connection identification for the connection to be evaluated.

[0055] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An abnormal connection evaluation method for terminal access authentication, characterized by, The method comprises the following steps: obtaining the embedding vectors corresponding to the to-be-evaluated log sequence and the embedding vectors corresponding to the historical log sequence of the neighbor historical connection of the to-be-evaluated connection, the to-be-evaluated connection and the neighbor historical connection being processes accessing the target system, the embedding vectors corresponding to the to-be-evaluated connection and the embedding vectors corresponding to the neighbor historical connection being vectors obtained by encoding the to-be-evaluated log sequence and the historical log sequence of the neighbor historical connection using a Transformer model; obtaining a neighbor structure similarity evaluation value of the to-be-evaluated connection according to the similarity between the embedding vectors corresponding to the to-be-evaluated connection and the embedding vectors corresponding to the neighbor historical connection, the to-be-evaluated log sequence and the historical log sequence, obtaining a neighbor distribution position evaluation value of the to-be-evaluated connection according to the probability density of the embedding vectors corresponding to the to-be-evaluated connection in the embedding vectors corresponding to the neighbor historical connection, and obtaining a behavior evaluation value of the to-be-evaluated connection according to the variance of the embedding vectors corresponding to all neighbor historical connections; obtaining a target abnormality evaluation value of the to-be-evaluated connection according to the evaluation factor of the to-be-evaluated connection and the initial abnormality evaluation value of the to-be-evaluated connection, and performing abnormal connection evaluation on the to-be-evaluated connection according to the target abnormality evaluation value; The method for obtaining the neighbor structure similarity evaluation value of the to-be-evaluated connection comprises the following steps: obtaining an event transition probability matrix corresponding to the to-be-evaluated connection according to the log event types in the to-be-evaluated log sequence, obtaining an event transition probability matrix corresponding to the neighbor historical connection according to the log event types in the historical log sequence of the neighbor historical connection, and obtaining the neighbor structure similarity evaluation value of the to-be-evaluated connection according to the event transition probability matrix corresponding to the to-be-evaluated connection, the event transition probability matrix corresponding to the neighbor historical connection, the similarity between the embedding vectors corresponding to the to-be-evaluated connection and the embedding vectors corresponding to the neighbor historical connection, the position marker values of the logs in the to-be-evaluated log sequence, and the position marker values of the logs in the historical log sequence. The method for obtaining the behavior evaluation value of the connection to be evaluated comprises the following steps: obtaining all historical connections of the same access terminal as the connection to be evaluated from all historical connections before the connection time of the connection to be evaluated, and recording all the historical connections as to-be-analyzed historical connections; recording the negative correlation mapping value of the variance of the embedding vector corresponding to all the to-be-analyzed historical connections as a change characteristic value; recording the Euclidean distance between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the to-be-analyzed historical connection as a difference value between the connection to be evaluated and the corresponding to-be-analyzed historical connection; recording the average value of the difference values between the connection to be evaluated and all the to-be-analyzed historical connections as a difference characteristic value; and recording the result of multiplying the change characteristic value and the difference characteristic value and then performing negative correlation mapping as the behavior evaluation value of the connection to be evaluated.

2. The method of claim 1, wherein the method further comprises: The neighborhood historical connection of the connection to be evaluated refers to the historical connection behavior within a preset time length from the connection time of the connection to be evaluated.

3. The method of claim 1, wherein the method further comprises: The method for obtaining the event transition probability matrix corresponding to the neighborhood historical connection comprises the following steps: A set composed of all historical connections before the connection time of the connection to be evaluated and the connection to be evaluated is recorded as a comprehensive set, the combination sequence corresponding to each connection in the comprehensive set is obtained, the first event type and the second event type in the bth combination in the combination sequence corresponding to any connection are the event type of the bth log and the event type of the bth+1 log in the log sequence corresponding to the corresponding connection respectively, a set composed of all combination types appearing in the combination sequence corresponding to all connections in the comprehensive set is recorded as a combination type set; In the combination sequence corresponding to any neighborhood historical connection P, the normalized value of the frequency of each combination type in the combination type set is obtained and recorded as the transition probability of the corresponding combination type under the neighborhood historical connection P, and a matrix composed of the transition probabilities of each combination type in the combination type set under the neighborhood historical connection P is recorded as the event transition probability matrix corresponding to the neighborhood historical connection P.

4. The method of claim 1, wherein the method further comprises: The method for obtaining the neighborhood structure similarity evaluation value of the connection to be evaluated according to the event transition probability matrix corresponding to the connection to be evaluated, the event transition probability matrix corresponding to the neighborhood historical connection, the similarity between the embedding vector corresponding to the connection to be evaluated and the embedding vector corresponding to the neighborhood historical connection, the position marker value of the log in the to-be-evaluated log sequence and the position marker value of the log in the historical log sequence comprises the following steps: A set composed of all neighborhood historical connections of the connection to be evaluated is recorded as a neighborhood historical connection set, a set composed of the embedding vectors corresponding to all neighborhood historical connections in the neighborhood historical connection set is recorded as a neighborhood embedding vector set, the average matrix of the event transition probability matrices corresponding to all neighborhood historical connections in the neighborhood historical connection set is obtained and recorded as the neighborhood transition probability matrix corresponding to the connection to be evaluated, and the JS divergence between the neighborhood transition probability matrix corresponding to the connection to be evaluated and the event transition probability matrix corresponding to the connection to be evaluated is obtained and recorded as a first structure indicator value. obtaining a vector similarity set corresponding to the connection to be evaluated, the mth vector similarity in the vector similarity set being a cosine similarity between the embedding vector corresponding to the connection to be evaluated and the mth embedding vector in the set of neighborhood embedding vectors, and a second structure indicator value being a result of subtracting a mean normalized value of the vector similarity set from a preset first constant; obtaining a position deviation degree representation value of each log in the log sequence to be evaluated, and a third structure indicator value being a mean of position deviation degree representation values of all logs in the log sequence to be evaluated; a negative correlation mapping value of a result of adding the first structure indicator value, the second structure indicator value and the third structure indicator value being taken as a neighborhood structure similarity evaluation value of the connection to be evaluated.

5. The method of claim 4, wherein the method further comprises: The method for obtaining the position deviation degree representation value comprises: for the cth log in the log sequence to be evaluated corresponding to the connection to be evaluated, obtaining all historical logs belonging to the same event type as the cth log in all historical log sequences corresponding to all neighborhood historical connections in the set of neighborhood historical connections, taking a set of all historical logs obtained as the cth log as a historical log set of the cth log, taking a mean of position marker values of each historical log in the historical log set as a neighborhood marker value of the cth log, taking a result of subtracting the neighborhood marker value of the cth log from the position marker value of the cth log as a feature position difference value of the cth log, obtaining feature position difference values of each historical log in the historical log set of the cth log, the feature position difference values of each historical log in the historical log set of the cth log being obtained in the same way as the feature position difference value of the cth log, and taking a mean of the feature position difference values of all historical logs in the historical log set as a historical difference average value of the cth log, and taking a square value of a difference between the feature position difference value of the cth log and the historical difference average value of the cth log as a position deviation degree representation value of the cth log.

6. The method of claim 4, wherein the method further comprises: The neighborhood distribution position evaluation value of the connection to be evaluated is a normalized value of a probability density of the embedding vector corresponding to the connection to be evaluated in the set of neighborhood embedding vectors.

7. The method of claim 1, wherein the method further comprises: determining whether the terminal is abnormal based on the authentication result. The evaluation factor of the connection to be evaluated is an inverse mapping value of a result of weighted summation of the neighborhood structure similarity evaluation value, the neighborhood distribution position evaluation value and the behavior evaluation value of the connection to be evaluated.

8. The abnormal connection evaluation method for terminal access authentication as described in claim 1, characterized in that, The method for obtaining the target anomaly evaluation value of the connection to be evaluated comprises: obtaining an anomaly score of the embedding vector corresponding to the connection to be evaluated by using the CBLOF algorithm, and taking the anomaly score of the embedding vector corresponding to the connection to be evaluated as an initial anomaly evaluation value of the connection to be evaluated; taking a normalized value of a result of multiplying the evaluation factor of the connection to be evaluated and the initial anomaly evaluation value of the connection to be evaluated as the target anomaly evaluation value of the connection to be evaluated.

Images