Security integration method and device for data classification and malicious behavior analysis and medium

Abstract

The invention relates to the field of network security, and discloses a security integration method and device for data classification and malicious behavior analysis, and a medium, and the method comprises the steps: obtaining network data from data sources of different network environments, and constructing a risk feature dictionary based on the network data; performing preliminary judgment and classification on the network data to obtain a classification result; further performing malicious behavior analysis on the classification result to obtain a malicious behavior analysis result; the method has the beneficial effects that efficient and accurate network security threat detection is realized; the intelligent evolution of the threat library is realized while the false alarm rate is reduced, and all-weather adaptive security protection is provided for a complex network environment.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for securely integrating data classification and malicious behavior analysis. Background Art

[0002] Data classification and malicious behavior analysis is defined as an evidence-based process that includes behavioral feature extraction, risk assessment, anomaly detection, and executable response strategies. These processes aim to identify existing or potential malicious behavior within a system or network, providing real-time early warning of threats and support for decision-making regarding mitigation measures for asset-related entities. In the cyberspace, data classification and malicious behavior analysis are considered important means of identifying, detecting, and responding to various malicious behaviors. This involves comprehensive analysis of user behavior, network traffic, system logs, and other data. It has uncovered known and unknown malicious behavior characteristics and further improved detection accuracy and effectiveness through the use of relevant tags.

[0003] Traditional data classification and malicious behavior analysis methods rely primarily on rule sets and signature libraries, detecting malicious behavior by using predefined rules and known threat signatures. However, these methods lack the ability to automatically update or rapidly deploy. These methods are significantly inadequate for addressing new threats, zero-day attacks, and complex attack patterns, making comprehensive and effective detection difficult. Furthermore, these methods are costly to establish and maintain, prone to false positives and false negatives, and unable to adapt to rapidly changing network environments. Summary of the Invention

[0004] The purpose of the present invention is to propose a secure integration method, device and medium for data classification and malicious behavior analysis to solve the technical problems of traditional data classification and malicious behavior analysis methods, such as high maintenance costs, easy false alarms and inability to adapt to rapidly changing network environments.

[0005] Specifically, the present invention provides a method for securely integrating data classification and malicious behavior analysis, comprising the following steps: S1. Obtain network data from data sources in different network environments and build a risk feature dictionary based on the network data; S2. Perform preliminary judgment and classification on the network data to obtain classification results; S3. Further perform malicious behavior analysis on the classification results to obtain malicious behavior analysis results.

[0006] A storage medium stores instructions and data for implementing a secure integration method for data classification and malicious behavior analysis.

[0007] A secure integration device for data classification and malicious behavior analysis comprises: a processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement a secure integration method for data classification and malicious behavior analysis.

[0008] The present invention provides the following beneficial effects: by integrating multi-source network data and constructing a dynamic risk signature dictionary, efficient and accurate network security threat detection is achieved. The system utilizes differentiated collection strategies (such as capturing firewall logs in seconds and integrating user behavior in hours) to ensure real-time data. It combines standardized processing with a weighted risk assessment model to rapidly identify high-risk events, and uses dynamic time window aggregation technology to accurately capture malicious behavior sequences. By mining temporal correlation features through word embedding and bidirectional LSTM, combined with principal component dimensionality reduction and multi-layer perceptron classification, detection accuracy is significantly improved. Its self-learning mechanism automatically captures new attack signatures and updates the dictionary. Combined with confidence thresholds and user feedback mechanisms, it enables intelligent evolution of the threat library while reducing false alarm rates, providing all-weather adaptive security protection for complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 It is a schematic diagram of the process of the method of the present invention; Figure 2 It is a detailed flowchart of data collection; Figure 3 It is a schematic diagram of the process of obtaining the malicious behavior subsequence; Figure 4 It is a schematic diagram of the risk signature dictionary construction process; Figure 5 It is a schematic diagram of the process of obtaining classification results; Figure 6 This is a schematic diagram of the malicious behavior analysis process; Figure 7 It is a schematic diagram of the working of the hardware device of an embodiment of the present invention. DETAILED DESCRIPTION

[0010] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0011] Before formally explaining the present invention, the scheme of the present invention is first generally explained for easy understanding.

[0012] Please refer to Figure 1 The present invention provides a method for securely integrating data classification and malicious behavior analysis, comprising: S1. Obtain network data from data sources in different network environments and build a risk feature dictionary based on the network data; Please refer to Figure 2 , Figure 2 It is a detailed flow chart of data collection.

[0013] It should be noted that step S1 is specifically as follows: S11. Identify all data sources in the network environment and use data collection tools to collect network data from different sources; As an embodiment, the present invention determines all data sources in the network environment, such as firewall logs, host logs, user behavior logs, etc., uses data collection tools to collect data from different sources, and identifies and determines all potential data sources in the network environment.

[0014] Preferably, the present invention deploys the data collection engine to each network node, including routers, switches, firewalls, and user terminals, to ensure comprehensive coverage of data sources by monitoring network traffic and behavior logs.

[0015] S12. Configure different collection frequencies for data from different sources, and ultimately convert data from different sources into standardized event sequences; As an example, the present invention configures the data collection frequency to ensure real-time and timely data. Specifically, a higher collection frequency (once per second) is configured for firewall and intrusion detection system logs, while a lower frequency (once per hour) is configured for host logs and user behavior logs. The collected data is preprocessed to remove duplicate and invalid data. Finally, timestamps from data from different sources are converted to a unified time format to form a standardized event sequence.

[0016] S13, extracting features from the standardized event sequence to obtain extracted features; Please refer to Figure 3 , Figure 3 It is a schematic diagram of the process of obtaining the malicious behavior subsequence; As an example, the present invention extracts features from standardized event sequences. This feature extraction uses a sliding window to count abnormal login frequencies, a dynamic time window to aggregate access behaviors, and association rules to mine temporal event chains. Z-score deviation and information entropy are then used to quantify behavioral anomalies. Feature weights are dynamically adjusted based on expert rules and historical attack data. Isolation forest detection is also used to detect outliers and capture new attack patterns, enabling automated labeling and updating of risk indicators.

[0017] The present invention focuses on features that may be related to security risks, such as abnormal logins, abnormal access frequencies, etc. By defining these security risk-related features and marking corresponding indicators in the event sequence, potential malicious behavior can be quickly identified.

[0018] S14, performing risk assessment on the extracted features to obtain a risk value; Specifically, the present invention sets a weighted sum formula to quantify the risk of each event, and defines the threshold T as 0.7. If If the risk score is >T, the event is considered too high, and the event is segmented and marked as malicious. Events with lower risk are marked as "low-risk events" or "normal behavior" and included in the normal behavior subsequence. The weighted sum formula is as follows:

[0019] in, represents the weight of the i-th feature, represents the value of the i-th feature, and n is the total number of features.

[0020] S15. Aggregate features that exceed a preset risk value to obtain a malicious behavior subsequence; As an embodiment, the present invention aggregates all high-risk events that occur to the same subject (user, IP address) within a specific time period, uses a dynamic time window to determine the aggregation range of 30 minutes, and stores all high-risk events aggregated within this time into a malicious behavior subsequence.

[0021] S16. Construct a risk feature dictionary based on malicious behavior subsequences.

[0022] Please refer to Figure 4 , Figure 4 It is a schematic diagram of the risk signature dictionary construction process; It should be noted that, in step S16, the specific process of constructing the risk feature dictionary is as follows: S161. Storing the features in the malicious behavior subsequence into a risk feature dictionary, where the dictionary records known malicious behavior features. Specifically, the features of malicious behavior subsequences are stored in a risk feature dictionary, which records known malicious behavior features. The features in the dictionary are categorized by type, such as attack techniques (brute force cracking, phishing attacks) and malware (Trojans, worms), to facilitate rapid feature search and matching.

[0023] S162. During the event segmentation process, the risk feature dictionary is used to match the features of each event. When a new malicious behavior is identified, its features are automatically added to the risk feature dictionary. Specifically, during the event segmentation process, the risk signature dictionary is used to match each event. The system extracts key features from the event to be processed and converts the raw event data into structured information that can be processed by the machine. These features are then range-matched with features in the risk signature dictionary to determine whether they represent known malicious behavior. When new malicious behavior is identified, its features are automatically added to the risk signature dictionary. The range matching judgment formula is as follows:

[0024] Where x is the eigenvalue to be matched, It is the preset valid range, a is 3 times, b is 5 times, if x=5, it returns 1 to indicate a successful match; if x>5, it returns 0 to indicate a mismatch.

[0025] S163. Regularly query system logs and analysis reports for new malicious signatures and update the risk signature dictionary; Specifically, to ensure that the risk signature dictionary can continuously reflect the latest security threats and malicious behaviors, new malicious signatures are regularly queried from system logs and analysis reports to update the risk signature dictionary.

[0026] S164. Arrange and optimize the risk feature dictionary updated in step S163 to obtain a final risk feature dictionary.

[0027] As an example, after the first three steps, the processed data is finally integrated and optimized to form the final risk signature dictionary. First, duplicate or outdated malicious behaviors are removed from the dictionary, and each unique malicious behavior is assigned a tag to assess its importance in malicious behavior identification. Finally, the data is sorted by importance, prioritizing the most critical malicious behaviors. Finally, all malicious behaviors are restored in a structured format for rapid retrieval and matching.

[0028]

[0029] in is the set of existing risk features, is a newly identified feature, It's an outdated feature. It is a mark set for each independent malicious behavior, based on factors such as the frequency, harm level and prevalence of the feature, and finally through Sort each malicious behavior to ensure that the most important features are at the front of the dictionary, which facilitates retrieval and matching for subsequent malicious behavior identification.

[0030] S2. Perform preliminary judgment and classification on the network data to obtain classification results; Please refer to Figure 5 , Figure 5 It is a schematic diagram of the process of obtaining classification results; It should be noted that step S2 is specifically as follows: S21, converting network data into high-dimensional feature vectors; In this invention, the standardized event features are input into this step. First, the discrete features are converted into high-order vectors through word embedding. This conversion enables the original discrete features to be processed more efficiently and provides richer detection information. The word embedding formula is as follows:

[0031] The formula is expressed as mapping the input feature x to a 100-dimensional feature vector v in the vector space through a function f.

[0032] S22, extracting time series features of high-dimensional feature vectors; After word embedding, features are further analyzed to extract temporal features. This feature extraction uses a bidirectional long short-term memory (Bi-LSTM) network to model the dependencies between event sequences. A self-attention mechanism is then incorporated to highlight key related events. Time intervals are encoded as periodic features to quantify behavioral rhythm anomalies. By integrating temporal dependencies, mutation nodes, and operation interval features, potential attack chains, such as "high-frequency login failures → port scanning," can be accurately captured. This process considers the temporal order and intervals between events, uncovering behavioral patterns that occur over time and revealing potential security threats.

[0033] S23, performing context association analysis on the temporal features to obtain fusion features; After temporal features are extracted, the next step is to analyze the contextual associations of events. This process considers the forward and backward dependencies (forward and reverse dependencies) between events in order to understand the meaning of each event in a broader context.

[0034]

[0035] Among them, C is the context feature, and BILSTM is a bidirectional long short-term memory network, which is used to capture the dependency relationship between previous and subsequent events.

[0036] After temporal and contextual analysis, all extracted features are merged to form a comprehensive feature representation that contains a multi-dimensional description of the behavior, including temporal changes, contextual relationships, and details of the feature itself.

[0037] S24. Input the fused features into the decision layer for preliminary judgment to obtain a classification result, which includes: suspicious malicious features and normal features.

[0038] The integrated features after fusion are input into the decision-making layer to preliminarily judge whether each behavior is malicious. In the decision-making layer, the behaviors are divided into "suspicious malicious behaviors" and "normal user behaviors". "Suspicious malicious behaviors" will be further passed to deep threat identification.

[0039] S3. Further perform malicious behavior analysis on the classification results to obtain malicious behavior analysis results.

[0040] Please refer to Figure 6 , Figure 6 This is a schematic diagram of the malicious behavior analysis process; It should be noted that step S3 is specifically as follows: S31. Perform dimensionality reduction processing on the suspicious malicious features to obtain features after dimensionality reduction; As an example, principal component analysis is used to extract suspicious malicious behavior features from behavioral temporal perception and perform dimensionality reduction. Principal component analysis reduces the dimension of the feature space, removes redundant information, and retains the most representative features. The feature dimensionality reduction formula is:

[0041] Among them, X is the original feature matrix with a size of 1000*50, W is the matrix composed of feature vectors after dimensionality reduction, the number of retained features is 20, and Z is the feature representation after dimensionality reduction with a size of 1000*20.

[0042] S32, inputting the reduced-dimensional features into a multi-layer perceptron for reclassification to obtain an accurate classification result; As an example, the reduced features are input into a multi-layer perceptron for classification, which includes an input layer, a hidden layer, and an output layer. If the feature exists in the risk feature dictionary, it is directly marked as malicious; if it does not exist in the risk feature dictionary, its confidence is further calculated. The classification formula is:

[0043] in, and are weight matrices, is the bias term, and f is the activation function.

[0044] S33. Match the precise classification result with the risk feature dictionary. If the match is successful, mark it as malicious behavior. Otherwise, further calculate its confidence level. As an embodiment, after feature matching fails, a confidence calculation is performed on the behavior. The confidence calculation includes the feature similarity, occurrence frequency, and behavior sequence pattern of the behavior. If the confidence score exceeds 0.7, the behavior is marked as malicious.

[0045] S34. If the confidence level exceeds the preset value, it will be marked as malicious behavior and included in the risk feature dictionary; otherwise, it will be considered normal behavior.

[0046] Specifically, the system automatically adds signatures of newly detected malicious behavior to the risk signature dictionary to enhance the system's identification capabilities. The updated risk signature dictionary is output as a new version of the data file, with version management and rollbacks when necessary. This file is stored in a relational database table format for quick access and querying.

[0047] The final risk signature dictionary is stored in a database, making it readily available to the system. During network detection, the system quickly determines whether captured behavior matches known malicious signatures. The method also incorporates a user feedback mechanism to review and provide feedback on the system's judgment structure.

[0048] See Figure 7 , Figure 7 4 is a schematic diagram of the working of the hardware device of an embodiment of the present invention, wherein the hardware device specifically includes: a security integration device 401 for data classification and malicious behavior analysis, a processor 402 and a storage medium 403.

[0049] A security integration device 401 for data classification and malicious behavior analysis: The security integration device 401 for data classification and malicious behavior analysis implements the security integration method for data classification and malicious behavior analysis.

[0050] Processor 402: The processor 402 loads and executes the instructions and data in the storage medium 403 to implement the security integration method of data classification and malicious behavior analysis.

[0051] Storage medium 403: The storage medium 403 stores instructions and data; the storage medium 403 is used to implement the security integration method of data classification and malicious behavior analysis.

[0052] The present invention achieves efficient and accurate network security threat detection by integrating multi-source network data and constructing a dynamic risk signature dictionary. The system utilizes differentiated collection strategies (such as capturing firewall logs in seconds and integrating user behavior in hours) to ensure real-time data. It combines standardized processing with a weighted risk assessment model to rapidly identify high-risk events, and uses dynamic time window aggregation technology to accurately capture malicious behavior sequences. By mining temporal correlation features through word embedding and bidirectional LSTM, combined with principal component dimensionality reduction and multi-layer perceptron classification, detection accuracy is significantly improved. Its self-learning mechanism automatically captures new attack signatures and updates the dictionary. Combined with confidence thresholds and user feedback, it enables intelligent evolution of the threat library while reducing false alarm rates, providing 24 / 7 adaptive security protection for complex network environments.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A secure integration method for data classification and malicious behavior analysis, characterized by: The following steps are involved: S1. Obtain network data from data sources in different network environments and build a risk feature dictionary based on the network data; S2. Perform preliminary judgment and classification on the network data to obtain classification results; S3. Further perform malicious behavior analysis on the classification results to obtain malicious behavior analysis results.

2. The method for secure integration of data classification and malicious behavior analysis according to claim 1, characterized in that: Step S1 is specifically as follows: S11. Identify all data sources in the network environment and use data collection tools to collect network data from different sources; S12. Configure different collection frequencies for data from different sources, and ultimately convert data from different sources into standardized event sequences; S13, extracting features from the standardized event sequence to obtain extracted features; S14, performing risk assessment on the extracted features to obtain a risk value; S15. Aggregate features that exceed a preset risk value to obtain a malicious behavior subsequence; S16. Construct a risk feature dictionary based on malicious behavior subsequences.

3. The method for secure integration of data classification and malicious behavior analysis according to claim 2, characterized in that: In step S14, the risk value is calculated as follows: in, represents the weight of the i-th feature, represents the value of the i-th feature, and n is the total number of features.

4. The method for secure integration of data classification and malicious behavior analysis according to claim 2, wherein: In step S16, the specific process of constructing the risk feature dictionary is as follows: S161. Storing the features in the malicious behavior subsequence into a risk feature dictionary, where the dictionary records known malicious behavior features. S162. During the event segmentation process, the risk feature dictionary is used to match the features of each event. When a new malicious behavior is identified, its features are automatically added to the risk feature dictionary. S163. Regularly query system logs and analysis reports for new malicious signatures and update the risk signature dictionary; S164. Arrange and optimize the risk feature dictionary updated in step S163 to obtain a final risk feature dictionary.

5. The method for secure integration of data classification and malicious behavior analysis according to claim 4, characterized in that: The matching process in step S152 is as follows: Where x is the eigenvalue to be matched, It is the preset valid range. If x=b, it returns 1 to indicate a successful match; if x>b, it returns 0 to indicate a mismatch.

6. The method for secure integration of data classification and malicious behavior analysis according to claim 1, characterized in that: The process of sorting and optimizing in step S154 is as follows: Repetitive or outdated malicious behaviors are deleted from the updated risk signature dictionary, and a tag is set for each unique malicious behavior to assess its importance in malicious behavior identification; Sorting by importance, the most critical malicious behaviors are prioritized. Finally, all malicious behaviors are re-stored in a structured form for fast retrieval and matching.

7. The method for secure integration of data classification and malicious behavior analysis according to claim 1, characterized in that: Step S2 is specifically as follows: S21, converting network data into high-dimensional feature vectors; S22, extracting time series features of high-dimensional feature vectors; S23, performing context association analysis on the temporal features to obtain fusion features; S24. Input the fused features into the decision layer for preliminary judgment to obtain a classification result, which includes: suspicious malicious features and normal features.

8. The method for secure integration of data classification and malicious behavior analysis according to claim 7, characterized in that: Step S3 is as follows: S31. Perform dimensionality reduction processing on the suspicious malicious features to obtain features after dimensionality reduction; S32, inputting the reduced-dimensional features into a multi-layer perceptron for reclassification to obtain an accurate classification result; S33. Match the precise classification result with the risk feature dictionary. If the match is successful, mark it as malicious behavior. Otherwise, further calculate its confidence level. S34. If the confidence level exceeds the preset value, it will be marked as malicious behavior and included in the risk feature dictionary; otherwise, it will be considered normal behavior.

9. A storage medium, characterized in that: The storage medium stores instructions and data for implementing a secure integration method of data classification and malicious behavior analysis as described in any one of claims 1 to 8.

10. A security integration device for data classification and malicious behavior analysis, characterized by: include: A processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement a secure integration method for data classification and malicious behavior analysis as described in any one of claims 1 to 8.

Images