Real-time data security monitoring system based on online data modeling

Abstract

This invention discloses a real-time data security monitoring system based on online data modeling, specifically relating to the field of network security technology. The system includes a data acquisition module for collecting real-time network stream data and extracting feature sequences of behavioral patterns; a feature space module for constructing a feature space and generating feature drift mapping sequences and abnormal behavior recognition sensitivity change trend sequences; a shift analysis module for identifying feature variation trends caused by low-intensity probing attack samples; a decay detection module for identifying the degradation characteristics of the real-time security monitoring classifier's ability to recognize real attack events; a risk assessment module for evaluating the risk level of induced drift in the real-time security monitoring classifier based on feature variation trends and recognition ability degradation characteristics; and a reconstruction trigger module for determining the risk level of the real-time data security monitoring system based on the risk level and triggering a security reconstruction mechanism for the real-time security monitoring classifier, thereby improving the stability of the security monitoring system in recognizing persistent induced attack behaviors.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, more particularly, the present application relates to a real-time data security monitoring system based on online data modeling. BACKGROUND

[0002] In existing real-time data security monitoring, online learning models generally rely on continuously input data for dynamic updating to adapt to changes in network environment. However, malicious actors can gradually interfere with the model's discriminant boundary by continuously injecting low-intensity exploratory samples, causing the model to learn abnormal behavior patterns as new "normal distribution" within the regular training period. This leads to a gradual decline in the model's recognition sensitivity to real attack behavior and irreversible recognition ability decline, seriously affecting the long-term stability and attack defense capability of the online security monitoring system.

[0003] To solve the above problems, a technical solution is provided. SUMMARY

[0004] To overcome the above-mentioned defects of the prior art, embodiments of the present application provide a real-time data security monitoring method and system based on online data modeling to solve the problems raised in the background art.

[0005] To achieve the above-mentioned purposes, the present application provides the following technical solutions:

[0006] The real-time data security monitoring system based on online data modeling comprises:

[0007] The data acquisition module acquires real-time network flow data, extracts features from the real-time network flow data, and outputs a feature sequence representing the behavior pattern of the network flow data;

[0008] The feature space module constructs a feature space based on the feature sequence, generates a feature drift mapping sequence and an abnormal behavior recognition sensitivity trend sequence;

[0009] The offset analysis module uses an abnormal distribution offset analysis method to analyze the feature drift mapping sequence to identify the feature variation trend caused by low-intensity exploratory attack samples;

[0010] The decay detection module uses an abnormal sensitivity decay detection method to analyze the abnormal behavior recognition sensitivity trend sequence to identify the decay characteristics of the real-time security monitoring classifier's recognition ability for real attack events;

[0011] The risk assessment module assesses the risk degree of induced drift of the real-time security monitoring classifier based on the feature variation trend and the decay characteristics;

[0012] The reconstruction triggering module determines the risk level of the real-time data security monitoring system according to the risk degree of the induced drift of the real-time security monitoring classifier, and triggers the security reconstruction mechanism of the real-time security monitoring classifier.

[0013] In a preferred embodiment, real-time network flow data is collected, feature extraction is performed on the real-time network flow data, and a feature sequence representing the behavior pattern of the network flow data is output, specifically:

[0014] Real-time network flow data from a network communication link is collected, and multi-dimensional feature extraction is performed on the real-time network flow data to construct a behavior pattern original feature matrix.

[0015] The behavior pattern original feature matrix is standardized and time series reconstructed, and a continuous feature sequence is formed according to a preset time window sliding strategy.

[0016] In a preferred embodiment, a feature space is constructed based on the feature sequence, a feature drift mapping sequence and an abnormal behavior recognition sensitivity change trend sequence are generated, specifically:

[0017] The continuous feature sequence is processed by embedding mapping based on distribution characteristics, and the continuous feature sequence is projected into a multi-dimensional feature space to construct a feature space representing the evolution process of the behavior pattern of the real-time network flow data.

[0018] In the feature space, the distribution difference of the continuous feature sequence in adjacent time windows is calculated, and a mapping function based on distribution distance measurement is used to generate a feature drift mapping sequence.

[0019] In the feature space, the output response of the abnormal behavior recognition model is monitored, the recognition response records of historical real attack samples are combined, the recognition sensitivity change parameter is calculated, and the abnormal behavior recognition sensitivity change trend sequence is constructed based on time sequence.

[0020] In a preferred embodiment, an abnormal distribution offset analysis method is used to analyze the feature drift mapping sequence to identify the feature variation trend caused by low-intensity exploratory attack samples, specifically:

[0021] The feature drift mapping sequence is divided into multiple continuous analysis windows, and the statistical distribution characteristic parameters of the feature drift mapping sequence in each analysis window are calculated.

[0022] Based on the statistical distribution characteristic parameters of the feature drift mapping sequence in different analysis windows, a distribution offset index sequence is constructed to describe the distribution change law of the feature drift mapping sequence.

[0023] The abnormal distribution offset analysis method is used to perform trend decomposition on the distribution offset index sequence, and the feature variation trend caused by the low-intensity exploratory attack sample is identified by comparing the similarity between the distribution offset index sequence and the historical abnormal attack sample feature distribution change.

[0024] In a preferred embodiment, the abnormal sensitivity decay detection method is used to analyze the abnormal behavior recognition sensitivity change trend sequence, and the decay feature of the real-time security monitoring classifier in identifying real attack events is identified, specifically:

[0025] The abnormal behavior recognition sensitivity change trend sequence is divided into multiple continuous analysis periods according to a predetermined detection window, and the statistical features of the abnormal behavior recognition sensitivity change trend sequence are calculated in each analysis period.

[0026] Based on the difference between the statistical features of the abnormal behavior recognition sensitivity change trend sequence and the preset abnormal behavior recognition sensitivity benchmark sequence, a sensitivity decay index sequence is constructed.

[0027] The abnormal sensitivity decay detection method is used to perform time series trend analysis on the sensitivity decay index sequence, and the decay feature of the real-time security monitoring classifier in identifying real attack events is identified.

[0028] In a preferred embodiment, based on the feature variation trend and the decay feature, the risk degree of the real-time security monitoring classifier induced drift is evaluated, specifically:

[0029] Based on the feature variation trend caused by the low-intensity exploratory attack sample, a feature variation amplitude index is calculated.

[0030] Based on the decay feature of the real-time security monitoring classifier in identifying real attack events, a sensitivity decay degree index is calculated.

[0031] The feature variation amplitude index and the sensitivity decay degree index are combined to calculate an induced drift risk comprehensive index.

[0032] In a preferred embodiment, according to the risk degree of the real-time security monitoring classifier induced drift, the risk level of the real-time data security monitoring system is determined, and the security reconstruction mechanism of the real-time security monitoring classifier is triggered, specifically:

[0033] The risk level division threshold of the real-time data security monitoring system is set in advance.

[0034] According to the comparison result of the induced drift risk comprehensive index and the risk level division threshold, the risk level of the real-time data security monitoring system is divided.

[0035] Based on the risk level of the real-time data security monitoring system, the corresponding safety reconstruction mechanism of the real-time security monitoring classifier is triggered.

[0036] The technical effects and advantages of the real-time data security monitoring system based on online data modeling of the application are as follows:

[0037] The data acquisition module guarantees the continuity and feature expression ability of network flow data; the feature space module can capture the evolution process of network behavior patterns by constructing a feature space; the deviation analysis module identifies the feature variation trend caused by low-intensity exploratory attacks, which helps to discover potential induced behaviors; the decay detection module identifies the decay characteristics of the real-time security monitoring classifier's recognition ability for real attack events, and timely discovers the decline of the recognition ability for real attacks; the risk assessment module integrates the feature variation trend and the decay characteristics, and comprehensively evaluates the risk degree of the real-time security monitoring classifier induced drift; the reconstruction triggering module determines the risk level of the real-time data security monitoring system according to the risk degree, and triggers the safety reconstruction mechanism of the real-time security monitoring classifier. The sensitivity, interpretability and self-recovery ability of the real-time data security monitoring system to potential induced attacks are improved, and the robustness and continuous defense ability of the real-time data security monitoring system in a dynamic environment are enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 The structure diagram of the real-time data security monitoring system based on online data modeling of the application is shown. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application.

[0040] Embodiment 1

[0041] Figure 1 The real-time data security monitoring system based on online data modeling of the application is given, which comprises:

[0042] The data acquisition module: collects real-time network flow data, extracts features from the real-time network flow data, and outputs feature sequences representing network flow data behavior patterns;

[0043] The feature space module: constructs a feature space based on the feature sequences, generates a feature drift mapping sequence and an abnormal behavior recognition sensitivity trend sequence;

[0044] Drift analysis module: using abnormal distribution drift analysis method to analyze the feature drift mapping sequence, identify the feature variation trend caused by low-intensity exploratory attack samples;

[0045] Decay detection module: using abnormal sensitivity decay detection method to analyze the abnormal behavior recognition sensitivity change trend sequence, to identify the decay characteristics of the real-time security monitoring classifier's ability to identify real attack events;

[0046] Risk assessment module: based on the feature variation trend and the decay characteristics, assess the risk degree of the real-time security monitoring classifier induced drift;

[0047] Reconstruction trigger module: according to the risk degree of the real-time security monitoring classifier induced drift, determine the risk level of the real-time data security monitoring system, and trigger the security reconstruction mechanism of the real-time security monitoring classifier.

[0048] Collect real-time network flow data, extract features from real-time network flow data, and output feature sequences representing network flow data behavior patterns, including:

[0049] Collect real-time network flow data from network communication links, perform multi-dimensional feature extraction operations on real-time network flow data, and construct behavior pattern original feature matrix;

[0050] Network communication link is the link channel between network devices for information transmission, including data transmission path between servers, routing devices and switching devices. Data acquisition unit is set at the entrance of network communication link. Data acquisition unit is a data acquisition device with real-time network data replication and transmission capability. The data acquisition unit configuration method is: capturing and replicating network flow data according to specific transmission protocol, and the captured data packet is real-time network flow data. Real-time network flow data includes transmission protocol type information, data packet length information, data packet arrival time information, connection source port information, connection target port information, data packet quantity information and time interval information between data packets.

[0051] The collected real-time network flow data is processed by using multi-dimensional feature extraction method. The multi-dimensional feature extraction method is: for each real-time network flow data packet, extract the corresponding transmission protocol type information, data packet length information, data packet arrival time information, connection source port information, connection target port information, data packet quantity information and time interval information between data packets; calculate the statistical indicators of each feature, including mean, maximum, minimum, median and variance, to form a set of statistical parameters of feature dimensions.

[0052] The average value of the data packet length information dimension feature is the sum of all data packet length values in the collection period divided by the number of data packets; the variance of the data packet length information dimension feature is the square sum of the difference between each data packet length value and the average value of the data packet length divided by the number of data packets; the average value of the time interval between data packets dimension feature is the sum of the time intervals between adjacent data packets in the collection period divided by the number of data packet intervals in the collection period, and the statistical indicators of other dimension features are the same as the above calculation method.

[0053] After the above multi-dimension feature extraction, a set of statistical parameters of each real-time network flow data packet in each feature dimension is obtained. The statistical parameter set of each data packet is used to construct a behavior pattern original feature matrix. Each row of the behavior pattern original feature matrix represents a network flow data in a collection period, and each column represents a different statistical indicator parameter of each feature dimension.

[0054] The behavior pattern original feature matrix is standardized and time series reconstructed to form a continuous feature sequence according to a preset time window sliding strategy.

[0055] The behavior pattern original feature matrix is processed by a standardization processing method. The standardization processing is as follows: the average value and the standard deviation of each column of data in the behavior pattern original feature matrix are calculated, and then each data in the column is subtracted from the average value of the column and divided by the standard deviation of the column, thereby obtaining a standardized data matrix of the behavior pattern original feature matrix.

[0056] Time series reconstruction is performed based on the standardized data matrix. The time series reconstruction is as follows: according to a preset time window length and sliding step, a sliding window strategy is used on the standardized data matrix. The sliding window strategy is to slide a fixed length data window along the time sequence of the standardized data matrix, starting from the first row, and moving down row by row, with the number of rows moved each time being the preset sliding step. All data covered by each sliding window is the time series data of the window. The time window length is set to a fixed window length of multiple rows of data, and the sliding step is less than or equal to the time window length, ensuring the overlap or continuity between consecutive windows.

[0057] For example, if the preset time window length is ten data of the collection period and the sliding step is two data of the collection period, the first time window is the data from the 1st row to the 10th row of the data matrix, the second time window is the data from the 3rd row to the 12th row, and so on, with a certain overlap between each window. Through the sliding window strategy processing, a continuous feature sequence reflecting the dynamic changes of the network flow data behavior pattern is formed.

[0058] The feature space is constructed based on the feature sequence, a feature drift mapping sequence and an abnormal behavior recognition sensitivity change trend sequence are generated, including:

[0059] The embedding mapping processing based on the distribution characteristics is performed on the continuity feature sequence, the continuity feature sequence is projected into the multi-dimensional feature space, and the feature space representing the behavior pattern evolution process of the real-time network flow data is constructed.

[0060] The continuity feature sequence takes a plurality of time window data sequences as basic units, and each time window contains a plurality of feature dimension data after the original feature matrix of the behavior pattern is processed by standardization. When the embedding mapping processing is performed on the continuity feature sequence, a statistical distribution feature-based embedding mapping method is used to project the features.

[0061] The statistical distribution feature-based embedding mapping method specifically includes: first, calculating the statistical distribution features of all feature dimension data in each time window of the continuity feature sequence. The statistical distribution features include mean, variance, skewness and kurtosis; the above statistical distribution features are combined to form a feature vector, and a multi-dimensional space mapping algorithm is used to project the feature vector into the constructed multi-dimensional feature space to obtain a feature space for representing the change of the network flow data behavior pattern over time.

[0062] In the feature space, the distribution difference of the continuity feature sequence in adjacent time windows is calculated, and a mapping function based on distribution distance measurement is used to generate a feature drift mapping sequence.

[0063] In the multi-dimensional feature space, in order to evaluate the change of the real-time network flow data behavior pattern between adjacent time windows, the statistical distribution difference of the feature vectors between adjacent time windows in the feature space is calculated. The calculation of the statistical distribution difference is performed by using a mapping function based on distribution distance measurement. The mapping function is a statistical distribution distance calculation function between two feature vectors in the feature space, which is calculated by using the Euclidean distance of the feature vectors.

[0064] For example, the feature vectors in the adjacent two time windows correspond to two specific positions in the feature space, and the distribution distance is calculated in the following manner: the difference between each dimension value of the first feature vector and the same dimension value of the second feature vector is calculated, the squared values of the differences are added, and the arithmetic square root of the added value is obtained to obtain the distribution distance value. The above operations are performed on all adjacent feature vectors in a plurality of continuous time windows to obtain the distribution distance values between each pair of adjacent feature vectors in sequence, and a feature drift mapping sequence is formed.

[0065] In the feature space, the output response of the abnormal behavior recognition model is monitored, the recognition response records of the historical real attack samples are combined, the recognition sensitivity change parameter is calculated, and an abnormal behavior recognition sensitivity change trend sequence is constructed based on the time sequence.

[0066] Based on the feature space, an anomaly behavior recognition model is deployed to identify abnormal behaviors in real-time network flow data. The anomaly behavior recognition model is a classification and recognition model pre-trained using historical real attack samples. Historical real attack samples are clearly labeled attack data, including feature sequences of historical network flow data where the attack type is clearly defined and has actually occurred. The anomaly behavior recognition model is deployed in the feature space. The feature vector of each time window is input into the anomaly behavior recognition model, and the model outputs an anomaly recognition result in real time. The output response includes recognition category information for whether the anomaly behavior detection is true or false, i.e., anomaly behavior category or normal behavior category.

[0067] To calculate the sensitivity variation parameters, the anomaly detection model's response records corresponding to historical real attack samples are first extracted. These records include accuracy, false negative rate, and false positive rate. For the output response of the anomaly detection model in the current time window, the accuracy, false negative rate, and false positive rate are calculated. Accuracy is defined as the ratio of the sum of samples correctly identified as anomalous behavior and samples correctly identified as normal behavior by the anomaly detection model within the current time window to the total number of input samples in the current time window. False negative rate is defined as the ratio of the number of samples that are actually anomalous behavior but were not identified by the anomaly detection model within the current time window to the total number of actual anomalous behavior samples within the current time window. False positive rate is defined as the ratio of the number of samples that are actually normal behavior but were incorrectly identified as anomalous behavior by the anomaly detection model within the current time window to the total number of actual normal behavior samples within the current time window. Next, the recognition accuracy, false negative rate, and false positive rate of the current time window are compared with the recognition accuracy, false negative rate, and false positive rate of historical real attack samples. The changes in recognition accuracy, false negative rate, and false positive rate are calculated respectively. These changes are used as parameters for the change in recognition sensitivity.

[0068] The sensitivity variation parameters of multiple consecutive time windows are arranged sequentially in chronological order to form a sequence of abnormal behavior recognition sensitivity variation trends. This sequence characterizes the changing ability of the abnormal behavior recognition model to recognize abnormal behavior as real-time network stream data changes.

[0069] Anomaly distribution shift analysis is used to analyze feature drift mapping sequences and identify feature variation trends caused by low-intensity probing attack samples, including:

[0070] The feature drift mapping sequence is divided into multiple consecutive analysis windows, and the statistical distribution characteristic parameters of the feature drift mapping sequence within each analysis window are calculated.

[0071] The feature drift mapping sequence is divided into several analysis windows of equal length. The length of the analysis window is usually determined based on the stability requirements of the actual network data feature changes; for example, ten consecutive feature drift mapping values ​​can be used as one analysis window.

[0072] Within each analysis window, statistical distribution parameters are calculated for the feature-shifted mapping sequence. These parameters include the mean, variance, skewness, and kurtosis of the feature-shifted mapping sequence within the current analysis window. These statistical parameters characterize the central tendency, dispersion, deviation from symmetry, and concentration of extreme values ​​of the data within the current analysis window, respectively.

[0073] Based on the statistical distribution characteristic parameters of the feature drift mapping sequence in different analysis windows, a distribution offset index sequence is constructed to describe the variation law of feature distribution.

[0074] The differences in statistical distribution characteristics between adjacent analysis windows are measured, and the distribution offset index of statistical distribution characteristics between each pair of adjacent analysis windows is calculated. The calculation of the distribution offset index includes a distance calculation method between statistical distribution parameters. The distance calculation method is to calculate the difference between each index of statistical distribution characteristics in the two analysis windows, square the difference, and then sum the squared values ​​and take the arithmetic square root of the sum. The distribution offset indices between all adjacent analysis windows are arranged in chronological order to form a distribution offset index sequence.

[0075] Anomaly distribution offset analysis is used to decompose the distribution offset index sequence into trends. By comparing the similarity between the distribution offset index sequence and the feature distribution changes of historical anomaly attack samples, the feature variation trend caused by low-intensity probing attack samples can be identified.

[0076] The abnormal distribution migration analysis method used is trend decomposition analysis. Specifically, trend decomposition analysis involves: extracting the trend of the distribution migration index sequence and decomposing it into a long-term trend component and a volatility component; the long-term trend component represents the long-term trend of the distribution migration index sequence over a time window, while the volatility component represents the short-term fluctuations of the distribution migration index sequence over a time window.

[0077] The implementation method of trend decomposition analysis is as follows: First, the long-term trend component of the distribution offset index sequence is extracted using the moving average method; then, the fluctuation component of the distribution offset index sequence is obtained by subtracting the value of the long-term trend component from the original value of the distribution offset index sequence. The moving average method is to sum the values ​​of multiple data points before and after each data point and then divide by the total number of data points.

[0078] The data on the changes in the feature distribution of historical anomaly attack samples is used for comparison. The data on the changes in the feature distribution of historical anomaly attack samples refers to the feature drift distribution offset features corresponding to historically known attack events, and the trend decomposition process is the same as above.

[0079] The comparison process involves calculating the similarity between the trend components of the current distribution offset index sequence and the trend components of historical anomaly attack samples. The similarity is calculated by summing the squares of the differences between the current trend component's value at each time point and the corresponding value of the historical trend component, and then taking the square root. This similarity calculation determines whether the current trend component exhibits a long-term trend similar to that of historical anomaly attack samples.

[0080] For example, if the calculated trend similarity value is lower than the preset similarity threshold, it means that the current feature variation trend is similar to the feature variation trend of historical low-intensity probing attack samples, thereby identifying the feature variation trend caused by the current low-intensity probing attack samples.

[0081] The feature variation trend is the long-term trend component of the distribution offset index sequence after trend decomposition, representing the long-term change trend of real-time network flow data features under the continuous influence of low-intensity probing attacks.

[0082] An anomaly sensitivity decay detection method was used to analyze the trend sequence of changes in the sensitivity of anomaly behavior recognition, and to identify the decay characteristics of the real-time security monitoring classifier's ability to recognize real attack events, including:

[0083] The abnormal behavior recognition sensitivity change trend sequence is divided into multiple continuous analysis periods according to a predetermined detection window, and the statistical characteristics of the abnormal behavior recognition sensitivity change trend sequence are calculated in each analysis period.

[0084] The abnormal behavior recognition sensitivity change trend sequence consists of the recognition accuracy change value, false negative rate change value, and false positive rate change value of multiple consecutive time windows, reflecting the change of the abnormal recognition model's ability to recognize abnormal behavior in real-time network stream data over time.

[0085] The sequence of changes in sensitivity for abnormal behavior detection is divided into multiple continuous analysis periods by a detection window length. The detection window length is a fixed length pre-set based on the observation requirements of real-time security monitoring for changes in sensitivity for abnormal behavior detection, typically using the sensitivity change parameters of multiple consecutive time windows as a single detection window. For example, the detection window length could be set to the sequence data of ten consecutive sensitivity change parameters.

[0086] Within each analysis period, the statistical characteristics of the changing trend sequence of abnormal behavior recognition sensitivity are calculated. These statistical characteristics include the mean and variance of the changes in recognition accuracy, the mean and variance of the changes in false negative rate, and the mean and variance of the changes in false positive rate.

[0087] Statistical calculations were performed for each of the above analysis periods to obtain the statistical characteristics of the change trend of abnormal behavior recognition sensitivity for all analysis periods.

[0088] Based on the statistical characteristics of the abnormal behavior recognition sensitivity change trend sequence and the difference between the preset abnormal behavior recognition sensitivity benchmark sequence, a sensitivity decay index sequence is constructed.

[0089] The abnormal behavior identification sensitivity benchmark sequence is a standard identification sensitivity statistical index calculated based on the identification response records of historical real attack samples. It includes the mean and variance benchmark values ​​of the change in identification accuracy, the mean and variance benchmark values ​​of the change in false negative rate, and the mean and variance benchmark values ​​of the change in false positive rate.

[0090] The process of constructing an index for the degree of sensitivity decay in a single analysis period is as follows:

[0091] The statistical characteristics of the abnormal behavior recognition sensitivity change trend sequence within each analysis period are compared with the corresponding statistical characteristic benchmark values ​​of the abnormal behavior recognition sensitivity benchmark sequence. Specifically, the differences between the mean and variance of the recognition accuracy change, the mean and variance of the false negative rate change, and the mean and variance of the false positive rate change within the current analysis period and their corresponding benchmark values ​​are calculated.

[0092] The differences are squared, summed, and the square root is taken to obtain the sensitivity decay index for each analysis period. A higher single-analysis-period sensitivity decay index indicates a more significant difference between the current anomaly detection model's ability and the historical baseline, reflecting the degree of degradation in detection capability. The single-analysis-period sensitivity decay indices for each analysis period are combined to obtain a sensitivity decay index sequence.

[0093] An abnormal sensitivity decay detection method was used to perform time-series trend analysis on the sensitivity decay index sequence to identify the decay characteristics of the real-time security monitoring classifier's ability to identify real attack events.

[0094] The abnormal sensitivity decay detection method is a time-series trend analysis method, which combines trend decomposition and trend testing to identify decay characteristics.

[0095] The process of time series trend analysis is as follows:

[0096] A trend decomposition method is used on the sensitivity decay index sequence to decompose it into a long-term trend component and a short-term fluctuation component. The trend decomposition method adopts the moving average method, which is to divide the sum of the values ​​of each data point and its two adjacent data points in the sensitivity decay index sequence by the number of data points taken, thereby obtaining the smooth long-term trend component and then the short-term fluctuation component.

[0097] A trend test is performed on the long-term trend component. The trend test method is to determine whether the value of the long-term trend component gradually increases with the increase of the time analysis period. Specifically, the slope of the trend change of the long-term trend component over multiple consecutive analysis periods is calculated, and the trend slope is calculated through linear trend regression analysis.

[0098] If the calculated trend slope is greater than the preset positive slope threshold, it indicates that the real-time security monitoring classifier's ability to identify real attack events is declining, thus identifying the decline characteristics of the real-time security monitoring classifier.

[0099] For example, if, after trend decomposition, the long-term trend component of the sensitivity decay index sequence shows a monotonically increasing trend over a continuous analysis period, and the calculated trend slope is a clearly positive value exceeding a preset positive slope threshold, then it is determined that the abnormal behavior recognition capability of the real-time security monitoring classifier has significantly decreased over time, identifying the decay characteristic of the real-time security monitoring classifier's ability to recognize real attack events. The decay characteristic of the real-time security monitoring classifier's recognition capability is manifested in a decrease in the recognition accuracy of the abnormal behavior recognition model and an increase in the false negative or false positive rate over a continuous analysis period.

[0100] Based on feature variation trends and decay characteristics, the risk of induced drift in real-time security monitoring classifiers is assessed, including:

[0101] The feature variation magnitude index is calculated based on the feature variation trend caused by low-intensity exploratory attack samples.

[0102] The feature variation magnitude index is used to quantify the degree to which real-time network flow data features change after being affected by low-intensity probing attacks. The feature variation trend is the long-term trend component caused by the identified low-intensity probing attack samples, reflecting the long-term change status of network flow data features within the analysis window.

[0103] The method for calculating the characteristic variation amplitude index is as follows:

[0104] The difference between the trend values ​​of each analysis window in the feature variation trend sequence is calculated. Specifically, the absolute value of the difference in trend values ​​between consecutive analysis windows is calculated, and the absolute values ​​of the difference in trend values ​​between all consecutive analysis windows are summed to obtain the cumulative sum of trend value differences. Then, the sum of trend value differences is divided by the total number of analysis windows to obtain the feature variation amplitude index. The feature variation amplitude index is used to quantitatively represent the cumulative change in the degree of feature shift of real-time network flow data under the continuous influence of low-intensity probing attack samples. Trend values ​​refer to the values ​​of specific data points in the long-term trend component.

[0105] Based on the decay characteristics of the real-time security monitoring classifier's ability to identify real attack events, an index of sensitivity decay is calculated.

[0106] The sensitivity decay index is used to quantify the degree to which a real-time security monitoring classifier's ability to identify real attack events deteriorates over time, and it is derived from the sensitivity decay index sequence.

[0107] The sensitivity attenuation index is calculated as follows:

[0108] The long-term trend component of the sensitivity decay index sequence is accumulated. The values ​​of all analysis periods (i.e., the sensitivity decay index for each single analysis period) of the long-term trend component are summed one by one, and then the accumulated value is divided by the total number of analysis periods to obtain the sensitivity decay index. The sensitivity decay index represents the degree of decline in the overall recognition capability of the real-time security monitoring classifier over a continuous analysis period.

[0109] A comprehensive index of induced drift risk is calculated by combining the characteristic variation amplitude index and the sensitivity decay index.

[0110] The Induced Drift Risk Comprehensive Index is used to comprehensively and quantitatively assess the overall risk level of induced drift in a real-time security monitoring classifier under the combined effects of low-intensity probing attacks and its own sensitivity degradation.

[0111] The calculation method for the comprehensive index of induced drift risk is as follows:

[0112] The characteristic variation amplitude index and the sensitivity decay index were normalized respectively.

[0113] The normalized feature variation amplitude index and sensitivity decay index are multiplied by preset risk weight parameters to obtain the comprehensive index of induced drift risk. The risk weight parameters are set based on the induced drift risk formation mechanism of the real-time safety monitoring classifier, and are usually equal to 0.5.

[0114] The higher the comprehensive index of induced drift risk, the higher the overall risk of induced drift in the real-time security monitoring classifier.

[0115] Based on the risk level of induced drift in the real-time security monitoring classifier, the risk level of the real-time data security monitoring system is determined, and a security reconstruction mechanism for the real-time security monitoring classifier is triggered, including:

[0116] Pre-set the risk level classification thresholds for the real-time data security monitoring system;

[0117] The risk level classification threshold serves as the specific boundary for the comprehensive index of induced drift risk, used to distinguish the state of the real-time data security monitoring system under different risk levels. The specific value of the risk level classification threshold is determined through analysis of the characteristics of abnormal behavior samples in historical network flow data and the performance data of historical security monitoring classifiers.

[0118] First, historical data samples of abnormal network behavior were collected, and the characteristic variation amplitude index and sensitivity decay index were calculated using these historical data samples. Then, a comprehensive index of induced drift risk was calculated based on the historical data samples. After statistically sorting all historical comprehensive index data of induced drift risk, a percentile method was used to define low-risk, medium-risk, and high-risk thresholds.

[0119] The low-risk threshold represents the boundary value at which the risk level of a real-time data security monitoring system changes from a safe state to a slightly risky state; the medium-risk threshold represents the boundary value at which the real-time data security monitoring system changes from a slightly risky state to a moderately risky state; and the high-risk threshold represents the boundary value at which the real-time data security monitoring system changes from a moderately risky state to a severely risky state.

[0120] Based on the comparison results between the comprehensive risk index of induced drift and the risk level classification threshold, the risk level of the real-time data security monitoring system is classified.

[0121] The method for classifying the risk level of a real-time data security monitoring system is as follows: The comprehensive index value of induced drift risk is compared with the risk level classification threshold to determine the risk level of the real-time data security monitoring system.

[0122] If the comprehensive index value of induced drift risk is less than or equal to the low risk threshold, the risk level of the real-time data security monitoring system is low risk.

[0123] If the comprehensive index value of induced drift risk is greater than the low risk threshold and less than or equal to the medium risk threshold, then the risk level of the real-time data security monitoring system is medium risk.

[0124] If the comprehensive index value of induced drift risk is greater than the medium risk threshold and less than or equal to the high risk threshold, then the risk level of the real-time data security monitoring system is high risk.

[0125] If the comprehensive index value of induced drift risk is greater than the high-risk threshold, the risk level of the real-time data security monitoring system is classified as severe risk.

[0126] Based on the risk level of the real-time data security monitoring system, the corresponding security reconstruction mechanism of the real-time security monitoring classifier is triggered.

[0127] The security reconstruction mechanism is a processing mechanism for reconstructing and restoring the recognition capabilities of real-time security monitoring classifiers. The security reconstruction mechanism includes operations such as updating security model parameters, retraining the abnormal behavior recognition model, and adjusting recognition thresholds. Specifically:

[0128] If the risk level of the real-time data security monitoring system is low, the security reconstruction mechanism will not be triggered.

[0129] If the real-time data security monitoring system is classified as medium risk, a security model parameter update mechanism is triggered. This mechanism involves fine-tuning or calibrating relevant model parameters in the real-time security monitoring classifier to improve its accuracy in identifying abnormal behavior in real-time network stream data.

[0130] If the real-time data security monitoring system is classified as high-risk, a retraining mechanism for the abnormal behavior recognition model is triggered. This retraining mechanism involves retraining the model using the latest collected real-time network stream data feature sequences and historical real attack sample data. The retraining method includes using supervised machine learning, training by matching sample labels with feature vectors, to restore the real-time security monitoring classifier's high-efficiency anomaly recognition performance.

[0131] If the risk level of the real-time data security monitoring system is severe, the joint operation of the identification threshold adjustment mechanism and the abnormal behavior identification model retraining mechanism will be triggered. Specifically, the abnormal behavior identification model will be retrained first, and then the identification threshold of the abnormal behavior identification model will be adjusted according to the performance results of the trained model. The identification threshold adjustment method includes optimizing the balance between the false detection rate and the false negative rate between the model output response and the actual attack sample label to achieve the maximum accuracy of detecting abnormal behavior in real-time network stream data.

[0132] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0133] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0134] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0135] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0136] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0137] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0138] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0139] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0140] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0141] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A real-time data security monitoring system based on online data modeling, characterized in that, include: Data acquisition module: Acquires real-time network stream data, extracts features from the real-time network stream data, and outputs feature sequences that characterize the behavior patterns of the network stream data; Feature space module: A feature space is constructed based on the feature sequence, generating a feature drift mapping sequence and an abnormal behavior recognition sensitivity change trend sequence, specifically: By performing embedding mapping processing based on distribution features on continuous feature sequences, the continuous feature sequences are projected into a multi-dimensional feature space to construct a feature space that characterizes the evolution process of real-time network flow data behavior patterns. In the feature space, the distribution difference of continuous feature sequences within adjacent time windows is calculated, and a feature drift mapping sequence is generated using a mapping function based on the distribution distance metric. In the feature space, the output response of the abnormal behavior recognition model is monitored. Combined with the recognition response records of historical real attack samples, the recognition sensitivity change parameters are calculated, and a sequence of abnormal behavior recognition sensitivity change trends is constructed based on the time sequence. Migration Analysis Module: Employs anomaly distribution migration analysis to analyze feature drift mapping sequences and identify feature variation trends caused by low-intensity probing attack samples. Specifically: The feature drift mapping sequence is divided into multiple consecutive analysis windows, and the statistical distribution characteristic parameters of the feature drift mapping sequence within each analysis window are calculated. Based on the statistical distribution characteristic parameters of the feature drift mapping sequence in different analysis windows, a distribution offset index sequence is constructed to describe the variation law of feature distribution. Anomaly distribution offset analysis is used to decompose the distribution offset index sequence into trends. By comparing the similarity between the distribution offset index sequence and the feature distribution changes of historical anomaly attack samples, the feature variation trend caused by low-intensity probing attack samples can be identified. Attenuation Detection Module: This module employs an anomaly sensitivity attenuation detection method to analyze the changing trend sequence of anomaly behavior recognition sensitivity, identifying the decay characteristics of the real-time security monitoring classifier's ability to recognize real attack events. Specifically: The abnormal behavior recognition sensitivity change trend sequence is divided into multiple continuous analysis periods according to a predetermined detection window, and the statistical characteristics of the abnormal behavior recognition sensitivity change trend sequence are calculated in each analysis period. Based on the statistical characteristics of the abnormal behavior recognition sensitivity change trend sequence and the difference between the preset abnormal behavior recognition sensitivity benchmark sequence, a sensitivity decay index sequence is constructed. An abnormal sensitivity decay detection method was used to perform time-series trend analysis on the sensitivity decay index sequence to identify the decay characteristics of the real-time security monitoring classifier's ability to identify real attack events. Risk assessment module: Based on feature variation trends and decay characteristics, assess the degree of risk of induced drift in the real-time safety monitoring classifier; Reconstruction Trigger Module: Based on the risk level of induced drift in the real-time security monitoring classifier, determine the risk level of the real-time data security monitoring system and trigger the security reconstruction mechanism of the real-time security monitoring classifier.

2. The real-time data security monitoring system based on online data modeling according to claim 1, characterized in that, Collect real-time network stream data, extract features from the real-time network stream data, and output feature sequences that characterize the behavioral patterns of the network stream data, specifically: Collect real-time network stream data from network communication links, perform multi-dimensional feature extraction operations on the real-time network stream data, and construct the original feature matrix of behavior patterns; The original feature matrix of the behavior pattern is standardized and reconstructed over time to form a continuous feature sequence according to a preset time window sliding strategy.

3. The real-time data security monitoring system based on online data modeling according to claim 2, characterized in that, Based on feature variation trends and decay characteristics, the risk of induced drift in real-time security monitoring classifiers is assessed, specifically as follows: The feature variation magnitude index is calculated based on the feature variation trend caused by low-intensity exploratory attack samples. Based on the decay characteristics of the real-time security monitoring classifier's ability to identify real attack events, an index of sensitivity decay is calculated. A comprehensive index of induced drift risk is calculated by combining the characteristic variation amplitude index and the sensitivity decay index.

4. The real-time data security monitoring system based on online data modeling according to claim 3, characterized in that, Based on the risk level of induced drift in the real-time security monitoring classifier, the risk level of the real-time data security monitoring system is determined, and the security reconstruction mechanism of the real-time security monitoring classifier is triggered, specifically as follows: Pre-set the risk level classification thresholds for the real-time data security monitoring system; Based on the comparison results between the comprehensive risk index of induced drift and the risk level classification threshold, the risk level of the real-time data security monitoring system is classified. Based on the risk level of the real-time data security monitoring system, the corresponding real-time security monitoring classifier's security reconstruction mechanism is triggered.

Images