Remote desktop behavior recognition model training method and remote desktop behavior recognition method

Abstract

The invention belongs to the field of network traffic, and provides a remote desktop behavior recognition model training method, the model comprises a first neural network and a second neural network, and the method comprises the following steps: acquiring remote desktop network traffic; taking a terminal, a virtual machine and a service system as nodes, and extracting node features from the network flow; link features are extracted from the network flow by taking a link from the terminal to the virtual machine and a link from the virtual machine to the service system as links; inputting the node features and the link features into a first neural network for training to obtain an embedded sequence divided according to a time window; and inputting the embedded sequence into a second neural network for training to obtain a trained remote desktop behavior recognition model. According to the invention, through modeling full-link flow characteristics among the terminal, the virtual machine and the service system, a more accurate and fine-grained user behavior identification effect can be realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network traffic, and particularly relates to a remote desktop behavior recognition model training method and a remote desktop behavior recognition method. BACKGROUND

[0002] A remote desktop system is a technology that allows users to remotely access and control another computer or device through a network (such as the Internet or a local area network). A remote desktop generally consists of four components: 1) an access terminal: a device for users to connect to the remote desktop system, including a zero terminal, a thin terminal with a remote desktop APP installed, and a fat terminal with a remote desktop APP installed; 2) a host computer: a server that installs a virtualization platform and hosts virtual machines; 3) a virtual machine: a virtualization device of the remote desktop system; and 4) a remote desktop protocol: a protocol used by the access terminal to access and use the remote desktop system.

[0003] In a remote desktop system, the input content (keyboard, mouse, audio peripherals, etc.) of a user at a terminal is sent to a virtual machine through a remote desktop transmission protocol. The virtual machine processes the input content and returns the output (image pixels or image instructions, audio, etc.) to the terminal through the protocol. At the same time, under the control of the user, the virtual machine accesses various application systems, such as mobile office applications, browsers, and video applications.

[0004] Under the background of the increasing popularity of remote desktop systems, the importance of user behavior auditing is increasingly prominent. Remote desktops are widely used in entertainment, office work, and high-security scenarios. In fields with particularly strict security requirements, effective auditing of user behavior has become a key means to ensure system security, improve management efficiency, and meet compliance requirements. User behavior on a remote desktop not only relates to information security, but also directly affects work efficiency. Behavior auditing provides managers with a comprehensive monitoring perspective, allowing them to promptly identify abnormal or illegal operations. On the other hand, it also forms a behavior standard for users. When users know that their operations can be recorded and traced, they are more likely to consciously comply with information security policies, thereby reducing risks from the source. At the same time, audit data can be used for behavior profiling, risk warning, and operation optimization, thereby building a safe, efficient, and controllable remote office environment.

[0005] Currently, remote desktop behavior auditing methods can be divided into three categories: video auditing methods, behavior classification methods based on image data features, and behavior auditing methods based on traffic features.

[0006] Video audit method: Video audit method captures screen images in user remote operation sessions in real time, at regular intervals or event triggers, forms complete video stream records, realizes visual and traceable audit of the whole process of user behavior, and is widely used in security compliance audit, fault troubleshooting, behavior tracing and other scenarios. However, video files are usually large in size, occupy a large amount of storage resources, and are difficult to structure and analyze automatically; in addition, the audit granularity depends on video playback, which is high in labor cost and not conducive to real-time threat detection. Although some video audit systems introduce key frame extraction, image recognition and other enhanced technologies to try to improve the structured audit capability on the basis of ensuring visibility, such methods still require a large amount of computing resources and manual audit overhead.

[0007] Video audit, as an important means of remote desktop user behavior tracing, has the advantages of strong intuitiveness and high reproducibility, but also has obvious limitations. First, video data is large in size, and long-term recording will occupy a large amount of storage resources and increase system burden. Second, video content lacks structured information, making it difficult to efficiently search and classify, and often requiring manual playback analysis during the audit process, which is not only labor-intensive but also difficult to achieve real-time. More importantly, video audit results largely depend on human subjective judgment and are easily affected by experience and cognitive differences, making it difficult to ensure the consistency and objectivity of the audit. These problems limit the application effect of video audit in large-scale and high real-time scenarios.

[0008] Behavior audit method based on image data features: The behavior classification method based on image data features is a method that obtains image data when a user operates on a remote desktop, extracts image features through machine learning, and classifies the user's current activity. For example, Chinese invention patent CN112559099A "Remote desktop image display method, device, system and storage medium based on user behavior". The patent trains a pre-trained model through image classification of the ImageNet dataset in the model training aspect. On this basis, sample images of scenes corresponding to pre-set user behavior categories are generated, and labels are labeled for transfer learning model training to generate a prediction model. In the user behavior recognition aspect, user operation images are obtained according to a pre-set sampling frequency, and user behavior images of a pre-set time sequence length are cropped and scaled according to a pre-set size and saved. The ResNet and LSTM networks are used to classify and predict the input feature sequence to determine the user's behavior category. The patent can identify user text table slide processing, three-dimensional design and image rendering, multimedia audio and video and mixed application mode, undefined behavior, etc.

[0009] The behavior audit method based on image data features has significant advantages in storage efficiency and automated audit capability compared to video audit. Image frame data is smaller in volume than continuous video data, has relatively low storage overhead, is convenient for long-term archiving and retrieval, and can reduce human involvement to some extent and improve audit efficiency through AI-based image recognition technology. However, this method still requires continuous storage of a large amount of image data, especially in high-frequency sampling or long-running scenarios, and the image data accumulates quickly, resulting in storage pressure.

[0010] The behavior audit method based on single-link network traffic features: The behavior audit method based on network traffic features uses the data flow transmitted between the access terminal and the virtual machine in the remote desktop system to extract statistical and structural features, and identifies the user's behavior type through pattern matching or machine learning models. The core principle is that every mouse click, keyboard input, or interface change of the user during remote operation will be converted into a certain pattern of data packet transmission at the remote desktop protocol layer (such as RDP, VNC), forming a perceptible "behavior-flow" mapping. The audit system extracts and models the timing features of the traffic packet size, sending interval, data flow direction, and burst spikes, trains a classification model to identify typical operation patterns such as text input, page browsing, and video playback. This method only needs to bypass the network traffic of the user accessing the remote desktop, without occupying the computing resources of the virtual machine or host machine, and does not affect the normal use of the user.

[0011] The behavior audit method based on network traffic features does not require storage resources, but existing technologies have the problem of insufficient recognition accuracy and coarse recognition granularity in actual use. The main reason is that existing behavior audit methods based on network traffic features are limited to the network link between the access terminal and the virtual machine, but this link transmits encoded and encrypted desktop images, which cannot directly and comprehensively reflect the user's behavior, so the existing method has coarse recognition granularity and low accuracy.

[0012] The abnormal traffic detection technology based on space-time features: Chinese patent application CN119814671A "A method and system for encrypted traffic classification based on space-time information fusion" and Chinese patent application CN114697096A "Intrusion detection method based on space-time features and self-attention mechanism" both extract the time and space features in network traffic and further classify abnormal traffic. The session flow composed of packets with the same five-tuple is taken as a node of the graph. For each pair of nodes in the graph, if the source IP address or the destination IP address of one node is the same as the source IP address or the destination IP address of the other node, an edge is established between the two nodes, thereby forming a traffic graph. The patent recursively extracts the features of the nodes layer by layer as the spatial features of the traffic, and uses the LSTM model to extract the time sequence features of the traffic. The two are fused to form space-time features, and then classified by SoftMax. Patent 2 first extracts the time sequence features of the traffic, and then uses a convolutional neural network to extract the spatial features in the time sequence features, and then classifies.

[0013] Although the abnormal traffic detection method based on space-time features improves the accuracy of abnormal traffic detection by simultaneously extracting the spatial and temporal vectors of the traffic, there are the following challenges in directly using such methods for remote desktop user behavior recognition:

[0014] (1) The particularity of the remote desktop data transmission paradigm makes it impossible to directly reuse such methods. In remote desktop access, the access terminal and the virtual machine transmit encrypted differential transmission pictures, rather than traditional business data. The characteristics of this link are not sufficient to support fine-grained user behavior auditing. For example, due to the similarity of the pictures, it is difficult to distinguish whether the user is using Word or Tencent Document; the virtual machine and the business system transmit business traffic, but business traffic does not necessarily directly reflect user behavior. For example, the APP of the virtual machine accesses the business system, but it does not mean that it is the current user's behavior, but it may be opened by the previous access user. Based on the above analysis, only focusing on the space-time features of any type of link is difficult to accurately reflect the behavior of the remote desktop user, and the background technology only focuses on the features of the terminal-business system type of link.

[0015] (2) and the space-time features in the remote desktop access process are significantly different from the space-time features extracted by the encrypted traffic detection: the extraction of the graph vector features of the remote desktop should simultaneously focus on the features of the device and the network connection, that is, the features of the nodes and the edges are simultaneously considered, and therefore the extraction process of the spatial vector is more complex; the method of splicing the spatial vector and the time vector adopted by the patent 1 cannot represent the characteristics of the interaction between the space-time features, that is, the spatial features of the remote desktop also develop and change with the time migration, and therefore the spatial features of each moment should be extracted, the spatial features of all nodes are embedded to form the overall spatial features of the remote desktop access graph, and the overall spatial features of each moment are combined to form the time sequence vector, so that the space-time features are obtained. SUMMARY

[0016] The application faces the remote desktop user behavior audit demand, and proposes a remote desktop behavior recognition model training method and a remote desktop behavior recognition method based on double-link. The application simultaneously focuses on the network traffic of the two-link access terminal to the virtual machine and the virtual machine to the business system, supports the fine-grained classification and abnormal behavior recognition of the user behavior without occupying the virtual machine computing and storage resources, and improves the security of the remote desktop system. The network traffic features of the two-link are modeled as a graph structure, an interactive graph representation model based on deep learning is designed, the space-time features of the full-link traffic features are extracted through the graph representation and the Long Short-Term Memory (LSTM) model, and the space-time features refer to the feature vectors presented by the full-link traffic features in the spatial and temporal dimensions. In the feature extraction and space-time vector representation process, the application combines the traffic paradigm of the remote desktop, and proposes a representation method of edge-point fusion and hierarchical aggregation. Through the embedding of the space-time dimension features of the full-link features by the graph representation model and the LSTM, the accurate modeling of the user network behavior is realized, so that the fine-grained classification of the user behavior is realized.

[0017] The first aspect of the application proposes a remote desktop behavior recognition model training method, and the model comprises a first neural network and a second neural network, and the steps comprise:

[0018] Obtaining remote desktop network traffic;

[0019] Taking the terminal, the virtual machine and the business system as nodes, extracting node features from the network traffic;

[0020] Taking the terminal to the virtual machine and the virtual machine to the business system as links, extracting link features from the network traffic;

[0021] Inputting the node features and the link features into the first neural network for training to obtain an embedded sequence divided according to a time window;

[0022] The embedding sequence is input into a second neural network for training to obtain a trained remote desktop behavior recognition model.

[0023] Further, the node features include terminal node features, virtual machine node features, and service system node features; and the link features include virtual machine-service system link edge features and terminal-virtual machine link edge features.

[0024] Further, the node features and the link features are input into a first neural network for training, the first neural network being a GraphSAGE model and including:

[0025] The neighbor nodes of each node are sampled;

[0026] The node features and the link features are aggregated according to the relationship between the node and the neighbor nodes.

[0027] Further, the aggregation of the node features and the link features includes:

[0028] According to the relationship between the node and the neighbor nodes, a first user behavior representation is obtained through the virtual machine node features, the service system node features, and the virtual machine-service system link edge features;

[0029] According to the relationship between the node and the neighbor nodes, a second user behavior representation is obtained through the terminal node features, the virtual machine node features, and the terminal-virtual machine link edge features;

[0030] Consistency of the first user behavior representation and the second user behavior representation is judged to obtain a full-link user behavior representation, and the aggregation is completed.

[0031] Further, the embedding sequence is input into a second neural network for training, the second neural network being an LSTM model and including:

[0032] The embedding sequence is modeled, and parameters in the LSTM model are trained.

[0033] The second aspect of the application proposes a remote desktop behavior recognition method, and steps thereof include:

[0034] Remote desktop network traffic to be detected is obtained, and detection node features and detection link features are extracted from the network traffic to be detected;

[0035] The detection node features and the detection link features are input into the remote desktop behavior recognition model to obtain an output sequence.

[0036] A global behavior representation is obtained through the output sequence, and a corresponding behavior type is generated.

[0037] Further, a global behavior representation is obtained by the output sequence, and a corresponding behavior type is generated, including:

[0038] The output sequence is average-pooled to obtain the global behavior representation;

[0039] The global behavior representation is input into a classifier to generate a corresponding behavior type.

[0040] Further, the classifier adopts an FCN model.

[0041] A third aspect of the present application provides an electronic device, including a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing the above method.

[0042] A fourth aspect of the present application provides a storage medium, which stores a computer program, and the computer program is executed by a computer to implement the above method.

[0043] The present application has the following beneficial effects:

[0044] 1. The present application supports distinguishing the operation that the user is currently likely to perform from network traffic, and compared with the user behavior recognition method based on video and picture, the present application is completely non-invasive to the user and does not occupy any computing, storage and network resources of the user.

[0045] 2. The present application models the whole-link traffic features among the terminal-virtual machine-service system, comprehensively examines the network traffic of the access terminal to the virtual machine and the virtual machine accessing the service system, makes up for the defects of coarse recognition granularity and low accuracy when only considering the access terminal to the virtual machine link, and can realize more accurate and fine-grained user behavior recognition effect.

[0046] 3. The present application supports dynamically changing the graph structure, thereby supporting more lightweight updating of the model during use. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 It is a remote desktop system deployment schematic diagram of the embodiment of the present application.

[0048] Figure 2 It is a remote desktop behavior recognition model training method flowchart of the embodiment of the present application.

[0049] Figure 3 It is a remote desktop behavior recognition method flowchart of the embodiment of the present application. DETAILED DESCRIPTION

[0050] The application will be described in further detail below with reference to the drawings, which are provided for explanation only and are not intended to limit the scope of the application.

[0051] In this embodiment, the remote desktop system includes an access terminal, a virtual machine and a service system, an access gateway is added in the access terminal and the virtual machine, and a boundary gateway is added in the virtual machine and the service system, so as to extract network traffic, as shown in Figure 1

[0052] The first aspect of the embodiment discloses a remote desktop behavior recognition model training method, as shown in Figure 2

[0053] In a remote desktop access process, the generated network traffic involves three key entities: an access terminal, a virtual machine and a service system accessed by the virtual machine. Because each entity serves as a network interaction node, it has a network identifier (IP / MAC). Terminal node features are extracted from the access terminal, node features are extracted from the virtual machine, and service system features are extracted from the service system. The node features extracted from each entity include four sub-features, as shown in Table 1.

[0054] Table 1

[0055]

[0056] In a remote desktop access process, the generated network traffic involves two links: an access terminal to virtual machine link and a virtual machine to service system link. Terminal-virtual machine link edge features are extracted from the access terminal to virtual machine link, and virtual machine-service system link edge features are extracted from the virtual machine to service system link. The link edge features extracted from each link include 22 sub-features, as shown in Table 2.

[0057] Table 2

[0058]

[0059]

[0060]

[0061] In order to accurately model the operation behavior of users in the remote desktop environment, the embodiment designs a Spatio-Temporal Graph Neural Network (STGNN) framework combining spatial structure modeling and temporal evolution modeling. The framework proposes a remote desktop interaction graph representation method, and combines an LSTM network to extract evolution features across time windows, thereby realizing continuous modeling and fine classification of user behavior.

[0062] ​​Further, in order to model the structural relationship between entities in the network, the embodiment proposes a remote desktop interaction graph representation method based on deep learning, which extracts spatial features of the interaction graph in each time window. Unlike traditional recursive aggregation representation methods based on node features, the embodiment fully considers the traffic paradigm of remote desktops and aggregates neighbor node features and edge features to the upper layer nodes during the aggregation process, thereby realizing full-link extraction of edge features of the two-link chain of access terminal<->virtual machine and virtual machine<->service system, and adopting an inductive updating node representation method suitable for dynamic graph structures and suitable for the application scenario of frequent changes of nodes in the remote desktop system. The interaction graph representation method in the embodiment includes the following steps:

[0063] (1) Feature preprocessing

[0064] The Max-Min normalization method is used for preprocessing the features of each dimension, and the method is as follows:

[0065]

[0066] Wherein, x is the original feature value, x min is the statistical minimum value of the feature, x max is the statistical maximum value of the feature, and x ′ is the normalized feature value.

[0067] (2) Neighbor sampling

[0068] For each node to be updated v, a fixed number of neighbor nodes are randomly sampled from the neighbor node set of the node, and these neighbor nodes and the edges from the node v to the neighbor nodes will be used for subsequent aggregation operations. This mechanism reduces the computational complexity and enhances the efficiency of local feature extraction.

[0069] (3) Neighbor feature aggregation

[0070] In traditional graph representation models such as GraphSAGE, the representation of a node is obtained by aggregating the features of neighbor nodes, and common aggregation methods such as mean, max-pooling, and LSTM are used. However, these methods usually only use the features of the node itself, ignoring the edge features between neighbor nodes and the center node. In the interaction graph of remote desktop access, the edge has obvious feature attributes, and ignoring the edge information is a waste of information. Therefore, the embodiment proposes an edge-point fusion and hierarchical aggregation representation method. The specific aggregation method is described as follows:

[0071] 1. User behavior representation in virtual machine-service system link

[0072] The user behavior representation of the link is computed from the virtual machine node features, the service system node features, and the virtual machine-service system link edge features.

[0073] The virtual machine node features are defined as E v , the service system node features are defined as E S , and the virtual machine-service system link edge features are defined as e V-S . In computing the user behavior representation, for a service system neighbor S of a virtual machine node V, first, the node features and edge features are concatenated z s = [E s || e V-S ]; then, for the concatenated features, a linear transformation and activation are performed: m S = ReLU (W f · z S + b f ), where W f are learnable weights; then the transformed features of all service system neighbors are max-pooled m N(V) = max S∈N(V) m S ; next, the virtual machine node features and the aggregated neighbor features are concatenated, and the center node is updated: In this way, the behavior pattern of the virtual machine accessing the service system can be captured.

[0074] 2. User behavior representation in terminal-virtual machine link

[0075] The user behavior representation of the link is computed from the terminal node features, the virtual machine node features, and the terminal-virtual machine link edge features.

[0076] The terminal node features are defined as E T , the virtual machine node features are defined as E' V , and the terminal-virtual machine link edge features are defined as e T-V . Since the terminal and the virtual machine are usually one-to-one connected, the node features and edge features can be directly fused:

[0077] z T-V = [E T || E' V || e T-V ]

[0078] Then a feature transformation is performed h T-V = ReLU (W t · z T-V + b t ), where w T may strengthen the weights of the protocol type and packet interval features.

[0079] 3. Full-link user behavior representation

[0080] Firstly, the representation results of two segments of links are spliced as global features: Then, a consistency factor sim is introduced to measure the consistency of the behaviors of two segments of links by cosine similarity, so as to capture the relevance of user-related operations: Finally, the spliced features and the consistency factor are fused to obtain the full-link user behavior representation H beahvior = [H global || sim], which can make a fine-grained judgment on user behavior after passing through a full connection layer. The introduction of the consistency determination helps to capture the feature that whether the application running in the virtual machine is triggered by the user who is logging in.

[0081] In the implementation process, the neighbor feature aggregation through multi-layer stacking can be deeply cooperated with full-link modeling, edge-point fusion, dynamic updating and other technologies, not only expanding the perception range of nodes to the multi-hop neighborhood, but also realizing the multi-layer abstraction of "original traffic-protocol features-behavior semantics", while ensuring the real-time adaptive ability of the model to the dynamic access of devices and complex interaction of protocols in the remote desktop environment, greatly improving the granularity and accuracy of behavior recognition.

[0082] Further, in the spatial feature extraction stage, the system has obtained the structured representation of each node in each time window through the graph representation model. In order to capture the dynamic features of user behavior evolution over time, this embodiment further introduces a long short-term memory network (Long Short-Term Memory, LSTM) to model the time sequence of the cross-time embedding sequence of the node. The LSTM model updates the state and extracts the memory of the node embedding in the sequence to generate a vector representation of the time dimension of the graph vector at different time

[0083] (1) LSTM model input

[0084] The network graph of the remote desktop system is divided into a sequence {T1, T2, …, T n} according to time windows. For any node v, its embedding representation in each time window T t is The embedding is output by the above graph representation model:

[0085]

[0086] (2) LSTM encoding process

[0087] The LSTM network models the above embedding sequence to learn the time dependence of the node representation. The state transition of the LSTM is as follows:

[0088] f t =σ(W f ·[h t-1 ,x t ]+b f )

[0089] i t =σ(W i ·[h t-1 ,x t ]+b i )

[0090] o t =σ(W o ·[h t-1 ,x t ]+b o )

[0091]

[0092] h t =o t *tanh(c t )

[0093] in:

[0094] f t ,i t ,o t They are forget gate, input gate, and output gate respectively;

[0095] c t is the memory unit state, h t is the hidden state output of the current time step;

[0096] σ(·) represents the Sigmoid activation function, and tanh(·) represents the hyperbolic tangent activation;

[0097] All W and b are learnable parameters of the LSTM model.

[0098] The second aspect of this embodiment discloses a remote desktop behavior recognition method, such as Figure 3 shown.

[0099] The network traffic generated during the remote desktop access process is obtained, and node features and link features are extracted from the network traffic. The node features and link features are input into the remote desktop behavior recognition model disclosed in the first aspect of this embodiment to obtain the output sequence {h1, h2, ..., h n}, that is, the sequence obtained by the LSTM model in the recognition model after the modeling of the entire time window is completed.

[0100] Further, the output sequence {h1,h2,…,hn Global temporal pooling is performed to obtain a global behavior representation of the node in the time dimension:

[0101]

[0102] H v Both the spatial structure embedding of the node and the time evolution feature are retained, and are the input basis of a subsequent behavior classification and audit analysis module.

[0103] To realize fine classification of the user behavior corresponding to the node, a fully connected neural network (FCN) is adopted as a classifier structure in the embodiment, and a DropOut layer is introduced to avoid overfitting. The global behavior representation is input into the classifier, and a Softmax function is introduced in the output layer to perform multi-class prediction, so as to realize accurate division of the operation type. The operation types supported by the embodiment for prediction include user editing of word / ppt / excel / online documents, browsing of web pages, video watching, and picture opening.

[0104] In some embodiments, different-risk operations can also be divided, and according to the category label corresponding to the maximum probability value, the behavior is divided into behavior types such as “normal operation”, “remote access”, “data download”, and “abnormal control”, to provide a structured basis for security audit.

[0105] The third aspect of the embodiment discloses an updating method of the remote desktop behavior recognition model.

[0106] To improve the real-time performance of the model and the adaptability to dynamic graph structures, a sliding time window mechanism and an incremental graph updating strategy are introduced into the remote desktop behavior recognition model disclosed in the first aspect of the application.

[0107] Network traffic is divided into a continuous time window sequence {T1, T2, T3, …, T n} according to a fixed time length. In the embodiment, the fixed time length is 5 minutes. Each time window T i corresponds to a network behavior graph G i = (V i , E i ), where V i represents a graph node set, and E i represents a set of edge nodes.

[0108] When a terminal accesses for the first time or a virtual machine accesses a certain business system for the first time, a new node and an edge are dynamically added in the graph structure;

[0109] If a node has no active record in continuous N time windows, or it is detected that the connection is disconnected, it is determined to be invalid and is removed.

[0110] The attributes of the existing edges, such as communication frequency and traffic, are dynamically updated, or the weights are decayed according to the activity level.

[0111] The mechanism guarantees the sensitivity of the graph structure to the dynamic behavior of the user, so that the model inference process can maintain the latest topology structure and avoid invalid information interference.

[0112] The above examples are only used to illustrate the technical solutions of the present application, but not to limit them. Those skilled in the art can modify or equivalently replace the technical solutions of the present application without departing from the spirit and scope of the present application. The protection scope of the present application should be subject to the description of the claims.

Claims

1. A method for training a remote desktop behavior recognition model, wherein the model includes a first neural network and a second neural network, and the steps include: Get remote desktop network traffic; Taking terminals, virtual machines and business systems as nodes, extracting node features from the network traffic; Taking the link from the terminal to the virtual machine and the link from the virtual machine to the business system as a link, extracting link features from the network traffic; Inputting the node features and the link features into a first neural network for training to obtain an embedding sequence divided by time windows; The embedded sequence is input into a second neural network for training to obtain a trained remote desktop behavior recognition model.

2. The method according to claim 1, characterized in that The node features include terminal node features, virtual machine node features and business system node features; the link features include virtual machine-business system link edge features and terminal-virtual machine link edge features.

3. The method according to claim 2, characterized in that Inputting the node features and the link features into a first neural network for training, wherein the first neural network is a GraphSAGE model, including: Sampling neighbor nodes of each node; The node features and the link features are aggregated according to the relationship between the node and the neighboring nodes.

4. The method according to claim 3, characterized in that Aggregating the node features and the link features includes: Obtaining a first user behavior representation based on the relationship between the node and the neighboring node through the virtual machine node feature, the business system node feature, and the virtual machine-business system link edge feature; Obtaining a second user behavior representation based on the relationship between the node and the neighboring node using the terminal node feature, the virtual machine node feature, and the terminal-virtual machine link edge feature; A consistency judgment is performed on the first user behavior representation and the second user behavior representation to obtain a full-link user behavior representation and complete aggregation.

5. The method according to claim 1, wherein The embedded sequence is input into a second neural network for training, where the second neural network is an LSTM model, including: The embedded sequence is modeled and the parameters in the LSTM model are trained.

6. A remote desktop behavior recognition method, comprising the steps of: Acquire the remote desktop network traffic to be detected, and extract the detection node features and the detection link features from the network traffic to be detected; the detection node feature and the detection link feature; Inputting the remote desktop behavior recognition model described in any one of claims 1 to 5 to obtain an output sequence; A global behavior representation is obtained through the output sequence, and a corresponding behavior type is generated.

7. The method according to claim 6, characterized in that The global behavior representation is obtained through the output sequence, and the corresponding behavior type is generated, including: Performing average pooling on the output sequence to obtain the global behavior representation; The global behavior representation is input into a classifier to generate a corresponding behavior type.

8. The method according to claim 7, characterized in that The classifier adopts the FCN model.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, the computer program being configured to be executed by the processor, the computer program comprising instructions for executing the method according to any one of claims 1 to 5 or 6 to 8.

10. A storage medium storing a computer program, wherein when the computer program is executed by a computer, the method according to any one of claims 1 to 5 or 6 to 8 is implemented.

Images