Network abnormal behavior detection method and system based on deep learning

Abstract

The invention discloses a network abnormal behavior detection method and system based on deep learning, and belongs to the technical field of network security, and the method comprises the steps: obtaining a to-be-detected network interaction data set, carrying out the multi-dimensional feature construction processing of the to-be-detected network interaction data set, and obtaining the to-be-detected network interaction data set; obtaining a time sequence connection feature, a content corresponding feature and a behavior stability feature of each interaction recording unit, generating an interaction abnormality judgment result containing an abnormality probability value through a pre-trained deep abnormality diagnosis network, screening out an abnormal interaction recording unit, analyzing an association mode of request data and response data in the abnormal interaction recording unit, and obtaining an interaction abnormality judgment result; and determining an abnormal behavior representation form, generating a network security processing instruction containing an interaction identifier and a risk control strategy based on the abnormal behavior representation form and a corresponding abnormal interaction recording unit, and pushing the network security processing instruction to a network protection system to trigger targeted protection operation. According to the invention, the timeliness and effectiveness of network security protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for detecting abnormal network behavior based on deep learning. Background Art

[0002] With the rapid development of network technology and the increasing frequency of network interactions, the detection of network anomaly is a crucial component of security maintenance. Currently, common methods for detecting network anomaly typically extract single-dimensional features from network interaction data (such as time intervals or field matching) and apply traditional models (such as rule engines or support vector machines) to determine anomalies. These methods only output binary results, indicating abnormality or normality, and these results are often used for logging or manual alerting. However, existing technologies struggle to fully capture multiple aspects of network interaction, such as temporal correlation patterns, data structure matching, and user operation consistency. They also fail to capture implicit correlations between features across different dimensions, resulting in inaccurate recognition of complex anomaly patterns. Furthermore, binary anomaly results lack clarity about the specific manifestations of anomalies, making it difficult to directly translate them into targeted protective measures. This limits the timeliness and effectiveness of network security protection. Consequently, how to more accurately identify network anomaly and translate detection results into protective actions has become a hot topic in current network security research. Summary of the Invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the present invention provides a network abnormal behavior detection method and system based on deep learning to solve the problem that the existing technology relies on single-dimensional features and traditional models in network security detection, making it difficult to fully identify complex abnormal patterns, and the corresponding binary results are not easy to convert into specific protection measures, which limits the timeliness and effectiveness of security protection.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides a method for detecting abnormal network behavior based on deep learning, comprising: Obtaining a set of network interaction data to be detected; Perform multi-dimensional feature construction on the network interaction data set to be tested to obtain the temporal connection characteristics, content corresponding characteristics and behavioral stability characteristics of each interaction record unit; The pre-trained deep anomaly diagnosis network processes temporal connection features, content correspondence features, and behavioral stability features to generate interactive anomaly judgment results including anomaly probability values; Filter out abnormal interaction record units based on the interaction anomaly determination results, analyze the correlation patterns between request data and response data in the abnormal interaction record units, and determine the manifestation of abnormal behavior; Based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, a network security disposal instruction containing interaction identification and risk control strategy is generated, and the network security disposal instruction is pushed to the network protection system to trigger targeted protection operations.

[0006] As a preferred embodiment of the method for detecting abnormal network behavior based on deep learning described in the present invention, the multi-dimensional feature construction processing is performed on the network interaction data set to be detected to obtain the temporal connection feature, content corresponding feature and behavior stability feature of each interaction record unit, including: Perform time series splitting on the network interaction data set to be detected, dividing the continuous interaction record units into independent interaction individuals according to time nodes, and generating interaction sequences; Perform temporal regularity analysis on the interaction sequence, extract the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculate the time interval between the two as the interaction response time lag parameter, and calculate the distribution of the sending time intervals of adjacent interaction record units as the interaction frequency fluctuation parameter. The interaction response time lag parameter and the interaction frequency fluctuation parameter together constitute the temporal connection feature; Performing content structure comparison processing on the interaction record unit, extracting the field type set of the operation request data and the field type set of the operation response data, counting the ratio of the number of matching field types to the total number of fields in the request data as a field structure matching parameter, checking whether the values ​​of the same fields in the request data and the response data meet the preset business specifications, and generating a field value consistency parameter. The field structure matching parameter and the field value consistency parameter together constitute the content corresponding feature; Perform behavioral tendency analysis on the interaction sequence, count the ratio of the number of times the user terminal initiates the same type of request data in continuous interactions to the total number of sessions as the operation repetition parameter, and analyze the frequency of changes in the type of data requested by the user terminal as the operation stability parameter. The operation repetition parameter and the operation stability parameter together constitute the behavioral stability feature.

[0007] As a preferred solution of the method for detecting abnormal network behavior based on deep learning described in the present invention, the method includes: performing temporal regularity analysis on the interaction sequence, extracting the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculating the time interval between the two as the interaction response time lag parameter, and calculating the distribution of the sending time intervals of adjacent interaction record units as the interaction frequency fluctuation parameter, including: Traverse the interaction sequence, and for each interaction record unit, obtain the sending time node of the operation request data and the receiving time node of the operation response data, and calculate the time difference between the two as the interaction response lag value; Statistical analysis is performed on the interaction response lag values ​​of all interaction record units in the interaction sequence, and the average level and dispersion of the lag values ​​are calculated, which are used as the stability parameter and fluctuation parameter of the interaction response lag respectively; Traverse the interaction sequence, calculate the time difference between the sending time nodes of the nth interaction record unit and the n-1th interaction record unit, and obtain the time interval between adjacent interactions; The distribution analysis of adjacent interaction time intervals is performed, the frequency of occurrence of interval values ​​in different time intervals is counted, and the interaction frequency fluctuation parameter is generated.

[0008] As a preferred solution of the method for detecting abnormal network behavior based on deep learning described in the present invention, wherein: performing content structure comparison processing on the interaction record unit, extracting the field type set of the operation request data and the field type set of the operation response data, counting the ratio of the number of matching field types to the total number of fields in the request data as a field structure matching parameter, checking whether the values ​​of the same fields in the request data and the response data meet the preset business specifications, and generating a field value consistency parameter, including: Performing field parsing on the operation request data and the operation response data of the interaction record unit, and extracting the request field type list and the response field type list respectively; Calculate the number of common fields between the request field type list and the response field type list, which is recorded as the number of matched fields. The total number of request data fields is the number of fields in the request field type list. The field structure matching parameter is the ratio of the number of matched fields to the total number of request data fields. For the common field types in the request field type list and the response field type list, obtain the specific value of the field in the operation request data and the specific value of the field in the operation response data; According to the value requirements of the field type in the preset business specification, determine whether the value of the field in the operation request data meets the requirements and obtain the request field validity mark; similarly, determine whether the value of the field in the operation response data meets the requirements and obtain the response field validity mark; Calculate the average level of the request field validity mark and the response field validity mark of all common fields as the field value consistency parameter.

[0009] As a preferred solution of the method for detecting abnormal network behavior based on deep learning described in the present invention, the method includes: performing behavioral tendency analysis on the interaction sequence, counting the ratio of the number of times the user terminal initiates the same type of request data in continuous interactions to the total number of sessions as an operation repetition parameter, and analyzing the frequency of changes in the type of data requested by the user terminal as an operation stability parameter, including: Traverse the interaction sequence, count the number of times the user terminal continuously initiates the same type of request data, and calculate the ratio of the number of requests of the same type to the total number of sessions as the base value of the operation repetition parameter; Divide the interaction sequence into multiple time windows. Each time window contains a fixed number of interaction record units. Count the occurrence frequency of the same type of request data in each time window. Calculate the difference in the frequencies of adjacent time windows as the fluctuation value of the operation repetition parameter. Traverse the interaction sequence, count the number of different types of request data initiated by the user end, and calculate the ratio of the number of different types of request data to the total number of sessions as the basic value of the operation stability parameter; Count the number of times the request data type changes within each time window, and calculate the difference in the number of changes between adjacent time windows as the fluctuation value of the operation stability parameter; The basic value and the fluctuation value of the operation repetition parameter are combined to generate the operation repetition parameter; The basic value and fluctuation value of the operational stability parameter are characteristically combined to generate the operational stability parameter.

[0010] As a preferred embodiment of the method for detecting abnormal network behavior based on deep learning described in the present invention, the method processes the temporal connection features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network to generate an interactive anomaly determination result including an anomaly probability value, including: Input the temporal connection features, content correspondence features, and behavioral stability features into the feature input layer of the deep anomaly diagnosis network, and generate a comprehensive feature vector through feature splicing operations; The time modeling sub-network of the deep anomaly diagnosis network performs contextual analysis of the time dimension on the comprehensive feature vector to extract the long-term correlation features of the interaction record units in the time series. The content analysis sub-network of the deep anomaly diagnosis network is used to extract local patterns in the content dimension of the comprehensive feature vector, and extract the structural correlation features of the request data and response data fields; The behavioral analysis sub-network of the deep anomaly diagnosis network performs behavioral tendency modeling on the comprehensive feature vector to extract stable features of user-side operating habits. The long-term correlation features, structural correlation features, and stable features are input into the anomaly scoring layer of the deep anomaly diagnosis network, and the anomaly probability value of each interaction record unit is calculated through a fully connected neural network; The interactive anomaly determination result is generated based on the comparison result between the anomaly probability value and the preset probability threshold.

[0011] As a preferred embodiment of the method for detecting abnormal network behavior based on deep learning described in the present invention, the method includes: screening out abnormal interaction record units based on the interaction anomaly determination result, analyzing the correlation pattern between request data and response data in the abnormal interaction record units, and determining the abnormal behavior manifestation form, including: Extracting interaction record units whose abnormal probability values ​​exceed a preset threshold from the interaction abnormality determination results as abnormal interaction record units; For each abnormal interaction record unit, extract the interaction response time lag parameter and interaction frequency fluctuation parameter in the temporal connection feature to analyze whether the temporal connection pattern deviates from the normal range; Extract the field structure matching parameters and field value consistency parameters in the corresponding features of the content, and analyze whether there are any anomalies in the data structure correspondence relationship; Extract the operation repetition parameters and operation stability parameters from the behavioral stability features to analyze whether there are any abnormal changes in the user-side operation stability; Based on the analysis results of time connection rules, data structure correspondence and changes in operation stability, the manifestation form of abnormal behavior is determined.

[0012] In a second aspect, the present invention provides a network abnormal behavior detection system based on deep learning, comprising: An acquisition module, used to acquire a set of network interaction data to be detected; A multi-dimensional feature construction and processing module is used to construct and process multi-dimensional features of the network interaction data set to be detected, and obtain the temporal connection features, content corresponding features and behavioral stability features of each interaction record unit; The deep anomaly diagnosis module is used to process temporal connection features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network to generate interactive anomaly judgment results including anomaly probability values; The abnormal behavior analysis module is used to filter out abnormal interaction record units based on the interaction anomaly determination results, analyze the correlation pattern between request data and response data in the abnormal interaction record units, and determine the manifestation of abnormal behavior; The linkage control module is used to generate network security disposal instructions containing interaction identification and risk control strategies based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, and push the network security disposal instructions to the network protection system to trigger targeted protection operations.

[0013] In a third aspect, the present invention provides an electronic device, comprising: Memory, used to store programs; A processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the deep learning-based network abnormal behavior detection method.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, the steps of implementing the method for detecting abnormal network behavior based on deep learning are implemented.

[0015] Beneficial effects of the present invention: The present invention obtains a set of network interaction data to be detected arranged in chronological order, constructs multi-dimensional features of temporal connection, content correspondence, and behavioral stability covering time correlation rules, data structure matching relationships, and user operation consistency, and can comprehensively characterize the normal mode of network interaction from three independent and complementary perspectives: the time attribute of interaction, the data structure attribute, and the user behavior attribute; the present invention processes the above-mentioned multi-dimensional features through a pre-trained deep anomaly diagnosis network, and automatically captures the implicit correlation relationship between the three types of features using the nonlinear modeling ability of deep learning. Compared with the traditional model that can only process linear or low-order feature combinations, it can more accurately identify single features. Complex abnormal patterns that cannot be reflected by one-dimensional features; after generating the abnormal judgment result, the specific manifestation form is determined by analyzing the correlation pattern of requests and responses in the abnormal interaction record unit, and the black box abnormality probability value is converted into clear types such as traceable time response abnormality, data structure abnormality or operation mode abnormality, providing specific direction for subsequent disposal; finally, based on the abnormal manifestation form, a safe disposal instruction containing interaction identification and risk control strategy is generated and pushed to the protection system, realizing the direct conversion from abnormal detection to protection operation, so that the detection results are not only used for alarm or recording, but also can trigger targeted protection measures, thereby improving the timeliness and effectiveness of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 An overall flow chart of a method for detecting abnormal network behavior based on deep learning is provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0018] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0019] Example 1, with reference to Figure 1 , is an embodiment of the present invention, which provides a method for detecting abnormal network behavior based on deep learning, such as Figure 1 As shown, the following steps are included: S100: Obtain a set of network interaction data to be detected; In the embodiment of the present invention, the network interaction data set to be detected in step S100 includes multiple interaction record units arranged in chronological order, each interaction record unit is composed of operation request data initiated by the user end and operation response data returned by the server end; In an embodiment of the present invention, the set of network interaction data to be detected is the fundamental data source for detecting abnormal network behavior. The chronologically ordered interaction record units reflect the order of user-server interactions within an enterprise's internal network. User-initiated operation request data is the instruction sent by a user to a server in order to use a network service. For example, in an enterprise office scenario, an employee's request to log into an internal office system or to query business data. The operation response data returned by the server is the server's feedback on these requests, such as prompts indicating successful or failed logins and the results of queried business data.

[0020] In an embodiment of the present invention, in an internal enterprise network environment, a network interaction data set to be detected can be obtained with the aid of network traffic sniffing technology. A network sniffing device is deployed at a key node of the enterprise network, such as a core switch, and the device monitors all data packets transmitted in the network. By deeply analyzing these data packets, the operation request data packets initiated by the user end and the operation response data packets returned by the server end are distinguished according to the network protocol rules. These interaction record units are sorted according to the timestamps of the data packets to obtain a network interaction data set to be detected. For example, a network sniffing device is used to capture and organize the interaction data between employees of each department and the enterprise server to form a complete network interaction data set to be detected. The interaction data obtained is used for security management, and the collection of relevant interaction data does not involve infringement of personal privacy data, and must be collected with the user's permission and knowledge.

[0021] S200: Perform multi-dimensional feature construction processing on the network interaction data set to be detected to obtain the temporal connection feature, content corresponding feature and behavior stability feature of each interaction record unit; In an embodiment of the present invention, a multi-dimensional feature construction process is performed on the network interaction data set to be detected to obtain the timing connection feature, content correspondence feature and behavior stability feature of each interaction record unit. The timing connection feature is used to describe the time correlation law between the request data and the response data, the content correspondence feature is used to describe the structural matching relationship of the request / response data fields, and the behavior stability feature is used to describe the operation consistency of the user terminal in continuous interaction.

[0022] In an embodiment of the present invention, the multi-dimensional feature construction process is to mine and analyze the network interaction data from multiple angles to extract key features that can reflect the characteristics of network interaction. The temporal connection feature focuses on the temporal correlation between request data and response data, such as how long it takes to get a response after the request is issued, whether the time interval between adjacent requests is stable, etc., which helps to discover problems such as network delay anomalies and request frequency anomalies. The content correspondence feature focuses on the matching of the request data and response data in field structure and value, such as whether the data field type and number required in the request are consistent with those returned in the response, and whether the values ​​of the same field comply with the enterprise business specifications. It can be used to detect anomalies such as data format errors and data tampering. The behavioral stability feature measures the consistency of the user's operating behavior during continuous network interaction, such as whether the user frequently initiates the same type of request, whether the change in request type complies with normal business processes, and can help identify abnormal operating modes.

[0023] In an embodiment of the present invention, a method combining association analysis and statistical analysis is used to construct and process multi-dimensional features of the network interaction data set to be detected. An association analysis algorithm, such as the Apriori algorithm, is used to analyze the time correlation and content matching relationship between the request data and the response data, and to extract the temporal connection features and content corresponding features. For behavioral stability features, statistical analysis methods are used, such as calculating the frequency distribution and change rate of the request type, to evaluate the consistency of user operations. For example, in an enterprise's internal project management system, multi-dimensional features of each interaction record unit are constructed by performing association analysis and statistical analysis on the employee's operation request data.

[0024] In an embodiment of the present invention, a multi-dimensional feature construction process is performed on the network interaction data set to be detected to obtain the temporal connection feature, content correspondence feature, and behavior stability feature of each interaction record unit, specifically including the following steps S210 to S260: Step S210: performing time series splitting processing on the network interaction data set to be detected, dividing the continuous interaction record units into independent interaction individuals according to time nodes, and generating an interaction sequence with time continuity.

[0025] Time series splitting involves dividing continuous network interaction data into time nodes, transforming previously continuous interaction records into independent and ordered individual interactions. This generated interaction sequence ensures the independence of each individual interaction while maintaining overall temporal continuity, facilitating subsequent analysis of the temporal patterns of network interactions.

[0026] In an enterprise's internal network, a fixed time window partitioning method is used to perform time series segmentation. A fixed time window length, such as 10 minutes, is set. Based on the timestamp, the interaction records in the network interaction data set to be tested are segmented into 10-minute intervals. Each interaction record within each time window is treated as a separate individual interaction. For example, in an enterprise's financial system, all employee interaction records between 9:00 AM and 9:10 AM are treated as a separate individual interaction, those between 9:10 AM and 9:20 AM as another separate individual interaction, and so on, generating a temporally continuous interaction sequence.

[0027] Step S220: Perform timing regularity analysis on the interaction sequence, extract the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculate the time interval between the two as the interaction response time lag parameter, and count the distribution of the sending time intervals of adjacent interaction record units as the interaction frequency fluctuation parameter. The interaction response time lag parameter and the interaction frequency fluctuation parameter together constitute the timing connection feature.

[0028] Timing pattern analysis is the process of deeply exploring and analyzing the temporal patterns inherent in interaction sequences. The time it takes to send operation request data and the time it takes to receive operation response data are key metrics for measuring the timeliness of network interactions. The interaction response lag parameter, calculated by calculating their time intervals, reflects the server's response speed to user requests and network latency. The distribution of the time intervals between adjacent interaction record units reflects the temporal regularity of user-initiated requests. The interaction frequency fluctuation parameter, obtained by statistically analyzing their distribution, helps identify unusual request frequency patterns, such as sudden high-frequency requests or prolonged request interruptions.

[0029] A sliding window statistical method is used to analyze the temporal patterns of interaction sequences. A sliding window is moved across the interaction sequence, with the window size set based on actual needs, for example, encompassing 20 interaction record units. Within each window, the sending time of the operation request data and the receiving time of the operation response data are extracted, and the interaction response time lag parameter is calculated. Simultaneously, the sending time intervals between adjacent interaction record units are calculated, and the distribution frequency of these time intervals in different intervals is statistically analyzed to obtain the interaction frequency fluctuation parameter. These parameters are continuously updated as the window slides, dynamically reflecting the temporal patterns of network interactions. For example, in an enterprise's human resources management system, a sliding window statistical method is used to analyze employee operation requests and system response times, extracting temporal connectivity features.

[0030] In an embodiment of the present invention, step S220 performs timing regularity analysis on the interaction sequence, extracts the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculates the time interval between the two as an interaction response time lag parameter, and calculates the distribution of the sending time intervals of adjacent interaction record units as an interaction frequency fluctuation parameter. The steps S221 to S226 are specifically included: Step S221: traverse the interaction sequence, obtain the sending time node of the operation request data and the receiving time node of the operation response data for each interaction record unit, and calculate the time difference between the two as the interaction response lag value.

[0031] Traversing an interaction sequence involves sequentially examining each interaction record unit in the sequence to obtain the time information for the operation request and response data within each unit. The send time of the operation request data is the specific moment when the client sends the request information to the network, while the receive time of the operation response data is the moment when the client receives the response information from the server. Calculating the difference between these two time points yields the interaction response lag value for that interaction record unit, which intuitively reflects the latency of that network interaction.

[0032] In an enterprise network, log auditing is used to traverse interaction sequences and calculate interaction response lag. Enterprise network devices (such as routers and firewalls) and servers typically record detailed access logs, which contain the time when requests are sent and responses are received. Professional log auditing tools can be used to extract the relevant time information for each interaction record from the log files and calculate the time difference. For example, in an enterprise email system, log auditing tools can analyze the time between email request sending and response receiving to calculate the interaction response lag for each interaction record.

[0033] Step S222: Statistically analyzing the interaction response lag values ​​of all interaction record units in the interaction sequence, and calculating the average level and dispersion of the lag values, which are used as the stability parameter and fluctuation parameter of the interaction response lag, respectively.

[0034] Statistical analysis of interaction latency values ​​aims to comprehensively understand the latency characteristics of network interactions. The average level reflects the average latency over a period of time and is an important indicator of network response performance. The dispersion reflects the fluctuation of latency values ​​and reflects the stability of network latency. A large dispersion indicates unstable network latency, possibly due to network congestion or server failure.

[0035] Using statistical methods for calculating the mean and standard deviation, statistical analysis is performed on the interaction response lag values ​​of all interaction recording units in an interaction sequence. The interaction response lag values ​​of all interaction recording units are collected to form a data set. The sum of these lag values ​​is calculated and divided by the number of interaction recording units to obtain the average lag value, which serves as the stability parameter of the interaction response lag. The square of the difference between each lag value and the average lag value is calculated, and the sum of these squared values ​​is divided by the number of interaction recording units. The square root is then taken to obtain the standard deviation, which serves as the fluctuation parameter of the interaction response lag. For example, in an enterprise file sharing system, by statistically analyzing the interaction response lag values ​​of all file download requests over a period of time, the stability and fluctuation parameters are obtained to evaluate the system's response performance.

[0036] Step S223: traverse the interaction sequence, calculate the time difference between the sending time nodes of the nth interaction record unit and the n-1th interaction record unit, and obtain the adjacent interaction time interval value.

[0037] The purpose of calculating the interval between consecutive interactions across an interaction sequence is to analyze the timing patterns of user-initiated requests. The interval between consecutive interactions reflects the time interval between two requests in a continuous network interaction, which helps identify the rhythm and patterns of user operations. For example, a relatively stable interval between consecutive interactions indicates a certain regularity in user operations; a sudden decrease or increase in the interval may indicate an unusual change in user behavior.

[0038] In an enterprise intranet, the time interval between adjacent interactions is calculated through database queries. The interaction sequence is stored in the database, with each interaction record containing the sending time of the operation request data. Using a database query statement, a self-join operation is used to link the nth interaction record with the n-1th interaction record. The difference between their sending times is calculated to obtain the time interval between adjacent interactions. For example, in an enterprise's customer relationship management system, database queries can be used to calculate the time interval between employee-initiated customer information query requests and analyze employee operational patterns.

[0039] Step S224: performing distribution analysis on adjacent interaction time intervals, counting the occurrence frequencies of the interval values ​​in different time intervals, and generating interaction frequency fluctuation parameters. The interaction frequency fluctuation parameters are used to represent the time regularity of the user terminal initiating request data.

[0040] Distribution analysis of adjacent interaction time intervals provides insight into the timing patterns of user-initiated requests. By dividing adjacent interaction time intervals into distinct time intervals and counting the frequency of occurrence of interval values ​​within each interval, we obtain the interaction frequency distribution. The interaction frequency fluctuation parameter uses this distribution to reflect the temporal regularity of user-initiated request data. If the frequency distribution is concentrated in specific intervals, it indicates a relatively regular timing of user-initiated requests; if the distribution is more dispersed, it indicates a poor temporal regularity.

[0041] Histogram statistics are used to analyze the distribution of adjacent interaction time intervals. Determine the time interval ranges, for example, categorize adjacent interaction time intervals into intervals of 0-5 seconds, 5-10 seconds, and 10-15 seconds. Count the number of occurrences of adjacent interaction time intervals within each interval and calculate the frequency of occurrence. Use data visualization tools to create a histogram to visually display the distribution of interaction frequency. This frequency data is then organized into a vector or matrix, which serves as an interaction frequency fluctuation parameter. For example, in an enterprise's office automation system, the distribution of adjacent interaction time intervals between employee approval requests can be analyzed to generate an interaction frequency fluctuation parameter to determine the temporal regularity of employee operations.

[0042] Step S225: combining the stability parameter, fluctuation parameter and interaction frequency fluctuation parameter of the interaction response time lag to generate a temporal connection feature including temporal connection stability and temporal initiation regularity information.

[0043] Feature combination integrates different features to form a more comprehensive and representative feature. The stability parameter of the interaction response delay reflects the average delay level in network interaction response time, while the fluctuation parameter reflects the stability of the delay. The interaction frequency fluctuation parameter indicates the temporal regularity of user-initiated requests. Combining these three parameters creates a temporal cohesion feature that simultaneously reflects the temporal stability of network interactions and the temporal regularity of user request initiation.

[0044] In an enterprise's internal network, vector concatenation is used to combine the stability and fluctuation parameters of interaction response time lag with the interaction frequency fluctuation parameter. These three parameters are represented as vectors and sequentially concatenated into a new vector, which is the temporal cohesion feature. For example, in an enterprise's project management system, the stability and fluctuation parameters of interaction response time lag, as well as the interaction frequency fluctuation parameter, are concatenated to generate a temporal cohesion feature, which is used to analyze the temporal characteristics of network interactions among project team members.

[0045] Step S226: Verify the validity of each parameter in the temporal connection feature through the feature importance evaluation method, and retain the parameters with high contribution to anomaly detection as the final temporal connection feature.

[0046] Feature importance assessment methods are used to evaluate the contribution of each feature to the target task (such as anomaly detection). Temporal connectivity features include stability parameters, fluctuation parameters, and interaction frequency fluctuation parameters for interaction response lag. Different parameters may play different roles in anomaly detection; some may contribute significantly, while others may have little or no effect. Using feature importance assessment methods, we can identify parameters that contribute most to anomaly detection and retain them as the final temporal connectivity features. This improves the accuracy and efficiency of anomaly detection and reduces unnecessary computational and storage overhead.

[0047] The feature importance assessment method uses the feature importance assessment mechanism in the random forest algorithm. Random forest is an ensemble learning algorithm composed of multiple decision trees. When training a random forest model, the average impurity reduction of each feature across all decision trees is calculated to assess its importance. Specifically, a training dataset containing temporal connectivity features and anomaly labels (normal or abnormal) is prepared. The random forest algorithm is used to train this dataset, and during training, the importance score of each feature is recorded. Features are ranked according to their importance scores, and features with higher scores are selected as the final temporal connectivity features. For example, in an enterprise's network security monitoring system, the random forest algorithm is used to assess the importance of parameters in the temporal connectivity features to select those that contribute significantly to anomaly detection.

[0048] Step S230: Perform content structure comparison processing on the interaction record unit, extract the field type set of the operation request data and the field type set of the operation response data, count the ratio of the number of matching field types to the total number of fields in the request data as the field structure matching parameter, check whether the values ​​of the same fields in the request data and the response data meet the preset business specifications, generate field value consistency parameters, and the field structure matching parameters and field value consistency parameters together constitute the content corresponding features.

[0049] Content structure comparison processing is the process of carefully comparing and analyzing the content structure of the operation request data and operation response data in the interaction record unit. The field type set refers to the type set of all fields contained in the operation request data or operation response data, such as string type, integer type, date type, etc. The field structure matching parameter measures the degree of field structure matching between the request data and the response data by counting the ratio of the number of matching field types to the total number of fields in the request data. Pre-set business specifications are established based on the enterprise's business needs and rules to standardize the value range and format of the same fields in the request data and response data. The field value consistency parameter checks whether the values ​​of the same fields in the request data and response data conform to the pre-set business specifications, reflecting the data value compliance. The content correspondence feature, composed of the field structure matching parameter and the field value consistency parameter, comprehensively reflects the structural matching relationship and value compliance of the request data and response data.

[0050] Within an enterprise's internal network, data parsing and rule matching methods are used to compare the content structure of interaction record units. Data parsing tools are used to parse operation request and response data, extracting a set of field types. The number of field type matches is counted, and field structure matching parameters are calculated. For field value consistency parameters, rule matching programs are developed based on pre-set business specifications to check the values ​​of identical fields in the request and response data. For example, within an enterprise's inventory management system, a content structure comparison is performed between employee-submitted inventory query requests and the system's returned response data. Field structure matching parameters and field value consistency parameters are calculated to assess data consistency and compliance.

[0051] In an embodiment of the present invention, step S230 performs content structure comparison processing on the interaction record unit, extracts the field type set of the operation request data and the field type set of the operation response data, counts the ratio of the number of matching field types to the total number of fields in the request data as a field structure matching parameter, checks whether the values ​​of the same fields in the request data and the response data meet the preset business specifications, and generates a field value consistency parameter. The steps specifically include the following steps S231 to S237: Step S231: performing field parsing processing on the operation request data and the operation response data of the interaction record unit, and extracting a request field type list and a response field type list respectively.

[0052] Field parsing involves in-depth analysis of the content of operation request and response data to extract field type information. The request field type list and response field type list, respectively, record the types of all fields in the operation request and response data. Within an enterprise network, different business systems may use different data formats (such as JSON, XML, and CSV) to transmit data, necessitating appropriate parsing methods for each data format.

[0053] For data in JSON format, use a professional JSON parser. The parser identifies the fields and values ​​in the data and determines the field types based on JSON syntax rules. For example, in a company's customer service system, customer feedback data submitted by employees may be in JSON format. A JSON parser can be used to extract a list of requested field types. For data in XML format, an XML parsing engine can be used. It can recognize XML tags and attributes and extract field type information. In a company's supply chain management system, order data sent by suppliers may be in XML format. An XML parsing engine can be used to extract a list of response field types.

[0054] Step S232: Calculate the number of common fields between the request field type list and the response field type list, record it as the matching field number, the total number of request data fields is the number of fields in the request field type list, and the field structure matching parameter is the ratio of the matching field number to the total number of request data fields.

[0055] Calculating the field structure matching parameter intuitively reflects the degree of match between the field structures of the request and response data. The greater the number of matching fields, the closer the field structure matching parameter is to 1, indicating a more similar field structure between the request and response data. Conversely, if the number of matching fields is small, the field structure matching parameter is smaller, indicating significant differences in the field structures.

[0056] Use set operations to calculate the number of matching fields. Convert the request field type list and the response field type list into sets, then find the intersection of these two sets. The number of elements in the intersection is the number of matching fields. For example, in a company's financial management system, set operations can be used to calculate field structure matching parameters between employee-submitted expense reimbursement requests and the system's returned processing results to determine data structure consistency.

[0057] Step S233: For the common field types in the request field type list and the response field type list, obtain the specific value of the field in the operation request data and the specific value of the field in the operation response data.

[0058] Obtaining the specific values ​​of common field types is to further verify the consistency of the request and response data. Within an enterprise network, different business systems have different requirements for field values, so accurate values ​​of these fields are essential for subsequent compliance checks.

[0059] Specific values ​​for common field types are obtained through data search and location. When parsing operation request and response data, the location and type information of each field is recorded. For common field types, the corresponding specific value is searched in the data based on the recorded location information. For example, in an enterprise's human resources management system, for salary adjustment requests submitted by employees and the approval result data returned by the system, the specific value for the common "Salary Amount" field type can be obtained through data search.

[0060] Step S234: According to the value requirements of the field type in the preset business specifications, determine whether the value of the field in the operation request data meets the requirements and obtain the request field validity mark; similarly, determine whether the value of the field in the operation response data meets the requirements and obtain the response field validity mark.

[0061] Preset business specifications are established by an enterprise based on its business needs and management rules. They are used to standardize the value range and format of data fields. They determine whether the values ​​of request and response fields meet the requirements, ensuring the legitimacy and accuracy of the data.

[0062] Use a rules engine to determine the validity of field values. Based on pre-defined business specifications, the rules engine checks the values ​​of the same fields in both the request and response data. If the value meets the rules, it is marked as valid; otherwise, it is marked as invalid. For example, in an enterprise's contract management system, the pre-defined business specification for the "Contract Amount" field requires a positive value. The rules engine verifies the values ​​of this field in both the request and response data, generating a request field validity flag and a response field validity flag.

[0063] Step S235: Calculate the average level of the request field validity mark and the response field validity mark of all common fields as the field value consistency parameter.

[0064] The calculated field value consistency parameter comprehensively evaluates the consistency and compliance of the values ​​for the same fields in the request and response data. By calculating the average level of the request field validity flags and the response field validity flags for all common fields, a quantitative indicator is generated to indicate the degree of data value consistency.

[0065] Calculate the field value consistency parameter using statistical calculations. Add the request field validity flags and response field validity flags for all common fields and divide by the number of common fields to obtain the average level, which serves as the field value consistency parameter. For example, in an enterprise project management system, statistical calculations are performed on the validity flags of multiple common fields (such as project schedule and budget amount) to obtain the field value consistency parameter and assess the consistency of project data.

[0066] Step S236: Perform a weighted combination of the field structure matching parameters and the field value consistency parameters, with the weights determined through historical data training, to generate content corresponding features containing field structure correspondence and field value compliance information.

[0067] The weighted combination of the field structure matching parameter and the field value consistency parameter comprehensively considers both data structure and value, forming a more comprehensive content-corresponding feature. Weights are determined through historical data training to assign appropriate weights based on the contribution of these two parameters to anomaly detection in historical data, thereby improving the accuracy and effectiveness of the content-corresponding feature.

[0068] Weights are determined using a linear regression algorithm in machine learning. A linear regression model is trained by collecting historical network interaction data, using field structure matching parameters and field value consistency parameters as input features and anomaly labels (normal or abnormal) as output labels. After model training, the regression coefficients are used as weights. The field structure matching parameters and field value consistency parameters are weighted and summed to generate content-corresponding features. For example, in an enterprise's network security audit system, weights are trained using a linear regression algorithm, and the field structure matching parameters and field value consistency parameters are weighted and combined to generate content-corresponding features for detecting anomalies in network interaction data.

[0069] Step S237: Confirm the accuracy of the content corresponding features through the content compliance verification method to ensure that it can effectively reflect the structural matching relationship between the request data and the response data.

[0070] Content compliance verification checks whether content features accurately reflect the structural matching relationship and value compliance between request and response data. This verification ensures the quality of content features and improves the accuracy of anomaly detection.

[0071] Content compliance verification is performed using cross-validation and comparative analysis. A portion of historical data is used as a validation set. Anomaly detection is performed using content-corresponding features. These features are then compared with actual anomaly labels, and metrics such as precision and recall are calculated. Detection results using different feature combinations are also compared to analyze the effectiveness of content-corresponding features. For example, in an enterprise's network monitoring system, cross-validation and comparative analysis can be used to confirm the accuracy of content-corresponding features and ensure their ability to effectively detect anomalies in network interaction data.

[0072] Step S240: Perform behavioral tendency analysis on the interaction sequence, count the ratio of the number of times the user terminal initiates the same type of request data in continuous interactions to the total number of sessions as the operation repetition parameter, analyze the frequency of changes in the type of data requested by the user terminal as the operation stability parameter, and the operation repetition parameter and the operation stability parameter together constitute the behavioral stability feature.

[0073] Behavioral tendency analysis is an in-depth analysis of the user's operational behavior during network interaction to extract features that reflect the stability and consistency of user operations. The operation repetition parameter measures the repetitiveness of user operations by counting the number of times the user initiates the same type of request data relative to the total number of sessions. If the operation repetition parameter is high, it means that the user frequently initiates the same type of request and the operation is repetitive; otherwise, it means that the operation types are more diverse. The operation stability parameter analyzes the frequency of change in the type of data requested by the user, reflecting the stability of the user's operation type. If the change frequency is low, it means that the user's operation type is relatively stable; if the change frequency is high, it means that the user's operation type changes frequently. The behavioral stability feature is composed of the operation repetition parameter and the operation stability parameter, which can comprehensively describe the consistency of the user's operation in continuous interaction.

[0074] Within an enterprise's internal network, behavioral trend analysis is performed on interaction sequences using statistical and trend analysis methods. Request data types within the interaction sequence are classified and counted, recording the number of occurrences of each request type. Operation repetition and stability parameters are calculated. For example, within an enterprise's office system, the number of employee requests for different types, such as file downloads and emails, initiated within a week is counted. These repetition and stability parameters are then calculated to analyze the stability of employee operational behavior.

[0075] In an embodiment of the present invention, step S240 performs behavioral trend analysis on the interaction sequence, calculates the ratio of the number of times the user terminal initiates the same type of request data in continuous interactions to the total number of sessions as an operation repetition parameter, and analyzes the frequency of changes in the type of data requested by the user terminal as an operation stability parameter. The steps S241 to S248 are specifically included: Step S241: traverse the interaction sequence, count the number of times the user terminal continuously initiates request data of the same type, and calculate the ratio of the number of times of the same type of request data to the total number of sessions as the basic value of the operation repetition parameter.

[0076] The purpose of traversing the interaction sequence is to comprehensively count the number of times the user initiates the same type of request data during network interaction. By counting the number of consecutive requests of the same type and calculating the ratio of this number to the total number of sessions, we can obtain a preliminary baseline value for the operation repetition parameter, which reflects the basic repetitiveness of user operations.

[0077] Within an enterprise network, logging and counting methods are used to traverse interaction sequences and calculate a baseline value for the repetition parameter. Network device and server logs record each user's request information. By analyzing the log files, the number of consecutive requests of the same type is counted. The total number of sessions is also recorded, and the ratio of the two is calculated. For example, within an enterprise's customer service system, the number of consecutive customer information query requests initiated by customer service personnel can be counted by analyzing their operation logs to calculate the baseline value for the repetition parameter.

[0078] Step S242: Divide the interaction sequence into multiple time windows, each time window contains a fixed number of interaction record units, count the occurrence frequency of the same type of request data in each time window, and calculate the difference in frequency between adjacent time windows as the fluctuation value of the operation repetition parameter.

[0079] Divide the interaction sequence into multiple time windows to dynamically observe changes in the user operation repetition parameter. Count the frequency of the same type of request data within each time window and calculate the difference in frequencies between adjacent time windows to obtain the fluctuation value of the operation repetition parameter, which reflects the stability of user operation repetition.

[0080] In an enterprise intranet, a sliding window technique is used to divide interaction sequences into multiple time windows. Each time window is set to contain a fixed number of interaction record units, such as 10. Within each time window, the number of occurrences of the same type of request data is counted to calculate the frequency. The difference in frequency between adjacent time windows is calculated as the fluctuation value of the operation repetition parameter. For example, in an enterprise sales management system, sales personnel's operation request data is divided into time windows, and the fluctuation value of the operation repetition parameter is calculated to analyze the stability of sales operations.

[0081] Step S243: traverse the interaction sequence, count the number of different types of request data initiated by the user terminal, and calculate the ratio of the number of different types of request data to the total number of sessions as the basic value of the operation stability parameter.

[0082] Traverse the interaction sequence to count the number of different types of requests initiated by the user end to understand the diversity of user operation types. Calculate the ratio of the number of different types of requests to the total number of sessions as the baseline value of the operation stability parameter, which reflects the basic stability of user operation types.

[0083] Use a classification and statistics approach to traverse the interaction sequence and calculate the baseline value of the operational stability parameter. Request data in the interaction sequence is categorized and the number of different request types is counted. The total number of sessions is also recorded and the ratio of the two is calculated. For example, in an enterprise's R&D management system, R&D personnel's operational requests (such as code submission requests and document download requests) are categorized and counted to calculate the baseline value of the operational stability parameter.

[0084] Step S244: Count the number of times the request data type changes in each time window, and calculate the difference in the number of changes in adjacent time windows as the fluctuation value of the operation stability parameter.

[0085] By counting the number of changes in the request data type in each time window and calculating the difference in the number of changes in adjacent time windows, the fluctuation value of the operation stability parameter is obtained, which reflects the fluctuation of the stability of the user operation type.

[0086] Use time window analysis and difference calculation to measure fluctuations in operational stability parameters. Within each time window, count the number of changes in the request data type. Calculate the difference between the number of changes in adjacent time windows as the fluctuation value of the operational stability parameter. For example, in an enterprise's market research system, perform time window analysis on changes in the operation request types of market researchers, calculate the fluctuation value of the operational stability parameter, and assess the stability of market research work.

[0087] Step S245: performing a feature combination on the basic value and the fluctuation value of the operation repetition parameter to generate an operation repetition parameter reflecting the repetitiveness of the user-side operation.

[0088] The basic value and fluctuation value of the feature combination operation repetition parameter are used to comprehensively consider the basic level and fluctuation of user operation repetition to form a more comprehensive operation repetition parameter.

[0089] Using vector concatenation, the base and fluctuation values ​​of the repetitive operation parameter are combined to create a feature. The base and fluctuation values ​​are represented as vectors, and then concatenated into a new vector, which serves as the repetitive operation parameter. For example, in a company's human resources training system, the base and fluctuation values ​​of a trainee's repetitive operation parameter are concatenated to generate the repetitive operation parameter, which can be used to evaluate the trainee's operational behavior.

[0090] Step S246: The basic value and the fluctuation value of the operation stability parameter are combined to generate an operation stability parameter that reflects the stability of the user-side operation.

[0091] The basic value and fluctuation value of the feature combination operation stability parameter are used to comprehensively consider the basic level and fluctuation of the stability of the user operation type to form a more comprehensive operation stability parameter.

[0092] Using vector concatenation, the base and fluctuation values ​​of operational stability parameters are combined to create a feature combination. The base and fluctuation values ​​are each represented as a vector, and these are concatenated into a new vector, which serves as the operational stability parameter. For example, in an enterprise's logistics management system, the base and fluctuation values ​​of logistics personnel's operational stability parameters are concatenated to generate the operational stability parameter, which is then used to assess the stability of logistics operations.

[0093] Step S247: confirm the complementarity of the operation repetition parameter and the operation stability parameter through the behavior pattern verification method to ensure that both reflect the operation stability characteristics of the user terminal.

[0094] The behavioral pattern verification method is used to check whether the operation repetition parameters and operation stability parameters complement each other and accurately reflect the operation stability characteristics of the user end. This verification improves the effectiveness and reliability of the behavioral stability characteristics.

[0095] Behavioral pattern verification is performed using cluster analysis and correlation analysis. Cluster analysis categorizes user behavior into different categories, observing the distribution of repetition and stability parameters within these categories. Correlation analysis is also used to calculate the correlation between these two parameters to ensure their independence and complementarity. For example, in an enterprise's information security management system, cluster analysis and correlation analysis are performed on employee network behavior to verify the complementarity between repetition and stability parameters.

[0096] Step S248: Train the behavior pattern benchmark through historical normal interaction data, compare the operation repetition parameter and the operation stability parameter with the benchmark value, and generate a behavior stability feature that reflects the degree of deviation of the operation tendency.

[0097] The training behavior pattern baseline is used to determine the normal user operation pattern based on historical normal interaction data. The operation repetition parameters and operation stability parameters are compared with the baseline values ​​to quantify the degree of deviation of user operation behavior from the normal pattern and generate behavioral stability features for anomaly detection.

[0098] Use unsupervised learning algorithms in machine learning, such as K-means clustering, to train a behavioral pattern baseline. Cluster analysis is performed on historical normal interaction data to determine the cluster center of normal operating behavior, which serves as the baseline value. The distance between the operation repetition and stability parameters and the baseline is calculated to generate a behavioral stability signature that reflects the degree of deviation from the operating tendency. For example, in an enterprise network monitoring system, the K-means clustering algorithm is used to train a behavioral pattern baseline. The current operation repetition and stability parameters are compared with the baseline to generate a behavioral stability signature to detect abnormal operating behavior.

[0099] Step S250: Input the temporal connection features, content corresponding features and behavioral stability features into the feature association analysis module, establish the association relationship between the features through the feature collaborative analysis method, and generate a target feature set with collaborative representation capabilities.

[0100] The feature association analysis module analyzes the relationships between temporal cohesion features, content correspondence features, and behavioral stability features. The feature collaboration analysis method explores the inherent connections between these features and combines them into a more representative and collaborative target feature set.

[0101] In an enterprise's internal network, the feature association analysis module utilizes an autoencoder model from deep learning. This model encodes and decodes input features, learning the underlying associations between them. Temporal connectivity features, content correspondence features, and behavioral stability features are input into the autoencoder model. By training the encoder portion of the model, low-dimensional representations of these features are extracted, forming a target feature set. For example, in an enterprise's network security situational awareness system, the autoencoder model is used to perform association analysis on these three features to generate a target feature set, improving the accuracy of anomaly detection.

[0102] Step S260: Based on the evaluation results of the influence of each feature in the target feature set on anomaly detection, the input order of temporal connection features, content corresponding features and behavioral stability features in the deep anomaly diagnosis network is adjusted, and features with high influence are input first.

[0103] Evaluating the impact of each feature in the target feature set on anomaly detection is used to determine the importance of each feature in anomaly detection. Adjusting the input order of features, prioritizing the most influential features, allows the deep anomaly diagnosis network to learn key information more quickly, improving the efficiency and accuracy of anomaly detection.

[0104] Use feature importance assessment algorithms (such as Random Forest's feature importance assessment) to evaluate the impact of each feature. By training a random forest model, the importance score of each feature in the model is calculated. Features are ranked based on the score, and their input order in the deep anomaly diagnosis network is adjusted. For example, in an enterprise network intrusion detection system, the Random Forest algorithm is used to assess the importance of each feature in the target feature set, adjust the input order, and improve intrusion detection performance.

[0105] S300: Processing temporal connection features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network to generate an interactive anomaly determination result including an anomaly probability value; In this embodiment of the present invention, the pre-trained deep anomaly diagnosis network in step S300 is a neural network model trained on a large amount of historical data. It analyzes and determines input features to generate interaction anomaly determination results. The anomaly probability value indicates the likelihood of an anomaly occurring in the interaction record unit, providing a quantitative basis for anomaly detection.

[0106] In enterprise networks, deep anomaly diagnosis networks utilize a combination of convolutional neural networks (CNNs) and recurrent neural networks (RNNs). Specifically, the cascaded architecture involves inputting a concatenated, comprehensive feature vector into the CNN layer, where convolution kernels extract local patterns from the feature vectors, capturing structural correlations in the content dimension. The CNN output is then processed sequentially, time-step by time, into an RNN (such as an LSTM or GRU) to model long-term temporal dependencies and deeply mine contextual information from interactive sequences. This cascaded architecture, through the synergistic mechanism of "CNN extracting local spatial features and RNN modeling temporal dynamics," effectively integrates anomaly patterns in both the content and temporal dimensions, improving the ability to identify abnormal behavior in complex networks. The CNN extracts local patterns, while the RNN processes temporal information. Temporal connectivity features, content-corresponding features, and behavioral stability features are fed into the combined model, which then undergoes forward propagation to output an anomaly probability value. For example, in an enterprise's network traffic anomaly detection system, a CNN-RNN combined model processes features, generates anomaly probability values, and determines whether network traffic is abnormal.

[0107] In an embodiment of the present invention, step S300 processes the temporal connection features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network to generate an interactive anomaly determination result including an anomaly probability value, specifically including the following steps S310 to S370: Step S310: Input the temporal connection features, content corresponding features and behavioral stability features into the feature input layer of the deep anomaly diagnosis network, and generate a comprehensive feature vector through feature splicing operation.

[0108] The feature input layer is the entry point for the deep anomaly diagnosis network to receive external feature data. Its main function is to integrate different types of input features. In an enterprise network environment, temporal connectivity features reflect the temporal patterns of network interactions, such as request-response delays and the stability of request frequency. Content correspondence features reflect the matching relationship between request and response data in terms of field structure and values, demonstrating data consistency and compliance. Behavioral stability features describe the consistency and stability of user-side operational behavior.

[0109] By combining these three features into a comprehensive feature vector through feature concatenation, we can fuse together information from multiple aspects and provide more comprehensive data for subsequent network layer analysis. In actual implementation, these features can be arranged in a fixed order based on the dimension and data type of the features. For example, if the temporal connection feature is a vector of length 5, the content corresponding feature is a vector of length 3, and the behavioral stability feature is a vector of length 4, then the length of the concatenated comprehensive feature vector is 12, and the relative positions of the various features remain fixed. In this way, the deep anomaly diagnosis network can obtain information about the time, content, and behavior of network interactions from this comprehensive feature vector.

[0110] Step S320: Perform context analysis on the comprehensive feature vector in the time dimension through the time modeling sub-network of the deep anomaly diagnosis network to extract the long-term correlation features of the interaction record unit in the time series.

[0111] The temporal modeling subnetwork in the deep anomaly diagnosis network plays a crucial role in mining the temporal dimension of comprehensive feature vectors. Within enterprise networks, network interactions exhibit complex temporal correlations. For example, users may initiate requests according to certain patterns over a period of time, or system response times may exhibit trends over time. The temporal modeling subnetwork is designed to capture these long-term temporal correlations.

[0112] In this embodiment of the present invention, step S320 performs context analysis on the comprehensive feature vector in the time dimension through the time modeling sub-network of the deep anomaly diagnosis network to extract the long-term correlation features of the interaction record units in the time series. Specifically, the following steps S321 to S326 are included: Step S321: The recurrent processing layer of the temporal modeling subnetwork processes the comprehensive feature vector in chronological order and captures the temporal correlation information between adjacent interaction record units through the hidden state transfer mechanism.

[0113] The recurrent processing layer is the core component of the temporal modeling subnetwork. It processes the integrated feature vector sequentially in chronological order. In an enterprise network environment, each interaction record unit corresponds to a specific time point, and these units form a chronological sequence. The recurrent processing layer uses a hidden state transfer mechanism to transfer the hidden state information from the previous time step to the current time step. The hidden state is understood as the network's memory and summary of the information from previous time steps, containing the relevant features of the previous interaction record unit.

[0114] For example, in an enterprise's office system, employee operation requests may exhibit certain temporal patterns, such as a high concentration of file queries and downloads in the morning. When processing the comprehensive feature vector of the current time step, the recurrent processing layer incorporates the hidden state of the previous time step to capture temporal correlations between adjacent interaction record units, such as changes in operation frequency and the continuity of request types.

[0115] Step S322: The attention mechanism layer of the time modeling sub-network performs weight distribution processing on the hidden state sequence output by the recurrent processing layer to generate the attention weight of each time node.

[0116] The attention mechanism layer further filters and weights the hidden state sequence output by the recurrent processing layer. Within the vast amount of interaction records within an enterprise network, information at different time points has varying importance for mining long-term correlation features. The attention mechanism layer assigns a corresponding attention weight to each time point based on the hidden state's characteristic information.

[0117] For example, in enterprise network monitoring, interaction records at key time points (such as peak business hours and after system updates) may contain more important information. The attention mechanism layer assigns higher weights to the hidden states at these key time points and lower weights to the hidden states at less important time points. This allows the network to pay more attention to information from these important time points in subsequent processing.

[0118] Step S323: Perform weighted aggregation processing on the hidden state sequence according to the attention weight to obtain long-term correlation features containing temporal context information.

[0119] Weighted aggregation is the process of applying the attention weights assigned by the attention mechanism layer to the hidden state sequence. By multiplying the hidden state of each time node by the corresponding attention weight and adding them together, a long-term correlation feature containing temporal context information is obtained.

[0120] In enterprise networks, this long-term correlation feature integrates important information from different time points, reflecting the overall behavioral patterns of network interactions over a period of time. For example, in an enterprise's supply chain management system, the long-term correlation feature derived through weighted aggregation processing reflects the long-term temporal relationship between supplier order requests and enterprise responses, helping enterprises predict future business needs and adjust supply strategies.

[0121] Step S324: The long-term correlation feature is used to represent the overall behavior pattern of the interaction record unit in the time dimension.

[0122] Long-term correlation features are a comprehensive description of network interactions over time. They contain key information extracted from multiple time points and can reflect the overall behavioral pattern of interaction records over a period of time. In enterprise intranets, this overall behavioral pattern is used for various purposes.

[0123] For example, in a company's customer relationship management system, long-term correlation features reveal the temporal patterns of interactions between customers and the company, such as the time periods during which customers typically initiate inquiries and the temporal distribution of purchase frequency. By analyzing these holistic behavioral patterns, companies can better understand customer needs, optimize service strategies, and improve customer satisfaction.

[0124] Step S325: Train the parameters of the time modeling sub-network using historical normal interaction data to ensure that it can effectively capture time-related information.

[0125] The parameters of the temporal modeling subnetwork are trained to enable the network to learn the normal temporal correlation patterns in the enterprise network. Historical normal interaction data contains a large number of network interaction records under normal business processes. These records reflect the temporal patterns of the enterprise network under normal circumstances.

[0126] During training, optimization algorithms (such as stochastic gradient descent) are used to continuously adjust the parameters of the temporal modeling subnetwork, ensuring that the long-term correlation features output by the network accurately reflect the temporal correlation information in historical, normal interaction data. For example, in a company's financial system, by training on historically normal financial data query and processing records, the temporal modeling subnetwork learns the normal temporal patterns of financial operations, enabling it to identify anomalous temporal correlations in subsequent detection.

[0127] Step S326: Verify the validity of the long-term correlation features using validation set data to ensure that they can distinguish between normal and abnormal temporal behavior patterns.

[0128] The validation set is an independent dataset used to evaluate the performance of the temporal modeling sub-network. It is independent of the training data and can more objectively test the effectiveness of long-term correlation features.

[0129] Within the enterprise's internal network, the validation set data is fed into the trained temporal modeling subnetwork to observe whether the outputted long-term correlation features can accurately distinguish between normal and abnormal temporal behavior patterns. For example, in enterprise network security, if the validation set data includes time records of known abnormal network attacks (such as distributed denial of service attacks), the network can be compared with the long-term correlation features under normal and abnormal conditions to determine whether it can effectively identify abnormal temporal behavior patterns. If the validation results are unsatisfactory, further adjustments to the temporal modeling subnetwork parameters or improvements to the training method are necessary.

[0130] Step S330: The content analysis sub-network of the deep anomaly diagnosis network performs local pattern extraction processing on the comprehensive feature vector in the content dimension to extract the structural association features of the request data and response data fields.

[0131] The content analysis subnetwork focuses on mining local patterns in the content dimension of request and response data fields from the comprehensive feature vector. Within an enterprise intranet, there are certain correlations between the field structures of request and response data, and these correlations are crucial for determining the legitimacy and accuracy of network interactions.

[0132] The content analysis subnetwork, using a convolutional neural network (CNN) architecture, performs sliding convolution operations on the comprehensive feature vector using convolution kernels to extract local characteristic patterns. For example, in an enterprise's office automation system, there are specific structural correlations between the field types in the request data (such as username, password, operation type) and the field types in the response data (such as login results and permission information). The convolution operations of the content analysis subnetwork capture these local structural correlations and can be used to detect anomalies such as whether the data has been tampered with and whether the field structure complies with business rules.

[0133] Step S340: The behavior analysis sub-network of the deep anomaly diagnosis network is used to perform tendency modeling processing on the comprehensive feature vector in the behavior dimension to extract stable features of the user's operating habits.

[0134] The behavior analysis sub-network focuses on the user's operational behavior tendencies in network interactions. In an enterprise internal network, each user usually has his or her own unique operating habits, which are relatively stable over a period of time.

[0135] The behavior analysis subnetwork uses a long short-term memory (LSTM) network to model user behavior. LSTMs can effectively process sequential data and remember user operations over extended periods of time. For example, in an enterprise document management system, a user may habitually upload and download documents during a specific time period each morning, and the file types they operate on are relatively consistent. By processing the comprehensive feature vectors, the behavior analysis subnetwork learns the stable characteristics of these user behavior habits. By continuously observing changes in these stable characteristics, it can promptly detect anomalies in user behavior, such as account theft or unusual operation patterns.

[0136] Step S350: Input the long-term correlation features, structural correlation features and stable features into the anomaly scoring layer of the deep anomaly diagnosis network, and calculate the anomaly probability value of each interaction record unit through the fully connected neural network.

[0137] The anomaly scoring layer is a key component of the deep anomaly diagnosis network, which comprehensively evaluates the various extracted features. Long-term correlation features reflect the overall behavioral patterns of network interactions over time, structural correlation features reflect the structural matching between request and response data fields, and stability features describe the stability of user-side operating habits.

[0138] A fully connected neural network integrates and processes these different types of features, calculating an anomaly probability for each interaction record through a series of linear transformations and nonlinear activation functions. In an enterprise network, this anomaly probability indicates the likelihood that an anomaly exists in that interaction record. For example, in an enterprise's online payment system, for each payment request and response interaction, the anomaly scoring layer calculates an anomaly probability based on long-term correlation features (such as payment timing patterns), structural correlation features (such as the structural match between payment amount and account information), and stable features (such as user payment habits). If the anomaly probability exceeds a certain threshold, the transaction is considered likely to be an anomaly.

[0139] Step S360: Compare the abnormal probability value with a preset probability threshold to generate an interaction abnormality determination result including a normal or abnormal identification.

[0140] The preset probability threshold is a critical value determined based on the enterprise's security policy and historical data. By comparing the calculated abnormal probability value with this threshold, it is simple and direct to determine whether the interaction record unit is abnormal.

[0141] In an enterprise's internal network, if the abnormality probability value is below a threshold, the interaction record unit is deemed normal and marked as "normal." If the abnormality probability value is above the threshold, it is deemed abnormal and marked as "abnormal." For example, in an enterprise's network access control system, if the calculated abnormality probability value for the interaction record between a user's login request and system response exceeds a preset threshold, the system will determine that the login behavior is abnormal and may pose a risk of account theft. Appropriate security measures, such as login restrictions and security alerts, will be implemented.

[0142] Step S370: Adjust the parameters of the deep anomaly diagnosis network using the validation set data to ensure the accuracy and stability of the anomaly probability value.

[0143] Validation set data plays an important role in adjusting the parameters of the deep anomaly diagnosis network, helping to evaluate the accuracy and stability of the anomaly probability values ​​calculated by the current network model.

[0144] In enterprise networks, the deep anomaly diagnosis network is tested using validation data to observe how closely the anomaly probability values ​​match the actual anomaly conditions. If a high number of misjudgments (misclassifying normal as abnormal or vice versa) is detected, network parameters need to be adjusted, such as adjusting the weights of the fully connected neural network and optimizing the parameters of the convolution kernel. Through continuous adjustment and verification, the deep anomaly diagnosis network can more accurately and stably calculate anomaly probabilities, improving anomaly detection performance. For example, in an enterprise's network security monitoring system, repeated testing and parameter adjustments on validation data ensure that the system can accurately identify various network anomalies and ensure the secure operation of the enterprise network.

[0145] S400: Filtering out abnormal interaction record units based on the interaction anomaly determination result, and analyzing the correlation pattern between request data and response data in the abnormal interaction record units to determine the manifestation form of abnormal behavior; In this embodiment of the present invention, the interaction anomaly determination result in step S400 provides a basis for screening abnormal interaction record units. Within the enterprise's internal network, interaction record units marked as "abnormal" are screened out based on the interaction anomaly determination result obtained in the previous step, which includes a normal or abnormal indicator. These abnormal interaction record units may conceal various network security risks or business process issues.

[0146] Analyzing the correlation patterns between request and response data in abnormal interaction records is a key step in gaining a deeper understanding of the nature of abnormal behavior. Specific logical and structural relationships exist between request and response data, and analyzing these relationships can reveal clues to abnormal behavior. For example, in an enterprise's e-commerce system, abnormal order requests and responses may manifest as a mismatch between the requested item quantity and the responded inventory information, or a significant difference between the requested price and the responded settlement price. By analyzing these correlation patterns, we can identify manifestations of abnormal behavior, such as data tampering and business rule violations.

[0147] In an embodiment of the present invention, step S400 filters out abnormal interaction record units based on the interaction anomaly determination result, analyzes the correlation pattern between request data and response data in the abnormal interaction record units, and determines the abnormal behavior manifestation form, which specifically includes the following steps S410 to S460: Step S410: extracting interaction record units whose abnormality probability values ​​exceed a preset threshold from the interaction abnormality determination results as abnormal interaction record units.

[0148] The preset threshold is a standard established during the anomaly determination process and is used to distinguish between normal and abnormal interaction record units. Within the enterprise network, interaction record units with anomaly probability values ​​exceeding this threshold are screened from the interaction anomaly determination results. These units are the focus of attention for potential abnormal behavior.

[0149] This screening process is accomplished through database queries. Interaction anomaly determination results are stored in the database, and SQL queries are used to filter based on anomaly probabilities and preset thresholds. For example, in an enterprise's network log database, executing the following query: "SELECT * FROM interaction_results WHERE anomaly_probability > [preset threshold]" will extract anomalous interaction records.

[0150] Step S420: For each abnormal interaction record unit, extract the interaction response time lag parameter and interaction frequency fluctuation parameter in its temporal connection feature, and analyze whether the temporal connection rule deviates from the normal range.

[0151] The interaction response lag parameter in the temporal connectivity feature reflects the time interval between sending a request and receiving a response, while the interaction frequency fluctuation parameter reflects the temporal regularity of request initiation. In an enterprise intranet, these parameters normally have a certain range of values ​​and a certain pattern of variation.

[0152] For each abnormal interaction record, these two parameters are extracted and compared with the normal range. For example, in an enterprise's file download service, normal interaction response lag may range from a few seconds to tens of seconds. If the interaction response lag for an abnormal interaction record reaches several minutes, it indicates a deviation from the temporal consistency pattern. Similarly, if the interaction frequency fluctuation parameter shows abnormal fluctuations (such as a sudden change from a stable request frequency to a high or low frequency request frequency), it may also indicate abnormal behavior, such as a network attack or system failure.

[0153] Step S430: extract the field structure matching parameters and field value consistency parameters in the content corresponding features, and analyze whether there is any abnormality in the data structure correspondence relationship.

[0154] The field structure matching parameter and field value consistency parameter in the content correspondence feature reflect the matching of the request data and response data in terms of field structure and value, respectively. Within an enterprise intranet, different business systems have clear regulations on the field structure and value of request and response data.

[0155] For each abnormal interaction record, these two parameters are extracted and analyzed. For example, in an enterprise's human resources management system, the request data contains basic employee information (such as name, age, and position), and the response data is matched to this information. If the field structure matching parameter is low, it indicates that the field structures of the request and response differ significantly; if the field value consistency parameter is low, it indicates that the values ​​of the same field do not comply with business specifications. These situations may indicate an anomaly in the data structure correspondence, such as data tampering or system configuration errors.

[0156] Step S440: extracting the operation repetition parameter and the operation stability parameter from the behavior stability feature, and analyzing whether there is any abnormal change in the user terminal operation stability.

[0157] The operation repetition parameter and operation stability parameter in the behavior stability feature describe the frequency of the user initiating the same type of request and the stability of the change of the request type, respectively. In an enterprise intranet, each user usually has their own relatively stable operation habits.

[0158] For each abnormal interaction record unit, these two parameters are extracted and compared with the user's normal operation pattern. For example, in an enterprise office system, a user may rarely initiate a specific type of request, but the operation repetition parameter for that type of request in the abnormal interaction record unit suddenly increases, or the operation stability parameter shows that the request type changes frequently and does not conform to normal business processes. This indicates that there has been an abnormal change in the user's operational stability, which may indicate account theft or malicious operation.

[0159] Step S450: Determine the abnormal behavior manifestation form by integrating the analysis results of the time connection rules, data structure correspondence and operation stability changes.

[0160] Comprehensively analyzing the results from the previous steps is key to identifying the specific manifestations of abnormal behavior. The three interrelated and complementary aspects of information—temporal patterns, data structure correspondences, and operational stability changes—can reveal the nature of abnormal behavior from different perspectives.

[0161] By comprehensively considering these factors within an enterprise network, we can more accurately identify the manifestations of abnormal behavior. For example, if time connections indicate excessive request-response delays, data structure correspondences indicate abnormal field values, and changes in operational stability indicate a sudden change in user operation patterns, these factors can be combined to identify data tampering and operational anomalies caused by a network attack. These analysis results are then collated and summarized to determine whether the abnormal behavior manifests as a timing anomaly, a data anomaly, or an operational anomaly.

[0162] Step S460: Verify the accuracy of the abnormal behavior manifestation form by matching the analysis results with the historical abnormal case library.

[0163] The historical anomaly case database is a collection of abnormal event records accumulated over the long-term network operations of an enterprise, containing various abnormal behavior patterns and handling experience. The abnormal behavior patterns obtained from the current analysis are matched with the historical anomaly case database to verify the accuracy of the analysis results.

[0164] If the current abnormal behavior on an enterprise network resembles a case in a historical case library, the nature of the abnormal behavior can be further confirmed by referring to the handling method and cause analysis of that case. For example, in enterprise network security management, if the abnormal behavior detected by analysis shows a sudden increase in request frequency and abnormal data structure, similar to a distributed denial of service attack case recorded in the historical case library, the current abnormal behavior can be determined to be a similar attack behavior, and appropriate preventive and handling measures can be taken. At the same time, if the current abnormal behavior pattern does not match any case in the historical case library, it may indicate the emergence of a new type of abnormality, requiring further in-depth analysis and research.

[0165] S500: Based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, a network security handling instruction including the interaction identification and risk control strategy is generated, and the network security handling instruction is pushed to the network protection system to trigger targeted protection operations.

[0166] In this embodiment of the present invention, the network security handling instructions in step S500 are response measures tailored to the specific circumstances of the abnormal behavior. They include an interaction identifier and a risk control strategy. The interaction identifier uniquely identifies the abnormal interaction record unit, facilitating the network protection system's location and handling of the abnormal event. The risk control strategy is a specific protective measure tailored to the specific manifestations of abnormal behavior.

[0167] Within the enterprise network, network security action instructions are generated based on the abnormal behavior patterns and corresponding abnormal interaction record units identified in the previous steps. For example, if the abnormal behavior manifests as data tampering, the risk control strategy might be to restrict the access rights of the relevant users, back up and restore the data, etc. The generated network security action instructions are sent to the network protection system (such as a firewall, intrusion detection system, etc.) through the network interface. Upon receiving the instructions, the network protection system will execute the corresponding protection actions based on the risk control strategy contained in the instructions to ensure the security of the enterprise network.

[0168] In an embodiment of the present invention, step S500 generates a network security handling instruction including an interaction identifier and a risk control strategy based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, and pushes the network security handling instruction to the network protection system to trigger a targeted protection operation. Specifically, the following steps S510 to S550 are included: Step S510: According to the abnormal behavior manifestation form, query the preset strategy mapping table to determine the corresponding risk control strategy.

[0169] The pre-set policy mapping table is developed based on the enterprise's historical experience and security policies. It establishes a correlation between specific manifestations of abnormal behavior and risk control strategies. Within the enterprise network, the corresponding risk control strategy is searched in the policy mapping table based on the previously determined abnormal behavior manifestations.

[0170] For example, a policy mapping table might specify that when abnormal behavior manifests as abnormal time response, the corresponding risk control strategy is to strengthen network monitoring and adjust server resource allocation; when abnormal behavior manifests as abnormal data structure, the corresponding risk control strategy is to perform data verification and restrict data access. By querying the policy mapping table, the risk control strategy for the current abnormal behavior can be quickly and accurately determined.

[0171] In the embodiment of the present invention, the preset policy mapping table is constructed by the following steps S501 to S507: Step S501: Collect historical abnormal event records, which include abnormal interaction record units, specific manifestations of abnormal behaviors, and corresponding manual handling strategies.

[0172] Historical abnormal event records are valuable data resources accumulated by enterprises during past network operations. Within the enterprise network, these records are collected through network monitoring systems and logging systems. These records detail the occurrence of each abnormal event, including abnormal interaction record units (such as request and response data, timestamps, etc.), abnormal behavior manifestations (such as time anomalies and data anomalies), and the manual resolution strategies implemented at the time (such as access restrictions and service restarts).

[0173] Step S502: Standardize the historical abnormal event records and unify the description method of the specific manifestation of abnormal behavior, which includes three categories: time response abnormality, data structure abnormality and operation mode abnormality.

[0174] Standardizing the processing of historical abnormal event records is to facilitate subsequent analysis and processing. Since different abnormal event records may use different description methods, in order to establish a unified policy mapping table, it is necessary to standardize the description of the specific manifestations of abnormal behavior.

[0175] In an enterprise's internal network, abnormal behavior is categorized into three types: time response anomalies, data structure anomalies, and operation mode anomalies. For example, abnormal events involving excessively long request-response delays are collectively described as time response anomalies; abnormal events involving mismatched request and response data field structures or non-compliant values ​​are collectively described as data structure anomalies; and abnormal events involving user operations that do not conform to normal business processes are collectively described as operation mode anomalies.

[0176] Step S503: Classify and organize the manual handling strategies in the historical abnormal event records. The handling strategies include four categories: monitoring strategy, restriction strategy, termination strategy and verification strategy.

[0177] Manual handling strategies are categorized and organized to make them clearer and more organized. Within the enterprise's internal network, manual handling strategies from historical abnormal event records are grouped into four categories: monitoring strategies, restriction strategies, termination strategies, and verification strategies. Monitoring strategies involve strengthening the monitoring of network activities, such as increasing the frequency of logging and enabling real-time monitoring. Restriction strategies limit certain user or system operational permissions, such as restricting access to specific network resources and reducing network bandwidth. Termination strategies terminate abnormal network sessions or services, such as forcibly closing abnormal connections and stopping abnormal processes. Verification strategies verify data or user identities, such as requiring password re-entry and performing identity authentication.

[0178] Step S504: establishing a correlation matrix between specific manifestations of abnormal behaviors and handling strategies, wherein each abnormal manifestation category in the matrix corresponds to at least one handling strategy category.

[0179] The association matrix is ​​a tool used to represent the relationship between the specific manifestations of abnormal behavior and the handling strategies. Within an enterprise's internal network, an association matrix is ​​established based on historical abnormal event records and categorized abnormal manifestation categories and handling strategy categories. The rows of the matrix represent abnormal manifestation categories (time response anomalies, data structure anomalies, and operation mode anomalies), and the columns represent handling strategy categories (monitoring strategy, restriction strategy, termination strategy, and verification strategy). Each element in the matrix represents the association between the corresponding abnormal manifestation category and handling strategy category. If an association exists, it is marked as 1, otherwise it is marked as 0. For example, when a time response anomaly occurs, the corresponding handling strategies may include monitoring strategy and restriction strategy. In this case, the elements in the matrix corresponding to the time response anomaly row and the monitoring strategy and restriction strategy columns are marked as 1.

[0180] Step S505: Count the co-occurrence frequencies of each abnormal manifestation form category and treatment strategy category, and select associations with co-occurrence frequencies higher than a preset threshold as valid associations.

[0181] Co-occurrence frequency refers to the ratio of the number of times a particular anomaly manifestation category and a handling strategy category appear together in historical anomaly event records to the total number of anomaly events. Within an enterprise network, the co-occurrence frequency of each anomaly manifestation category and handling strategy category in the association matrix is ​​calculated. The preset threshold is a critical value determined based on the enterprise's security policy and actual circumstances. Associations with a co-occurrence frequency above the preset threshold are selected as valid associations. These valid associations indicate that, in most cases, the corresponding handling strategy is effective when a particular anomaly manifestation occurs. For example, if the co-occurrence frequency of time response anomalies and monitoring strategies exceeds the preset threshold, then the monitoring strategy is a relatively effective handling method for time response anomalies.

[0182] Step S506: Arrange the valid association relationships into a policy mapping table, which includes an abnormal manifestation form category field and a corresponding handling policy category field.

[0183] The effective association relationships obtained by screening are organized into a policy mapping table to facilitate subsequent query and use. In the enterprise internal network, the structure of the policy mapping table includes an abnormal manifestation form category field and a corresponding handling policy category field.

[0184] Step S507: regularly update the policy mapping table, obtain newly added historical abnormal event records, recalculate the co-occurrence frequency and adjust the effective association relationship to ensure the timeliness of the policy mapping table.

[0185] As the enterprise network environment changes and new abnormal events emerge, the policy mapping table needs to be continuously updated to maintain its timeliness. Within the enterprise network, newly added historical abnormal event records are regularly collected and added to the existing historical abnormal event records. The co-occurrence frequency between abnormal manifestation categories and handling strategy categories is recalculated, and the effective association relationship is adjusted based on the new co-occurrence frequency. For example, when a new abnormality type emerges or the existing handling strategy is found to be ineffective, the policy mapping table is updated promptly to ensure that the most effective risk control strategy can be implemented in the face of various abnormal behaviors.

[0186] Step S520: extracting the unique interaction identifier of the abnormal interaction record unit as a basis for locating the abnormal event.

[0187] A unique interaction identifier (UII) is a unique identifier for each abnormal interaction record, used to accurately locate abnormal events within the network. Within an enterprise network, an abnormal interaction record may contain multiple pieces of information, such as a timestamp, requesting IP address, and session ID. This information is combined to generate a unique interaction identifier.

[0188] For example, the timestamp, requesting IP address, and session ID are combined into a single string to uniquely identify each abnormal interaction record. In subsequent processing, the network protection system uses this unique interaction identifier to quickly locate the specific abnormal interaction record and obtain detailed information about the abnormal event, such as the time of occurrence, the users involved, and the systems involved.

[0189] Step S530: Integrate the interaction identifier, risk control strategy and abnormal behavior manifestation to generate a network security handling instruction containing detailed abnormal information.

[0190] Information integration combines three key pieces of information: interaction identification, risk control strategies, and abnormal behavior patterns, to form a complete network security response plan. Within an enterprise network, network protection systems require this detailed information to accurately execute protection operations.

[0191] The interaction identifier serves as the basis for locating an abnormal event, the risk control strategy serves as the specific response measure, and the abnormal behavior pattern serves as the description of the abnormal event. For example, a network security handling instruction uses the following format: "Interaction identifier: [specific identifier]; abnormal behavior pattern: [abnormal time response]; risk control strategy: [enable monitoring strategy, restrict access to specific servers]." This instruction clearly conveys the key information of the abnormal event, facilitating the network protection system's response.

[0192] Step S540: Send the network security handling instruction to the network protection system through the network communication interface, so that after receiving the network security handling instruction, the network protection system parses the risk control policy information therein and performs corresponding protection operations.

[0193] The network communication interface bridges the gap between the network security action instruction generation system and the network protection system. Within the enterprise's internal network, generated network security action instructions are sent to network protection systems (such as firewalls and intrusion detection systems) via network communication interfaces (e.g., TCP / IP, HTTP, etc.).

[0194] After receiving the network security disposal instruction, the network protection system parses the risk control policy information therein. According to different risk control strategies, corresponding protection operations are performed. For example, if the risk control strategy is a monitoring strategy, the network protection system will trigger a traffic monitoring operation, focusing on monitoring the user-side traffic corresponding to the abnormal interaction recording unit, and recording detailed traffic information, such as traffic size, flow direction, protocol type, etc.; if the risk control strategy is a restriction strategy, the network protection system will trigger a traffic restriction operation, rate-limiting the user-side traffic corresponding to the abnormal interaction recording unit, reducing the traffic transmission speed, such as limiting bandwidth, setting an upper limit on access frequency, etc.; if the risk control strategy is a termination strategy, the network protection system will trigger a session termination operation, forcibly terminating the current session of the user-side corresponding to the abnormal interaction recording unit and disconnecting the network connection, such as closing the TCP connection, stopping UDP communication, etc.; if the risk control strategy is a verification strategy, the network protection system will trigger an identity authentication operation, requiring the user-side corresponding to the abnormal interaction recording unit to perform additional identity authentication to confirm the legitimacy of the identity, such as requiring the input of a verification code, performing fingerprint recognition, etc.

[0195] At the same time, through the protection operation execution result feedback mechanism, the operation execution status is returned to the anomaly detection system for subsequent policy optimization and adjustment. This protection operation execution result feedback mechanism is a key component in ensuring the effectiveness and adaptability of network security disposal instructions. Within the enterprise network, after executing the protection operation corresponding to the risk control strategy, the network protection system will collect relevant information about the operation execution, such as whether the operation was successful, the time of operation execution, and the impact of the operation on the network or system. This information is then fed back to the anomaly detection system via the network communication interface.

[0196] After receiving feedback, the anomaly detection system analyzes it in detail. If the protection operation successfully resolves the anomaly, the anomaly detection system records the process and uses it as historical experience to handle similar anomalies in the future. If the protection operation fails to effectively resolve the anomaly, or if new problems arise during execution, the anomaly detection system will reassess the rationality of the risk control strategy. For example, if the execution of a restriction policy excessively restricts network traffic, affecting normal business operations, the anomaly detection system will adjust the restriction policy parameters based on the feedback, such as appropriately increasing bandwidth limits or relaxing access frequency limits.

[0197] By continuously receiving feedback and optimizing and adjusting its policies, the anomaly detection system can gradually improve its ability to respond to various anomalies, making network security instructions more precise and effective. In daily enterprise network operations, as business grows and the network environment changes, new abnormal behaviors may continue to emerge. This dynamic feedback and optimization mechanism ensures that the enterprise network remains secure and stable.

[0198] Step S550: Record detailed information of the abnormal interaction recording unit through the log system for subsequent abnormal behavior tracing and analysis.

[0199] Logging systems play a crucial role in enterprise network security management. They record detailed information about unusual interaction records, providing a solid data foundation for subsequent tracing and analysis of abnormal behavior. Within an enterprise network, when an unusual interaction record is detected, the logging system collects comprehensive information about the record, including but not limited to the specific content of the request data, detailed response data, request and response timestamps, the identities of the users involved, and the identification of network devices.

[0200] These detailed logs act like a "ledger" of network activity. When tracing abnormal behavior, security managers can use the chronological order and related information in the logs to gradually reconstruct the entire process of the abnormal event. For example, if a user's account experiences unusual login activity, by reviewing the account's login time, login IP address, and request data sent during login, the source of the abnormal login can be determined, determining whether it was an internal error or an external malicious attack.

[0201] At the same time, the information recorded by the log system also helps analyze abnormal behavior. Security managers collect and analyze large amounts of abnormal log data to identify patterns and regularities in abnormal behavior. For example, by analyzing abnormal logs over a period of time, they may find a significant increase in the frequency of abnormal login requests within a specific time period, or that certain types of abnormal requests consistently originate from a specific IP address range. This provides targeted evidence for further strengthening network security.

[0202] Furthermore, the logging system can be integrated with other security tools and systems to achieve even more advanced functionality. For example, log data can be linked to the intrusion detection system's rule base. When log data matches abnormal patterns in the rule base, the system automatically issues an alert, prompting security managers to address the issue promptly. By effectively recording and utilizing the logging system, enterprises can better address network security challenges and ensure the normal operation of the network and the security of data.

[0203] Example 2: This example provides a power big data privacy protection system based on federated learning, including: An acquisition module, used to acquire a set of network interaction data to be detected; A multi-dimensional feature construction and processing module is used to construct and process multi-dimensional features of the network interaction data set to be detected, and obtain the temporal connection features, content corresponding features and behavioral stability features of each interaction record unit; The deep anomaly diagnosis module is used to process temporal connection features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network to generate interactive anomaly judgment results including anomaly probability values; The abnormal behavior analysis module is used to filter out abnormal interaction record units based on the interaction anomaly determination results, analyze the correlation pattern between request data and response data in the abnormal interaction record units, and determine the manifestation of abnormal behavior; The linkage control module is used to generate network security disposal instructions containing interaction identification and risk control strategies based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, and push the network security disposal instructions to the network protection system to trigger targeted protection operations.

[0204] This embodiment further provides an electronic device applicable to a method for detecting abnormal network behavior based on deep learning, including: Memory and processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement a network abnormal behavior detection method based on deep learning as proposed in the above embodiment.

[0205] This embodiment also provides a storage medium having a computer program stored thereon. When the program is executed by a processor, a method for detecting abnormal network behavior based on deep learning as proposed in the above embodiment is implemented.

[0206] The storage medium proposed in this embodiment and the method for detecting abnormal network behavior based on deep learning proposed in the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0207] From the above description of the embodiments, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware. Of course, it can also be implemented using hardware, but in many cases the former is the preferred embodiment. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, can be embodied in the form of a software product. This software product can be stored on a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk, or optical disk, and includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0208] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting abnormal network behavior based on deep learning, characterized by: Obtaining a set of network interaction data to be detected; Perform multi-dimensional feature construction on the network interaction data set to be tested to obtain the temporal connection characteristics, content corresponding characteristics and behavioral stability characteristics of each interaction record unit; The pre-trained deep anomaly diagnosis network processes temporal connection features, content correspondence features, and behavioral stability features to generate interactive anomaly judgment results including anomaly probability values; Filter out abnormal interaction record units based on the interaction anomaly determination results, analyze the correlation patterns between request data and response data in the abnormal interaction record units, and determine the manifestation of abnormal behavior; Based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, a network security disposal instruction containing interaction identification and risk control strategy is generated, and the network security disposal instruction is pushed to the network protection system to trigger targeted protection operations.

2. The method for detecting abnormal network behavior based on deep learning according to claim 1, wherein: The multi-dimensional feature construction process is performed on the network interaction data set to be detected to obtain the temporal connection feature, content corresponding feature and behavior stability feature of each interaction record unit, including: Perform time series splitting on the network interaction data set to be detected, dividing the continuous interaction record units into independent interaction individuals according to time nodes, and generating interaction sequences; Perform temporal regularity analysis on the interaction sequence, extract the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculate the time interval between the two as the interaction response time lag parameter, and calculate the distribution of the sending time intervals of adjacent interaction record units as the interaction frequency fluctuation parameter. The interaction response time lag parameter and the interaction frequency fluctuation parameter together constitute the temporal connection feature; Performing content structure comparison processing on the interaction record unit, extracting the field type set of the operation request data and the field type set of the operation response data, counting the ratio of the number of matching field types to the total number of fields in the request data as a field structure matching parameter, checking whether the values ​​of the same fields in the request data and the response data meet the preset business specifications, and generating a field value consistency parameter. The field structure matching parameter and the field value consistency parameter together constitute the content corresponding feature; Perform behavioral tendency analysis on the interaction sequence, count the ratio of the number of times the user terminal initiates the same type of request data in continuous interactions to the total number of sessions as the operation repetition parameter, and analyze the frequency of changes in the type of data requested by the user terminal as the operation stability parameter. The operation repetition parameter and the operation stability parameter together constitute the behavioral stability feature.

3. The method for detecting abnormal network behavior based on deep learning according to claim 2, characterized in that: The method of performing temporal regularity analysis on the interaction sequence, extracting the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculating the time interval between the two as the interaction response time lag parameter, and calculating the distribution of the sending time intervals of adjacent interaction record units as the interaction frequency fluctuation parameter, includes: Traverse the interaction sequence, and for each interaction record unit, obtain the sending time node of the operation request data and the receiving time node of the operation response data, and calculate the time difference between the two as the interaction response lag value; Statistical analysis is performed on the interaction response lag values ​​of all interaction record units in the interaction sequence, and the average level and dispersion of the lag values ​​are calculated, which are used as the stability parameter and fluctuation parameter of the interaction response lag respectively; Traverse the interaction sequence, calculate the time difference between the sending time nodes of the nth interaction record unit and the n-1th interaction record unit, and obtain the time interval between adjacent interactions; The distribution analysis of adjacent interaction time intervals is performed, the frequency of occurrence of interval values ​​in different time intervals is counted, and the interaction frequency fluctuation parameter is generated.

4. The method for detecting abnormal network behavior based on deep learning according to claim 3, characterized in that: The content structure comparison processing is performed on the interaction record unit, the field type set of the operation request data and the field type set of the operation response data are extracted, the ratio of the number of matching field types to the total number of fields in the request data is counted as a field structure matching parameter, and the values ​​of the same fields in the request data and the response data are checked to see whether they meet the preset business specifications, and the field value consistency parameter is generated, including: Performing field parsing on the operation request data and the operation response data of the interaction record unit, and extracting the request field type list and the response field type list respectively; Calculate the number of common fields between the request field type list and the response field type list, which is recorded as the number of matched fields. The total number of request data fields is the number of fields in the request field type list. The field structure matching parameter is the ratio of the number of matched fields to the total number of request data fields. For the common field types in the request field type list and the response field type list, obtain the specific value of the field in the operation request data and the specific value of the field in the operation response data; According to the value requirements of the field type in the preset business specification, determine whether the value of the field in the operation request data meets the requirements and obtain the request field validity mark; similarly, determine whether the value of the field in the operation response data meets the requirements and obtain the response field validity mark; Calculate the average level of the request field validity mark and the response field validity mark of all common fields as the field value consistency parameter.

5. The method for detecting abnormal network behavior based on deep learning according to claim 4, characterized in that: The behavioral tendency analysis of the interaction sequence is performed, the ratio of the number of times the user terminal initiates the same type of request data in continuous interactions to the total number of sessions is counted as an operation repetition parameter, and the frequency of changes in the type of data requested by the user terminal is analyzed as an operation stability parameter, including: Traverse the interaction sequence, count the number of times the user terminal continuously initiates the same type of request data, and calculate the ratio of the number of requests of the same type to the total number of sessions as the base value of the operation repetition parameter; Divide the interaction sequence into multiple time windows. Each time window contains a fixed number of interaction record units. Count the occurrence frequency of the same type of request data in each time window. Calculate the difference in the frequencies of adjacent time windows as the fluctuation value of the operation repetition parameter. Traverse the interaction sequence, count the number of different types of request data initiated by the user end, and calculate the ratio of the number of different types of request data to the total number of sessions as the basic value of the operation stability parameter; Count the number of times the request data type changes within each time window, and calculate the difference in the number of changes between adjacent time windows as the fluctuation value of the operation stability parameter; The basic value and the fluctuation value of the operation repetition parameter are combined to generate the operation repetition parameter; The basic value and fluctuation value of the operational stability parameter are characteristically combined to generate the operational stability parameter.

6. The method for detecting abnormal network behavior based on deep learning according to claim 4, characterized in that: The pre-trained deep anomaly diagnosis network processes the temporal connection features, content correspondence features, and behavioral stability features to generate an interactive anomaly determination result including an anomaly probability value, including: Input the temporal connection features, content correspondence features, and behavioral stability features into the feature input layer of the deep anomaly diagnosis network, and generate a comprehensive feature vector through feature splicing operations; The time modeling sub-network of the deep anomaly diagnosis network performs contextual analysis of the time dimension on the comprehensive feature vector to extract the long-term correlation features of the interaction record units in the time series. The content analysis sub-network of the deep anomaly diagnosis network is used to extract local patterns in the content dimension of the comprehensive feature vector, and extract the structural correlation features of the request data and response data fields; The behavioral analysis sub-network of the deep anomaly diagnosis network performs behavioral tendency modeling on the comprehensive feature vector to extract stable features of user-side operating habits. The long-term correlation features, structural correlation features, and stable features are input into the anomaly scoring layer of the deep anomaly diagnosis network, and the anomaly probability value of each interaction record unit is calculated through a fully connected neural network; The interactive anomaly determination result is generated based on the comparison result between the anomaly probability value and the preset probability threshold.

7. The method for detecting abnormal network behavior based on deep learning according to claim 5, wherein: The abnormal interaction record unit is selected based on the interaction abnormality determination result, and the correlation pattern between the request data and the response data in the abnormal interaction record unit is analyzed to determine the abnormal behavior manifestation form, including: Extracting interaction record units whose abnormal probability values ​​exceed a preset threshold from the interaction abnormality determination results as abnormal interaction record units; For each abnormal interaction record unit, extract the interaction response time lag parameter and interaction frequency fluctuation parameter in the temporal connection feature to analyze whether the temporal connection pattern deviates from the normal range; Extract the field structure matching parameters and field value consistency parameters in the corresponding features of the content, and analyze whether there are any anomalies in the data structure correspondence relationship; Extract the operation repetition parameters and operation stability parameters from the behavioral stability features to analyze whether there are any abnormal changes in the user-side operation stability; Based on the analysis results of time connection rules, data structure correspondence and changes in operation stability, the manifestation form of abnormal behavior is determined.

8. A network abnormal behavior detection system based on deep learning, applying a network abnormal behavior detection method based on deep learning according to any one of claims 1 to 7, characterized in that: include: An acquisition module, used to acquire a set of network interaction data to be detected; A multi-dimensional feature construction and processing module is used to construct and process multi-dimensional features of the network interaction data set to be detected, and obtain the temporal connection features, content corresponding features and behavioral stability features of each interaction record unit; The deep anomaly diagnosis module is used to process temporal connection features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network to generate interactive anomaly judgment results including anomaly probability values; The abnormal behavior analysis module is used to filter out abnormal interaction record units based on the interaction anomaly determination results, analyze the correlation pattern between request data and response data in the abnormal interaction record units, and determine the manifestation of abnormal behavior; The linkage control module is used to generate network security disposal instructions containing interaction identification and risk control strategies based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, and push the network security disposal instructions to the network protection system to trigger targeted protection operations.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a method for detecting abnormal network behavior based on deep learning according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a method for detecting abnormal network behavior based on deep learning according to any one of claims 1 to 7 are implemented.

Images