A deep learning-based network abnormal behavior detection method and system

Abstract

The application discloses a network abnormal behavior detection method and system based on deep learning, and belongs to the technical field of network security, and comprises the following steps: obtaining a network interaction data set to be detected, performing multi-dimensional feature construction processing on the network interaction data set to be detected, obtaining time sequence connection features, content corresponding features and behavior stability features of each interaction record unit, generating an interaction abnormality judgment result containing an abnormal probability value through a pre-trained deep abnormality diagnosis network, screening out abnormal interaction record units, analyzing the association mode of request data and response data, determining an abnormal behavior manifestation form, generating a network security disposal instruction containing an interaction identifier and a risk control strategy based on the abnormal behavior manifestation form and the corresponding abnormal interaction record units, and pushing the network security disposal instruction to a network protection system to trigger a targeted protection operation. The application improves the timeliness and effectiveness of network security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network abnormal behavior detection method and system based on deep learning. BACKGROUND

[0002] With the rapid development of network technology, network interaction activities are increasingly frequent, and network abnormal behavior detection is an important security maintenance link. At present, the common network abnormal behavior detection method usually extracts single-dimensional features (such as time interval or field matching) of network interaction data, calls traditional models (such as rule engine or support vector machine) for abnormal judgment, and only outputs binary results of abnormal or normal, and the detection results are mostly used for log recording or manual alarm. However, the existing technology cannot comprehensively reflect the time correlation law, data structure matching relationship and user operation consistency of network interaction and other characteristics, cannot capture the implicit association between different dimensional features, and leads to inaccurate recognition of complex abnormal patterns; at the same time, the binary abnormal results cannot clearly show the specific manifestation form of the abnormality, and it is difficult to directly convert into targeted protection measures, so that the timeliness and effectiveness of network security protection are limited. Based on this, how to more accurately identify network abnormal behavior and promote the conversion of detection results to protection operation has become a research hotspot in the current network security field. SUMMARY

[0003] In view of the above problems, the present application is proposed.

[0004] Therefore, the present application provides a network abnormal behavior detection method and system based on deep learning to solve the problem in the prior art that it is difficult to comprehensively identify complex abnormal patterns and the corresponding binary results are not easy to be converted into specific protection measures due to the dependence on single-dimensional features and traditional models in network security detection, which limits the timeliness and effectiveness of security protection.

[0005] To solve the above technical problems, the present application provides the following technical solutions:

[0006] In a first aspect, the present application provides a network abnormal behavior detection method based on deep learning, comprising:

[0007] obtaining a set of network interaction data to be detected;

[0008] performing multi-dimensional feature construction processing on the set of network interaction data to be detected to obtain time sequence connection features, content corresponding features and behavior stability features of each interaction record unit;

[0009] processing the time sequence connection features, the content corresponding features and the behavior stability features through a pre-trained deep abnormal diagnosis network to generate an interaction abnormal judgment result containing an abnormal probability value;

[0010] According to the interaction anomaly judgment result, an abnormal interaction record unit is screened out, and a correlation mode of request data and response data in the abnormal interaction record unit is analyzed to determine an abnormal behavior manifestation form;

[0011] Based on the abnormal behavior manifestation form and the corresponding abnormal interaction record unit, a network security disposal instruction containing an interaction identifier and a risk control strategy is generated, and the network security disposal instruction is pushed to a network protection system to trigger a targeted protection operation.

[0012] As a preferred scheme of the network abnormal behavior detection method based on deep learning, the multi-dimensional feature construction processing is performed on the to-be-detected network interaction data set to obtain time sequence connection features, content corresponding features and behavior stability features of each interaction record unit, including:

[0013] The to-be-detected network interaction data set is subjected to time sequence splitting processing, and continuous interaction record units are divided into independent interaction individuals according to time nodes to generate an interaction sequence;

[0014] The interaction sequence is subjected to time sequence rule analysis processing, the sending time of operation request data and the receiving time of operation response data in each interaction record unit are extracted, the time interval between the two is calculated as an interaction response time lag parameter, the distribution of the sending time interval of adjacent interaction record units is counted as an interaction frequency fluctuation parameter, and the interaction response time lag parameter and the interaction frequency fluctuation parameter jointly constitute the time sequence connection features;

[0015] The interaction record unit is subjected to content structure comparison processing, the field type set of operation request data and the field type set of operation response data are extracted, the ratio of the matching number of field types to the total number of request data fields is counted as a field structure matching parameter, whether the values of the same fields in the request data and the response data conform to the preset business specification is checked to generate a field value consistency parameter, and the field structure matching parameter and the field value consistency parameter jointly constitute the content corresponding features;

[0016] The interaction sequence is subjected to behavior tendency analysis processing, the ratio of the number of times of initiating the same type of request data to the total number of sessions in continuous interaction is counted as an operation repetition parameter, and the change frequency of the request data type of the user end is analyzed as an operation stability parameter, and the operation repetition parameter and the operation stability parameter jointly constitute the behavior stability features.

[0017] As a preferred scheme of the network anomaly behavior detection method based on deep learning, wherein: the time sequence analysis processing is performed on the interaction sequence, the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit are extracted, the time interval between the two is calculated as the interaction response time lag parameter, and the sending time interval distribution of adjacent interaction record units is counted as the interaction frequency fluctuation parameter, including:

[0018] The sending time node of the operation request data and the receiving time node of the operation response data are obtained for each interaction record unit, and the time difference between the two is calculated as the interaction response time lag value;

[0019] The interaction response time lag values of all interaction record units in the interaction sequence are statistically analyzed, and the average level and the dispersion degree of the time lag values are calculated as the stability parameter and the fluctuation parameter of the interaction response time lag, respectively;

[0020] The time difference between the sending time nodes of the n-th interaction record unit and the n-1-th interaction record unit is calculated by traversing the interaction sequence, and the adjacent interaction time interval value is obtained;

[0021] The adjacent interaction time interval value is analyzed, the occurrence frequency of the interval value in different time intervals is counted, and the interaction frequency fluctuation parameter is generated.

[0022] As a preferred scheme of the network anomaly behavior detection method based on deep learning, wherein: the content structure comparison processing is performed on the interaction record unit, the field type set of the operation request data and the field type set of the operation response data are extracted, the ratio of the matching number of field types to the total number of request data fields is counted as the field structure matching parameter, and the values of the same fields in the request data and the response data are checked whether they conform to the preset business specification to generate the field value consistency parameter, including:

[0023] The field analysis processing is performed on the operation request data and the operation response data of the interaction record unit, and the request field type list and the response field type list are extracted, respectively;

[0024] The number of common fields of the request field type list and the response field type list is calculated, which is recorded as the matching field number, the total number of request data fields is the number of fields in the request field type list, and the field structure matching parameter is the ratio of the matching field number to the total number of request data fields;

[0025] For the common field types of the request field type list and the response field type list, the specific value of the field in the operation request data and the specific value of the field in the operation response data are obtained;

[0026] According to the value requirement of the field type in the preset business specification, it is judged whether the value of the field in the operation request data meets the requirement, and a request field validity mark is obtained; similarly, it is judged whether the value of the field in the operation response data meets the requirement, and a response field validity mark is obtained.

[0027] The average level of the request field validity mark and the response field validity mark of all common fields is calculated as a field value consistency parameter.

[0028] As a preferred scheme of the network abnormal behavior detection method based on deep learning, the interaction sequence is subjected to behavior tendency analysis processing, the ratio of the number of times of initiating the same type of request data to the total number of sessions of the user end in continuous interaction is counted as an operation repetition parameter, and the frequency of change of the request data type of the user end is analyzed as an operation stability parameter, including:

[0029] The interaction sequence is traversed, the number of times of initiating the same type of request data of the user end continuously is counted, and the ratio of the number of times of initiating the same type of request data to the total number of sessions is calculated as a basic value of the operation repetition parameter;

[0030] The interaction sequence is divided into a plurality of time windows, each time window contains a fixed number of interaction record units, the frequency of the same type of request data in each time window is counted, and the difference value of the frequencies of adjacent time windows is calculated as a fluctuation value of the operation repetition parameter;

[0031] The interaction sequence is traversed, the number of times of initiating different types of request data of the user end is counted, and the ratio of the number of times of initiating different types of request data to the total number of sessions is calculated as a basic value of the operation stability parameter;

[0032] The number of times of change of the request data type in each time window is counted, and the difference value of the change numbers of adjacent time windows is calculated as a fluctuation value of the operation stability parameter;

[0033] The basic value and the fluctuation value of the operation repetition parameter are combined to generate the operation repetition parameter;

[0034] The basic value and the fluctuation value of the operation stability parameter are combined to generate the operation stability parameter.

[0035] As a preferred scheme of the network abnormal behavior detection method based on deep learning, the time series connection feature, the content corresponding feature and the behavior stability feature are processed through the pre-trained deep anomaly diagnosis network to generate an interaction anomaly judgment result containing an abnormal probability value, including:

[0036] The time series connection feature, the content corresponding feature and the behavior stability feature are input into the feature input layer of the deep anomaly diagnosis network, and a comprehensive feature vector is generated through feature splicing operation.

[0037] The time modeling subnetwork of the deep anomaly diagnosis network performs context analysis and processing on the comprehensive feature vector in the time dimension, and extracts long-term correlation features of the interaction record units in the time sequence;

[0038] The content analysis subnetwork of the deep anomaly diagnosis network performs local pattern extraction processing on the comprehensive feature vector in the content dimension, and extracts structural correlation features of the request data and the response data fields;

[0039] The behavior analysis subnetwork of the deep anomaly diagnosis network performs tendency modeling processing on the comprehensive feature vector in the behavior dimension, and extracts stable features of the user end operation habits;

[0040] The long-term correlation features, the structural correlation features and the stable features are input into the anomaly score layer of the deep anomaly diagnosis network, and the anomaly probability values of each interaction record unit are calculated through a fully connected neural network;

[0041] According to the comparison result of the anomaly probability value and the preset probability threshold, an interaction anomaly judgment result is generated.

[0042] As a preferred scheme of the network anomaly behavior detection method based on deep learning, wherein: the interaction anomaly record units are filtered out according to the interaction anomaly judgment result, and the correlation mode of the request data and the response data in the abnormal interaction record units is analyzed to determine the abnormal behavior manifestation, including:

[0043] The interaction record units with the anomaly probability value exceeding the preset threshold are extracted from the interaction anomaly judgment result as the abnormal interaction record units;

[0044] For each abnormal interaction record unit, the interaction response time lag parameter and the interaction frequency fluctuation parameter in the time sequence connection feature are extracted, and whether the time connection rule deviates from the normal range is analyzed;

[0045] The field structure matching parameter and the field value consistency parameter in the content corresponding feature are extracted, and whether the data structure corresponding relationship is abnormal is analyzed;

[0046] The operation repetition parameter and the operation stability parameter in the behavior stability feature are extracted, and whether the user end operation stability changes abnormally is analyzed;

[0047] The analysis results of the time connection rule, the data structure corresponding relationship and the operation stability change are combined to determine the abnormal behavior manifestation.

[0048] In a second aspect, the application provides a network anomaly behavior detection system based on deep learning, comprising:

[0049] An acquisition module is configured to acquire a set of network interaction data to be detected.

[0050] The multi-dimensional feature construction processing module is configured to perform multi-dimensional feature construction processing on the network interaction data set to be detected to obtain time sequence connection features, content corresponding features and behavior stability features of each interaction record unit.

[0051] The deep anomaly diagnosis module is configured to process the time sequence connection features, the content corresponding features and the behavior stability features through a pre-trained deep anomaly diagnosis network to generate an interaction anomaly judgment result containing an anomaly probability value.

[0052] The abnormal behavior analysis module is configured to filter out abnormal interaction record units according to the interaction anomaly judgment result, analyze the association mode of request data and response data in the abnormal interaction record units, and determine an abnormal behavior manifestation form.

[0053] The linkage control module is configured to generate a network security disposal instruction containing an interaction identifier and a risk control strategy based on the abnormal behavior manifestation form and the corresponding abnormal interaction record units, and push the network security disposal instruction to a network protection system to trigger a targeted protection operation.

[0054] In a third aspect, the present application provides an electronic device, comprising:

[0055] A memory is configured to store a program.

[0056] A processor is configured to execute the computer executable instructions, and the computer executable instructions, when executed by the processor, implement the steps of the network anomaly behavior detection method based on deep learning.

[0057] In a fourth aspect, the present application provides a computer readable storage medium, comprising: the program, when executed by the processor, implements the steps of the network anomaly behavior detection method based on deep learning.

[0058] The application has the beneficial effects that: the application can comprehensively depict the normal mode of network interaction from the time attribute, data structure attribute and user behavior attribute of interaction by acquiring the time-sequentially arranged network interaction data set to be detected, constructing the multi-dimensional features of time sequence connection, content correspondence and behavior stability covering the time correlation rule, data structure matching relationship and user operation consistency; the pre-trained deep anomaly diagnosis network processes the above multi-dimensional features, automatically captures the implicit correlation among the three types of features by using the nonlinear modeling capability of deep learning, and can more accurately identify the complex abnormal mode that cannot be reflected by single-dimensional features compared with the traditional model which can only process linear or low-order feature combinations; after generating the abnormal judgment result, the specific manifestation form is determined by analyzing the correlation mode of the request and response in the abnormal interaction record unit, the black-box abnormal probability value is converted into specific types such as time response anomaly, data structure anomaly or operation mode anomaly, and specific directions are provided for subsequent disposal; finally, the security disposal instruction containing the interaction identifier and the risk control strategy is generated based on the abnormal manifestation form and is pushed to the protection system, realizing the direct conversion from anomaly detection to protection operation, so that the detection result is not only used for alarm or record, but also triggers targeted protection measures, and the timeliness and effectiveness of network security protection are improved. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0060] Figure 1 The application provides a network abnormal behavior detection method based on deep learning. DETAILED DESCRIPTION

[0061] In order to make the above-mentioned purposes, features and advantages of the application more obvious and easy to understand, the specific embodiments of the application will be described in detail below with reference to the drawings in the specification. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should be within the protection scope of the application.

[0062] Embodiment 1, refer to Figure 1 For an embodiment of the application, a network abnormal behavior detection method based on deep learning is provided, as shown in Figure 1 The method comprises the following steps:

[0063] S100: obtain a network interaction data set to be detected;

[0064] In the embodiment of the application, the network interaction data set to be detected in step S100 comprises a plurality of interaction record units arranged in time sequence, each of which is composed of operation request data initiated by a user end and operation response data returned by a service end;

[0065] In the embodiment of the application, the network interaction data set to be detected is a basic data source for detecting network abnormal behaviors, wherein the interaction record units arranged in time sequence reflect the sequence of user interaction with the service end in the enterprise internal network. The operation request data initiated by the user end is an instruction sent by the user to the service end for using network services, such as a request of an employee to log in to an internal office system, a request to query business data, etc. in an enterprise office scenario; and the operation response data returned by the service end is feedback given by the service end to these requests, such as a prompt of login success or failure, a result of queried business data, etc.

[0066] In the embodiment of the application, in the enterprise internal network environment, the network interaction data set to be detected can be obtained by means of network flow sniffing technology. A network sniffing device is deployed at a key node of the enterprise network, such as a core switch, which listens to all data packets transmitted in the network. By deeply analyzing these data packets according to network protocol rules, the operation request data packets initiated by the user end and the operation response data packets returned by the service end are distinguished. These interaction record units are sorted according to the timestamps of the data packets, thereby obtaining the network interaction data set to be detected. For example, the interaction data between employees of each department and the enterprise server is captured and sorted by using the network sniffing device, thereby forming a complete network interaction data set to be detected. The obtained interaction data is used for security management, and the collection of relevant interaction data does not involve the infringement of personal privacy data, and is obtained on the premise of permission and knowledge of the user.

[0067] S200: perform multi-dimensional feature construction processing on the network interaction data set to be detected, to obtain time sequence connection features, content corresponding features and behavior stability features of each interaction record unit;

[0068] In the embodiment of the application, the multi-dimensional feature construction processing is performed on the network interaction data set to be detected, to obtain the time sequence connection features, the content corresponding features and the behavior stability features of each interaction record unit. The time sequence connection features are used to describe the time correlation law of the request data and the response data, the content corresponding features are used to describe the structure matching relationship of the request / response data fields, and the behavior stability features are used to describe the operation consistency of the user end in continuous interaction.

[0069] In the embodiments of the present application, the multi-dimensional feature construction processing is to mine and analyze network interaction data from multiple angles to extract key features that can reflect the characteristics of network interaction. The time sequence connection feature focuses on the correlation of request data and response data in time, such as how long it takes to get a response after a request is sent, whether the time interval between adjacent requests is stable, etc., which helps to find network delay anomalies, request frequency anomalies, etc. The content corresponding feature focuses on the matching of request data and response data in field structure and value, such as whether the data field type and number required in the request are consistent with the return in the response, whether the values of the same field conform to the enterprise business specification, etc., which can be used to detect data format errors, data tampering, etc. The behavior stability feature measures the consistency of user's operation behavior in continuous network interaction process, such as whether the user frequently initiates the same type of request, whether the change of request type conforms to the normal business process, etc., which helps to identify abnormal operation mode.

[0070] In the embodiments of the present application, the multi-dimensional feature construction processing of the to-be-detected network interaction data set adopts a method combining association analysis and statistical analysis. The association analysis algorithm, such as Apriori algorithm, is used to analyze the time correlation and content matching relationship between request data and response data, and to extract time sequence connection features and content corresponding features. For the behavior stability feature, statistical analysis methods, such as calculating the frequency distribution and change rate of request type, are used to evaluate the consistency of user operation. For example, in an enterprise internal project management system, the multi-dimensional features of each interaction record unit are constructed by performing association analysis and statistical analysis on the operation request data of employees.

[0071] In the embodiments of the present application, the multi-dimensional feature construction processing of the to-be-detected network interaction data set obtains the time sequence connection feature, the content corresponding feature and the behavior stability feature of each interaction record unit, which specifically includes the following steps S210-S260:

[0072] Step S210: Time sequence splitting processing is performed on the to-be-detected network interaction data set, and continuous interaction record units are divided into independent interaction individuals according to time nodes to generate interaction sequences with time continuity.

[0073] The time sequence splitting processing is to divide continuous network interaction data according to time nodes, so that the originally continuous interaction record units become independent and ordered interaction individuals. The interaction sequence generated in this way not only ensures the independence of each interaction individual, but also maintains the overall time continuity, which is convenient for subsequent analysis of the time sequence rule of network interaction.

[0074] In the enterprise intranet, the method of fixed time window division is used for time series splitting processing. A fixed time window length, such as 10 minutes, is set, and the interaction record units in the network interaction data set to be detected are divided according to every 10 minutes interval based on the time stamp. For the interaction record units in each time window, they are regarded as an independent interaction individual. For example, in the financial system of an enterprise, all the interaction record units of the employees between 9:00-9:10 in the morning are regarded as an independent interaction individual, and the interaction record units between 9:10-9:20 are regarded as another independent interaction individual, and so on, to generate an interaction sequence with time continuity.

[0075] Step S220: Time sequence rule analysis processing is performed on the interaction sequence, the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit are extracted, the time interval between the two is calculated as the interaction response time lag parameter, and the sending time interval distribution of adjacent interaction record units is calculated as the interaction frequency fluctuation parameter, and the interaction response time lag parameter and the interaction frequency fluctuation parameter jointly constitute the time sequence connection feature.

[0076] The time sequence rule analysis processing is a process of in-depth mining and analysis of the time rules contained in the interaction sequence. The sending time of the operation request data and the receiving time of the operation response data are key indicators for measuring the timeliness of network interaction. The interaction response time lag parameter obtained by calculating the time interval between them reflects the response speed of the server to the user request and the network delay. The sending time interval distribution of adjacent interaction record units reflects the time regularity of the user end initiating the request, and the interaction frequency fluctuation parameter obtained by calculating the distribution is helpful to find abnormal request frequency patterns, such as sudden high-frequency requests or long-time request interruption.

[0077] The time sequence rule analysis processing on the interaction sequence uses a sliding window statistical method. A sliding window is used to move on the interaction sequence, and the size of the window is set according to actual needs, for example, containing 20 interaction record units. In each window, the sending time of the operation request data and the receiving time of the operation response data are extracted, and the interaction response time lag parameter is calculated. At the same time, the sending time interval of adjacent interaction record units is calculated, and the distribution frequency of these time intervals in different intervals is calculated to obtain the interaction frequency fluctuation parameter. With the sliding of the window, these parameters are constantly updated to dynamically reflect the time sequence rules of network interaction. For example, in the human resource management system of an enterprise, the operation request and system response time of the employees are analyzed by the sliding window statistical method, and the time sequence connection feature is extracted.

[0078] In the embodiment of the present application, in step S220, the time sequence rule analysis processing is performed on the interaction sequence, the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit are extracted, the time interval between the two is calculated as the interaction response time lag parameter, the sending time interval distribution of adjacent interaction record units is counted as the interaction frequency fluctuation parameter, and the following steps S221-S226 are specifically included:

[0079] In step S221, the sending time node of the operation request data and the receiving time node of the operation response data are obtained for each interaction record unit in the interaction sequence, and the time difference between the two is calculated as the interaction response time lag value.

[0080] Traversing the interaction sequence means checking each interaction record unit in the interaction sequence in turn to obtain the time information of the operation request data and the operation response data in each unit. The sending time node of the operation request data is the specific time when the user terminal sends the request information into the network, and the receiving time node of the operation response data is the time when the user terminal receives the response information from the server. The difference between the two time nodes is calculated to obtain the interaction response time lag value of the interaction record unit, which directly reflects the delay of the network interaction.

[0081] In the enterprise internal network, the interaction sequence is traversed by log auditing and the interaction response time lag value is calculated. The network devices (such as routers, firewalls) and servers of the enterprise usually record detailed access logs, which contain the sending time of the request and the receiving time of the response. Through a professional log auditing tool, the relevant time information of each interaction record unit is extracted from the log file, and the time difference is calculated. For example, in the enterprise mail system, the time of the mail sending request and the receiving response is analyzed by the log auditing tool to calculate the interaction response time lag value of each interaction record unit.

[0082] In step S222, the interaction response time lag values of all interaction record units in the interaction sequence are statistically analyzed, and the average level and the dispersion degree of the time lag values are calculated as the stability parameter and the fluctuation parameter of the interaction response time lag, respectively.

[0083] The statistical analysis of the interaction response time lag value is to grasp the delay characteristics of the network interaction as a whole. The average level reflects the average delay of the network in a period of time, which is an important indicator for measuring the response performance of the network. The dispersion degree reflects the fluctuation amplitude of the time lag value, which reflects the stability of the network delay. If the dispersion degree is large, it means that the network delay is unstable, and there may be problems such as network congestion and server failure.

[0084] The interaction response time lag values of all interaction record units in the interaction sequence are statistically analyzed using the mean and standard deviation calculation method in statistics. The interaction response time lag values of all interaction record units are collected to form a data set. The sum of these time lag values is calculated and divided by the number of interaction record units to obtain the average time lag value as the stability parameter of the interaction response time lag. The square of the difference between each time lag value and the average time lag value is calculated, the sum of these square values is calculated and divided by the number of interaction record units, and the square root is taken to obtain the standard deviation as the fluctuation parameter of the interaction response time lag. For example, in the file sharing system of an enterprise, the response performance of the system is evaluated by statistically analyzing the interaction response time lag values of all file download requests in a period of time to obtain the stability parameter and the fluctuation parameter.

[0085] Step S223: Traverse the interaction sequence to calculate the time difference between the sending time nodes of the nth interaction record unit and the (n-1)th interaction record unit to obtain the adjacent interaction time interval value.

[0086] The purpose of calculating the adjacent interaction time interval value by traversing the interaction sequence is to analyze the time regularity of the user end initiating requests. The adjacent interaction time interval value reflects the time interval between two requests in continuous network interactions, which helps to find the rhythm and pattern of user operations. For example, if the adjacent interaction time interval value is relatively stable, it means that the user's operation has certain regularity; if the interval value suddenly becomes smaller or larger, it may indicate that the user's operation behavior has changed abnormally.

[0087] In an enterprise internal network, the adjacent interaction time interval value is calculated by database query. The interaction sequence is stored in the database, and each interaction record unit contains the sending time node of the operation request data. Using the query statement of the database, the nth interaction record unit and the (n-1)th interaction record unit are associated by self-joining operation to calculate the difference value of their sending time nodes to obtain the adjacent interaction time interval value. For example, in the customer relationship management system of an enterprise, the adjacent interaction time interval value of the employee's request for customer information query is calculated by database query to analyze the operation regularity of the employee.

[0088] Step S224: Perform distribution analysis on the adjacent interaction time interval value to count the frequency of interval values in different time intervals to generate the interaction frequency fluctuation parameter, which is used to represent the time regularity of the user end initiating request data.

[0089] Distribution analysis of adjacent interaction time interval values is used to understand the time pattern of user-initiated requests. By dividing adjacent interaction time interval values into different time intervals and counting the frequency of interval values in each interval, the distribution of interaction frequency is obtained. The interaction frequency fluctuation parameter reflects the time regularity of user-initiated request data according to this distribution. If the frequency distribution is concentrated in certain intervals, it indicates that the user-initiated request time is regular; if the distribution is scattered, it indicates that the time regularity is poor.

[0090] The distribution analysis of adjacent interaction time interval values uses a histogram statistical method. Determine the division range of time intervals, for example, divide adjacent interaction time interval values into 0-5 seconds, 5-10 seconds, 10-15 seconds, etc. Count the number of adjacent interaction time interval values in each interval and calculate the frequency. Use data visualization tools to draw a histogram to visually display the distribution of interaction frequency. At the same time, organize these frequency data into a vector or matrix as the interaction frequency fluctuation parameter. For example, in the enterprise office automation system, the distribution analysis of the adjacent interaction time interval values of the employee-initiated approval request generates the interaction frequency fluctuation parameter to judge the time regularity of the employee's operation.

[0091] Step S225: Combine the stability parameter, fluctuation parameter of interaction response time lag and interaction frequency fluctuation parameter to generate a time sequence connection feature containing time connection stability and time initiation regularity information.

[0092] Feature combination is to integrate different features to form a more comprehensive and representative feature. The stability parameter of interaction response time lag reflects the average delay level of network interaction in response time, and the fluctuation parameter reflects the stability of the delay; the interaction frequency fluctuation parameter represents the time regularity of user-initiated requests. Combining these three parameters together, the time sequence connection feature can reflect both the stability of network interaction in time connection and the time regularity of user request initiation.

[0093] In the enterprise internal network, the stability parameter, fluctuation parameter of interaction response time lag and interaction frequency fluctuation parameter are combined by vector splicing. These three parameters are represented as vectors, and they are spliced into a new vector in order. This new vector is the time sequence connection feature. For example, in the enterprise project management system, the stability parameter, fluctuation parameter of interaction response time lag and interaction frequency fluctuation parameter are spliced into a vector to generate a time sequence connection feature for analyzing the network interaction time characteristics of project team members.

[0094] Step S226: Verify the effectiveness of each parameter in the time sequence connection feature through a feature importance evaluation method, and retain the parameters with high contribution to anomaly detection as the final time sequence connection feature.

[0095] The feature importance evaluation method is used to evaluate the contribution of each feature to the target task (such as anomaly detection). In the time series connection feature, the stable parameters, fluctuation parameters and interaction frequency fluctuation parameters of the interaction response time lag are included. Different parameters may have different effects on anomaly detection, and some parameters may have a greater contribution to anomaly detection, while some parameters may have a smaller effect or even no effect. Through the feature importance evaluation method, parameters with high contribution to anomaly detection are screened out, and these parameters are retained as the final time series connection feature, which can improve the accuracy and efficiency of anomaly detection and reduce unnecessary calculation and storage overhead.

[0096] The feature importance evaluation method adopts the feature importance evaluation mechanism in the random forest algorithm. Random forest is an ensemble learning algorithm composed of multiple decision trees. When training the random forest model, the average impurity reduction of each feature in all decision trees is calculated to evaluate the importance of the feature. Specifically, a training data set containing time series connection features and anomaly labels (normal or abnormal) is prepared. The random forest algorithm is used to train the data set, and the importance score of each feature is recorded during the training process. According to the importance score, the features are sorted, and the features with higher scores are selected as the final time series connection features. For example, in the network security monitoring system of an enterprise, the parameters in the time series connection feature are evaluated for importance by the random forest algorithm, and the parameters with a large contribution to anomaly detection are screened out.

[0097] Step S230: Perform content structure comparison processing on the interaction record unit, extract the field type set of the operation request data and the field type set of the operation response data, count the matching number of field types and the ratio of the total number of request data fields as the field structure matching parameter, check whether the values of the same fields in the request data and the response data conform to the preset business specification, generate the field value consistent parameter, and the field structure matching parameter and the field value consistent parameter together constitute the content corresponding feature.

[0098] The content structure comparison processing is a process of comparing and analyzing the content structure of the operation request data and the operation response data in the interaction record unit in detail. The field type set refers to the type set of all fields contained in the operation request data or the operation response data, such as string type, integer type, date type, etc. The field structure matching parameter measures the matching degree of the request data and the response data in the field structure by counting the matching number of the field type and the ratio of the total number of the request data fields. The preset business specification is formulated according to the business needs and rules of the enterprise, and is used to standardize the value range and format of the same fields in the request data and the response data. The field value consistency parameter checks whether the values of the same fields in the request data and the response data conform to the preset business specification, so as to reflect the compliance of the data values. The content corresponding feature is composed of the field structure matching parameter and the field value consistency parameter, and can comprehensively reflect the structure matching relationship and the value compliance of the request data and the response data.

[0099] In the enterprise internal network, the content structure comparison processing of the interaction record unit adopts a data analysis and rule matching method. The operation request data and the operation response data are analyzed by using a data analysis tool to extract the field type set. The matching number of the field type is counted, and the field structure matching parameter is calculated. For the field value consistency parameter, a rule matching program is written according to the preset business specification to check the values of the same fields in the request data and the response data. For example, in the inventory management system of the enterprise, the content structure comparison processing of the inventory query request submitted by the employee and the response data returned by the system is performed, the field structure matching parameter and the field value consistency parameter are calculated, and the consistency and compliance of the data are evaluated.

[0100] In the embodiment of the application, in step S230, the content structure comparison processing of the interaction record unit is performed, the field type set of the operation request data and the field type set of the operation response data are extracted, the matching number of the field type and the ratio of the total number of the request data fields are counted as the field structure matching parameter, and the values of the same fields in the request data and the response data are checked to see whether they conform to the preset business specification, and the field value consistency parameter is generated, which specifically includes the following steps S231-S237:

[0101] Step S231: The field analysis processing of the operation request data and the operation response data of the interaction record unit is performed, and the request field type list and the response field type list are extracted respectively.

[0102] Field parsing processing is a deep analysis of the content of operation request data and operation response data to extract field type information. Request field type list and response field type list record the types of all fields in operation request data and operation response data respectively. In the enterprise intranet, different business systems may use different data formats (such as JSON, XML, CSV) to transmit data, so it is necessary to use corresponding parsing methods for different data formats.

[0103] For JSON format data, a professional JSON parser is used for parsing. The parser can identify fields and values in the data according to the syntax rules of JSON, and determine the type of the field. For example, in the customer service system of an enterprise, the customer feedback data submitted by employees may be in JSON format, and the request field type list is extracted through the JSON parser. For XML format data, an XML parsing engine is used, which can identify XML tags and attributes and extract field type information. In the supply chain management system of an enterprise, the order data sent by suppliers may be in XML format, and the response field type list is extracted through the XML parsing engine.

[0104] Step S232: Calculate the number of common fields between the request field type list and the response field type list, denoted as the number of matching fields, the total number of request data fields is the number of fields in the request field type list, and the field structure matching parameter is the ratio of the number of matching fields to the total number of request data fields.

[0105] The calculation of the field structure matching parameter directly reflects the matching degree of operation request data and operation response data in the field structure. The more the number of matching fields, the closer the field structure matching parameter to 1, which means that the field structure of request data and response data is more similar; on the contrary, if the number of matching fields is small, the field structure matching parameter is small, which means that the difference in field structure is large.

[0106] The number of matching fields is calculated using the method of set operation. Convert the request field type list and the response field type list into sets, find the intersection of the two sets, and the number of elements in the intersection is the number of matching fields. For example, in the financial management system of an enterprise, the expense reimbursement request submitted by employees and the processing result data returned by the system are calculated by set operation to calculate the field structure matching parameter and judge the consistency of the data structure.

[0107] Step S233: For the common field types of the request field type list and the response field type list, get the specific value of the field in the operation request data and the specific value of the field in the operation response data.

[0108] The specific value of the common field type is obtained to further check the consistency of the request data and the response data in content. In an intranet, different business systems have different requirements for field values, so the specific values of these fields need to be accurately obtained for subsequent compliance checks.

[0109] The specific value of the common field type is obtained by data searching and positioning. When parsing the operation request data and the operation response data, the position and type information of each field are recorded. For the common field type, the corresponding specific value is searched in the data according to the recorded position information. For example, in the human resource management system of an enterprise, the salary adjustment request submitted by an employee and the approval result data returned by the system, for the common "salary amount" field type, the specific value is obtained by data searching.

[0110] Step S234: According to the value requirement of the field type in the preset business specification, it is judged whether the value of the field in the operation request data meets the requirement, and the request field validity mark is obtained; similarly, it is judged whether the value of the field in the operation response data meets the requirement, and the response field validity mark is obtained.

[0111] The preset business specification is formulated by the enterprise according to its business needs and management rules, which is used to standardize the value range and format of the data field. It is judged whether the values of the request field and the response field meet the requirements to ensure the legality and accuracy of the data.

[0112] The rule engine is used to judge the validity of the field value. The rule engine writes rules according to the preset business specification, and checks the values of the same field in the operation request data and the operation response data. If the value meets the rule requirement, it is marked as valid; otherwise, it is marked as invalid. For example, in the contract management system of an enterprise, for the "contract amount" field, the preset business specification requires that the value must be a positive number, and the rule engine will judge the value of this field in the request data and the response data, and generate the request field validity mark and the response field validity mark.

[0113] Step S235: Calculate the average level of the request field validity marks and the response field validity marks of all common fields as the field value consistency parameter.

[0114] The calculation of the field value consistency parameter is used to comprehensively evaluate the consistency and compliance of the values of the same field in the request data and the response data. By calculating the average level of the request field validity marks and the response field validity marks of all common fields, a quantitative index is obtained to represent the consistency degree of the data values.

[0115] The field value consistency parameter is calculated using statistical calculation method. The request field validity flags and response field validity flags of all common fields are added together and divided by the number of common fields to obtain the average level as the field value consistency parameter. For example, in the project management system of an enterprise, the validity flags of multiple common fields (such as project progress, budget amount, etc.) are statistically calculated to obtain the field value consistency parameter, which evaluates the consistency of project data.

[0116] Step S236: The field structure matching parameter and the field value consistency parameter are combined with weights, and the weights are determined by historical data training to generate a content corresponding feature containing field structure correspondence and field value compliance information.

[0117] The weighted combination of the field structure matching parameter and the field value consistency parameter is used to comprehensively consider the two aspects of data structure and value, forming a more comprehensive content corresponding feature. The weights are determined by historical data training, which is to reasonably allocate the weights according to the contribution of the two parameters to anomaly detection in historical data, so as to improve the accuracy and effectiveness of the content corresponding feature.

[0118] The linear regression algorithm in machine learning is used to determine the weights. By collecting historical network interaction data, the field structure matching parameter and the field value consistency parameter are used as input features, and the anomaly label (normal or abnormal) is used as output label to train the linear regression model. After the model training is completed, the regression coefficient obtained is the weight. The field structure matching parameter and the field value consistency parameter are weighted and summed according to the weight to generate the content corresponding feature. For example, in the network security audit system of an enterprise, the weights are trained by linear regression algorithm, and the field structure matching parameter and the field value consistency parameter are combined with weights to generate the content corresponding feature, which is used to detect anomalies in network interaction data.

[0119] Step S237: The accuracy of the content corresponding feature is confirmed by the content compliance verification method to ensure that it can effectively reflect the structure matching relationship between the request data and the response data.

[0120] The content compliance verification method is a method for checking whether the content corresponding feature accurately reflects the structure matching relationship and value compliance between the request data and the response data. The quality of the content corresponding feature is ensured by verification to improve the accuracy of anomaly detection.

[0121] The content compliance verification is performed using a cross-validation and comparative analysis method. A part of historical data is taken as a verification set, and the content corresponding features are used for anomaly detection, compared with the actual anomaly label, and the accuracy, recall rate and other indicators are calculated. At the same time, the detection results under different feature combinations are compared, and the effectiveness of the content corresponding features is analyzed. For example, in the network monitoring system of an enterprise, the accuracy of the content corresponding features is confirmed through cross-validation and comparative analysis, and it is ensured that the content corresponding features can effectively detect the anomalies of network interaction data.

[0122] Step S240: performing behavior tendency analysis processing on the interaction sequence, taking the ratio of the number of times of initiating the same type of request data to the total number of sessions as an operation repetition parameter, and analyzing the change frequency of the request data type of the user terminal as an operation stability parameter, and the operation repetition parameter and the operation stability parameter jointly constitute a behavior stability feature.

[0123] The behavior tendency analysis processing is to deeply analyze the operation behavior of the user terminal in the network interaction process to extract features reflecting the stability and consistency of the user operation. The operation repetition parameter measures the repeatability of the user operation by taking the ratio of the number of times of initiating the same type of request data to the total number of sessions. If the operation repetition parameter is high, it means that the user frequently initiates the same type of request, and the operation has a certain repeatability; otherwise, it means that the operation type is more diversified. The operation stability parameter analyzes the change frequency of the request data type of the user terminal, reflecting the stability of the operation type of the user. If the change frequency is low, it means that the operation type of the user is stable; if the change frequency is high, it means that the operation type of the user changes frequently. The behavior stability feature is jointly constituted by the operation repetition parameter and the operation stability parameter, and can comprehensively describe the operation consistency of the user terminal in continuous interaction.

[0124] In the internal network of an enterprise, the behavior tendency analysis processing is performed on the interaction sequence, and the data statistics and trend analysis method is adopted. The request data types in the interaction sequence are classified and counted, and the number of occurrences of each request data type is recorded; the operation repetition parameter and the operation stability parameter are calculated. For example, in the office system of an enterprise, the number of times of different types of requests such as file download requests and email sending requests initiated by employees within a week is counted, the operation repetition parameter and the operation stability parameter are calculated, and the operation behavior stability of the employees is analyzed.

[0125] In the embodiment of the application, step S240, the behavior tendency analysis processing is performed on the interaction sequence, the ratio of the number of times of initiating the same type of request data to the total number of sessions is taken as an operation repetition parameter, and the change frequency of the request data type of the user terminal is analyzed as an operation stability parameter, which specifically includes the following steps S241-S248:

[0126] Step S241: Traverse the interaction sequence, count the number of times the user end initiates the same type of request data successively, and calculate the ratio of the number of times of the same type of request data to the total number of sessions as the basic value of the operation repetition parameter.

[0127] Traversing the interaction sequence is to comprehensively count the case of the user end initiating the same type of request data in the network interaction process. By counting the number of times of successively initiating the same type of request data and calculating the ratio of the number of times to the total number of sessions, a preliminary operation repetition parameter basic value is obtained, reflecting the basic repetitiveness of user operation.

[0128] In the enterprise internal network, the method of log recording and counting statistics is used to traverse the interaction sequence and calculate the basic value of the operation repetition parameter. The logs of network devices and servers record the request information of each user, and by analyzing the log files, the number of times of successively initiating the same type of request data is counted. At the same time, the total number of sessions is recorded, and the ratio of the two is calculated. For example, in the customer service system of an enterprise, by analyzing the operation logs of customer service personnel, the number of times of successively initiating customer information query requests is counted, and the basic value of the operation repetition parameter is calculated.

[0129] Step S242: Divide the interaction sequence into multiple time windows, each time window containing a fixed number of interaction record units, count the frequency of the same type of request data in each time window, and calculate the difference value of the frequency of adjacent time windows as the fluctuation value of the operation repetition parameter.

[0130] Dividing the interaction sequence into multiple time windows is used to dynamically observe the change of the user operation repetition parameter. The frequency of the same type of request data in each time window is counted, and the difference value of the frequency of adjacent time windows is calculated to obtain the fluctuation value of the operation repetition parameter, reflecting the stability of user operation repetitiveness.

[0131] In the enterprise internal network, the sliding window technique is used to divide the interaction sequence into multiple time windows. A fixed number of interaction record units, such as 10, are set in each time window. In each time window, the number of times of the same type of request data is counted, and the frequency is calculated. The difference value of the frequency of adjacent time windows is calculated as the fluctuation value of the operation repetition parameter. For example, in the sales management system of an enterprise, the operation request data of sales personnel is divided into time windows, and the fluctuation value of the operation repetition parameter is calculated to analyze the stability of sales operation.

[0132] Step S243: Traverse the interaction sequence, count the number of times the user end initiates the same type of request data successively, and calculate the ratio of the number of times of the same type of request data to the total number of sessions as the basic value of the operation repetition parameter.

[0133] The number of different types of request data initiated by the user terminal is counted by traversing the interaction sequence, and the diversity of user operation types is understood. The ratio of the number of different types of request data to the total number of sessions is calculated as the basic value of the operation stability parameter, reflecting the basic stability of the user operation type.

[0134] The basic value of the operation stability parameter is calculated by traversing the interaction sequence using classification statistics. The request data in the interaction sequence is classified, and the number of different types of request data is counted. At the same time, the total number of sessions is recorded, and the ratio of the two is calculated. For example, in the enterprise's R&D management system, the operation requests of R&D personnel (such as code submission requests, document download requests, etc.) are classified and counted, and the basic value of the operation stability parameter is calculated.

[0135] Step S244: Count the number of changes in request data types in each time window, and calculate the difference in the number of changes between adjacent time windows as the fluctuation value of the operation stability parameter.

[0136] The number of changes in request data types in each time window is counted and the difference in the number of changes between adjacent time windows is calculated to obtain the fluctuation value of the operation stability parameter, reflecting the fluctuation of the stability of the user operation type.

[0137] The fluctuation value of the operation stability parameter is calculated using the time window analysis and difference calculation method. In each time window, the number of changes in request data types is counted. The difference in the number of changes between adjacent time windows is calculated as the fluctuation value of the operation stability parameter. For example, in the enterprise's market research system, the operation request type changes of market research personnel are analyzed using time windows, and the fluctuation value of the operation stability parameter is calculated to evaluate the stability of market research work.

[0138] Step S245: Feature combination of the basic value and the fluctuation value of the operation repetition parameter to generate the operation repetition parameter reflecting the repetition of the user terminal operation.

[0139] Feature combination of the basic value and the fluctuation value of the operation repetition parameter is used to comprehensively consider the basic level and fluctuation of the user operation repetition, forming a more comprehensive operation repetition parameter.

[0140] The basic value and the fluctuation value of the operation repetition parameter are feature combined using vector splicing. The basic value and the fluctuation value are represented as vectors, which are spliced into a new vector as the operation repetition parameter. For example, in the enterprise's human resource training system, the basic value and the fluctuation value of the operation repetition parameter of the training trainees are vector spliced to generate the operation repetition parameter to evaluate the operation behavior of the trainees.

[0141] Step S246: Feature combination of the basic value and the fluctuation value of the operation stability parameter to generate the operation stability parameter reflecting the stability of the user terminal operation.

[0142] The feature combination operation of the base value and the fluctuation value of the operation stability parameter is used to comprehensively consider the basic level and fluctuation of the operation type stability of the user, and form a more comprehensive operation stability parameter.

[0143] The base value and the fluctuation value of the operation stability parameter are combined using the vector splicing method. The base value and the fluctuation value are respectively represented as vectors, and they are spliced into a new vector as the operation stability parameter. For example, in the logistics management system of an enterprise, the base value and the fluctuation value of the operation stability parameter of the logistics personnel are spliced into vectors to generate the operation stability parameter, and the stability of the logistics operation is evaluated.

[0144] Step S247: The complementarity of the operation repetition parameter and the operation stability parameter is confirmed by the behavior pattern verification method, and it is ensured that the two together reflect the operation stability characteristics of the user end.

[0145] The behavior pattern verification method is used to check whether the operation repetition parameter and the operation stability parameter can complement each other and accurately reflect the operation stability characteristics of the user end together. The effectiveness and reliability of the behavior stability characteristics are improved through verification.

[0146] The behavior pattern verification is performed using the clustering analysis and correlation analysis method. The operation behavior of the user is divided into different categories through clustering analysis, and the distribution of the operation repetition parameter and the operation stability parameter in different categories is observed. At the same time, the correlation between the two parameters is calculated using correlation analysis to ensure that they have certain independence and complementarity. For example, in the information security management system of an enterprise, the network operation behavior of employees is subjected to clustering analysis and correlation analysis to verify the complementarity of the operation repetition parameter and the operation stability parameter.

[0147] Step S248: The operation repetition parameter and the operation stability parameter are compared with the benchmark value by training the behavior pattern benchmark through historical normal interaction data, and the behavior stability characteristics reflecting the deviation degree of operation tendency are generated.

[0148] The behavior pattern benchmark is trained to determine the normal mode of user operation according to historical normal interaction data. The operation repetition parameter and the operation stability parameter are compared with the benchmark value to quantify the deviation degree of the user operation behavior from the normal mode, and the behavior stability characteristics are generated for anomaly detection.

[0149] The behavior pattern benchmark is trained using an unsupervised learning algorithm in machine learning, such as K-means clustering. By clustering analysis on historical normal interaction data, the clustering center of normal operation behavior is obtained as a benchmark value. The distance between the operation repetition parameter and the operation stability parameter and the benchmark value is calculated to generate the behavior stability feature reflecting the deviation degree of operation tendency. For example, in the network monitoring system of an enterprise, the behavior pattern benchmark is trained by the K-means clustering algorithm, the current operation repetition parameter and the operation stability parameter are compared with the benchmark value, and the behavior stability feature is generated to detect abnormal operation behavior.

[0150] Step S250: input the time sequence connection feature, the content corresponding feature and the behavior stability feature into the feature correlation analysis module, establish the correlation between the features through the feature collaborative analysis method, and generate a target feature set with collaborative representation ability.

[0151] The feature correlation analysis module is used to analyze the correlation between the time sequence connection feature, the content corresponding feature and the behavior stability feature. The feature collaborative analysis method combines these features into a target feature set with better representativeness and collaborative representation ability by mining the internal relationship between them.

[0152] In the internal network of an enterprise, the feature correlation analysis module adopts the autoencoder model in deep learning. The autoencoder model encodes and decodes the input features, and learns the potential correlation between the features. The time sequence connection feature, the content corresponding feature and the behavior stability feature are input into the autoencoder model, and the low-dimensional representation of the features is extracted through the encoder part of the trained model to form a target feature set. For example, in the network security situation awareness system of an enterprise, the autoencoder model is used to analyze the correlation of the three features, and a target feature set is generated to improve the accuracy of anomaly detection.

[0153] Step S260: based on the influence degree evaluation result of each feature in the target feature set on anomaly detection, adjust the input order of the time sequence connection feature, the content corresponding feature and the behavior stability feature in the deep anomaly diagnosis network, and preferentially input the features with high influence degree.

[0154] The influence degree of each feature in the target feature set on anomaly detection is evaluated to determine the importance of each feature in anomaly detection. The input order of the features is adjusted, and the features with high influence degree are preferentially input, so that the deep anomaly diagnosis network can learn the key information faster, and the efficiency and accuracy of anomaly detection are improved.

[0155] The feature importance evaluation algorithm (such as the feature importance evaluation of the random forest) is used to evaluate the influence degree of each feature. By training the random forest model, the importance score of each feature in the model is calculated. According to the score, the features are sorted, and their input order in the deep anomaly diagnosis network is adjusted. For example, in the network intrusion detection system of an enterprise, the importance of each feature in the target feature set is evaluated using the random forest algorithm, and the input order is adjusted to improve the performance of intrusion detection.

[0156] S300: processing the time sequence connection feature, the content corresponding feature and the behavior stability feature through the pre-trained deep anomaly diagnosis network to generate an interaction anomaly judgment result containing an anomaly probability value;

[0157] In the embodiment of the present application, the pre-trained deep anomaly diagnosis network in step S300 is a neural network model trained by a large amount of historical data, which can analyze and judge the input features to generate an interaction anomaly judgment result. The anomaly probability value represents the possibility of the occurrence of the interaction record unit, providing a quantitative basis for anomaly detection.

[0158] In the internal network of an enterprise, the deep anomaly diagnosis network adopts a combined model of convolutional neural network (CNN) and recurrent neural network (RNN), specifically a series combination structure including inputting the comprehensive feature vector generated by splicing into the CNN layer, using the convolution kernel to extract the local pattern of the feature vector, and capturing the structure correlation feature in the content dimension; the output of the CNN is taken as the input sequence of the RNN (such as LSTM or GRU), which is processed in time steps to model the long-term time dependence and realize the deep mining of the context information on the interaction sequence. The series structure effectively fuses the content and time dimension anomaly patterns through the collaborative mechanism of "CNN extracts local spatial features + RNN models time sequence dynamics", and improves the recognition ability of complex network anomaly behaviors. CNN is used to extract the local pattern of the feature, and RNN is used to process the time sequence information of the feature. The time sequence connection feature, the content corresponding feature and the behavior stability feature are input into the combined model, and the anomaly probability value is output through the forward propagation calculation of the model. For example, in the network traffic anomaly detection system of an enterprise, the CNN-RNN combined model is used to process the features to generate the anomaly probability value to judge whether the network traffic is abnormal.

[0159] In the embodiment of the present application, step S300, the time sequence connection feature, the content corresponding feature and the behavior stability feature are processed through the pre-trained deep anomaly diagnosis network to generate an interaction anomaly judgment result containing an anomaly probability value, specifically including the following steps S310-S370:

[0160] Step S310: input the time connection feature, the content corresponding feature and the behavior stability feature into the feature input layer of the deep anomaly diagnosis network, and generate a comprehensive feature vector through feature splicing operation.

[0161] The feature input layer is the entrance of the deep anomaly diagnosis network to receive external feature data, and its main function is to integrate different types of input features. In the enterprise internal network environment, the time connection feature reflects the law of network interaction in the time dimension, such as the time delay of request response, the stability of request frequency, etc.; the content corresponding feature reflects the matching relationship between request data and response data in field structure and value, which can reflect the consistency and compliance of data; and the behavior stability feature describes the consistency and stability of user operation behavior.

[0162] The three features are combined into a comprehensive feature vector through feature splicing operation, which can integrate multiple information together to provide more comprehensive data for subsequent network layer analysis. In actual implementation, these features can be arranged in a fixed order according to the dimension and data type of the features. For example, if the time connection feature is a vector with a length of 5, the content corresponding feature is a vector with a length of 3, and the behavior stability feature is a vector with a length of 4, then the length of the spliced comprehensive feature vector is 12, and the relative position of each part of the feature remains fixed. In this way, the deep anomaly diagnosis network can obtain information about time, content and behavior of network interaction from the comprehensive feature vector.

[0163] Step S320: perform context analysis and processing of the comprehensive feature vector in the time dimension through the time modeling sub-network of the deep anomaly diagnosis network, and extract long-term association features of the interactive record units in the time sequence.

[0164] The time modeling sub-network plays an important role in mining time dimension information in the comprehensive feature vector in the deep anomaly diagnosis network. In the enterprise internal network, network interaction behavior has complex associations in time, for example, a user may initiate requests according to certain rules within a period of time, or the response time of the system may show a certain trend over time. The role of the time modeling sub-network is to capture these long-term time association features.

[0165] In the embodiment of the present application, step S320, the time modeling sub-network of the deep anomaly diagnosis network performs context analysis and processing of the comprehensive feature vector in the time dimension, and extracts long-term association features of the interactive record units in the time sequence, which specifically includes the following steps S321-S326:

[0166] Step S321: the cycle processing layer of the time modeling sub-network processes the comprehensive feature vector in time sequence, and captures the time association information between adjacent interactive record units through a hidden state transmission mechanism.

[0167] The recurrent processing layer is a core component of the time modeling subnetwork, which sequentially processes the integrated feature vectors in chronological order. In the enterprise network environment, each interaction record unit corresponds to a specific time point, and these units form a sequence in chronological order. The recurrent processing layer passes the hidden state information of the previous time step to the current time step through a hidden state transmission mechanism. The hidden state is understood as a kind of memory and summary of the network for the information of the previous time step, which contains the relevant features of the previous interaction record unit.

[0168] For example, in the office system of an enterprise, there may be certain time regularities in the operation requests of employees, such as concentrated file queries and downloads in the morning. When processing the integrated feature vector of the current time step, the recurrent processing layer combines the hidden state of the previous time step, thereby capturing the temporal correlation information between adjacent interaction record units, such as changes in operation frequency and continuity of request types.

[0169] Step S322: The attention mechanism layer of the time modeling subnetwork performs weight allocation processing on the hidden state sequence output by the recurrent processing layer, generating attention weights for each time node.

[0170] The role of the attention mechanism layer is to further filter and weight the hidden state sequence output by the recurrent processing layer. In the large number of interaction records of the enterprise network, the importance of information at different time nodes for mining long-term correlation features is different. The attention mechanism layer assigns appropriate attention weights to each time node based on the feature information of the hidden state.

[0171] For example, in network monitoring of an enterprise, the interaction records at certain key time points (such as peak business hours, after system updates, etc.) may contain more important information. The attention mechanism layer will calculate and assign higher weights to the hidden states of these key time points, and lower weights to the hidden states of some relatively unimportant time nodes. In this way, the network will pay more attention to important time node information in subsequent processing.

[0172] Step S323: Perform weighted aggregation processing on the hidden state sequence according to the attention weights to obtain a long-term correlation feature containing temporal context information.

[0173] Weighted aggregation processing is the process of applying the attention weights assigned by the attention mechanism layer to the hidden state sequence. By multiplying the hidden state of each time node by the corresponding attention weight and adding them together, a long-term correlation feature containing temporal context information is obtained.

[0174] In enterprise networks, this long-term association feature integrates important information from different time nodes, reflecting the overall behavior pattern of network interactions over a period of time. For example, in an enterprise's supply chain management system, the long-term association feature obtained through weighted aggregation processing reflects the long-term time association between supplier order requests and enterprise responses, helping the enterprise to predict future business demand and adjust supply strategies.

[0175] Step S324: The long-term association feature is used to represent the overall behavior pattern of the interaction record unit in the time dimension.

[0176] The long-term association feature is a comprehensive description of network interactions in the time dimension, which contains key information extracted from multiple time nodes and can reflect the overall behavior pattern of the interaction record unit over a period of time. In enterprise internal networks, this overall behavior pattern is used for various purposes.

[0177] For example, in an enterprise's customer relationship management system, the long-term association feature reflects the time regularity of customer interactions with the enterprise, such as when customers usually initiate consultation requests, the time distribution of purchase frequency, etc. By analyzing these overall behavior patterns, the enterprise can better understand customer needs, optimize service strategies, and improve customer satisfaction.

[0178] Step S325: Train the parameters of the time modeling sub-network through historical normal interaction data to ensure that it can effectively capture time association information.

[0179] Training the parameters of the time modeling sub-network is to enable the network to learn the normal time association patterns in the enterprise network. Historical normal interaction data contains a large number of network interaction records under normal business processes, which reflect the time regularity of the enterprise network under normal conditions.

[0180] During training, the parameters of the time modeling sub-network are continuously adjusted using optimization algorithms (such as stochastic gradient descent) to make the long-term association features output by the network as accurately as possible reflect the time association information in the historical normal interaction data. For example, in an enterprise's financial system, by training on historical normal financial data queries and processing records, the time modeling sub-network learns the normal patterns of financial operations in time, so that it can identify abnormal time associations in subsequent detection.

[0181] Step S326: Verify the effectiveness of the long-term association feature through validation set data to ensure that it can distinguish between normal and abnormal time behavior patterns.

[0182] Validation set data is an independent data set used to evaluate the performance of the time modeling sub-network. It is independent of the training data and can more objectively verify the effectiveness of the long-term association feature.

[0183] In the enterprise internal network, the verification set data is input into the trained time modeling sub-network, and whether the output long-term association features can accurately distinguish normal and abnormal time behavior patterns is observed. For example, in the network security protection of the enterprise, if the time records of some known abnormal network attacks (such as distributed denial of service attacks) are contained in the verification set data, by comparing the long-term association features in normal and abnormal cases, it is judged whether the network can effectively identify the abnormal time behavior pattern. If the verification result is not ideal, the parameters of the time modeling sub-network need to be further adjusted or the training method needs to be improved.

[0184] Step S330: The content analysis sub-network of the deep anomaly diagnosis network performs local pattern extraction processing in the content dimension on the comprehensive feature vector, and extracts the structural association features of the request data and the response data fields.

[0185] The content analysis sub-network focuses on mining the local patterns of the request data and the response data fields in the content dimension from the comprehensive feature vector. In the enterprise internal network, there is a certain association relationship between the field structures of the request data and the response data, and these association relationships are crucial for judging the legitimacy and accuracy of network interaction.

[0186] The content analysis sub-network adopts a convolutional neural network (CNN) architecture, uses convolution kernels to perform sliding convolution operations on the comprehensive feature vector, and extracts local feature patterns. For example, in the office automation system of the enterprise, there is a specific structural association between the field types (such as username, password, operation type, etc.) in the request data and the field types (such as login result, permission information, etc.) in the response data. Through the convolution operation of the content analysis sub-network, these local structural association features are captured, which are used to detect whether the data is tampered with, whether the field structure conforms to the business rules, and other abnormal situations.

[0187] Step S340: The behavior analysis sub-network of the deep anomaly diagnosis network performs tendency modeling processing in the behavior dimension on the comprehensive feature vector, and extracts stable features of the user's operation habits.

[0188] The behavior analysis sub-network mainly focuses on the operation behavior tendency of the user in network interaction. In the enterprise internal network, each user usually has his own unique operation habits, and these habits have a certain stability over a period of time.

[0189] The behavior analysis subnetwork uses a long short-term memory network (LSTM) to model the operation behavior of the user. The LSTM can effectively process sequence data and remember the operation information of the user over a long period of time. For example, in a document management system of an enterprise, a certain user may be accustomed to uploading and downloading documents at a specific time period in the morning every day, and the file types of the operations are also relatively fixed. Through processing of the comprehensive feature vector, the behavior analysis subnetwork can learn the stable features of these user operation habits. By continuously observing the changes in these stable features, the abnormality of the user operation behavior can be discovered in a timely manner, such as whether the account is stolen, whether there is an abnormal operation mode, and the like.

[0190] Step S350: input the long-term correlation feature, the structural correlation feature, and the stable feature into the anomaly score layer of the deep anomaly diagnosis network, and calculate the anomaly probability value of each interaction record unit through a fully connected neural network.

[0191] The anomaly score layer is a key part of the deep anomaly diagnosis network for comprehensive evaluation of the extracted various features. The long-term correlation feature reflects the overall behavior pattern of the network interaction in the time dimension, the structural correlation feature embodies the structural matching relationship of the request data and the response data field, and the stable feature describes the stability of the user end operation habit.

[0192] The fully connected neural network fuses and processes these different types of features, and calculates the anomaly probability value of each interaction record unit through a series of linear transformations and nonlinear activation functions. In the enterprise network, the anomaly probability value represents the possibility of the occurrence of the anomaly of the interaction record unit. For example, in the network payment system of an enterprise, for each interaction record of a payment request and a response, the anomaly score layer calculates the anomaly probability value of the transaction according to the long-term correlation feature (such as the payment time rule), the structural correlation feature (such as the structural matching of the payment amount and the account information), and the stable feature (such as the payment habit of the user). If the anomaly probability value exceeds a certain threshold value, it is considered that the transaction may be abnormal.

[0193] Step S360: compare the anomaly probability value with a preset probability threshold value, and generate an interaction anomaly judgment result containing a normal or abnormal identification.

[0194] The preset probability threshold value is a critical value determined according to the security policy and historical data of the enterprise. By comparing the calculated anomaly probability value with this threshold value, it is simple and direct to judge whether the interaction record unit is abnormal.

[0195] In the enterprise internal network, if the anomaly probability value is lower than the threshold value, the interaction record unit is determined to be normal and marked as "normal"; if the anomaly probability value is higher than the threshold value, it is determined to be abnormal and marked as "abnormal". For example, in the network access control system of an enterprise, for the interaction record of the login request and system response of a user, when the calculated anomaly probability value is higher than the preset threshold value, the system determines that the login behavior is abnormal, which may exist the risk of stolen account, and accordingly takes corresponding security measures, such as limiting login, sending security prompts, etc.

[0196] Step S370: Adjust the parameters of the deep anomaly diagnosis network through the validation set data to ensure the accuracy and stability of the anomaly probability value.

[0197] The validation set data plays an important role in adjusting the parameters of the deep anomaly diagnosis network, helping to evaluate the accuracy and stability of the anomaly probability value calculated by the current network model.

[0198] In the enterprise network, the validation set data is used to test the deep anomaly diagnosis network, and the matching degree of the anomaly probability value and the actual abnormal situation is observed. If it is found that there are more misjudgments (determining normal as abnormal or vice versa), the parameters of the network need to be adjusted, such as adjusting the weights of the fully connected neural network, optimizing the parameters of the convolution kernel, etc. Through continuous adjustment and verification, the deep anomaly diagnosis network can more accurately and stably calculate the anomaly probability value, and improve the performance of anomaly detection. For example, in the network security monitoring system of an enterprise, through repeated testing and parameter adjustment of the validation set data, it is ensured that the system can accurately identify various network abnormal behaviors, and guarantee the safe operation of the enterprise network.

[0199] S400: According to the interaction anomaly judgment result, the abnormal interaction record unit is screened out, and the correlation mode of the request data and the response data in the abnormal interaction record unit is analyzed to determine the abnormal behavior manifestation form;

[0200] In the embodiment of the present application, the interaction anomaly judgment result in step S400 provides a basis for screening the abnormal interaction record unit. In the enterprise internal network, according to the interaction anomaly judgment result containing normal or abnormal identification obtained in the previous steps, the interaction record unit marked as "abnormal" is screened out. These abnormal interaction record units may hide various network security risks or business process problems.

[0201] Analyzing the association pattern between the request data and the response data in the abnormal interaction record unit is a key step to deeply understand the essence of abnormal behavior. There is a specific logical relationship and structural matching relationship between the request data and the response data, and by analyzing these relationships, the clues of abnormal behavior can be found. For example, in the enterprise's e-commerce system, abnormal order requests and responses may be manifested as the mismatch between the requested commodity quantity and the responded inventory information, the large difference between the requested price and the responded settlement price, etc. By analyzing these association patterns, the abnormal behavior manifestation forms such as data tampering, business rule violation, etc. can be determined.

[0202] In the embodiment of the present application, the abnormal interaction record unit is filtered out according to the interaction abnormality determination result in step S400, and the association pattern between the request data and the response data in the abnormal interaction record unit is analyzed to determine the abnormal behavior manifestation form, which specifically includes the following steps S410-S460:

[0203] Step S410: Extract the interaction record unit with the abnormal probability value exceeding the preset threshold value from the interaction abnormality determination result as the abnormal interaction record unit.

[0204] The preset threshold value is a standard determined in the previous abnormality determination process, which is used to distinguish between normal and abnormal interaction record units. In the enterprise internal network, the interaction record unit with the abnormal probability value exceeding this threshold value is filtered out from the interaction abnormality determination result. These units are the key objects of attention that may have abnormal behavior.

[0205] This filtering process is realized by means of database query. The interaction abnormality determination result is stored in the database, and the SQL query statement is used to filter according to the abnormal probability value and the preset threshold value. For example, in the enterprise's network log database, the following query statement is executed: "SELECT * FROM interaction_results WHERE anomaly_probability>[preset threshold value]", which can extract the abnormal interaction record unit.

[0206] Step S420: For each abnormal interaction record unit, extract the interaction response time lag parameter and the interaction frequency fluctuation parameter in the time sequence connection feature, and analyze whether the time sequence connection law deviates from the normal range.

[0207] The interaction response time lag parameter in the time sequence connection feature reflects the time interval from the issuance of the request data to the reception of the response data, and the interaction frequency fluctuation parameter embodies the time regularity of the request data initiation. In the enterprise internal network, these parameters have certain value range and variation law under normal circumstances.

[0208] For each abnormal interaction record unit, the two parameters are extracted and compared with the normal range. For example, in the file download service of an enterprise, the normal interaction response time lag may be between a few seconds and tens of seconds. If the interaction response time lag of a certain abnormal interaction record unit reaches several minutes, it means that the time connection rule deviates. Similarly, if the interaction frequency fluctuation parameter abnormally fluctuates (such as suddenly changing from a stable request frequency to a high or low frequency request), it may also indicate abnormal behavior, such as network attacks, system failures, etc.

[0209] Step S430: Extract the field structure matching parameter and the field value consistent parameter in the content corresponding feature, and analyze whether the data structure corresponding relationship is abnormal.

[0210] The field structure matching parameter and the field value consistent parameter in the content corresponding feature respectively reflect the matching of the request data and the response data in the field structure and the value. In the enterprise internal network, the field structure and the value of the request data and the response data are clearly specified by different business systems.

[0211] For each abnormal interaction record unit, the two parameters are extracted and analyzed. For example, in the human resource management system of an enterprise, the request data contains the basic information of an employee (such as name, age, position, etc.), and the response data is corresponded thereto. If the field structure matching parameter is low, it means that the field structure difference between the request and the response is large; if the field value consistent parameter is low, it means that the value of the same field does not conform to the business specification. These situations may indicate that the data structure corresponding relationship is abnormal, such as data tampering, system configuration error, etc.

[0212] Step S440: Extract the operation repetition parameter and the operation stability parameter in the behavior stability feature, and analyze whether the user end operation stability changes abnormally.

[0213] The operation repetition parameter and the operation stability parameter in the behavior stability feature respectively describe the frequency of the user end initiating the same type of request and the stability of the request type change. In the enterprise internal network, each user usually has his own relatively stable operation habit.

[0214] For each abnormal interaction record unit, the two parameters are extracted and compared with the normal operation mode of the user. For example, in the office system of an enterprise, a certain user seldom initiates a specific type of request, but in the abnormal interaction record unit, the operation repetition parameter of the type of request suddenly increases, or the operation stability parameter shows that the request type changes frequently and does not conform to the normal business process, which means that the user end operation stability changes abnormally, and there may be account theft, malicious operation, etc.

[0215] Step S450: Based on the analysis results of time connection rules, data structure correspondence, and operation stability changes, determine the abnormal behavior performance mode.

[0216] The results obtained by integrating the previous steps are the key to determining the specific performance mode of abnormal behavior. The information in these three aspects of time connection rules, data structure correspondence, and operation stability changes is interrelated and complementary, reflecting the essence of abnormal behavior from different angles.

[0217] In the enterprise internal network, by comprehensively considering these factors, the performance mode of abnormal behavior can be more accurately determined. For example, if the time connection rule shows that the request response delay is too long, the data structure correspondence shows that the field value is abnormal, and the operation stability change shows that the user operation mode suddenly changes, by integrating these information, it can be determined that there may be data tampering and operation anomalies caused by network attacks. Organize and summarize these analysis results to determine whether the abnormal behavior is a specific performance mode such as time anomaly, data anomaly, or operation anomaly.

[0218] Step S460: Match the analysis results with the historical abnormal case library to verify the accuracy of the abnormal behavior performance mode.

[0219] The historical abnormal case library is a record of abnormal events accumulated by the enterprise in the long-term network operation process, containing various abnormal behavior performance modes and processing experience. By matching the abnormal behavior performance mode obtained by the current analysis with the historical abnormal case library, the accuracy of the analysis results can be verified.

[0220] In the enterprise internal network, if the current abnormal behavior performance mode is similar to a case in the historical case library, refer to the handling method and cause analysis of the case to further confirm the nature of the current abnormal behavior. For example, in the network security management of the enterprise, if the current analysis shows that the abnormal behavior is a sudden increase in request frequency and data structure anomaly, which is similar to the distributed denial of service attack case recorded in the historical case library, it is determined that the current abnormal behavior is also a similar attack behavior, and corresponding prevention and handling measures are taken. At the same time, if it is found that the current abnormal behavior performance mode does not match any case in the historical case library, it may mean that a new type of abnormality has occurred, which needs further in-depth analysis and research.

[0221] S500: Based on the abnormal behavior performance mode and the corresponding abnormal interaction record unit, generate a network security disposal instruction containing interaction identification and risk control strategy, and push the network security disposal instruction to the network protection system to trigger targeted protection operations.

[0222] In the embodiment of the present application, the network security handling instruction in step S500 is a countermeasure formulated according to the specific situation of the abnormal behavior, which contains an interaction identifier and a risk control policy. The interaction identifier is used to uniquely identify the abnormal interaction record unit, facilitating the network protection system to locate and handle the abnormal event; the risk control policy is a specific protection measure formulated for different abnormal behavior manifestations.

[0223] In the enterprise internal network, the network security handling instruction is generated according to the abnormal behavior manifestation and the corresponding abnormal interaction record unit determined in the previous steps. For example, for the case where the abnormal behavior is data tampering, the risk control policy may be to limit the access rights of the related user, backup and restore the data, etc. The generated network security handling instruction is sent to the network protection system (such as firewall, intrusion detection system, etc.) through the network interface. After receiving the instruction, the network protection system will execute the corresponding protection operation according to the risk control policy therein, to protect the security of the enterprise network.

[0224] In the embodiment of the present application, the network security handling instruction containing the interaction identifier and the risk control policy is generated based on the abnormal behavior manifestation and the corresponding abnormal interaction record unit in step S500, and the network security handling instruction is pushed to the network protection system to trigger the targeted protection operation, which specifically includes the following steps S510-S550:

[0225] Step S510: According to the abnormal behavior manifestation, query the preset policy mapping table to determine the corresponding risk control policy.

[0226] The preset policy mapping table is formulated by the enterprise according to historical experience and security policy, which establishes the association between the specific abnormal behavior manifestation and the risk control policy. In the enterprise internal network, the corresponding risk control policy is found in the policy mapping table according to the previously determined abnormal behavior manifestation.

[0227] For example, the policy mapping table may stipulate that when the abnormal behavior manifests as time response anomaly, the corresponding risk control policy is to strengthen network monitoring and adjust server resource allocation; when the abnormal behavior manifests as data structure anomaly, the corresponding risk control policy is to perform data verification and limit data access. By querying the policy mapping table, the risk control policy for the current abnormal behavior can be quickly and accurately determined.

[0228] In the embodiment of the present application, the preset policy mapping table is constructed by the following steps S501-S507:

[0229] Step S501: Collect historical abnormal event records, which contain abnormal interaction record units, specific abnormal behavior manifestations and corresponding manual handling policies.

[0230] Historical abnormal event records are valuable data resources accumulated by enterprises in the past network operation process. In the enterprise internal network, these historical abnormal event records are collected through network monitoring systems, log recording systems, etc. These records record the occurrence of each abnormal event in detail, including abnormal interaction record units (such as request and response data, time stamp, etc.), abnormal behavior manifestation forms (such as time abnormality, data abnormality, etc.), and the manual handling strategy taken at that time (such as limiting access, restarting service, etc.).

[0231] Step S502: Standardize the historical abnormal event records, and unify the description methods of the specific manifestation forms of abnormal behaviors, including three types of time response abnormality, data structure abnormality, and operation mode abnormality.

[0232] The standardization of historical abnormal event records is to facilitate subsequent analysis and processing. Since different abnormal event records may use different description methods, in order to establish a unified strategy mapping table, the description of the specific manifestation forms of abnormal behaviors needs to be standardized.

[0233] In the enterprise internal network, the specific manifestation forms of abnormal behaviors are summarized into three types of time response abnormality, data structure abnormality, and operation mode abnormality. For example, various abnormal events of excessively long request response delay are uniformly described as time response abnormality; abnormal events of mismatched request and response data field structure and non-standard value are uniformly described as data structure abnormality; abnormal events of user operation behavior not conforming to normal business process are uniformly described as operation mode abnormality.

[0234] Step S503: Classify and organize the manual handling strategies in the historical abnormal event records, including four types of monitoring strategy, limiting strategy, termination strategy, and verification strategy.

[0235] The classification and organization of manual handling strategies make the strategies more clear and orderly. In the enterprise internal network, the manual handling strategies in the historical abnormal event records are summarized into four types of monitoring strategy, limiting strategy, termination strategy, and verification strategy. The monitoring strategy refers to strengthening the monitoring of network activities, such as increasing the frequency of log recording, starting real-time monitoring, etc.; the limiting strategy refers to limiting the operation permissions of users or systems, such as limiting access to specific network resources, reducing network bandwidth, etc.; the termination strategy refers to terminating abnormal network sessions or services, such as forcibly closing abnormal connections, stopping abnormal processes, etc.; the verification strategy refers to verifying data or user identity, such as requiring re-entry of password, performing identity authentication, etc.

[0236] Step S504: Establish the association relationship matrix of the specific manifestation forms of abnormal behaviors and the handling strategies, in which each abnormal manifestation form category corresponds to at least one handling strategy category.

[0237] The association relationship matrix is a tool for representing the relationship between the specific manifestation of abnormal behavior and the disposal strategy. In the enterprise internal network, the association relationship matrix is established according to the historical abnormal event records and the classified abnormal manifestation categories and disposal strategy categories. The rows of the matrix represent the abnormal manifestation categories (time response abnormality, data structure abnormality, operation mode abnormality), and the columns represent the disposal strategy categories (monitoring strategy, restriction strategy, termination strategy, verification strategy). Each element in the matrix represents the association of the corresponding abnormal manifestation category and disposal strategy category, and is marked as 1 if there is an association, otherwise marked as 0. For example, when the time response abnormality occurs, the corresponding disposal strategies may include the monitoring strategy and the restriction strategy, and then the elements in the matrix of the time response abnormality row and the monitoring strategy column and the restriction strategy column are marked as 1.

[0238] Step S505: Count the co-occurrence frequency of each abnormal manifestation category and disposal strategy category, and screen the association relationship with a co-occurrence frequency higher than a preset threshold as an effective association.

[0239] The co-occurrence frequency refers to the proportion of the number of times that a certain abnormal manifestation category and disposal strategy category appear simultaneously in the total number of abnormal events in the historical abnormal event records. In the enterprise internal network, the co-occurrence frequency of each abnormal manifestation category and disposal strategy category in the association relationship matrix is counted. The preset threshold is a critical value determined according to the security policy and actual situation of the enterprise. The association relationship with a co-occurrence frequency higher than the preset threshold is screened as an effective association, which indicates that in most cases, when a certain abnormal manifestation occurs, the corresponding disposal strategy is effective. For example, if the co-occurrence frequency of the time response abnormality and the monitoring strategy is higher than the preset threshold, it means that when the time response abnormality occurs, the monitoring strategy is a more effective disposal method.

[0240] Step S506: Organize the effective association relationship into a strategy mapping table, and the strategy mapping table includes an abnormal manifestation category field and a corresponding disposal strategy category field.

[0241] The effective association relationship screened is organized into a strategy mapping table, which is convenient for subsequent query and use. In the enterprise internal network, the structure of the strategy mapping table includes an abnormal manifestation category field and a corresponding disposal strategy category field.

[0242] Step S507: Regularly update the strategy mapping table, obtain new historical abnormal event records, recalculate the co-occurrence frequency and adjust the effective association relationship, and ensure the timeliness of the strategy mapping table.

[0243] As the enterprise network environment changes and new abnormal events occur, the policy mapping table needs to be updated continuously to maintain its timeliness. In the enterprise internal network, newly added historical abnormal event records are collected regularly and added to the original historical abnormal event records. The co-occurrence frequency of abnormal behavior pattern categories and disposal policy categories is recalculated, and the effective association relationship is adjusted according to the new co-occurrence frequency. For example, when a new abnormal type appears or it is found that the original disposal policy is not effective, the policy mapping table is updated in time to ensure that the most effective risk control policy can be taken when facing various abnormal behaviors.

[0244] Step S520: Extract the unique interaction identifier of the abnormal interaction record unit as the positioning basis of the abnormal event.

[0245] The unique interaction identifier is a unique identifier of each abnormal interaction record unit, which is used to accurately locate the abnormal event in the network. In the enterprise internal network, the abnormal interaction record unit may contain multiple information such as timestamp, request IP address, session ID, etc., and the unique interaction identifier is generated by combining these information.

[0246] For example, the timestamp, request IP address and session ID are combined into a string as the unique interaction identifier of the abnormal interaction record unit. In subsequent processing, the network protection system quickly locates the specific abnormal interaction record unit according to this unique interaction identifier and understands the detailed information of the abnormal event, such as the time of abnormal occurrence, the users and systems involved, etc.

[0247] Step S530: Integrate the interaction identifier, risk control policy and abnormal behavior pattern information to generate a network security disposal instruction containing detailed abnormal information.

[0248] Information integration is to combine the three key information of interaction identifier, risk control policy and abnormal behavior pattern together to form a complete network security disposal instruction. In the enterprise internal network, the network protection system needs these detailed information to accurately perform the protection operation.

[0249] The interaction identifier is used as the positioning basis of the abnormal event, the risk control policy is used as the specific handling measure, and the abnormal behavior pattern is used as the description of the abnormal event. For example, the network security disposal instruction adopts the following format: "Interaction identifier: [specific identifier]; Abnormal behavior pattern: [time response abnormality]; Risk control policy: [start monitoring policy, limit access to specific server]". Such instruction clearly conveys the key information of the abnormal event, which is convenient for the network protection system to process.

[0250] Step S540: sending the network security disposal instruction to the network protection system through the network communication interface, so that the network protection system receives the network security disposal instruction, parses the risk control strategy information therein, and performs the corresponding protection operation.

[0251] The network communication interface is a bridge connecting the network security disposal instruction generation system and the network protection system. In the enterprise internal network, the generated network security disposal instruction is sent to the network protection system (such as firewall, intrusion detection system, etc.) through the network communication interface (such as TCP / IP protocol, HTTP protocol, etc.).

[0252] After receiving the network security disposal instruction, the network protection system parses the risk control strategy information therein. According to different risk control strategies, the corresponding protection operation is performed. For example, if the risk control strategy is the monitoring strategy, the network protection system will trigger the traffic monitoring operation, and the abnormal interaction record unit corresponding to the user terminal traffic is monitored, and the detailed information of the traffic is recorded, such as traffic size, flow direction, protocol type, etc.; if the risk control strategy is the restriction strategy, the network protection system will trigger the traffic restriction operation, and the abnormal interaction record unit corresponding to the user terminal traffic is rate limited, and the traffic transmission speed is reduced, such as limiting bandwidth, setting access frequency upper limit, etc.; if the risk control strategy is the termination strategy, the network protection system will trigger the session termination operation, and forcibly terminate the current session of the abnormal interaction record unit corresponding to the user terminal, and disconnect the network connection, such as closing TCP connection, stopping UDP communication, etc.; if the risk control strategy is the verification strategy, the network protection system will trigger the identity verification operation, and require the abnormal interaction record unit corresponding to the user terminal to perform additional identity verification to confirm the identity legality, such as requiring to input verification code, performing fingerprint identification, etc.

[0253] At the same time, through the protection operation execution result feedback mechanism, the operation execution state is returned to the abnormal detection system, which is used for subsequent strategy optimization and adjustment. The protection operation execution result feedback mechanism is an important link to ensure the effectiveness and adaptability of the network security disposal instruction. In the enterprise internal network, after the network protection system performs the protection operation corresponding to the risk control strategy, it will collect the related information of the operation execution, such as whether the operation is successful, the time of the operation execution, the influence of the operation on the network or system, etc., and feedback these information to the abnormal detection system through the network communication interface.

[0254] After receiving feedback, the anomaly detection system performs a detailed analysis. If the protection measures successfully resolve the anomaly, the system records the process as historical experience for handling similar anomalies in the future. If the protection measures fail to resolve the anomaly effectively, or if new problems arise during execution, the system reassesses the appropriateness of the risk control strategy. For example, if excessively restricting network traffic during the implementation of a restriction policy impacts normal business operations, the system will adjust the parameters of the restriction policy based on feedback, such as appropriately increasing bandwidth limits or relaxing access frequency limits.

[0255] By continuously receiving feedback and optimizing and adjusting strategies, the anomaly detection system can gradually improve its ability to respond to various abnormal situations, making network security response commands more accurate and effective. In the daily network operations of an enterprise, new abnormal behaviors may constantly emerge as business develops and the network environment changes. This dynamic feedback and optimization mechanism can ensure that the enterprise network is always in a safe and stable operating state.

[0256] Step S550: Record detailed information of the abnormal interaction record unit through the log system for subsequent abnormal behavior tracing and analysis.

[0257] Log systems play a crucial role in enterprise network security management. They record detailed information about abnormal interaction logs, providing a solid data foundation for subsequent anomaly tracing and analysis. Within the enterprise network, when an abnormal interaction log is detected, the log system comprehensively collects various information about that log, including but not limited to the specific content of the operation request data, the details of the operation response data, the timestamps of the request and response, the user identity information involved, and the identification of the network device.

[0258] These detailed log entries act like a ledger of network activity. When it's necessary to trace the source of abnormal behavior later, security administrators can reconstruct the entire process of the abnormal event by referring to the time sequence and related information in the logs. For example, if an abnormal login behavior is detected for a user's account, by checking the login time, login IP address, and request data sent during login in the log system, the source of the abnormal login can be determined, and it can be judged whether it was an internal staff error or an external malicious attack.

[0259] Meanwhile, the information recorded by the log system also helps in the analysis of abnormal behavior. Security managers can statistically analyze large amounts of abnormal log data to identify patterns and regularities in abnormal behavior. For example, by analyzing abnormal logs over a period of time, they may discover that the frequency of abnormal login requests increases significantly during a specific time period, or that certain types of abnormal requests consistently originate from a specific range of IP addresses, providing targeted evidence for further strengthening network security protection.

[0260] Furthermore, logging systems can be integrated with other security tools and systems to achieve more advanced functionalities. For example, log data can be correlated with the rule base of an intrusion detection system. When information in the logs matches an abnormal pattern in the rule base, the system automatically issues an alert, reminding security managers to take timely action. Through the effective recording and utilization of logs, enterprises can better address cybersecurity challenges and ensure the normal operation of the network and the security of data.

[0261] Example 2: This example provides a power big data privacy protection system based on federated learning, including:

[0262] The acquisition module is used to acquire the set of network interaction data to be detected;

[0263] The multi-dimensional feature construction and processing module is used to construct multi-dimensional features for the network interaction data set to be detected, and to obtain the temporal connection features, content correspondence features and behavioral stability features of each interaction record unit.

[0264] The deep anomaly diagnosis module is used to process temporal coherence features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network, and generate interactive anomaly judgment results containing anomaly probability values.

[0265] The abnormal behavior analysis module is used to filter out abnormal interaction record units based on the interaction anomaly judgment results, and analyze the correlation pattern between request data and response data in the abnormal interaction record units to determine the abnormal behavior manifestation.

[0266] The linkage control module is used to generate network security handling instructions containing interaction identifiers and risk control strategies based on the abnormal behavior manifestations and corresponding abnormal interaction record units, and push the network security handling instructions to the network protection system to trigger targeted protection operations.

[0267] This embodiment also provides an electronic device applicable to a deep learning-based network anomaly behavior detection method, including:

[0268] The system includes a memory and a processor. The memory stores computer-executable instructions, and the processor executes these instructions to implement a deep learning-based network anomaly behavior detection method as described in the above embodiments.

[0269] The embodiment also provides a storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method for detecting network abnormal behavior based on deep learning.

[0270] The storage medium provided by the embodiment belongs to the same inventive concept as the method for detecting network abnormal behavior based on deep learning, and the technical details not described in the embodiment can be referred to the above embodiments, and the embodiment has the same beneficial effects as the above embodiments.

[0271] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary universal hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk or an optical disk, etc., including a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.

[0272] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A method for detecting abnormal network behavior based on deep learning, characterized in that: Obtain the set of network interaction data to be detected; Multi-dimensional feature construction processing is performed on the network interaction data set to be detected to obtain the temporal connection features, content correspondence features and behavioral stability features of each interaction record unit; By processing temporal coherence features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network, interactive anomaly judgment results containing anomaly probability values ​​are generated. Based on the results of the interaction anomaly determination, abnormal interaction record units are selected, and the correlation patterns between request data and response data in the abnormal interaction record units are analyzed to determine the manifestation of abnormal behavior. Based on the abnormal behavior patterns and corresponding abnormal interaction record units, a network security handling instruction containing interaction identifiers and risk control strategies is generated, and the network security handling instruction is pushed to the network protection system to trigger targeted protection operations. The process involves multi-dimensional feature construction of the network interaction data set to be detected, resulting in temporal continuity features, content correspondence features, and behavioral stability features for each interaction record unit, including: The network interaction data set to be detected is split into time series, and continuous interaction record units are divided into independent interaction individuals according to time nodes to generate interaction sequences; The interaction sequence is processed by time-series pattern analysis. The sending time of operation request data and the receiving time of operation response data in each interaction record unit are extracted. The time interval between the two is calculated as the interaction response time delay parameter. The distribution of the sending time interval of adjacent interaction record units is statistically analyzed as the interaction frequency fluctuation parameter. The interaction response time delay parameter and the interaction frequency fluctuation parameter together constitute the time sequence connection feature. The interactive record unit is subjected to content structure comparison processing. The field type set of the operation request data and the field type set of the operation response data are extracted. The ratio of the number of matching field types to the total number of fields in the request data is used as the field structure matching parameter. The values ​​of the same fields in the request data and response data are checked to see if they conform to the preset business specifications. Field value consistency parameters are generated. The field structure matching parameter and the field value consistency parameter together constitute the content correspondence feature. Behavioral tendency analysis is performed on the interaction sequence. The ratio of the number of times the user initiates the same type of data request in continuous interaction to the total number of sessions is used as the operation repetition parameter. The frequency of change of the data type requested by the user is analyzed as the operation stability parameter. The operation repetition parameter and the operation stability parameter together constitute the behavioral stability feature. The process involves filtering out abnormal interaction record units based on the interaction anomaly determination results, analyzing the correlation patterns between request and response data within these abnormal interaction record units, and determining the manifestation of abnormal behavior, including: Extract interaction record units whose abnormal probability values ​​exceed a preset threshold from the interaction anomaly determination results, and use them as abnormal interaction record units; For each abnormal interaction record unit, extract the interaction response delay parameter and interaction frequency fluctuation parameter from the timing connection features, and analyze whether the timing connection pattern deviates from the normal range. Extract the field structure matching parameters and field value matching parameters from the features corresponding to the content, and analyze whether there are any anomalies in the data structure correspondence. Extract the operation repetition parameters and operation stability parameters from the behavioral stability features, and analyze whether there are abnormal changes in the stability of user-end operations. Based on the analysis results of the combined time-series patterns, data structure correspondences, and changes in operational stability, the manifestations of abnormal behavior are determined.

2. The method for detecting abnormal network behavior based on deep learning as described in claim 1, characterized in that: The process of analyzing the temporal patterns of the interaction sequence, extracting the sending time of the operation request data and the receiving time of the operation response data in each interaction record unit, calculating the time interval between the two as the interaction response delay parameter, and statistically analyzing the distribution of the sending time intervals of adjacent interaction record units as the interaction frequency fluctuation parameter includes: Traverse the interaction sequence, and for each interaction record unit, obtain the sending time node of the operation request data and the receiving time node of the operation response data, and calculate the time difference between the two as the interaction response delay value. Statistical analysis was performed on the interaction response time delay values ​​of all interaction record units in the interaction sequence, and the average level and dispersion of the time delay values ​​were calculated, which were used as the stability parameter and fluctuation parameter of the interaction response time delay, respectively. Traverse the interaction sequence and calculate the time difference between the sending time nodes of the nth interaction record unit and the (n-1)th interaction record unit to obtain the adjacent interaction time interval value; The distribution of adjacent interaction time intervals is analyzed, and the frequency of occurrence of the intervals in different time intervals is statistically analyzed to generate interaction frequency fluctuation parameters.

3. The method for detecting abnormal network behavior based on deep learning as described in claim 2, characterized in that: The content structure comparison processing of the interaction record unit involves extracting the field type set of the operation request data and the field type set of the operation response data, calculating the ratio of the number of matching field types to the total number of fields in the request data as a field structure matching parameter, checking whether the values ​​of the same fields in the request data and response data conform to the preset business specifications, and generating a field value consistency parameter, including: The operation request data and operation response data of the interaction record unit are parsed to extract the request field type list and response field type list respectively. Calculate the number of common fields between the request field type list and the response field type list, denoted as the number of matched fields. The total number of fields in the request data is equal to the number of fields in the request field type list. The field structure matching parameter is the ratio of the number of matched fields to the total number of fields in the request data. For a common field type in both the request field type list and the response field type list, obtain the specific value of that field in the operation request data and the specific value of that field in the operation response data. Based on the value requirements of this field type in the preset business specifications, determine whether the value of this field in the operation request data meets the requirements, and obtain the validity mark of the request field; similarly, determine whether the value of this field in the operation response data meets the requirements, and obtain the validity mark of the response field. Calculate the average level of the request field validity markers and response field validity markers for all common fields, and use this as a parameter for consistent field values.

4. The network anomaly behavior detection method based on deep learning as described in claim 3, characterized in that: The behavioral tendency analysis of the interaction sequence includes: calculating the ratio of the number of times the user initiates the same type of request data in continuous interactions to the total number of sessions as an operation repetition parameter; and analyzing the frequency of changes in the data types requested by the user as an operation stability parameter. Traverse the interaction sequence, count the number of times the user client continuously initiates the same type of request data, and calculate the ratio of the number of the same type of request data to the total number of sessions, which serves as the base value for the operation repetition parameter; The interaction sequence is divided into multiple time windows, each containing a fixed number of interaction record units. The frequency of the same type of request data in each time window is counted, and the difference in frequency between adjacent time windows is calculated as the fluctuation value of the operation repetition parameter. Traverse the interaction sequence, count the number of different types of request data initiated by the user, and calculate the ratio of the number of different types of request data to the total number of sessions, which serves as the base value for the operation stability parameter. Count the number of times the requested data type changes within each time window, calculate the difference in the number of changes between adjacent time windows, and use this as the fluctuation value of the operation stability parameter; The operational repeatability parameter is generated by combining the base value and fluctuation value of the operational repeatability parameter. The operating stability parameter is generated by combining the base value and the fluctuation value of the operating stability parameter.

5. The method for detecting abnormal network behavior based on deep learning as described in claim 4, characterized in that: The pre-trained deep anomaly diagnosis network processes temporal coherence features, content correspondence features, and behavioral stability features to generate interactive anomaly judgment results containing anomaly probability values, including: The temporal sequence features, content correspondence features, and behavioral stability features are input into the feature input layer of the deep anomaly diagnosis network, and a comprehensive feature vector is generated through feature concatenation. By using the temporal modeling subnetwork of the deep anomaly diagnosis network to perform temporal contextual analysis on the comprehensive feature vector, long-term correlation features of the interactive recording units in the time series are extracted. The content analysis subnetwork of the deep anomaly diagnosis network is used to perform local pattern extraction processing on the comprehensive feature vector in the content dimension, and to extract the structural correlation features between the request data and response data fields. By using the behavior analysis subnetwork of the deep anomaly diagnosis network to perform behavioral dimension tendency modeling on the comprehensive feature vector, stable features of user terminal operation habits are extracted. Long-term correlation features, structural correlation features, and stable features are input into the anomaly scoring layer of the deep anomaly diagnosis network, and the anomaly probability value of each interactive recording unit is calculated through a fully connected neural network. Based on the comparison between the abnormal probability value and the preset probability threshold, an interaction anomaly determination result is generated.

6. A deep learning-based network anomaly behavior detection system, employing the deep learning-based network anomaly behavior detection method as described in any one of claims 1 to 5, characterized in that, include: The acquisition module is used to acquire the set of network interaction data to be detected; The multi-dimensional feature construction and processing module is used to construct multi-dimensional features for the network interaction data set to be detected, and to obtain the temporal connection features, content correspondence features and behavioral stability features of each interaction record unit. The deep anomaly diagnosis module is used to process temporal coherence features, content correspondence features, and behavioral stability features through a pre-trained deep anomaly diagnosis network, and generate interactive anomaly judgment results containing anomaly probability values. The abnormal behavior analysis module is used to filter out abnormal interaction record units based on the interaction anomaly judgment results, and analyze the correlation pattern between request data and response data in the abnormal interaction record units to determine the abnormal behavior manifestation. The linkage control module is used to generate network security handling instructions containing interaction identifiers and risk control strategies based on the abnormal behavior manifestations and corresponding abnormal interaction record units, and push the network security handling instructions to the network protection system to trigger targeted protection operations.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the deep learning-based network abnormal behavior detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the deep learning-based network abnormal behavior detection method according to any one of claims 1 to 5.

Images