A Cross-Platform User Behavior Analysis Method and System Based on Transfer Learning

Abstract

This invention provides a cross-platform user behavior analysis method and system based on transfer learning, relating to the field of network security technology. First, it acquires historical network behavior records from a source domain security platform and real-time network behavior stream data from a target domain security platform. The former includes security behavior sequences of source domain users under different access scenarios, while the latter includes dynamic security operation records of the target domain user's current session. Next, it extracts cross-domain security features from both types of data to construct a cross-domain security behavior association graph. Based on this graph, it uses a transfer learning model to transfer historical malicious behavior patterns from the source domain to the target domain, generating cross-platform transferred security features. Then, it calls a security behavior analysis model for joint modeling and temporal security association analysis to identify abnormal security behavior patterns of target domain users. Finally, it matches the abnormal patterns with a network security handling rule base to generate and distribute protection policies, achieving real-time risk interception.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a cross-platform user behavior analysis method and system based on transfer learning. Background Technology

[0002] In the field of cybersecurity, with the continuous expansion and increasing complexity of network applications, the analysis of user behavior on different security platforms is crucial for ensuring network security. Currently, due to differences in architecture, application scenarios, and user groups, different security platforms have accumulated a large amount of user network behavior data.

[0003] Existing user behavior analysis methods are typically limited to a single platform. While source domain security platforms accumulate rich historical network behavior records, encompassing various security behavior sequences under different access scenarios, such as login operations, permission changes, resource access, and anomaly blocking, this data only reflects user behavior patterns within that platform. Target domain security platforms primarily focus on real-time network behavior stream data, including dynamic security operation records of target domain users in the current session, such as session identifiers, access request types, permission verification status, and resource operation trajectories. However, they lack in-depth mining and utilization of historical malicious behavior patterns.

[0004] The difficulty in directly sharing and correlating data across different platforms hinders the full utilization of malicious behavior knowledge accumulated in the source domain to assist the target domain in conducting more accurate user behavior analysis and security protection. Furthermore, data analysis from a single platform struggles to comprehensively capture user behavioral characteristics and potential security threats across different scenarios, resulting in vulnerabilities and blind spots in network security protection. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a cross-platform user behavior analysis method based on transfer learning, the method comprising:

[0006] The system acquires historical network behavior records from the source domain security platform and real-time network behavior stream data from the target domain security platform. The historical network behavior records contain security behavior sequences of source domain users under different access scenarios. The security behavior sequences include login operation records, permission change records, resource access records, and abnormal blocking records. The real-time network behavior stream data contains dynamic security operation records of target domain users in the current session. The dynamic security operation records include session identifier, access request type, permission verification status, and resource operation trajectory.

[0007] Cross-domain security feature extraction processing is performed on the historical network behavior record data and the real-time network behavior stream data to identify network behavior types with security semantic associations in the source domain and the target domain, and to construct a cross-domain security behavior association graph.

[0008] Based on the cross-domain security behavior association graph, the historical malicious behavior pattern knowledge of the source domain security platform is transferred to the target domain security platform through a transfer learning model, generating cross-platform transfer security features that integrate cross-domain malicious pattern features.

[0009] The security behavior analysis model is invoked to jointly model the cross-platform migration security features and the target domain's current security behavior features in the real-time network behavior stream data, and the abnormal security behavior patterns of target domain users are identified through time-series security correlation analysis.

[0010] Based on the abnormal security behavior pattern, a preset network security handling rule base is matched to generate a network security protection policy that includes risk behavior types and corresponding blocking measures. The network security protection policy is then sent to the access control module of the target domain security platform to perform real-time risk interception operations.

[0011] In another aspect, embodiments of the present invention also provide a cross-platform user behavior analysis system based on transfer learning, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0012] Based on the above, this embodiment of the invention acquires historical network behavior records from the source domain security platform and real-time network behavior stream data from the target domain security platform. It then performs cross-domain security feature extraction processing on both types of data and constructs a cross-domain security behavior association graph. This effectively identifies network behavior types with security semantic associations in the source and target domains, achieving the association and integration of cross-platform behavior features. Based on the cross-domain security behavior association graph, a transfer learning model is used to transfer historical malicious behavior pattern knowledge from the source domain to the target domain, generating cross-platform migration security features that integrate cross-domain malicious pattern features. This fully leverages the value of the source domain data. A security behavior analysis model is invoked to jointly model the cross-platform migration security features and the current security behavior features of the target domain. Through temporal security association analysis, abnormal security behavior patterns of target domain users are accurately identified, improving the accuracy and timeliness of abnormal behavior detection. Finally, based on the abnormal security behavior patterns, a preset network security handling rule base is matched to generate and distribute network security protection strategies, achieving real-time risk interception operations and effectively enhancing network security protection capabilities. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the execution flow of the cross-platform user behavior analysis method based on transfer learning provided in an embodiment of the present invention.

[0014] Figure 2 This is a schematic diagram of exemplary hardware and software components of a cross-platform user behavior analysis system based on transfer learning provided in an embodiment of the present invention. Detailed Implementation

[0015] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a cross-platform user behavior analysis method based on transfer learning, provided in one embodiment of the present invention. The following is a detailed description of this cross-platform user behavior analysis method based on transfer learning.

[0016] Step S110: Obtain historical network behavior record data from the source domain security platform and real-time network behavior stream data from the target domain security platform. The historical network behavior record data includes security behavior sequences of source domain users under different access scenarios. The security behavior sequences include login operation records, permission change records, resource access records, and abnormal blocking records. The real-time network behavior stream data includes dynamic security operation records of target domain users in the current session. The dynamic security operation records include session identifier, access request type, permission verification status, and resource operation trajectory.

[0017] In this embodiment, the source domain security platform is set as the enterprise's internal office network security platform, and the target domain security platform is the enterprise's cloud business system security platform.

[0018] When retrieving historical network behavior records from the source domain security platform, extraction must be performed through the platform's built-in data interface. This interface follows a pre-defined data interaction protocol and can retrieve all security behavior sequences within a specified time period from the source domain's database. These security behavior sequences are stored and categorized by user identifiers, with each user identifier corresponding to various records generated under different access scenarios.

[0019] The extraction of login operation records must cover relevant information each time a user logs into the system. Login method information is obtained by parsing the login verification method field in the system log; different login methods correspond to different identification codes. Login device information is extracted from device access records, including device type identifiers, hardware signatures, etc. Login location information is determined based on the identification information of the network access point, which corresponds to a specific network area.

[0020] The acquisition of permission change records relies on the operation logs of the permission management module in the source domain security platform. When a user's permissions change, the system automatically records the permission level before and after the change, the executor of the change operation, the time of the change, and a description of the reason for the change. This information will be fully extracted and included in the historical network behavior record data.

[0021] Extracting resource access records requires traversing the access logs of all accessible resources within the source domain. For each user's resource access behavior, the system records the resource identifier accessed, the start and end times of the access, the type of operation performed during the access process (such as read, modify, delete, etc.), and access frequency statistics.

[0022] The abnormal blocking records are extracted from the security protection module logs of the source domain security platform. When the system detects abnormal user behavior and blocks it, it can record information such as the time of the blocking, the blocked user's ID, the specific behavior that triggered the blocking, the blocking method (such as temporarily prohibiting login, restricting operation permissions, etc.), and the duration of the blocking.

[0023] When acquiring real-time network behavior flow data from the target domain security platform, this is achieved through the platform's real-time data acquisition module. This module monitors user sessions in real time and encapsulates dynamic security operation records according to a preset format before transmitting them to the data processing center.

[0024] The session identifier is automatically generated by the target domain security platform when a user establishes a session. It is a unique string used to identify the user's actions throughout the session. The access request type is determined based on the user's action instructions within the session; different action instructions correspond to different request type identifiers.

[0025] The permission verification status is obtained based on the result of permission verification of user operations by the target domain security platform. When a user performs an operation, the system performs permission verification and records the verification result (such as passed, failed, or requiring further verification) in real time.

[0026] Resource operation tracking records the sequence and specific details of a user's access to and operation of various cloud resources during a session. Each resource operation is recorded, including the name of the resource operated on, the type of operation, the time of the operation, and the result of the operation.

[0027] For user privacy-sensitive data involved in the data acquisition process, such as user authentication information and personal preference settings, data anonymization techniques are employed. Specifically, sensitive fields are replaced or encrypted to ensure that specific user information cannot be identified during data storage and transmission. Simultaneously, access control mechanisms are implemented to restrict access to sensitive data, ensuring that only authorized personnel and systems can access this data to prevent privacy leaks.

[0028] Step S120: Perform cross-domain security feature extraction processing on the historical network behavior record data and the real-time network behavior stream data, identify network behavior types with security semantic association in the source domain and target domain, and construct a cross-domain security behavior association graph.

[0029] This step aims to extract security features from behavioral data in the source and target domains, identify network behavior types with security semantic associations, and construct an association graph based on these features.

[0030] Step S121: Extract a source domain security feature set from the security behavior sequence of the historical network behavior record data. The source domain security feature set includes login behavior features, permission operation features, resource access features, and abnormal response features. The login behavior features are used to describe the login method, login device, and login location information of the source domain user. The permission operation features are used to represent the user's behavior of changing system permissions. The resource access features are used to describe the path and frequency pattern of the user's access to network resources. The abnormal response features are used to record the blocking records and response types of abnormal behaviors by the security platform.

[0031] When extracting the source domain security feature set, in-depth analysis of historical network behavior records is required. For login behavior features, relevant information is extracted from login operation records and characterized. Login method features are represented by login method identification codes, with different identification codes corresponding to different login methods; login device features are composed of a combination of device type identifier and hardware feature code; and login location features are converted into corresponding location feature vectors based on the identification information of the network access point.

[0032] Extracting permission operation features involves analyzing permission change records and transforming user actions that alter system permissions into feature vectors. These feature vectors contain information such as the direction of the permission change (elevation or demotion), the magnitude of the change, the frequency of the change, and the triggering conditions for the change.

[0033] Resource access features are extracted based on resource access records. By analyzing the paths users take to access network resources, path feature vectors are generated; based on statistical information on access frequency, frequency feature vectors are constructed. The path feature vectors and frequency feature vectors together constitute the resource access features.

[0034] The abnormal response features are extracted from the abnormal blocking records. The blocking records and response types of the security platform for abnormal behavior are transformed into feature vectors, which include information such as the blocking frequency, blocking method, response speed, and response strength.

[0035] Step S122: Extract the target domain security feature set from the dynamic security operation records of the real-time network behavior flow data. The target domain security feature set includes session access features, permission verification features, resource operation features, and connection status features. The session access features are used to describe the session establishment method and duration of the target domain user. The permission verification features are used to represent the permission verification result of the user's operation. The resource operation features are used to reflect the user's CRUD operation trajectory on the target domain resources. The connection status features are used to record the stability of the network connection and the data transmission status.

[0036] When extracting the target domain security feature set, real-time network behavior flow data is parsed and characterized. Session access features are extracted by obtaining the session establishment method (e.g., login via webpage, client login) from the session establishment information and converting it into corresponding feature codes. Session duration is calculated using the time difference between the session start and end, and then converted into a duration feature vector.

[0037] The permission verification features are generated based on the permission verification status, and different verification results (pass, fail, require further verification, etc.) are transformed into corresponding feature values ​​to form a permission verification feature vector.

[0038] Resource operation characteristics are extracted and analyzed to understand the user's CRUD (Create, Read, Update, Delete) operations on target domain resources. Each operation type is encoded, and an operation sequence feature vector is generated based on the order of operations and the objects being operated on, thereby reflecting the resource operation characteristics.

[0039] Connection state features are extracted based on network connection monitoring data. Network connection stability is transformed into a stability feature vector by information such as the frequency of connection interruptions and changes in connection latency; data transmission status is generated into a transmission status feature vector based on information such as transmission rate and whether transmission is complete. The stability feature vector and the transmission status feature vector together constitute the connection state features.

[0040] Step S123: Perform security semantic association recognition processing on the login behavior features and permission operation features in the source domain security feature set and the session access features and permission verification features in the target domain security feature set. By analyzing their respective security function intentions, determine cross-domain security behavior type pairs with similar protection objectives. The cross-domain security behavior type pairs include the correspondence between source domain login behavior and target domain session establishment behavior, and the correspondence between source domain permission change behavior and target domain permission verification behavior.

[0041] Security semantic association recognition is the core of this step. By analyzing the security functional intent behind the features, similar behavior types across domains can be found.

[0042] Step S1231: Extract login behavior semantic description information from the login behavior features of the source domain security feature set. The login behavior semantic description information includes login method description, login device type description, and login location description.

[0043] When extracting semantic description information of login behavior, semantic parsing is performed on the login behavior features. The login method description is a textual description of the login method in the login behavior features, such as "password login" or "fingerprint login"; the login device type description is based on the device type identifier in the login device features and is transformed into descriptions such as "desktop computer" or "mobile terminal"; the login location description is based on the network access point information corresponding to the login location feature vector and is transformed into descriptions such as "office intranet" or "external public network".

[0044] Step S1232: Extract session establishment semantic description information from the session access features of the target domain security feature set. The session establishment semantic description information includes a description of the session initiation method, a description of the session device identifier, and a description of the session network environment.

[0045] Semantic parsing is performed on session access features to extract semantic descriptions of session establishment. The session initiation method description is a textual description of how the session was established, such as "initiating a session via a browser" or "initiating a session via a dedicated client"; the session device identification description is based on the device information involved in the session access features and is transformed into descriptions such as "Windows system device" or "iOS system device"; the session network environment description is based on the network access information at the time of session establishment and is transformed into descriptions such as "enterprise intranet" or "Internet".

[0046] Step S1233: Perform security function intent annotation processing on the login behavior semantic description information and the session establishment semantic description information. Determine the corresponding security protection intents through manual annotation or pre-trained intent recognition models. The security protection intents include identity authenticity verification intent, device legitimacy verification intent, and environmental security verification intent.

[0047] When annotating security function intents, if manual annotation is used, security experts will establish semantic description information based on login behavior semantic description information and session information, determine the underlying security protection intent, and make corresponding annotations.

[0048] If a pre-trained intent recognition model is used, this model, trained on a large amount of labeled data, can identify the security intent corresponding to the semantic description information. By inputting the login behavior semantic description information and the session establishment semantic description information into the pre-trained intent recognition model, the model can output corresponding security intent labels, such as identity verification intent, device legitimacy verification intent, or environmental security verification intent.

[0049] For example, the semantic description of login behavior, "login to a desktop computer on the office intranet with a password," may be labeled as an intent to verify identity authenticity and an intent to verify environmental security. Similarly, the semantic description of session establishment, "initiate a session using an iOS device in an Internet environment via a browser," may be labeled as an intent to verify device legitimacy and an intent to verify environmental security.

[0050] Step S1234: Perform preliminary matching between the semantic description information of login behavior with the same security protection intent and the semantic description information of session establishment to form candidate security behavior type pairs.

[0051] After obtaining the security protection intentions of the login behavior semantic description information and the session establishment semantic description information, the security protection intentions of the two are compared. When the two have the same security protection intention, the corresponding login behavior and session establishment behavior are initially matched to form candidate security behavior type pairs.

[0052] For example, if the security intent of a login behavior is to verify the authenticity of the identity and the legitimacy of the device, and the security intent of a session establishment behavior is also to verify the authenticity of the identity and the legitimacy of the device, then these two behaviors are combined into a pair of candidate security behavior types.

[0053] Step S1235: Extract the semantic description information of permission operation and permission verification corresponding to the source domain permission operation features and the target domain permission verification features, respectively, and determine the corresponding security protection intent to form another set of candidate security behavior type pairs.

[0054] Extract semantic description information of permission operations from the source domain permission operation features. This semantic description information is a textual description of user permission change behavior, such as "promote user A's permission from ordinary employee to department administrator" or "revoke user B's file modification permission".

[0055] Extract permission verification semantic description information from the permission verification features of the target domain. This permission verification semantic description information is a textual description of the permission verification result, such as "User C's operation permission verification passed" or "User D's operation permission verification failed, insufficient permissions".

[0056] Using the same method as in step S1233, determine the security protection intent corresponding to the semantic description information of permission operation and the semantic description information of permission verification. These security protection intents may include permission rationality verification intent, operation compliance verification intent, etc.

[0057] The semantic description information of permission operations and permission verification with the same security protection intent are matched to form another set of candidate security behavior type pairs.

[0058] Step S1236: Perform functional similarity calculation on the candidate security behavior type pairs. By comparing the degree of overlap between behavior triggering conditions, operation execution process and security response results, generate a functional similarity score. When the functional similarity score exceeds a preset similarity threshold, it is determined to be a cross-domain security behavior type pair with security semantic association.

[0059] When calculating the functional similarity of candidate security behavior pairs, the triggering conditions of the two behaviors in each candidate pair are first analyzed. The triggering conditions include the preconditions for the behavior to occur and the event that triggers the behavior. The similarity of the triggering conditions is obtained by comparing the degree of overlap between the two triggering conditions.

[0060] Next, the operation execution process is analyzed, including the steps of the behavior execution, the modules involved, the order of operations, etc., and the degree of overlap between the two operation execution processes is compared to obtain the process similarity.

[0061] Then, the security response results are analyzed, including the system's response after the action is executed and its impact on the system state. The degree of overlap between the two security response results is compared to obtain the similarity of the response results.

[0062] The similarity of triggering conditions, process similarity, and response results is calculated by combining them according to preset weights to generate a functional similarity score. The preset weights are determined based on the importance of each factor in the functional similarity assessment; for example, the weight of triggering conditions and response results may be higher than the weight of the operation execution process.

[0063] When the functional similarity score exceeds the preset similarity threshold, it indicates that the candidate security behavior type pair has a high functional similarity and is thus identified as a cross-domain security behavior type pair with security semantic association.

[0064] Step S124: Based on the cross-domain security behavior type pair, and in conjunction with the network security policy documents of the source domain and the target domain, extract the association rules between the security behavior types. The association rules include behavior triggering condition association, operation object association, and security policy response association.

[0065] Obtain network security policy documents for the source and target domains. These documents specify in detail the handling methods, triggering conditions, and target objects for different security behaviors.

[0066] Based on cross-domain security behavior type pairs, we search for clauses and regulations related to these behavior types in cybersecurity policy documents. By analyzing these clauses, we extract the correlation rules between security behavior types.

[0067] Behavior trigger condition association refers to the relationship between the trigger conditions of one security behavior and the trigger conditions of another security behavior. For example, the trigger condition of "multiple incorrect password logins" in the source domain may be associated with the trigger condition of "re-initiating the session after abnormal interruption" in the target domain.

[0068] Operation object association refers to the association between the operation objects targeted by two security behaviors. For example, the permission change behavior of "internal database" in the source domain and the access behavior of "cloud database" in the target domain may have an association in terms of operation objects.

[0069] Security policy response correlation refers to the correlation between the response policies of a security platform to two security behaviors. For example, the "temporarily freeze account" response in the source domain to abnormal login behavior and the "terminate session connection" response in the target domain to abnormal session behavior may have a policy correlation.

[0070] Step S125: Based on the cross-domain security behavior type pairs and association rules, construct a cross-domain security behavior association graph with security behavior types as nodes and association rules as edges. The edge attributes of the cross-domain security behavior association graph include an association strength description, which is generated based on the functional similarity of cross-domain security behaviors and the overlap of protection targets.

[0071] Each security behavior type in the cross-domain security behavior type pair is used as a node in the association graph, and each node contains information such as the identifier and semantic description of that security behavior type.

[0072] The extracted association rules are used as edges connecting nodes. Each edge corresponds to one association rule, and the type of association rule is recorded (such as behavior trigger condition association, operation object association, etc.).

[0073] The edge association strength description is generated by combining the functional similarity of cross-domain security behaviors and the overlap of protection objectives. The functional similarity is the functional similarity score calculated in step S1236, and the overlap of protection objectives is obtained by comparing the degree of overlap of the protection objectives of the two security behaviors.

[0074] The functional similarity and the overlap of protection targets are combined, for example, by taking the average of the two, or by adding them together after assigning different weights according to their importance, to obtain a numerical value describing the association strength. The larger the value, the higher the association strength.

[0075] The completed cross-domain security behavior association map can clearly show the relationship and strength of the association between security behavior types in the source domain and the target domain.

[0076] Step S130: Based on the cross-domain security behavior association graph, the historical malicious behavior pattern knowledge of the source domain security platform is transferred to the target domain security platform through a transfer learning model to generate cross-platform migration security features that integrate cross-domain malicious pattern features.

[0077] This step utilizes a cross-domain security behavior association graph and leverages a transfer learning model to achieve cross-domain transfer of knowledge about malicious behavior patterns, thereby generating security features that integrate cross-domain malicious pattern characteristics and enhancing the target domain's ability to identify malicious behavior.

[0078] Step S131: Input the malicious behavior samples in the historical network behavior record data into the source domain security feature layer of the transfer learning model. Based on the association rules in the cross-domain security behavior association graph, perform feature space mapping processing on the source domain malicious behavior features, transform the source domain malicious behavior features from the source domain security feature space to the target domain security feature space, and generate initial transfer malicious features. The initial transfer malicious features include common malicious login pattern features, unauthorized operation pattern features, and abnormal resource access pattern features in the source domain.

[0079] Malicious behavior samples are selected from historical network behavior records. These samples are known malicious behavior sequences that have been labeled, such as login behavior that attempts to crack passwords multiple times, unauthorized privilege escalation behavior, and access behavior that downloads a large number of sensitive resources.

[0080] These malicious behavior samples are input into the source domain security feature layer of the transfer learning model. This layer is responsible for extracting and representing the malicious behavior features from the source domain. The source domain security feature layer consists of multiple neurons that process the input malicious behavior samples to extract the malicious behavior features from the source domain. These features exist in the source domain security feature space in the form of feature vectors.

[0081] Based on the association rules in the cross-domain security behavior association graph, the correspondence between the malicious behavior features of the source domain and the various feature dimensions in the security feature space of the target domain is determined. For example, the "login frequency" dimension of the malicious login pattern feature in the source domain may correspond to the "session initiation frequency" dimension of the session establishment behavior feature in the target domain, and the "abnormal login location" dimension in the source domain may correspond to the "abnormal session network environment" dimension in the target domain.

[0082] Based on these correspondences, feature space mapping is performed on the source domain malicious behavior feature vector. Specifically, each feature component in the source domain malicious behavior feature vector is mapped to the target domain security feature space according to its corresponding dimension, generating a feature vector in the target domain security feature space, i.e., the initial transferred malicious feature.

[0083] The malicious login pattern features in the initial migration malicious features include the mapping features of common patterns in the source domain, such as multiple failed logins in a short period of time and logins initiated from abnormal locations, in the target domain feature space; the unauthorized operation pattern features cover the mapping features of patterns such as unapproved privilege escalation and operations beyond the scope of permissions in the source domain; the abnormal resource access pattern features include the mapping features of patterns such as a large number of accesses to sensitive resources in the source domain and frequent access to resources outside of working hours.

[0084] Step S132: The initial migrated malicious features are calibrated by the security domain adaptation module of the transfer learning model. Based on the preset adjustment coefficient corresponding to the association strength description of the cross-domain security behavior association graph, the weights of each feature component in the initial migrated malicious features are dynamically adjusted to generate calibrated migrated malicious features. The preset adjustment coefficient is positively correlated with the association strength description, and the feature component corresponding to the association strength description is assigned the corresponding adjustment coefficient.

[0085] The security domain adaptation module is a key module in the transfer learning model used to handle the domain differences between the source and target domains. It reduces the impact of domain shift by adjusting the initial malicious features of the transfer.

[0086] Step S1321: In the security domain adaptation module, a security domain difference evaluation function is constructed based on the cross-domain security behavior association graph. The security domain difference evaluation function is used to quantify the difference in security protection rules between the initial migration malicious features and the target domain security feature set.

[0087] The construction of the security domain difference assessment function needs to comprehensively consider the differences in security protection rules between the source and target domains reflected in the cross-domain security behavior correlation graph. These differences may be reflected in the criteria for determining behavior triggering conditions, the severity of security response strategies, and the granularity of operation permissions.

[0088] The function takes as input an initial set of malicious migration features and a set of security features in the target domain. It calculates the differences between the two in the feature dimensions related to various security protection rules and outputs a quantified difference value. For example, for the rule-related dimension of "login frequency threshold", it compares the difference between the threshold corresponding to the feature component mapped from the source domain and the actual threshold in the target domain, and incorporates this difference into the function calculation.

[0089] Step S1322: Calculate the domain offset index of each feature component in the initial migration malicious feature according to the security domain difference evaluation function. The domain offset index is positively correlated with the degree of difference in security rules between the feature component and the target domain, and the degree of difference corresponds to the domain offset index value of the feature component.

[0090] Each feature component in the initial migrated malicious features is input into the security domain difference evaluation function to calculate the degree of difference between the feature component and the security rules of the source and target domains. Based on the magnitude of the difference, the corresponding domain offset index is determined. The greater the difference, the higher the domain offset index, indicating that the feature component has lower applicability in the target domain and requires more significant adjustments.

[0091] For example, if a certain feature component in the initial migration malicious feature corresponds to "password error threshold of 5 times" in the source domain, while the corresponding threshold in the target domain is 3 times, and the difference between the two is large, then the domain offset index of that feature component is high.

[0092] Step S1323: Extract the association strength description corresponding to each feature component from the cross-domain security behavior association graph, query the preset mapping table based on the association strength description, and determine the preset adjustment coefficient of each feature component. The association strength description and the preset adjustment coefficient in the mapping table are in a corresponding relationship.

[0093] The association strength description of each edge in the cross-domain security behavior association graph corresponds to the degree of association between the related security behavior types in the source and target domains. For each feature component in the initial migrated malicious features, its corresponding association relationship in the association graph is found, and the association strength description of that association relationship is extracted.

[0094] The pre-defined mapping table is constructed based on extensive domain migration experience and the knowledge of security experts. It records the pre-defined adjustment coefficients corresponding to different association strength descriptions. The higher the value of the association strength description, the larger the corresponding pre-defined adjustment coefficient, indicating that the feature component has higher reliability in cross-domain migration and should be assigned a higher weight.

[0095] For example, when the correlation strength is described as "strong correlation", the preset adjustment coefficient may be 0.8; when the correlation strength is described as "medium correlation", the preset adjustment coefficient may be 0.5; and when the correlation strength is described as "weak correlation", the preset adjustment coefficient may be 0.2.

[0096] Step S1324: Generate feature component calibration parameters based on the domain offset index and the preset adjustment coefficient.

[0097] The characteristic component calibration parameters are generated by combining the domain offset index and the preset adjustment coefficient. Specifically, the domain offset index is used to correct the preset adjustment coefficient. The higher the domain offset index, the greater the attenuation effect on the preset adjustment coefficient, and the smaller the obtained calibration parameter; conversely, the lower the domain offset index, the closer the calibration parameter is to the preset adjustment coefficient.

[0098] For example, the calibration parameter can be generated by multiplying the preset adjustment coefficient by (1 minus the ratio of the domain offset index to the maximum domain offset index), thereby achieving dynamic adjustment of the feature component weights.

[0099] Step S1325: Multiply each feature component in the initial migration malicious feature with the corresponding feature component calibration parameter to generate the adjusted feature component.

[0100] For each feature component in the initial migrated malicious features, its value is multiplied by the corresponding feature component calibration parameter to obtain the adjusted feature component. This operation ensures that feature components with small domain offsets and high correlation strength have higher values ​​after adjustment, playing a greater role in subsequent feature processing; while the influence of feature components with large domain offsets and low correlation strength is weakened.

[0101] Step S1326: Combine the adjusted feature components according to the feature dimension order of the target domain security feature set to generate calibrated migration malicious features.

[0102] According to the arrangement order of each feature dimension in the target domain security feature set, the adjusted feature components are rearranged and combined to form calibrated migration malicious features, which fully conform to the dimensional structure of the target domain security feature space and can better adapt to the security environment of the target domain.

[0103] Step S133: Extract the target domain basic security features from the target domain security feature set. The target domain basic security features include target domain-specific permission level features, resource access control list features, and session management rule features.

[0104] Features that reflect the unique security attributes of the target domain are selected from the target domain's security feature set and used as the target domain's basic security features. Permission level features are characteristics related to the user permission level system defined by the target domain based on its own business needs, including the operation scope corresponding to different permission levels and the criteria for dividing permission levels; resource access control list features record the access permission settings for different users or user groups for each resource in the target domain, such as which users can access a resource and what operations they can perform; session management rule features cover the target domain's rules for creating, maintaining, and terminating sessions, such as session timeout and session concurrency limits.

[0105] The extraction of these features needs to be combined with the target domain's security configuration files and policy documents to ensure that the extracted features accurately reflect the target domain's basic security characteristics.

[0106] Step S134: The calibrated malicious migration feature is associated and integrated with the target domain basic security feature to generate a fused intermediate security feature.

[0107] Association integration processing is the process of organically combining calibrated migrated malicious features with the target domain's basic security features. First, the inherent relationship between the two types of features is analyzed. For example, the unauthorized operation pattern feature in the calibrated migrated malicious features may be associated with the permission level feature in the target domain's basic security features, and the abnormal resource access pattern feature may be associated with the resource access control list feature.

[0108] Based on these relationships, the two types of features are concatenated. The calibrated, transferred malicious feature vector and the target domain's basic security feature vector are connected in order of feature dimensions to form a longer feature vector, i.e., a fused intermediate security feature. This concatenation method preserves the complete information of both features, ensuring that the fused feature contains both the malicious pattern knowledge transferred from the source domain and reflects the basic security characteristics of the target domain.

[0109] Step S135: Invoke the malicious knowledge distillation unit of the transfer learning model to encode the historical malicious behavior pattern knowledge of the source domain security platform into a malicious knowledge vector. The malicious knowledge vector includes malicious behavior sequence templates, abnormal feature combination patterns and security response rules identified by the source domain.

[0110] The role of the malicious knowledge distillation unit is to extract and encode complex historical malicious behavior patterns from the source domain into a concise vector form. First, it sorts and summarizes the historical malicious behavior patterns of the source domain security platform, extracting representative malicious behavior sequence templates, such as the typical sequence "attempted login – privilege escalation – resource theft"; abnormal feature combination patterns, i.e., combinations of multiple abnormal features occurring simultaneously, such as the combination of "login from a different location + extensive privilege queries + access to sensitive resources"; and security response rules for these malicious behaviors, such as "triggering secondary verification when detecting login from a different location and extensive privilege queries."

[0111] Then, an encoding algorithm is used to transform this knowledge into a malicious knowledge vector. During the encoding process, each malicious behavior sequence template, abnormal feature combination pattern, and security response rule is mapped to a specific dimension in the vector, and its numerical value indicates the importance or frequency of occurrence of the knowledge.

[0112] Step S136: The fused intermediate security feature is subjected to knowledge enhancement processing through the malicious knowledge vector, so that the fused intermediate security feature carries the regularity knowledge of the source domain malicious behavior pattern, and generates a cross-platform migration security feature. The cross-platform migration security feature includes cross-domain common malicious features migrated from the source domain and target domain local security features.

[0113] Knowledge augmentation is the process of integrating the source domain malicious behavior pattern knowledge contained in the malicious knowledge vector into the fusion intermediate security feature. Specifically, it involves concatenating the malicious knowledge vector with the fusion intermediate security feature vector to form a new feature vector, i.e., cross-platform transferable security feature.

[0114] The spliced ​​cross-platform migration security features not only include the cross-domain common malicious features migrated from the source domain represented by the calibrated migration malicious features, and the target domain local security features represented by the target domain basic security features, but also incorporate the regularity knowledge of the source domain malicious behavior patterns, thereby greatly enhancing the feature representation capabilities.

[0115] Step S140: Call the security behavior analysis model to jointly model the cross-platform migration security features and the target domain current security behavior features in the real-time network behavior stream data, and identify abnormal security behavior patterns of target domain users through time-series security correlation analysis.

[0116] This step utilizes a security behavior analysis model to combine cross-platform migration security characteristics with the current security behavior characteristics of the target domain for modeling and analysis, and identifies abnormal security behavior patterns through time-series correlation analysis.

[0117] The security behavior analysis model is an intelligent analysis framework integrating recurrent neural networks (RNNs) and long short-term memory networks (LSTMs) to jointly model cross-platform migration security features and real-time network behavior features in the target domain. It identifies abnormal security behavior patterns of users in the target domain through temporal security correlation analysis. This security behavior analysis model comprises a multi-layered structure.

[0118] Shared security feature layer: RNN is used to extract the correlation between cross-domain common malicious behavior patterns and real-time behavior of the target domain, and generate cross-domain common security feature vectors;

[0119] Target domain security feature layer: Combines the target domain security policy document to enhance the feature components corresponding to local security rules, and generates target domain-specific security feature vectors;

[0120] Temporal security association module: By dividing time windows, extracting behavior dependency rules (such as trigger condition dependency and operation sequence dependency), and constructing a security behavior transition probability matrix, a temporal association model is generated to describe the differences between normal and malicious behavior patterns.

[0121] Anomaly detection mechanism: By calculating the safety deviation between actual behavior and expected behavior (weighted fusion feature component differences and protection priorities), real-time identification and early warning of abnormal security behavior are achieved.

[0122] Step S141: Input the cross-platform migration security features and the current security behavior features of the target domain into the shared security feature layer of the security behavior analysis model, perform deep security feature extraction processing through a recurrent neural network, capture the correlation between cross-domain common malicious behavior patterns and real-time behavior of the target domain, and generate a cross-domain common security feature vector.

[0123] The target domain's current security behavior characteristics are features extracted from real-time network behavior stream data that reflect the user's current operational state, including the current session state, ongoing resource operations, and permission verification results.

[0124] Cross-platform migration security features and current security behavior features of the target domain are simultaneously input into the shared security feature layer of the security behavior analysis model. This shared security feature layer adopts a recurrent neural network (RNN) structure, which can process sequential data and capture its temporal dependencies.

[0125] Recurrent neural networks (RNNs), through their internal memory units, can retain previously processed feature information when processing input features. This allows them to analyze the correlation between cross-domain common malicious behavior patterns contained in cross-platform migration security features and the current real-time behavior of the target domain. For example, when an operation sequence similar to a cross-domain common malicious behavior pattern appears in the current security behavior features of the target domain, the network can identify the aforementioned correlation.

[0126] Among them, cross-domain common malicious behavior patterns refer to the set of malicious behavior features that have security semantic associations between the source domain (internal office network of an enterprise) and the target domain (cloud business system). They are common threat patterns extracted from historical malicious behavior knowledge of the source domain and adapted to the target domain through transfer learning.

[0127] After processing by a recurrent neural network, deep features that reflect the above-mentioned relationships are extracted, forming a cross-domain common security feature vector.

[0128] Step S142: Input the cross-domain common security feature vector into the target domain security feature layer of the security behavior analysis model, and perform targeted optimization processing in conjunction with the target domain security policy document to strengthen the feature components corresponding to the target domain-specific security rules and generate a target domain-specific security feature vector.

[0129] The target domain security feature layer focuses on optimizing cross-domain common security feature vectors in a target domain-specific way. First, it obtains the target domain's security policy document, which details the target domain's unique security rules, such as access restrictions for specific resources and approval processes for special operations.

[0130] Based on the target domain's security policy document, identify the feature components that need to be strengthened. These feature components correspond to security rules specific to the target domain, such as feature components related to "access permissions for sensitive fields in cloud databases" and feature components related to "approval for cross-regional data transfer," etc.

[0131] These feature components in the cross-domain common security feature vector are enhanced, for example, by increasing their weights, to make them more prominent in subsequent analysis. After the above targeted optimization process, a target domain-specific security feature vector is generated, which better reflects the security behavior characteristics of the target domain itself.

[0132] Step S143: Fuse the cross-domain common security feature vector and the target domain specific security feature vector to generate a joint security behavior feature vector, wherein the joint security behavior feature vector includes malicious pattern features of cross-domain migration and the current real-time security behavior features of the target domain.

[0133] The fusion process uses a splicing method to connect the cross-domain common security feature vector and the target domain-specific security feature vector in the order of feature dimensions to form a joint security behavior feature vector.

[0134] The above fusion method retains all the information of the two feature vectors, so that the joint security behavior feature vector contains both the malicious pattern features migrated from across domains and the current real-time security behavior features of the target domain.

[0135] Step S144: Call the temporal security correlation module of the security behavior analysis model to perform time series dependency analysis on the joint security behavior feature vector. By analyzing the triggering relationship, sequence relationship and causal relationship between security behavior features at consecutive time points, a temporal correlation model of user security behavior sequence is constructed. The temporal correlation model is used to describe the feature change pattern under normal security behavior mode and the feature abnormal trajectory under malicious behavior mode.

[0136] The temporal security association module is responsible for performing time-series analysis on the joint security behavior feature vectors to uncover the dependencies between security behaviors.

[0137] Step S1441: Arrange the joint security behavior feature vectors into a security behavior time series according to the time sequence of the security behaviors. Each feature element in the security behavior time series corresponds to a user security behavior feature at a certain time point. The user security behavior feature includes the login status, permission level, resource access records and operation results at that time point.

[0138] Based on the timestamps of the security behaviors, the feature elements in the joint security behavior feature vector are sorted to form a security behavior time series. Each feature element corresponds to a user's security behavior characteristic at a specific point in time, where login status includes logged in, not logged in, and login abnormality; permission level is the permission level possessed by the user at that point in time; resource access records cover the resource identifier and operation type accessed at that point in time; and operation results include success, failure, and rejection.

[0139] Step S1442: In the time-series security association module, the security behavior time series is divided into time windows. Multiple consecutive security behavior feature elements are combined into a security behavior window. Each security behavior window contains consecutive security behavior features within a preset time length. The time length is determined based on the average response time of security events in the target domain.

[0140] The division of time windows is to facilitate the analysis of security behavior characteristics within a certain time range. The determination of the preset time length should refer to the average response time of security events in the target domain, ensuring that each time window can cover a complete security event processing cycle or a related continuous sequence of behaviors.

[0141] For example, if the average response time for security events in the target domain is 10 minutes, the length of the time window can be set to 10 minutes, and each security behavior window contains all security behavior feature elements within that 10 minutes.

[0142] Step S1443: Perform correlation analysis on the feature elements in each security behavior window. By analyzing the triggering conditions, operation order and causal relationship between the preceding and subsequent security behavior feature elements in the security behavior window, extract the dependency rules between security behaviors. The dependency rules include behavior triggering condition dependency, operation execution order dependency and security state change dependency.

[0143] For each security behavior window, the relationship between its preceding and subsequent feature elements is analyzed one by one. Behavior trigger condition dependency means that the occurrence of a subsequent behavior depends on the preceding behavior meeting specific trigger conditions, such as "resource access can only be granted after successful login (preceding behavior)"; operation execution order dependency means that there is a fixed execution order between behaviors, such as "first requesting permissions (preceding behavior), then changing permissions (subsequent behavior)"; security state change dependency means that the preceding behavior causes a change in the system's security state, which in turn triggers the subsequent behavior, such as "privilege escalation (preceding behavior) leads to a decrease in the system's security state level, thereby triggering security auditing (subsequent behavior)".

[0144] By analyzing these relationships, corresponding dependency rules are extracted as a basis for describing the associations between security behaviors.

[0145] Step S1444: Construct a security behavior transition probability matrix based on the dependency rules. The security behavior transition probability matrix is ​​used to represent the probability of transitioning from one security behavior feature element to the next security behavior feature element. The higher the value of the matrix element, the higher the frequency of the corresponding behavior transition path in the normal security behavior mode.

[0146] The rows and columns of the safety behavior transition probability matrix correspond to different safety behavior feature elements. The element values ​​in the matrix represent the probability of transitioning from the safety behavior feature element corresponding to a row to the safety behavior feature element corresponding to a column. This probability is calculated based on the dependency rules and the frequency of the sequential occurrence of the two behavior feature elements in historical behavior data. For example, if in historical data, the proportion of times behavior B immediately follows behavior A is high compared to the total number of times behavior A occurs, then the element value in row A and column B of the matrix will be larger.

[0147] Step S1445: Combining the security behavior transition probability matrix of multiple security behavior windows, the long-term dependency of the security behavior time series is modeled through a long short-term memory network to generate a time-series correlation model that describes the differences between normal and malicious security behavior patterns. The time-series correlation model includes a set of normal security behavior transition paths and a set of malicious security behavior transition paths.

[0148] Long Short-Term Memory (LSTM) networks can effectively capture long-term dependencies in time series, making them suitable for modeling time series of security behaviors. The security behavior transition probability matrix of multiple security behavior windows is input into the LSTM network.

[0149] By learning the behavior transfer patterns between different windows, the network distinguishes between normal and malicious security behavior patterns. The set of normal security behavior transfer paths includes those that occur frequently under normal circumstances and have a high probability of transfer; the set of malicious security behavior transfer paths includes special transfer paths that only appear under malicious behavior patterns and have a low probability of occurrence under normal conditions.

[0150] The generated temporal association model can store these path sets in a structured data format. Each path contains a sequence of behavioral feature elements, transition probabilities, and corresponding behavioral pattern labels (normal or malicious). For example, a normal security behavior transition path might be "successful login - query public resources - logout," which has a high transition probability; while a malicious security behavior transition path might be "abnormal login - privilege escalation attempt - access sensitive resources," which has a low transition probability under normal conditions.

[0151] Step S145: Based on the temporal correlation model, perform malicious behavior pattern prediction processing on the joint security behavior feature vector to generate the expected security behavior feature sequence of the target domain user. The expected security behavior feature sequence reflects the security behavior features that the user should generate under normal security rules.

[0152] The joint security behavior feature vector is predicted using the constructed temporal correlation model. First, the security behavior feature sequence at the current time and previous times is extracted from the joint security behavior feature vector and input into the temporal correlation model.

[0153] The temporal correlation model analyzes the degree of matching between the current behavior sequence and normal paths based on a set of normal safety behavior transition paths, predicting the user's potential safety behavior characteristics at various subsequent time points. During the prediction process, the temporal correlation model can refer to the transition probabilities of normal safety behavior transition paths, prioritizing transition paths with higher probabilities as the basis for prediction.

[0154] The generated expected security behavior feature sequence is a sequence of feature vectors arranged in chronological order, with each feature vector corresponding to an expected security behavior feature at a future point in time. These features cover aspects such as login status, permission level, resource access plan, and operation type, reflecting the behavioral characteristics that users should exhibit according to normal behavior patterns under the constraints of normal security rules. For example, if the current user is in a normal logged-in state and is accessing ordinary work resources, the expected security behavior feature sequence might include "continue accessing relevant work resources - submit operation results - maintain login status or log out normally".

[0155] Among them, the normal security rules are a behavioral norm system built upon target domain security policy documents, historical normal behavior data, and cross-domain security behavior correlation graphs. They define the behavioral characteristics and security protection principles of target domain users in legitimate operation scenarios. Its core components include:

[0156] Dynamic behavior baseline: A set of normal security behavior transition paths generated by a temporal correlation model, such as high-frequency behavior sequences like "successful login - access to public resources - normal logout", which reflects the temporal dependencies of users' routine operations;

[0157] Static policy constraints: The rules explicitly stated in the target domain security policy document, including session management rules (such as session timeout and concurrency limits), permission level classification standards (such as the scope of operations corresponding to different permissions), and resource access control lists (such as access permission configuration for sensitive resources).

[0158] Expected behavior generation mechanism: Based on the time-series correlation model, the predicted sequence of security behavior features that users should generate later reflects the expected behavior under normal rule constraints, and serves as a benchmark for judging whether the actual behavior is abnormal (such as expected resource access scope, permission operation type, etc.).

[0159] Step S146: Perform real-time comparison and analysis between the current security behavior features of the target domain and the expected security behavior feature sequence, calculate the security deviation between the actual security behavior features and the expected security behavior features, and mark the corresponding behavior features as abnormal security candidate features when the security deviation exceeds a preset deviation threshold.

[0160] Real-time comparison and analysis is a key step in determining whether a user's current behavior is abnormal. It quantifies the difference between actual and expected behavior by calculating the security deviation.

[0161] Step S1461: Extract real-time security behavior feature vectors from the current security behavior features of the target domain. The real-time security behavior feature vectors include the login status vector, permission operation vector, resource access vector, and connection status vector at the current time point.

[0162] The login state vector describes the current user's login status, including login identifier, login duration, and login device status; the permission operation vector records the permission-related operations currently being performed by the current user, such as permission query and permission request; the resource access vector reflects the current user's access to resources, including the accessed resource identifier, access method, and access progress; and the connection state vector contains the current status information of the network connection, such as connection speed, connection stability, and data transmission volume.

[0163] Step S1462: Extract the expected security behavior feature vector corresponding to the current time point from the expected security behavior feature sequence. The expected security behavior feature vector is generated based on the prediction of normal behavior patterns by the time series correlation model and includes expected login status, expected permission operation, expected resource access and expected connection status.

[0164] Based on the current time point, find the corresponding expected security behavior feature vector in the expected security behavior feature sequence. The expected login state in this expected security behavior feature vector corresponds to the real-time login state vector, the expected permission operation corresponds to the real-time permission operation vector, the expected resource access corresponds to the real-time resource access vector, and the expected connection state corresponds to the real-time connection state vector.

[0165] For example, if the current time is 10 minutes after the user logs in, the expected resource access in the expected security behavior feature vector might be "accessing the document resources of project A", while the expected permission operation might be "no permission to change operations".

[0166] Step S1463: After performing feature component alignment processing on the real-time security behavior feature vector and the expected security behavior feature vector, calculate the difference vector of the corresponding feature components in the real-time security behavior feature vector and the expected security behavior feature vector. Each element of the difference vector represents the degree of deviation between the actual value and the expected value of a single security feature component.

[0167] Feature component alignment is performed to ensure that the real-time security behavior feature vector and the expected security behavior feature vector correspond one-to-one in feature dimensions, facilitating subsequent difference calculations. For identical feature dimensions present in two vectors, alignment is performed directly; for feature dimensions that exist only in one vector, the corresponding feature component in the other vector is set to a default value (such as zero), indicating that the feature has no practical meaning in the current situation.

[0168] After alignment, the differences between the corresponding feature components are calculated. For each feature component, the component value in the expected safety behavior feature vector is subtracted from the component value in the real-time safety behavior feature vector, and the difference is used as the element value at the corresponding position in the difference vector. The magnitude of this element value indicates the degree of deviation between the actual value and the expected value of a single safety feature component; a positive value indicates that the actual value is higher than the expected value, and a negative value indicates that the actual value is lower than the expected value.

[0169] Step S1464: Based on the protection priority of each security feature component in the target domain security policy, assign priority weights to each element in the difference vector.

[0170] The target domain security policy clearly defines the importance of different security feature components in the protection system, i.e., protection priority. For example, feature components related to access to sensitive resources have a higher protection priority, while feature components related to browsing ordinary resources have a lower protection priority.

[0171] Based on these protection priorities, a corresponding priority weight is assigned to each element in the difference vector. The higher the protection priority of a feature component, the greater its corresponding priority weight, meaning that deviations in that feature component have a greater impact on the overall security situation. The range of priority weight values ​​is set according to actual needs to ensure that the relative importance of different feature components is reflected.

[0172] Step S1465: Perform a weighted inner product operation on the difference vector and the priority weight to generate a comprehensive safety deviation score. The higher the comprehensive safety deviation score, the greater the deviation between the actual safe behavior and the expected normal behavior.

[0173] The weighted inner product operation is as follows: multiply each element in the difference vector by its corresponding priority weight, and then add all the product results together. The sum is the comprehensive score of safety deviation.

[0174] For example, if the difference vector is [d1, d2, d3] and the corresponding priority weights are [w1, w2, w3], then the comprehensive safety deviation score = d1×w1 + d2×w2 + d3×w3. This calculation method considers both the degree of deviation of each feature component and its importance in security protection, enabling the comprehensive score to more accurately reflect the overall deviation between actual and expected behavior.

[0175] Step S1466: Compare the comprehensive safety deviation score with a preset safety threshold. When the comprehensive safety deviation score exceeds the preset safety threshold, determine the current safety behavior feature as an abnormal safety candidate feature, and record the time point and behavior details corresponding to the abnormal safety candidate feature.

[0176] The preset security threshold is set based on the security requirements of the target domain and historical security event data. It serves as a critical value for determining whether behavior is abnormal. The setting of this preset security threshold needs to comprehensively consider the system's false alarm rate and false negative rate to ensure effective identification of abnormal behavior while avoiding excessive false alarms.

[0177] When the comprehensive security deviation score exceeds the preset security threshold, it indicates that the current security behavior deviates significantly from the expected normal behavior, which may pose a security risk. Therefore, it is marked as an abnormal security candidate feature. At the same time, detailed information such as the time point corresponding to the abnormal security candidate feature, the user identifier involved, the specific behavior content (such as the resources accessed, the operations performed, etc.), and the comprehensive security deviation score are recorded.

[0178] Step S147: Perform context security correlation verification on the abnormal security candidate features, and determine whether they conform to the feature combination rules of known malicious behavior patterns by combining the security behavior features before and after them. When there are abnormal security candidate features that continuously conform to the malicious pattern, they are determined to be abnormal security behavior patterns. The abnormal security behavior patterns include the start time point of the abnormal behavior, the continuous behavior sequence and the corresponding security risk type.

[0179] Contextual security correlation verification is used to further confirm whether the abnormal security candidate features belong to the real abnormal security behavior pattern, and avoid misjudgment due to accidental deviation of a single feature.

[0180] First, the security behavior features adjacent to the candidate anomaly security feature are obtained to form a behavior feature sequence segment containing the candidate feature. The length of this behavior feature sequence segment is set according to the actual situation, and it usually covers several behavior features before and after the candidate feature to comprehensively reflect the context of the candidate feature.

[0181] Then, the behavioral feature sequence fragment is compared with the feature combination patterns of known malicious behavior patterns. The feature combination patterns of known malicious behavior patterns are summarized from historical malicious behavior data and security expert knowledge, and include the feature sequence patterns of typical malicious behaviors, such as "abnormal login - multiple privilege escalation attempts - access to sensitive resources - large-scale data download".

[0182] During the comparison process, the behavioral characteristics in the sequence fragments are analyzed to see if they match the characteristic combination patterns of malicious patterns, including the sequence order of behaviors, the value range of feature components, and the changing trend of security deviation. If there are continuous abnormal security candidate features in the sequence fragment, and the combination of these features conforms to the characteristic combination pattern of a known malicious behavior pattern, then the behavioral pattern corresponding to the sequence fragment can be determined to be an abnormal security behavior pattern.

[0183] Once the abnormal security behavior pattern is identified, it is necessary to determine its starting time point (i.e., the time when the first abnormal security candidate feature appears), the continuous behavior sequence (the complete behavior sequence from the starting time point to the last abnormal security candidate feature), and the corresponding security risk type (such as data leakage risk, privilege abuse risk, etc.).

[0184] Step S150: Based on the abnormal security behavior pattern, match the preset network security handling rule base to generate a network security protection strategy that includes risk behavior types and corresponding blocking measures, and send the network security protection strategy to the access control module of the target domain security platform to perform real-time risk interception operations.

[0185] Based on the identified abnormal security behavior patterns, this step formulates corresponding network security protection strategies and issues them for execution, so as to achieve real-time interception and handling of security risks.

[0186] Step S151: Classify the abnormal security behavior patterns into risk behavior types. By matching the feature change trajectory of the abnormal security behavior patterns with the malicious behavior template library in the network security handling rule base, the risk behavior type to which the abnormal behavior belongs is determined. The risk behavior types include unauthorized login risk, unauthorized operation risk, malicious resource transmission risk, and abnormal connection risk. Each risk behavior type corresponds to a specific combination of malicious behavior features.

[0187] Classifying and processing risk behaviors is a prerequisite for accurately formulating protection strategies. Risk types are determined by matching malicious behavior templates.

[0188] For example, step S1511: extract feature change trajectory from the abnormal security behavior pattern, the feature change trajectory includes the start time point of the abnormal behavior, behavior sequence, resource identifier involved, operation result and security deviation change trend.

[0189] The extraction of feature change trajectories is a detailed analysis of abnormal security behavior patterns. The start time point clarifies the beginning of the abnormal behavior; the behavior sequence is the chronological arrangement of all behavioral features during the abnormal behavior process; the resource identifiers involved record the resources targeted by the abnormal behavior; the operation results reflect the execution status of each behavior (success, failure, etc.); and the security deviation change trend shows the change in the comprehensive security deviation score from the beginning to the end of the abnormal behavior (e.g., gradually increasing, suddenly increasing and then stabilizing, etc.).

[0190] For example, the characteristic change trajectory of a certain abnormal security behavior pattern may be as follows: the starting time is 9:00, the behavior sequence is "login from a different location - attempt to modify permissions - access customer database - download a large amount of data", the resource involved is identified as "customer database", the operation results are "success - failure - success - success" in sequence, and the security deviation change trend is "gradually increase to exceed the threshold and then remain at a high level".

[0191] Step S1512: Retrieve a preset set of malicious behavior templates from the malicious behavior template library of the network security handling rule base. The set of malicious behavior templates includes unauthorized login templates, unauthorized operation templates, malicious resource transmission templates, and abnormal connection templates. Each malicious behavior template includes a typical malicious behavior sequence, a feature component threshold range, and security deviation change characteristics.

[0192] The cybersecurity handling rule base is a pre-built database containing various security handling rules and templates. The malicious behavior template library stores standard templates for different types of risky behaviors.

[0193] The unauthorized login template contains a typical sequence of unauthorized login behaviors, such as "login on unfamiliar device - multiple incorrect passwords - login using default password", and the threshold range of feature components such as "the deviation between the login location and the commonly used location exceeds X" and "the login device is an unregistered device". The security deviation change feature is "the security deviation increases sharply at the moment of login".

[0194] The unauthorized operation template includes a sequence of behaviors such as "a user with ordinary privileges attempts to access the administrator interface - modifies the permission configuration file - executes the administrator operation", and the threshold range of the feature components is such as "the permission operation request exceeds the user's current permission level Y or more". The security deviation change feature is "as the number of unauthorized operation attempts increases, the security deviation gradually increases".

[0195] The behavior sequence of a malicious resource transfer template may be "accessing sensitive resources - compressing and packaging sensitive files - transferring data to an external IP address", with characteristic component threshold ranges such as "transferring file size exceeds Z" and "transfer target IP is an address in the high-risk IP list", and the security deviation change characteristic is "the security deviation reaches its peak during the resource transfer stage".

[0196] The behavioral sequence of the abnormal connection template includes "establishing connections with multiple unknown IPs in a short period of time - sending abnormal format data packets - attempting to probe system vulnerabilities", the threshold range of characteristic components is such as "the number of connection requests per minute exceeds W", and the security deviation change characteristic is "as the number of connection requests increases, the security deviation continues to increase".

[0197] Step S1513: Calculate the trajectory similarity between the feature change trajectory and each malicious behavior template. Generate a trajectory similarity score by comparing the matching degree of the behavior sequence, the conformity of the feature component threshold, and the similarity of the security deviation change trend.

[0198] Trajectory similarity calculation comprehensively evaluates the similarity between feature change trajectories and malicious behavior templates from multiple dimensions.

[0199] The degree of matching between behavioral sequences is determined by comparing the consistency of the types, order, and number of behaviors in the two sequences. For example, if the behavioral sequence of a feature change trajectory is 80% consistent with the behavioral sequence of a template in terms of behavior type and order, then the degree of matching is relatively high.

[0200] The degree of conformity to the feature component threshold is to check whether the feature components in the feature change trajectory fall within the feature component threshold range specified by the template. The more feature components that conform, the higher the similarity of that dimension.

[0201] The similarity of the trends in safety deviation is determined by comparing the curves of safety deviation over time. The more similar the curves are, the higher the similarity in that dimension.

[0202] The similarity scores of the three dimensions mentioned above are combined and calculated according to preset weights to generate a trajectory similarity score. The weights are determined based on the importance of each dimension in the similarity assessment; for example, the matching degree of behavioral sequences may have the highest weight.

[0203] Step S1514: Sort the trajectory similarity scores from high to low, select the malicious behavior template with the highest trajectory similarity score as the matching template, and when the highest trajectory similarity score exceeds the preset template matching threshold, determine the malicious behavior type corresponding to the matching template as the risk behavior type of the abnormal security behavior mode.

[0204] After sorting the trajectory similarity scores of all malicious behavior templates, the template with the highest score is selected as the matching template. The preset template matching threshold is the critical value for determining whether a match is successful. This preset template matching threshold is set according to the specificity of the template and the actual matching requirements.

[0205] When the highest trajectory similarity score exceeds the preset template matching threshold, it indicates that the abnormal security behavior pattern is highly similar to the matching template. Therefore, the malicious behavior type corresponding to the matching template is identified as the risk behavior type of the abnormal security behavior pattern. For example, if the highest-scoring matching template is a malicious resource transmission template, then the risk behavior type is malicious resource transmission risk.

[0206] Step S152: Based on the risk behavior type, query the risk level classification standard in the network security handling rule base, and calculate the risk level assessment value by combining the duration, scope of impact and security deviation of the abnormal security behavior pattern. The risk level assessment value is used to indicate the severity of the risk behavior and corresponds to different response priorities.

[0207] Calculating risk level assessment values ​​helps determine the urgency of the response and the appropriate level of intervention.

[0208] First, the corresponding risk level classification standard is retrieved from the cybersecurity handling rule base based on the type of risk behavior. Different types of risk behaviors have different classification standards. For example, the classification of malicious resource transmission risk may focus more on the sensitivity and volume of transmitted data, while unauthorized login risk may focus more on the permission level of the login account.

[0209] Then, an evaluation is conducted based on the specific parameters of the abnormal security behavior pattern. Duration refers to the length of time from the onset of the abnormal behavior to its identification; the longer the duration, the higher the risk level may be. Scope of impact includes the number of affected resources, the range of users, system modules, etc.; the wider the scope of impact, the higher the risk level. The higher the comprehensive security deviation score, the greater the degree of deviation from normal behavior, and the higher the risk level.

[0210] Based on the risk level classification standards, these parameters are converted into corresponding scores, and then the risk level assessment value is calculated according to a preset calculation formula (such as weighted summation). This risk level assessment value is usually divided into several level intervals, each interval corresponding to a different response priority, such as extremely high, high, medium, and low. The higher the priority, the more urgent and severe the measures required.

[0211] Step S153: Based on the risk behavior type and risk level assessment value, retrieve matching risk blocking measures from the network security handling rule base. The risk blocking measures include session termination measures, permission restriction measures, access blocking measures, identity two-factor authentication measures, and security alarm measures.

[0212] The cybersecurity response rule base stores risk mitigation measures corresponding to each type of risky behavior and risk level assessment value.

[0213] When the risk behavior type is unauthorized login risk and the risk level assessment value is high, the blocking measures that may be invoked include session termination measures (immediately terminating the current login session) and two-factor authentication measures (requiring the user to re-authenticate through a more stringent authentication method); if the risk level assessment value is extremely high, access blocking measures may also be added (prohibiting the user from logging in again for a certain period of time).

[0214] To address the risk of unauthorized operations, depending on the risk level, measures such as permission restrictions (temporarily reducing user permissions to the default level) and access blocking (prohibiting access to specific high-privilege resources) may be taken.

[0215] The blocking measures corresponding to the risk of malicious resource transmission may include access blocking measures (cutting off the connection with the external transmission target), session termination measures, etc., and at high risk levels, security alarm measures may also be triggered (sending real-time alarm information to security managers).

[0216] Possible blocking measures for abnormal connection risks include access blocking measures (prohibiting connections to unknown IPs) and session termination measures.

[0217] Step S154: Integrate the risk behavior type, risk level assessment value and corresponding risk blocking measures into a network security protection strategy. The network security protection strategy also includes the user scope to which the strategy applies, the effective time range and the execution priority.

[0218] A cybersecurity protection strategy is a comprehensive plan for risk management. The applicable user scope of the strategy clearly defines the specific users or user groups to whom the strategy targets; the effective timeframe specifies when the strategy will take effect and its duration, such as "effective immediately, lasting 24 hours"; and the execution priority is determined based on the risk level assessment value, ensuring that high-priority strategies are executed first.

[0219] For example, a complete network security protection strategy might be as follows: the risk behavior type is malicious resource transmission risk, the risk level assessment value is extremely high, the risk blocking measures include "immediately terminating the session, cutting off the connection with the external IP, and sending an alert to the security administrator", the applicable user scope is "user A", the effective time range is "from the time the policy is generated until 24 hours later", and the execution priority is "highest".

[0220] During the integration process, it is essential to ensure that all information within the strategy is accurately matched and logically consistent. For example, when the risk level assessment value is "extremely high," the corresponding risk prevention measures should be sufficiently stringent, and the execution priority should be set to the highest level to ensure rapid response to severe risks. Simultaneously, the user scope applicable to the strategy must precisely match the users involved in the abnormal security behavior patterns to avoid impacting unrelated users.

[0221] Step S155: Distribute the network security protection policy to the access control module of the target domain security platform to perform real-time risk interception operations.

[0222] After the network security protection policy is generated, it is transmitted to the access control module through the policy distribution mechanism within the target domain security platform. The distribution process uses encrypted transmission to ensure that the policy is not tampered with or leaked during transmission.

[0223] After receiving the network security protection policy, the access control module parses the policy and extracts key information such as risk blocking measures, applicable user scope, effective time range, and execution priority. Based on the execution priority, the access control module executes the corresponding risk blocking operations in sequence.

[0224] For example, regarding the network security protection policy in the above example, the access control module first verifies whether user A is in the current session. If so, it immediately executes the "terminate session" operation to disconnect user A from the cloud business system. Then, based on the external IP information specified in the policy, it cuts off the connection with these IPs to prevent malicious resources from continuing to be transmitted. At the same time, according to the preset alarm mechanism, it sends alarm information containing risk details, such as the type of risk behavior, the time of occurrence, and the users involved, to the security administrator's terminal device.

[0225] During execution, the access control module can record operation logs in real time, including the time of policy execution, the specific measures taken, and the operation results, for subsequent auditing and traceability. If an abnormal situation is encountered during execution, such as the inability to terminate the session, the access control module can automatically trigger a backup plan, such as restricting all operation permissions for user A and sending an alarm message again to prompt manual intervention.

[0226] In addition, the access control module can automatically stop related blocking operations and restore the user's normal access permissions after the policy expires, based on the effective time range in the policy (if the previous operation restricted the permissions), ensuring that risks are effectively managed while minimizing the impact on normal business operations.

[0227] Figure 2 The illustration shows exemplary hardware and software components of a cross-platform user behavior analysis system 100 based on transfer learning, which can implement the ideas of this application, according to some embodiments of this application. For example, a processor 120 can be used in the cross-platform user behavior analysis system 100 based on transfer learning and to perform the functions in this application.

[0228] For example, a cross-platform user behavior analysis system 100 based on transfer learning may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the cross-platform user behavior analysis system 100 based on transfer learning may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The methods of this application can be implemented according to these program instructions. The cross-platform user behavior analysis system 100 based on transfer learning also includes an I / O interface 150 between the computer and other input / output devices.

[0229] Furthermore, this embodiment of the invention also provides a readable storage medium, wherein computer-executable instructions are preset in the readable storage medium, and when the processor executes the computer-executable instructions, the above-mentioned cross-platform user behavior analysis method based on transfer learning is implemented.

[0230] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A cross-platform user behavior analysis method based on transfer learning, characterized in that, The method includes: The system acquires historical network behavior records from the source domain security platform and real-time network behavior stream data from the target domain security platform. The historical network behavior records contain security behavior sequences of source domain users under different access scenarios. The security behavior sequences include login operation records, permission change records, resource access records, and abnormal blocking records. The real-time network behavior stream data contains dynamic security operation records of target domain users in the current session. The dynamic security operation records include session identifier, access request type, permission verification status, and resource operation trajectory. Cross-domain security feature extraction processing is performed on the historical network behavior record data and the real-time network behavior stream data to identify network behavior types with security semantic associations in the source and target domains, and to construct a cross-domain security behavior association graph; including: The source domain security feature set is extracted from the security behavior sequence of the historical network behavior record data. The source domain security feature set includes login behavior features, permission operation features, resource access features, and abnormal response features. The login behavior features are used to describe the login method, login device, and login location information of the source domain user. The permission operation features are used to represent the user's behavior of changing system permissions. The resource access features are used to describe the path and frequency of the user's access to network resources. The abnormal response features are used to record the blocking records and response types of abnormal behaviors by the security platform. The target domain security feature set is extracted from the dynamic security operation records of the real-time network behavior flow data. The target domain security feature set includes session access features, permission verification features, resource operation features, and connection status features. The session access features are used to describe the session establishment method and duration of the target domain user. The permission verification features are used to represent the permission verification result of the user's operation. The resource operation features are used to reflect the user's CRUD operation trajectory of the target domain resources. The connection status features are used to record the stability of the network connection and the data transmission status. Security semantic association recognition processing is performed on the login behavior features and permission operation features in the source domain security feature set and the session access features and permission verification features in the target domain security feature set. By analyzing their respective security function intentions, cross-domain security behavior type pairs with similar protection objectives are determined. The cross-domain security behavior type pairs include the correspondence between source domain login behavior and target domain session establishment behavior, and the correspondence between source domain permission change behavior and target domain permission verification behavior. Based on the cross-domain security behavior type pairs, and combined with the network security policy documents of the source domain and the target domain, association rules between security behavior types are extracted. The association rules include behavior triggering condition association, operation object association, and security policy response association. Based on the cross-domain security behavior type pairs and association rules, a cross-domain security behavior association graph is constructed with security behavior types as nodes and association rules as edges. The edge attributes of the cross-domain security behavior association graph include an association strength description, which is generated based on the functional similarity of cross-domain security behaviors and the overlap of protection targets. Based on the cross-domain security behavior association graph, the historical malicious behavior pattern knowledge of the source domain security platform is transferred to the target domain security platform through a transfer learning model, generating cross-platform transfer security features that integrate cross-domain malicious pattern features. The security behavior analysis model is invoked to jointly model the cross-platform migration security features and the target domain's current security behavior features in the real-time network behavior stream data, and the abnormal security behavior patterns of target domain users are identified through time-series security correlation analysis. Based on the abnormal security behavior pattern, a preset network security handling rule base is matched to generate a network security protection policy that includes risk behavior types and corresponding blocking measures. The network security protection policy is then sent to the access control module of the target domain security platform to perform real-time risk interception operations.

2. The cross-platform user behavior analysis method based on transfer learning according to claim 1, characterized in that, The step of performing security semantic association recognition processing on login behavior features and permission operation features in the source domain security feature set and session access features and permission verification features in the target domain security feature set includes: Login behavior semantic description information is extracted from the login behavior features of the source domain security feature set. The login behavior semantic description information includes login method description, login device type description and login location description. Session establishment semantic description information is extracted from the session access features of the target domain security feature set. The session establishment semantic description information includes a description of the session initiation method, a description of the session device identifier, and a description of the session network environment. The semantic description information of the login behavior and the semantic description information of the session establishment are processed by security function intent annotation. The corresponding security protection intents are determined by manual annotation or pre-trained intent recognition model. The security protection intents include identity authenticity verification intent, device legality verification intent and environmental security verification intent. The semantic description information of login behaviors with the same security protection intent is initially matched with the semantic description information of session establishment to form candidate security behavior type pairs; Extract the semantic description information of permission operation and permission verification corresponding to the source domain permission operation features and the target domain permission verification features, respectively, and determine the corresponding security protection intent to form another set of candidate security behavior type pairs; Functional similarity is calculated for the candidate security behavior type pairs. By comparing the degree of overlap between behavior triggering conditions, operation execution process and security response results, a functional similarity score is generated. When the functional similarity score exceeds a preset similarity threshold, it is determined to be a cross-domain security behavior type pair with security semantic association.

3. The cross-platform user behavior analysis method based on transfer learning according to claim 1, characterized in that, Based on the cross-domain security behavior association graph, the historical malicious behavior pattern knowledge of the source domain security platform is transferred to the target domain security platform through a transfer learning model, generating cross-platform transferable security features that integrate cross-domain malicious pattern features, including: Malicious behavior samples from the historical network behavior record data are input into the source domain security feature layer of the transfer learning model. Based on the association rules in the cross-domain security behavior association graph, the source domain malicious behavior features are processed by feature space mapping. The source domain malicious behavior features are transformed from the source domain security feature space to the target domain security feature space to generate initial transfer malicious features. The initial transfer malicious features include common malicious login pattern features, unauthorized operation pattern features, and abnormal resource access pattern features in the source domain. The initial migrated malicious features are calibrated by the security domain adaptation module of the transfer learning model. Based on the preset adjustment coefficient corresponding to the association strength description of the cross-domain security behavior association graph, the weights of each feature component in the initial migrated malicious features are dynamically adjusted to generate calibrated migrated malicious features. The preset adjustment coefficient is positively correlated with the association strength description, and the feature component corresponding to the association strength description is assigned the corresponding adjustment coefficient. Extract the target domain basic security features from the target domain security feature set. The target domain basic security features include target domain-specific permission level features, resource access control list features, and session management rule features. The calibrated malicious migration features are associated and integrated with the target domain basic security features to generate a fused intermediate security feature. The malicious knowledge distillation unit of the transfer learning model is invoked to encode the historical malicious behavior pattern knowledge of the source domain security platform into a malicious knowledge vector. The malicious knowledge vector includes malicious behavior sequence templates, abnormal feature combination patterns and security response rules identified by the source domain. The fused intermediate security features are augmented by the malicious knowledge vector, so that the fused intermediate security features carry the regularity knowledge of the source domain's malicious behavior patterns, generating cross-platform migration security features. The cross-platform migration security features include cross-domain common malicious features migrated from the source domain and target domain local security features.

4. The cross-platform user behavior analysis method based on transfer learning according to claim 3, characterized in that, The security domain adaptation module of the transfer learning model performs domain offset calibration on the initial migrated malicious features. Based on the preset adjustment coefficients corresponding to the correlation strength description of the cross-domain security behavior correlation graph, it dynamically adjusts the weights of each feature component in the initial migrated malicious features to generate calibrated migrated malicious features, including: In the security domain adaptation module, a security domain difference evaluation function is constructed based on the cross-domain security behavior association graph. The security domain difference evaluation function is used to quantify the differences in security protection rules between the initial migration malicious features and the target domain security feature set. The domain offset index of each feature component in the initial migration malicious feature is calculated based on the security domain difference evaluation function. The domain offset index is positively correlated with the degree of difference in security rules between the feature component and the target domain, and the degree of difference corresponds to the domain offset index value of the feature component. The association strength descriptions corresponding to each feature component are extracted from the cross-domain security behavior association graph. Based on the association strength descriptions, a preset mapping table is queried to determine the preset adjustment coefficients for each feature component. The association strength descriptions and preset adjustment coefficients in the mapping table are in a corresponding relationship. Based on the domain offset index and the preset adjustment coefficient, feature component calibration parameters are generated; The adjusted feature components are generated by multiplying each feature component in the initial migration malicious feature with the corresponding feature component calibration parameter. The adjusted feature components are combined in order of feature dimensions of the target domain security feature set to generate calibrated migration malicious features.

5. The cross-platform user behavior analysis method based on transfer learning according to claim 1, characterized in that, The method involves using a security behavior analysis model to jointly model the cross-platform migration security features and the target domain's current security behavior features in the real-time network behavior stream data. Through time-series security correlation analysis, it identifies abnormal security behavior patterns of target domain users, including: The cross-platform migration security features and the current security behavior features of the target domain are input into the shared security feature layer of the security behavior analysis model. Deep security feature extraction is performed through a recurrent neural network to capture the correlation between cross-domain common malicious behavior patterns and real-time behavior of the target domain, and to generate a cross-domain common security feature vector. The cross-domain common security feature vector is input into the target domain security feature layer of the security behavior analysis model, and targeted optimization is performed in conjunction with the target domain security policy document to strengthen the feature components corresponding to the target domain-specific security rules and generate a target domain-specific security feature vector. By fusing the cross-domain common security feature vector and the target domain-specific security feature vector, a joint security behavior feature vector is generated. The joint security behavior feature vector includes the malicious pattern features of cross-domain migration and the current real-time security behavior features of the target domain. The temporal security correlation module of the security behavior analysis model is invoked to perform time series dependency analysis on the joint security behavior feature vector. By analyzing the triggering relationship, sequence relationship and causal relationship between security behavior features at consecutive time points, a temporal correlation model of user security behavior sequence is constructed. The temporal correlation model is used to describe the feature change pattern under normal security behavior mode and the feature abnormal trajectory under malicious behavior mode. Based on the time-series correlation model, the joint security behavior feature vector is processed for malicious behavior pattern prediction to generate the expected security behavior feature sequence of the target domain user. The expected security behavior feature sequence reflects the security behavior features that the user should generate under normal security rules. The current security behavior characteristics of the target domain are compared and analyzed in real time with the expected security behavior characteristic sequence. The security deviation between the actual security behavior characteristics and the expected security behavior characteristics is calculated. When the security deviation exceeds a preset deviation threshold, the corresponding behavior characteristics are marked as abnormal security candidate characteristics. The abnormal security candidate features are subjected to context security correlation verification processing. The features are combined with the security behavior features before and after them to determine whether they conform to the feature combination rules of known malicious behavior patterns. When there are abnormal security candidate features that continuously conform to the malicious pattern, they are determined to be abnormal security behavior patterns. The abnormal security behavior patterns include the start time point of the abnormal behavior, the continuous behavior sequence and the corresponding security risk type.

6. The cross-platform user behavior analysis method based on transfer learning according to claim 5, characterized in that, The time-series security correlation module of the security behavior analysis model performs time-series dependency analysis on the joint security behavior feature vector, including: The joint security behavior feature vector is arranged into a security behavior time series according to the time order of the security behavior occurrence. Each feature element in the security behavior time series corresponds to a user security behavior feature at a certain time point. The user security behavior feature includes the login status, permission level, resource access records and operation results at that time point. In the time-series security association module, the security behavior time series is divided into time windows. Multiple consecutive security behavior feature elements are combined into a security behavior window. Each security behavior window contains consecutive security behavior features within a preset time length. The time length is determined based on the average response time of security events in the target domain. A correlation analysis is performed on the feature elements within each security behavior window. By analyzing the triggering conditions, operation order, and causal relationship between the preceding and subsequent security behavior feature elements within the security behavior window, dependency rules between security behaviors are extracted. These dependency rules include behavior triggering condition dependency, operation execution order dependency, and security state change dependency. Based on the dependency rules, a security behavior transition probability matrix is ​​constructed. The security behavior transition probability matrix is ​​used to represent the probability of transitioning from one security behavior feature element to the next security behavior feature element. The higher the value of the matrix element, the higher the frequency of the corresponding behavior transition path in the normal security behavior mode. By combining the security behavior transition probability matrix of multiple security behavior windows, the long-term dependency of the security behavior time series is modeled through a long short-term memory network to generate a temporal correlation model that describes the difference between normal and malicious security behavior patterns. The temporal correlation model includes a set of normal security behavior transition paths and a set of malicious security behavior transition paths.

7. The cross-platform user behavior analysis method based on transfer learning according to claim 5, characterized in that, The step of performing real-time comparison and analysis between the current security behavior characteristics of the target domain and the expected security behavior characteristic sequence, and calculating the security deviation between the actual security behavior characteristics and the expected security behavior characteristics, includes: Extract real-time security behavior feature vectors from the current security behavior features of the target domain. The real-time security behavior feature vectors include the login status vector, permission operation vector, resource access vector, and connection status vector at the current time point. Extract the expected security behavior feature vector corresponding to the current time point from the expected security behavior feature sequence. The expected security behavior feature vector is generated based on the prediction of normal behavior patterns by the time series correlation model and includes expected login status, expected permission operation, expected resource access and expected connection status. After performing feature component alignment processing on the real-time security behavior feature vector and the expected security behavior feature vector, the difference vector of the corresponding feature components in the real-time security behavior feature vector and the expected security behavior feature vector is calculated. Each element of the difference vector represents the degree of deviation between the actual value and the expected value of a single security feature component. Based on the protection priority of each security feature component in the target domain security policy, a priority weight is assigned to each element in the difference vector; The difference vector is weighted and the priority weight is used to perform a weighted inner product operation to generate a comprehensive safety deviation score. The higher the comprehensive safety deviation score, the greater the deviation between the actual safety behavior and the expected normal behavior. The comprehensive safety deviation score is compared with a preset safety threshold. When the comprehensive safety deviation score exceeds the preset safety threshold, the current safety behavior feature is determined to be an abnormal safety candidate feature, and the time point and behavior details corresponding to the abnormal safety candidate feature are recorded.

8. The cross-platform user behavior analysis method based on transfer learning according to claim 1, characterized in that, The step of matching the abnormal security behavior pattern with a preset network security handling rule base to generate a network security protection strategy that includes risk behavior types and corresponding blocking measures includes: The abnormal security behavior patterns are classified into risk behavior types. By matching the feature change trajectory of the abnormal security behavior patterns with the malicious behavior template library in the network security handling rule base, the risk behavior type to which the abnormal behavior belongs is determined. The risk behavior types include unauthorized login risk, unauthorized operation risk, malicious resource transmission risk, and abnormal connection risk. Each risk behavior type corresponds to a specific combination of malicious behavior features. Based on the risk behavior type, the risk level classification standard in the network security handling rule base is queried. Combined with the duration, scope of impact and security deviation of the abnormal security behavior pattern, a comprehensive score is calculated to determine the risk level assessment value. The risk level assessment value is used to indicate the severity of the risk behavior and corresponds to different response priorities. Based on the risk behavior type and risk level assessment value, matching risk blocking measures are retrieved from the network security handling rule base. The risk blocking measures include session termination measures, permission restriction measures, access blocking measures, identity two-factor authentication measures, and security alarm measures. The risk behavior types, risk level assessment values, and corresponding risk blocking measures are integrated into a network security protection strategy. The network security protection strategy also includes the user scope to which the strategy applies, the effective time range, and the execution priority.

9. A cross-platform user behavior analysis system based on transfer learning, characterized in that, The device includes a processor and a memory, the memory being connected to the processor. The memory is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the memory to implement the cross-platform user behavior analysis method based on transfer learning as described in any one of claims 1-8.

Images