Security defense method, system and equipment based on behavior sequence analysis

Abstract

The invention belongs to the technical field of network security, and provides a security defense method, system and device based on behavior sequence analysis, and the method comprises the steps of data preprocessing and feature engineering, abnormal sample expansion under privacy protection, complex attack association detection and model dynamic optimization. According to the method, the confrontation network is generated through the local training condition sequence of each node under the federated learning framework, the compliance time sequence abnormal samples are generated on the premise of protecting data privacy, the problem of insufficient model training caused by rare abnormal samples is effectively solved, the generalization ability of the detection model is improved, and the detection efficiency is improved. By modeling the behavior sequence of each domain into a graph structure and introducing a causal attention mechanism, the cross-resource and cross-time complex attack chain, such as the whole process of APT attack, can be identified, and the detection capability of attack behaviors with strong concealment and long duration time is remarkably improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to security defense methods, systems and devices based on behavioral sequence analysis. Background Technology

[0002] Behavioral sequence analysis refers to the analysis of the chronological sequences of operational behaviors of various entities within a network to identify potential anomalies or attacks. In the field of network security, analyzing behavioral sequences allows us to grasp the patterns and anomalies of operations from a temporal perspective, providing a basis for security defense.

[0003] Existing behavioral sequence analysis security defense technologies mostly focus on the detection of single-domain data, such as analyzing terminal data or network data, using traditional feature matching or simple machine learning algorithms, such as rule-based intrusion detection systems, which use a pre-set attack feature rule base to determine whether an attack exists; or some single-domain anomaly detection models, which use historical data within a single domain to train the model for detection.

[0004] However, these existing technologies have significant drawbacks. On the one hand, single-domain detection struggles to handle complex cross-domain attacks, such as APT attacks which often involve interactions across multiple domains, making it impossible for single-domain detection to fully identify the attack chain. On the other hand, attack samples are often scarce, resulting in low detection rates for traditional methods due to a lack of sufficient anomaly samples, and the models are difficult to adapt to changes in business scenarios, easily failing due to behavioral drift. Furthermore, there is a risk of data privacy breaches during data sharing and model training, as direct cross-domain data transmission can expose sensitive corporate information. Summary of the Invention

[0005] The purpose of this application is to propose a security defense method, system, and device based on behavioral sequence analysis to solve the technical problem that single-domain detection is difficult to deal with complex cross-domain attacks.

[0006] To address the aforementioned technical problems, this application provides a security defense method based on behavioral sequence analysis, employing the following technical solution: Security defense methods based on behavioral sequence analysis include the following steps: Collect heterogeneous data from multiple sources from terminal systems, network devices, and business systems, perform data cleaning, missing value completion, feature normalization, and time series window division, and generate a time series behavior sequence in a unified format; Under the federated learning framework, each domain node generates synthetic anomaly sequences based on local temporal behavior sequences, combined with organizational structure knowledge graphs and business rule constraints to train condition sequence GANs. Each node encrypts and uploads the model parameters to the federated server for aggregation, resulting in a globally converged generative model. This constructs a synthetic anomaly sample library to supplement the anomaly samples required for attack detection. By integrating multi-source data to construct a cross-domain knowledge graph, each domain node maps its local temporal behavior sequence to a subgraph. Features are extracted through graph convolutional networks and uploaded to a federated server to construct a global graph. A spatiotemporal causal attention mechanism is introduced to focus on causally related nodes. The attack probability of the sequence to be detected is inferred based on the pooled features of the global graph, and the attack chain and new samples are output. The federated server performs time-series consistency assessment and filtering on new samples uploaded from various domains to obtain compliant time-series samples. It then updates model parameters through federated incremental learning to achieve continuous model optimization, forming a closed-loop defense system of detection, update, and optimization.

[0007] Preferably, the multi-source heterogeneous data includes: user login time, file access path, and permission operation type extracted from terminal logs; source IP address, destination IP address, request frequency, and data transmission volume obtained from network device logs; user department, job permissions, and business operation time period extracted from business systems; data cleaning uses the 3σ criterion to remove outliers in numerical fields, missing value completion uses interpolation to complete missing time-series data, feature normalization performs Min-Max standardization on numerical features, and performs one-hot encoding on categorical features; the time-series behavior sequences include normal behavior sequences and real abnormal sequences.

[0008] Preferably, the federated learning framework includes multiple domain nodes and a federated server. Each node locally deploys a conditional sequence generative adversarial network. The generator takes random noise and real anomaly features as input to generate synthetic sequences, and the discriminator is used to distinguish between real and synthetic sequences.

[0009] Preferably, the conditional sequence GAN includes a generator and a discriminator. The generator uses real anomalous sequence features and random noise as input to generate synthetic anomalous sequences. The discriminator is used to distinguish between real sequences and synthetic sequences. During the training process, the model is jointly optimized through temporal adversarial loss and knowledge constraint loss. In the local temporal behavior sequences, normal behavior sequences are used to assist the discriminator in distinguishing between real normal sequences and synthetic anomalous sequences. Real anomalous sequences provide attack feature references for the generator to generate synthetic anomalous sequences. The federated server uses a sample-weighted average method to aggregate the model parameters of each domain node. The model parameters are processed using a homomorphic encryption algorithm before transmission.

[0010] Preferably, the domain knowledge graph stores the association relationships between domain, resource, user, device, and attack stage in the form of triples. The subgraph uses users, devices, and resources as nodes and temporal interaction relationships as edges. The edge attributes of the subgraph include interaction time and interaction type. The graph convolutional network extracts the local structural features of the subgraph by updating the node feature vectors. The local structural features of the subgraph include the temporal behavior features of the nodes themselves and the association features between nodes.

[0011] Preferably, the spatiotemporal causal attention mechanism determines the attention weight by calculating the causal correlation probability between nodes. The causal correlation probability is determined based on the results of intervention experiments on node behavior. The attack probability is mapped to the [0,1] interval through an activation function. A preset probability threshold is used to determine whether the temporal behavior sequence at the current time is an attack. If it is determined to be an attack, the sequence is labeled as a new anomalous sample. The output attack chain must include the node interaction sequence, attack stage label, and violation rule basis. If it is determined to be normal, the sequence is labeled as a new normal sample. The new samples include new anomalous samples, new normal samples, and unlabeled temporal behavior sequences newly generated in each domain.

[0012] Preferably, the temporal consistency evaluation calculates the score by measuring the deviation between the actual operation interval of the sample and the historical average interval, and only retains samples with a score ≥ the temporal consistency threshold; incremental training only updates the parameters of the classification layer and attention layer of the model, and retains the parameters of the graph convolutional layer; the federated incremental learning updates the model parameters by: each domain node using its own selected local compliant temporal samples as the initial value, using mini-batch gradient descent to incrementally train the key parameters, and then encrypting and uploading the updated parameters to obtain the optimized global model. The federated server aggregates the parameters and distributes them to each domain node to replace the original model parameters, forming a closed loop.

[0013] To address the aforementioned technical problems, embodiments of this application also provide a security defense system based on behavioral sequence analysis, including: Multi-source heterogeneous data acquisition module: Deployed in enterprise terminal systems, network devices and business systems, it collects terminal, network and business data in real time and outputs raw multi-source data; Preprocessing module: Receives raw multi-source data, removes numerical outliers using the 3σ criterion or IQR method, interpolates and completes missing time series data, performs Min-Max standardization on numerical features and one-hot encoding on categorical features, and outputs normalized features; The time-series sequence construction module receives normalized features, concatenates single-user or single-device features in chronological order to form a time-series behavior sequence, generates a zero vector and marks it as a silent window if there is no behavior in the window, labels the normal behavior sequence and the real abnormal sequence, and outputs the time-series behavior sequence. The federated framework initialization module builds an architecture with multiple domain nodes and a federated server. The federated server is deployed in an enterprise private cloud or local data center. Each node deploys a conditional sequence GAN sub-model. The federated server aggregates parameters without storing the original data and outputs the framework configuration information. Conditional Sequence GAN Training Module: Receives temporal behavior sequences and framework configuration information, combines organizational structure knowledge graphs and business rules, trains conditional sequence GANs locally on each node, the generator takes input real abnormal sequence features and random noise to generate synthetic abnormal sequences, the discriminator distinguishes between real sequences and synthetic sequences, optimizes the model through temporal adversarial loss and knowledge constraint loss, and outputs encrypted conditional sequence GAN model parameters. Federation parameter aggregation module: Receives encrypted model parameters, aggregates parameters using sample size weighted average method, outputs aggregated global conditional sequence GAN model parameters to each node, and outputs globally converged conditional sequence GAN model. Cross-domain knowledge graph construction module: Receives synthetic anomaly sequences and time-series behavior sequences, integrates business topology data, attack knowledge base, and organizational permission data, and constructs and outputs a cross-domain knowledge graph containing triples with "domain-resource-user-device-attack stage" relationships; Cross-domain subgraph construction module: Receives time-series behavior sequences and cross-domain knowledge graphs, maps local time-series behavior sequences to subgraphs, and outputs subgraphs; Subgraph feature extraction module: Receives a subgraph, updates the node feature vectors using a graph convolutional network, extracts local structural features that reflect the temporal features of the nodes themselves and the correlation features between nodes, and outputs the local structural features of the subgraph; Spatiotemporal causal attention fusion module: Receives local structural features of subgraph and cross-domain knowledge graph, constructs global graph on federated server, introduces causal inference algorithm to distinguish between correlation and causality between nodes, calculates causal attention weights to focus on attack-related node pairs, and outputs global graph and causal attention weight set; Attack detection and inference module: Receives the temporal behavior sequence to be detected, the spatiotemporal causal attention global graph and the attention weight set, calculates the attack probability through the FC-GNN model, determines whether it is an attack or normal according to the preset threshold, outputs the attack chain and new samples, and triggers active defense actions at the same time. The new samples include new abnormal samples, new normal samples and unlabeled temporal behavior sequences. Sample quality assessment module: Receives new samples, synthesizes abnormal sequences, calculates the temporal consistency score of new samples, filters out non-compliant temporal samples with scores less than the temporal consistency threshold, and outputs compliant temporal samples; Local incremental training module: Receives compliant time series samples, uses the existing FC-GNN model as the initial value, updates the parameters of the model's classification layer and attention layer using mini-batch gradient descent, and outputs the locally updated model parameters; The Federation parameter update module receives locally updated model parameters, aggregates the parameters using a sample-weighted average method, and outputs the optimized global FC-GNN model parameters to each domain node, thereby achieving dynamic model optimization and forming a defense loop.

[0014] Preferably, the multi-source heterogeneous data acquisition module supports sensitive field desensitization processing and has data integrity verification function; after the preprocessing module marks the missing data, the output data includes the missing window position information; In the conditional sequence GAN training module, when an anomalous sequence violates the organizational knowledge graph permission rules, its compliance probability is reduced and the loss value is increased to optimize the generator; the federated parameter aggregation module and the federated parameter update module use Paillier homomorphic encryption to process the parameters before transmitting the model parameters. The subgraph nodes of the cross-domain subgraph construction module include temporal behavior features and node risk level labels, and support subgraph compression; the subgraph feature extraction module adopts a graph convolutional network architecture and outputs features along with feature importance scores. The causal inference algorithm of the spatiotemporal causal attention fusion module records the intervention experiment process and dynamically adjusts the attention weights; the attack probability threshold of the attack detection inference module supports adaptive optimization. In the mini-batch gradient descent of the local incremental training module, the batch size is adjusted according to the amount of data at each node; the federated parameter update module has model version management functionality.

[0015] To address the aforementioned technical problems, this application also provides a computer device, comprising: at least one processor; a memory communicatively connected to the at least one processor; and a network interface; wherein the processor, memory, and network interface are communicatively connected to each other via a system bus, and the memory stores instructions executable by the processor, which are used to be executed by the processor to implement the aforementioned method.

[0016] The beneficial effects of this invention are as follows: This application provides a security defense method based on behavioral sequence analysis. By training a conditional sequence generative adversarial network locally at each node under a federated learning framework, it generates compliant temporal anomaly samples while protecting data privacy. This effectively solves the problem of insufficient model training caused by the scarcity of anomaly samples and improves the generalization ability of the detection model.

[0017] This method models the behavioral sequences of each domain as a graph structure and introduces a causal attention mechanism. This invention can identify complex attack chains that span resources and time periods, such as the entire process of APT attacks, and significantly improves the detection capability for highly concealed and long-lasting attack behaviors.

[0018] This method employs a federated incremental learning mechanism to dynamically update model parameters based on new samples, avoiding full retraining. This saves computational resources and enables the model to quickly adapt to behavioral drift and new business scenarios, forming a closed-loop optimized adaptive defense system. Attached Figure Description

[0019] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of the security defense method provided in the embodiments of this application; Figure 2 This is an exemplary system architecture diagram to which this application can be applied; Figure 3 This is a schematic block diagram of one embodiment of a computer device according to the present application. Detailed Implementation

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms in the specification, claims, and foregoing description of the drawings include and have, and any variations thereof, and are intended to cover non-exclusive inclusion. The terms first, second, etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0022] References to embodiments herein mean that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0024] Example 1 The security defense method based on behavior sequence analysis includes steps 1-4, wherein: Step 1: Data Preprocessing and Feature Engineering: Collect heterogeneous data from multiple sources from terminal systems, network devices, and business systems, perform data cleaning, missing value completion, feature normalization, and time series window division to generate standardized time series behavior sequences in a unified format, including normal behavior sequences and real abnormal sequences.

[0025] Furthermore, the multi-source heterogeneous data includes: user login time, file access path, and permission operation type extracted from terminal logs; source IP address, destination IP address, request frequency, and data transmission volume obtained from network device logs; and user department, job permissions, and business operation time period extracted from business systems. Data cleaning employs the 3σ criterion to remove outliers from numerical fields. Missing value completion uses interpolation to fill in missing time-series data. Feature normalization performs Min-Max standardization on numerical features and one-hot encoding on categorical features.

[0026] Collect raw behavioral sequence data from nodes in each domain, clean, normalize, and extract features from the multi-source heterogeneous raw data, and generate time-series behavioral sequences in a unified format.

[0027] Step 1.1: Collect multi-source heterogeneous raw data: Collect logs in real time through the enterprise SIEM system, or extract data in batches from the database using the API interface. The data collection frequency is once every 5 minutes to ensure timeliness.

[0028] Extract terminal data from the terminal operating system logs, file management system logs, and access control module to obtain the user login time T. login File access path P file Permission operation type O perm .

[0029] Network data is collected from network device logs and traffic monitoring tools to obtain the source IP address. src Destination IP address dst Request frequency F req Data transmission volume V data .

[0030] Extract business data from the enterprise business system to obtain the user's department D. dept Job authority R role Business operation period T biz .

[0031] Step 1.2: Data cleaning: Remove outliers, fill in missing time series data to ensure data integrity and accuracy, and obtain cleaned multi-source data.

[0032] Outlier removal: The 3σ criterion is used to remove records in numerical fields that exceed "mean ± 3 times standard deviation". For example, if a user's file access time has a mean of 2 seconds and a standard deviation of 1 second, then records with "single access time > 2 + 3 × 1 = 5 seconds" are identified as outliers and deleted.

[0033] It should be noted that the 3σ criterion requires the data to be approximately normally distributed. If the data is not normally distributed, the IQR (interquartile range) method should be used instead. There are two ways to determine whether the data is approximately normally distributed: one is a visualization method, which involves drawing a quantile-quantile plot. If the data points approximately fall on a straight line, then the data is approximately normally distributed. The other is a statistical test method, using the Shapiro-Wilk test, which is common knowledge and will not be elaborated further.

[0034] Missing value imputation: Interpolation is used to impute missing time-series data within a short period. For long-term missing data exceeding 30 minutes, linear interpolation combined with historical mean is used for imputation. If there is no historical data for the missing period, it is marked as missing and skipped from the window.

[0035] Example: If login records for 9:00-9:05 are missing, the records for that time period can be supplemented by interpolating the login frequency of adjacent time periods (8:55-9:00, 9:05-9:10).

[0036] Step 1.3: Feature Normalization: The cleaned multi-source data is divided into numerical features and categorical features, and standardized transformations are performed on each. For numerical features, such as request frequency F... req Data transmission volume V data Min-Max normalization is used to map feature values ​​to the [0,1] interval, eliminating the influence of units; for categorical features, such as operation type O perm Department D dept One-hot encoding is used to convert the data into numerical vectors to obtain normalized features.

[0037] Step 1.4: Time Series Construction: Using a time window Δt as the unit, the normalized features of a single user or single device are concatenated in chronological order to form a time series behavior sequence S, reflecting the temporal correlation of behaviors. The time window is set to 5 minutes and can be adjusted according to the business scenario. S=[x1,x2,...,x] n ], where x i Let be the feature vector of dimension d for the i-th time window, where d = the total number of normalized features. Each sequence corresponds to the continuous behavior of a single user or device. If there is no behavior within the time window Δt, a zero vector is generated as x. i And mark it as a silent window in the sequence.

[0038] Time series construction is achieved through sliding time windows: Let the time window Δt = 5 min, the sliding step size = Δt, and the window be non-overlapping. Concatenate the feature vectors of the time intervals [t0, t0 + Δt], [t0 + Δt, t0 + 2Δt], ..., [t0 + (n-1)Δt, t0 + nΔt] in sequence to form S. Example: User A's behavioral sequence S from 9:00 to 10:00. A =[x1(9:00-9:05),x2(9:05-9:10),...,x 12 (9:55-10:00)).

[0039] Sequences of normal behavior S are selected from S that conform to the company's business rules and are risk-free operation records, such as daily user logins, access to files within the department's authorized scope, and business operations during work hours. After being marked as normal by manual or automated rules, normal behavior sequences S are obtained. normal The automation rules include: 1. User login time matching Tbiz, such as 9:00-18:00; 2. File access path (Pfile) conforming to departmental permissions, such as R&D domain users only accessing the project directory; 3. Operation type (Operation) not high-risk, such as deletion or modification. Meeting all rules indicates normal operation.

[0040] From historical security incident logs and handled attack cases, identify risky operations (S), such as internal privilege abuse, abnormal logins or data transmissions in the early stages of an APT attack. After being marked as abnormal by the security administrator, the actual abnormal sequence S is obtained. abnormal .

[0041] Step 2: Anomaly Sample Enlargement under Privacy Protection: Under the federated learning framework, each domain node trains a conditional sequence GAN based on local temporal behavior sequences, combined with organizational structure knowledge graphs and business rule constraints, to generate synthetic anomaly sequences. Each node encrypts and uploads the conditional sequence GAN model parameters to the federated server for aggregation. The model parameters include the weights and biases of the conditional sequence GAN generator and discriminator, resulting in a globally convergent conditional sequence GAN generation model. This constructs a synthetic anomaly sample library to supplement the anomaly samples required for attack detection.

[0042] Furthermore, the federated learning framework includes multiple domain nodes and a federated server. Each node locally deploys a conditional sequence generative adversarial network. The generator takes random noise and real anomaly features as input to generate synthetic sequences, and the discriminator is used to distinguish between real and synthetic sequences.

[0043] Furthermore, the conditional sequence GAN includes a generator and a discriminator. The generator uses real anomalous sequence features and random noise as input to generate synthetic anomalous sequences. The discriminator is used to distinguish between real sequences and synthetic sequences. The training process jointly optimizes the model through temporal adversarial loss and knowledge constraint loss. The local temporal behavior sequences include normal behavior sequences and real anomalous sequences. Normal behavior sequences are used to assist the discriminator in distinguishing between real normal sequences and synthetic anomalous sequences. Real anomalous sequences provide attack feature references for the generator, and finally, synthetic anomalous sequences are generated.

[0044] Furthermore, the federated server uses a sample size weighted average method to aggregate the model parameters of each domain node. The larger the sample size of a node, the higher its contribution weight to the global model parameters. The model parameters are processed using a homomorphic encryption algorithm before transmission to avoid leakage of the original data.

[0045] Under the federated learning framework, conditional sequence GANs are trained locally on each domain node to generate abnormal samples that conform to temporal logic and attack characteristics, thereby expanding the training dataset, solving the problem of scarce abnormal samples, and avoiding the centralized storage of sensitive data.

[0046] Step 2.1: Federated Framework Initialization: Build a federated learning architecture, clarify the roles and responsibilities of each node, deploy local models, and ensure that raw data is not transmitted across nodes.

[0047] The federated learning architecture comprises K domain nodes and one federated server. The federated server is deployed in an enterprise's private cloud or on-premises data center, using HTTPS communication to ensure secure data transmission between nodes. The domain nodes include the enterprise's R&D, finance, and production domains. Each node locally deploys a conditional sequence GAN (Generative Adversarial Network) sub-model, which includes a generator G and a discriminator D. The generator G generates synthetic anomalous sequences, and the discriminator D distinguishes real sequences from synthetic sequences. The federated server is responsible for aggregating model parameters and does not store the raw data.

[0048] Once the federated framework is initialized, each domain node has deployed a conditional sequence GAN sub-model, and the federated server has completed its communication configuration and can receive model parameters uploaded by the nodes.

[0049] Step 2.2: Local Training of Conditional Sequence GAN: Each domain node trains the generator G and discriminator D of the conditional sequence GAN based on local data and domain knowledge constraints, ensuring that the generated synthetic sequences are both realistic and conform to business logic. Local data includes normal behavior sequences S. normal , True abnormal sequence S abnormal .

[0050] Domain knowledge constraints include organizational structure knowledge graph (KG). org Business Rules R biz KG orgBuilt upon enterprise HR and access control systems, it is stored in triplet format. biz Defined by security administrators in conjunction with enterprise business scenarios, or generated statistically from historical normal behavior data.

[0051] Generator G training: Using the feature vector c of the real anomalous sequence and random noise z as input, generate a synthetic anomalous sequence S. gen =G(z|c), where c is S abnormal Feature summaries, such as abnormal operation types and attack periods, are generated by statistically analyzing the average feature values ​​of the Sabnormal domain. Knowledge graph constraints ensure that S... gen In line with business logic, such as embedding a KG when generating a sequence of non-project documents accessed by engineers. org Department-document permission relationships in the document.

[0052] Discriminator D training: Input real sequence and synthetic anomalous sequence S gen Output the probability P that the sequence is true. real ∈[0,1], the goal is to distinguish between the real sequence and the synthetic sequence, where the real sequence is S. normal +S abnormal A set of.

[0053] Loss function optimization: using temporal adversarial loss L T and knowledge constraint loss L KG Joint optimization to ensure S gen It is both realistic and in line with business logic.

[0054] Temporal Adversarial Loss L T Divided into discriminator loss L D,T And generator loss L G,T The total temporal adversarial loss is the sum of the losses of the generator and the discriminator in the temporal dimension, i.e., L. T =L D,T +L G,T .

[0055] Formula 1: L D,T =-E S,pdata [logD(S)]-E Sgen,pgen [log(1-D(S gen ))] Where: L D,T For discriminator loss; E is the expected value, averaged over all input sequences; S is the true sequence; p data S represents the probability distribution of the true sequence; D(S) is the output probability of the discriminator for S; S gen To synthesize abnormal sequences; p gen For S gen The probability distribution of D(S); gen) is the discriminator for S gen The output probability is ; log is the natural logarithm.

[0056] Formula 2: L G,T =-E Sgen,pgen [logD(S gen )] Where: L G,T This is the generator loss.

[0057] Formula 3: L KG =1-P comply Where: L KG For knowledge graph constraint loss; P comply For S gen Permission compliance probability, based on knowledge graph KG org The triplet rule calculation in S, if S gen If user U accesses document D in accordance with the rule <U, accessible, D>, then P comply =1; if completely violated, then P comply =0, if there is a partial violation, then P comply = Number of actions that meet the permissions / Total number of actions, value [0-1]. Example: Sgen contains 5 actions, 3 of which are compliant, then P comply =3 / 5=0.6. L KG L measures the fit between the synthesized sequence and the domain knowledge constraints. KG The smaller the value, the more the synthesized sequence conforms to the business logic.

[0058] Formula 4: L total =L T +λ·L KG Where: L total To calculate the total loss of a GAN, we need to minimize the generator loss and maximize the discriminator loss; L T For temporal adversarial loss, the temporal similarity between the synthesized sequence and the real sequence is measured to ensure that the temporal logic of the synthesized sequence is consistent with that of the real sequence; λ is a weighting coefficient, determined through cross-validation, with an empirical value of 0.3-0.5, used to balance L T and L KG .

[0059] It should be noted that generator G generates S gen First, check the KG. org If the current user's permission triplet, such as <Engineer E, can access, project document P>, generates a behavior sequence containing "E accesses non-project document Q", then a knowledge constraint check is triggered: calculate P. comply At this time P comply =0, because Q is not within the reach of E; LKG =1-0=1, by increasing the total loss through formula 4, backpropagation optimizes the generator G, reduces the generation of illegal sequences, and forms a causal chain of "knowledge constraint → loss adjustment → generator optimization".

[0060] Step 2.3: Federated Parameter Aggregation: Each node trains for E rounds, such as 10 rounds. After that, the parameters of the generator G and the discriminator D are homomorphically encrypted using the Paillier algorithm and uploaded to the federated server. The parameters include weights W and biases b. The server aggregates the parameters of the conditional sequence GAN model using a weighted average and distributes them to each node as the initial parameters for the next round of training. This process is repeated until the conditional sequence GAN model converges.

[0061] With generator weight W G For example, Formula 5:

[0062] Among them: W G global The weight of the global generator after aggregation by the federated server; K is the number of domain nodes, such as K=3 for 3 domains: R&D, Finance, and Production; n k W represents the local training sample size for the k-th node, such as n1=1000 for the R&D domain and n2=800 for the financial domain; G local,k The generator weights are generated locally at the k-th node and uploaded after being encrypted by Paillier.

[0063] The aggregated W G global The data is distributed to each node as the initial weights for the next round of training, ensuring that the model on each node converges to the global optimum, while avoiding the uploading of raw data to protect privacy.

[0064] After the above processing, a globally convergent federated conditional sequence GAN model is obtained, including the generator G. global and discriminator D global G global It can generate a synthetic anomaly sample library S that conforms to temporal logic and business rules. gen,lib Such as 100,000 different types of privilege abuse and APT initial operation sequences.

[0065] Step 3: Complex Attack Association Detection: Integrate multi-source data to construct a cross-domain knowledge graph. Each domain node maps its local temporal behavior sequence to a subgraph. Features are extracted through a graph convolutional network and uploaded to a federated server. A global graph is constructed and a spatiotemporal causal attention mechanism is introduced to focus on causal association nodes. Based on the global graph pooling features, the attack probability of the sequence to be detected is inferred using an FC-GNN model. Attack chains and new samples are output to achieve complex attack identification.

[0066] Furthermore, the domain knowledge graph stores the association relationships between domain, resource, user, device, and attack phase in the form of triples. The subgraph uses users, devices, and resources as nodes and temporal interaction relationships as edges. The edge attributes of the subgraph include interaction time and interaction type. The graph convolutional network extracts the local structural features of the subgraph by updating the node feature vectors. The local structural features of the subgraph include the temporal behavior features of the nodes themselves and the association features between nodes.

[0067] Furthermore, the spatiotemporal causal attention mechanism determines attention weights by calculating the causal correlation probability between nodes, focusing on node interaction relationships that directly affect the attack results. The causal correlation probability is determined based on the results of intervention experiments on node behavior, and the attack probability is mapped to the [0,1] interval through an activation function. A preset probability threshold is used to determine whether the temporal behavior sequence at the current time is an attack. If it is determined to be an attack, the sequence is labeled as a new anomalous sample, and the output attack chain must include the node interaction sequence, attack stage label, and violation rule basis. If it is determined to be normal, the sequence is labeled as a new normal sample. New samples include new anomalous samples, new normal samples, and unlabeled temporal behavior sequences newly generated in each domain.

[0068] Within the federated framework, the behavioral sequences of each domain are modeled as subgraphs. By fusing cross-domain features and spatiotemporal causal relationships through FC-GNN (Federated Graph Neural Network), complex attack chains that span resources and time periods can be identified, such as the entire process of APT attacks: reconnaissance → penetration → data theft.

[0069] Security administrators or knowledge graph-based algorithms integrate multi-source data from enterprises, including business topology data, attack knowledge bases, and organizational permission data, to construct a cross-domain knowledge graph (KG) in the form of triplets containing domain-resource-user-device-attack stage associations. cross The cross-domain knowledge graph KGcross employs a rule-based and machine learning-based construction algorithm. The specific steps include: 1. Data preprocessing: entity identification and relationship extraction from business topology data, attack knowledge bases, and organizational permission data; 2. Rule construction: basic rules are defined by the security administrator, such as user-department and device-domain affiliation rules; 3. Knowledge fusion: entity linking eliminates entity redundancy in multi-source data; 4. Knowledge completion: the TransE model is used to predict missing relationships, such as completing the relationship that user A can access project documents based on the fact that user A belongs to the R&D domain and R&D domain devices can access project documents, ultimately forming a KG in triplet form. cross .

[0070] Step 3.1: Cross-domain subgraph construction: Each domain node maps its local behavior sequence to a subgraph G. k =(V k E kThis uses a graph structure to represent the temporal interaction relationships between "user-device-resource," laying the foundation for subsequent feature extraction. Specifically: V k Each node consists of a user node u, a device node d, and a resource node r. Each node's attribute is the feature vector x generated in step 1. i ; E k An edge represents a temporal interaction between nodes, such as user u accessing device d at time t, with the edge attributes being interaction time t and interaction type type.

[0071] Step 3.2: Subgraph structural feature extraction: Subgraph G is extracted from each node using GCN (Graph Convolutional Network). k Local structural features h v This reflects the interaction between nodes and their neighbors, avoiding the transmission of original subgraph data.

[0072] GCN node feature update, Formula 6:

[0073] Where: h v (l) Let h be the feature vector of node v in the l-th layer of the network. When the initial layer l=0, h v (0) The node attribute vector x generated in step 1 i h v (l+1) h is the updated feature vector of node v in the (l+1)th layer of the network; u (l) Let be the feature vector of node u in the l-th layer network; u is a neighboring node of node v; N(v) is the set of neighboring nodes of node v, such as device nodes that interact with user v; W (l) b is the trainable weight matrix of layer l, optimized through backpropagation; (l) Let l be the bias vector of the l-th layer; normalized adjacency matrix The elements corresponding to nodes v and u are selected to avoid the influence of node degree. =D -1 / 2 AD -1 / 2 A is a subgraph G k The adjacency matrix is ​​given by A[v,u] = 1 if nodes v and u interact, otherwise A[v,u] = 0; D is the degree matrix, D[v,v] = ∑ u A[v,u]; σ is the ReLU activation function.

[0074] After the above processing, the local structural feature set {h} of each domain node is obtained. v Each node corresponds to a structural feature vector.

[0075] Step 3.3: Fusion of Spatiotemporal Causal Attention Mechanisms: The federated server constructs a global graph, introduces a causal inference algorithm to distinguish between correlation and causality, and focuses on causally related node pairs through an attention mechanism, providing a basis for attack chain reconstruction. Global Graph Construction: The federated server will incorporate cross-domain structural features h v Sets, constructing a global graph G global =(∪V k ,∪E k ), where: ∪V k It is the set of nodes of all domains, ∪E k Based on KG cross Supplementary cross-domain edges. A causal inference algorithm (Do-Calculus) is introduced to distinguish between correlation and causality. For example, user u downloading code → external IP transmitting data is a causal relationship, while unrelated logins at the same time are correlational. Attention weight α is used to further differentiate between these relationships. ij Focusing on causal pairs of nodes, the attack chain is reconstructed.

[0076] Spatiotemporal causal attention weight calculation: Combining Do-Calculus and attention mechanisms in causal inference, causal attention weights are introduced to quantify the strength of causal associations between nodes.

[0077] Formula 7: α ij =exp(Do(P(y|do(x i ),x j ))) / ∑ m∈N(i) exp(Do(P(y|do(x i ),x m ))) Where: α ij x represents the causal attention weight between node i and node j, with values ​​ranging from [0,1]. Larger values ​​indicate a stronger causal relationship. i x is the temporal behavior feature vector of node i; j Let be the temporal behavior feature vector of node j; y is the attack result variable, y=1 for attack, y=0 for normal; m is the index of the node's neighbor nodes; Do(P(y|do(x)) i ),x j Intervention x for the Do operator computation i After that, x j The causal probability of y; N(i) is the global neighbor set of node i; exp is an exponential function to ensure that the weights are non-negative.

[0078] The attack result variable y is defined as follows: y=1 (attack) must satisfy "existence of a cross-domain knowledge graph KG". crossThe attack phase characteristics defined in the document include "abnormal IP scanning during the reconnaissance phase, privilege escalation during the penetration phase, and large-scale data transfer during the data theft phase"; y=0 must satisfy "all behaviors conform to the organizational structure knowledge graph KG". org Rbiz defines permission rules and business rules. Permission rules include rules such as "User U, can access, document D", and business rules include rules such as "operation during working hours".

[0079] Do operator computation steps: From the global graph G global Filter the subset of behavior sequences containing nodes i and j; perform the intervention operation do(x) on this subset. i That is, fix x i Behavioral characteristics, such as "user u downloads code"; the proportion of samples with y=1 in the subset after statistical intervention, which is Do(P(y|do(x)). i ),x j )).

[0080] α ij This is used to focus on causally related node pairs in a cross-domain graph, such as key nodes in an attack chain. After the above processing, a global graph G is obtained. global The set of causal attention weights {α ij}

[0081] Step 3.4: Attack Detection Inference: Input the sequence of behaviors to be detected, S test S test That is, the probability P of a current time sequence of actions S being an attack behavior is calculated using the FC-GNN model. attack The result is determined based on the threshold τ, and the attack chain is output.

[0082] Formula 8: P attack =Sigmoid(W final ·h global +b final ) Where: P attack h represents the probability that the sequence to be detected is an attack, ranging from [0,1]. The closer it is to 1, the higher the probability of an attack. global For global graph G global The pooling characteristics are obtained by average pooling the structural features of all nodes in the global graph; W final b represents the weights of the final classification layer. final The bias of the final classification layer is obtained through backpropagation optimization; Sigmoid is the activation function.

[0083] The threshold τ = 0.8 was determined through cross-validation. If P attackIf the value is greater than τ, it is considered an attack, and the following follow-up actions are taken: 1. Proactive defense: Automatically execute defensive measures, such as isolating infected devices, revoking user privileges, and blocking malicious IPs; 2. Alarms and logging: Trigger alarms to notify security administrators, log the attack chain, such as node interaction sequences and attack stages, and add it to the security event database; 3. Sample labeling: Mark the sequence as a new anomalous sample S. new,abn Step 4 is used for incremental model updates.

[0084] If P attack If the value is less than or equal to τ, it is considered normal. Subsequent processing includes: 1. Monitoring and recording: Marking this sequence as a new normal sample S. new,norm If the sequence belongs to a new business scenario, such as a new operation for remote work, enter step 4 for model adaptation and update; 2. Defense maintenance: No additional actions are taken, and the current security policy is maintained.

[0085] The new sample includes S new,abn S new,norm And the newly generated unlabeled temporal behavior sequences in each domain, S new,abn and S new,norm Feedback is periodically sent to step 2 to update the federated GAN and knowledge graph, ensuring that the model adapts to new threats.

[0086] Step 4: Dynamic Model Optimization: The federated server performs temporal consistency assessment and filtering on new samples uploaded from each domain to obtain compliant temporal samples. The parameters of the FC-GNN model are updated through federated incremental learning to achieve continuous optimization of the FC-GNN model, forming a closed-loop adaptive defense system of detection, update, and optimization.

[0087] Furthermore, the temporal consistency evaluation calculates the score by measuring the deviation between the actual operation interval of the sample and the historical average interval, and only retains samples with scores ≥ the temporal consistency threshold; incremental training only updates the parameters of the model's classification layer and attention layer, while retaining the parameters of the graph convolutional layer to avoid overfitting.

[0088] Furthermore, the federated incremental learning update of model parameters includes: each domain node, based on its own selected local compliant time series samples, uses the existing model as the initial value, performs incremental training on key parameters using mini-batch gradient descent, and then encrypts and uploads the updated parameters to obtain the optimized global model. The federated server aggregates the parameters and distributes them to each domain node to replace the original model parameters, forming a closed loop.

[0089] Step 4.1: Sample Quality Assessment: The federated server assesses the quality of new samples uploaded from each domain. new Perform time series validity checks, calculate the time series consistency score of the samples, filter out non-compliant time series samples, and ensure the quality of incremental training data. New sample S new Including S new,abn and S new,norm .

[0090] Formula 9:

[0091] Wherein: S consist The temporal consistency score for the new sample is defined, with a value ranging from (0,1]. The closer the score is to 1, the more reasonable the temporal sequence. n represents the sequence S of the new sample. new Number of time steps; t i Let i be the operation time of the i-th time step; This refers to the average interval for this type of operation, such as the average interval for a normal login. =10min, obtained from historical normal sample statistics; σ represents the deviation between the actual interval and the average interval; exp is an exponential function that ensures the score is in the interval (0,1]. The smaller the deviation, the closer the score is to 1.

[0092] Statistical verification based on historical samples shows that when S... consist When S ≥ 0.5, the temporal pattern matching degree between the sample and normal or abnormal behavior reaches more than 85%, such as a normal login interval deviation ≤ 5 min; when S consist When the value is less than 0.5, the sample time series deviation exceeds 10 minutes, and 90% of the deviations are due to data acquisition errors or noise, such as incorrect log timestamps or misoperations. Therefore, 0.5 is set as the time series consistency threshold to form a causal relationship of "time series deviation → low score → poor sample quality".

[0093] S consist Used to filter non-compliant time series samples, if S consist Values ​​<0.5 are considered to have unreasonable timing and are filtered out; only S is retained. consist Compliant time series samples with a value of ≥0.5 are used for subsequent training.

[0094] Step 4.2: Local Incremental Training: Each domain node uses the current FC-GNN model parameters θ current Using the initial values, incremental training is performed using the filtered new samples via mini-batch gradient descent. This only updates some key parameters of the FC-GNN model, namely the classification and attention layer parameters, avoiding full retraining, saving resources, and obtaining the locally updated parameters θ. local,update .

[0095] Model parameters θ current Including GCN weights W (l) Attention weight α ij Classification layer parameters W final and b final .

[0096] Mini-BatchSGD is employed, where new samples are grouped by batch size B, with B empirically set to 32 (adjustable). One batch is input for training at a time, progressively updating the parameters. The adjustment of the mini-batch size B must consider the data volume and hardware performance of the domain nodes: Regarding data volume, if the number of new samples on the domain node is <100, B is set to 16; if 100 ≤ samples < 500, B is set to 32; if the number of samples is ≥500, B is set to 64, avoiding large training fluctuations due to too small a B or insufficient memory due to too large a B. Regarding hardware performance, if the GPU memory on the domain node is <8GB, B is set to a maximum of 32; if GPU memory is ≥8GB, B can be increased to 64 to ensure no memory overflow issues during training. After adjustment, the model's convergence speed needs to be tested on a validation set. If the convergence speed is too slow, the value of B can be appropriately reduced and the learning rate increased.

[0097] Parameter update range: Only update classification layer W final b final and attention layer α ij The parameters are retained for the GCN layer, as the feature extraction capability of the GCN layer is already stable, thus avoiding overfitting.

[0098] Formula 10: L ce =-(1 / B)∑ b=1 B [y b ·log(P attack,b )+(1-y b )·log(1-P attack,b )] Where: L ce y is the average cross-entropy loss of the batch of samples, ranging from [0, +∞). The smaller the value, the closer the model's predicted value is to the true label; B is the batch size, the number of samples input for each training iteration; b Let y be the label of the b-th sample. b =1 indicates an abnormal sample, y b =0 indicates a normal sample; P attack,b is the attack probability output of the FC-GNN on the b-th sample; log is the natural logarithm.

[0099] Formula 11: θ new =θ old -η·▽ θ L ce Where: θ new The updated model parameters; θ old For the model parameters before the update, such as W final b final and α ij η is the learning rate, empirically set to 0.001; ▽ θ Lce For the loss function L ce The gradient with respect to parameter θ represents the direction of the effect of parameter changes on the loss.

[0100] With W final Let's take the update as an example: Calculate L ce For W final gradient▽ Wfina L ce According to formula W final,new =W final,old -η·▽ Wfina L ce renew.

[0101] Step 4.3: Federal Parameter Update: Each node will increment the FC-GNN model parameters θ after training. local,update The encrypted data is uploaded to the federated server, which then aggregates it into θ using the weighted average formula from step 2. global,update Distribute to each node, replacing the original θ current The dynamic optimization of the FC-GNN model was completed.

[0102] The updated global FC-GNN model θ global,update Each domain node uses this model as input for a new round of detection, forming a closed loop of detection → new sample → incremental update → re-detection. All new samples must undergo quality assessment and incremental training to ensure that the model continuously adapts to behavioral changes.

[0103] Example 2 Based on the same inventive concept as the security defense method based on behavioral sequence analysis provided in the embodiments of this application, the embodiments of this application also provide a security defense system based on behavioral sequence analysis. If there is anything unclear about the content in the system embodiments, please refer to the corresponding content in the method embodiments.

[0104] Security defense systems based on behavioral sequence analysis include: Multi-source heterogeneous data acquisition module: Deployed in enterprise terminal systems, network devices and business systems, it collects logs in real time or extracts data in batches through the enterprise SIEM system or API interface. The acquisition frequency is once every 5 minutes to ensure timeliness. The acquired data includes terminal data, network data and business data, and outputs multi-source heterogeneous raw data. Terminal data includes user login time, file access path, and permission operation type; network data includes source IP address, destination IP address, request frequency, and data transmission volume; business data includes user department, job permissions, and business operation time period. Preprocessing module: Receives raw multi-source data. When the data is approximately normally distributed, the 3σ criterion is used. When the data is not normally distributed, the IQR method is used. Outliers in numerical fields are removed. Short-term missing time series data are completed by interpolation. Long-term missing data (more than 30 minutes) are completed by linear interpolation combined with historical mean. If there is no historical data, it is marked as missing and the corresponding window is skipped. Min-Max standardization is performed on numerical features and mapped to the [0,1] interval. Categorical features are converted into numerical vectors by one-hot encoding. Normalized features are output. The time-series sequence construction module receives normalized features, uses a 5-minute adjustable time window, and concatenates single-user or single-device features in chronological order to form a time-series behavior sequence. If there is no behavior within the window, a zero vector is generated and marked as a silent window. At the same time, it filters and labels normal behavior sequences and real abnormal sequences, and outputs the time-series behavior sequence. Normal behavior sequences conform to business rules and are risk-free operations, while real abnormal sequences come from historical security events and handled attack cases. The federated framework initialization module establishes an architecture with multiple domain nodes and a federated server. The federated server is deployed in an enterprise private cloud or local data center and uses HTTPS communication. Each domain node deploys a conditional sequence GAN sub-model. The federated server is responsible for aggregating model parameters and does not store raw data, and outputs framework configuration information. The domain nodes include R&D domain, finance domain, and production domain. The sub-models include generators and discriminators. Conditional Sequence GAN Training Module: Receives temporal behavior sequences and framework configuration information, combines organizational structure knowledge graphs and business rules, and trains conditional sequence GANs locally on each domain node. The generator uses real anomaly sequence features and random noise as input to generate synthetic anomaly sequences. The discriminator distinguishes between real and synthetic sequences. The model is jointly optimized using temporal adversarial loss and knowledge constraint loss, outputting the locally trained encrypted conditional sequence GAN model parameters. The knowledge graph triples store department-user-permission relationships, and the model parameters include weights and biases. Federation parameter aggregation module: Receives encrypted model parameters, aggregates parameters using a sample size weighted average method, with higher weights for larger node sample sizes, outputs aggregated global conditional sequence GAN model parameters to each domain node, updates conditional sequence GAN sub-models, and outputs globally converged conditional sequence GAN model. Cross-domain knowledge graph construction module: Receives synthetic anomaly sequences and time-series behavior sequences from the global GAN ​​model, integrates business topology data, attack knowledge base, and organizational permission data, constructs a cross-domain knowledge graph containing triples with "domain-resource-user-device-attack stage" relationships, and outputs the cross-domain knowledge graph; Cross-domain subgraph construction module: Receives time-series behavior sequences and cross-domain knowledge graphs, maps local time-series behavior sequences to subgraphs, and outputs subgraphs; subgraph nodes are users, devices, and resources, and edges are time-series interaction relationships containing interaction time and type attributes; Subgraph feature extraction module: Receives a subgraph, updates the node feature vectors using a graph convolutional network, extracts local structural features that reflect the temporal features of the nodes themselves and the correlation features between nodes, and outputs the local structural features of the subgraph; Spatiotemporal causal attention fusion module: Receives local structural features of subgraph and cross-domain knowledge graph, constructs global graph on federated server, introduces causal inference algorithm to distinguish between correlation and causality between nodes, calculates causal attention weights to focus on attack-related node pairs, and outputs global graph and causal attention weight set; Attack detection and inference module: Receives the temporal behavior sequence to be detected, the spatiotemporal causal attention global graph, and the attention weight set. Calculates the attack probability using the FC-GNN model, maps it to the [0,1] interval using an activation function, and determines whether it is an attack or normal based on a preset threshold. Attacks are marked as new anomalous samples, and normal samples are marked as new normal samples. Outputs the attack chain and new samples, while simultaneously triggering proactive defense actions. The attack chain includes node interaction sequence, attack stage labels, and violation rules. New samples include new anomalous, new normal, and unlabeled sequences. Defense actions include isolating devices and blocking IPs. Sample quality assessment module: Receives new samples, synthesizes abnormal sequences, calculates the temporal consistency score of new samples, filters out non-compliant temporal samples with scores less than the temporal consistency threshold based on the deviation between the actual operation interval and the historical average interval, and outputs compliant temporal samples. Local incremental training module: Receives compliant time series samples, uses the existing FC-GNN model as the initial value, updates the parameters of the model's classification layer and attention layer using mini-batch gradient descent, retains the graph convolutional layer parameters to avoid overfitting, and outputs the locally updated model parameters; The Federation parameter update module receives locally updated model parameters, aggregates the parameters using a sample-weighted average method, and outputs the optimized global FC-GNN model parameters to each domain node, replacing the original model parameters to achieve dynamic model optimization and form a defense loop.

[0105] Furthermore, the multi-source heterogeneous data acquisition module supports sensitive field desensitization processing, using hash algorithms to desensitize sensitive information such as user ID numbers and financial data, and has a data integrity verification function. It verifies the consistency between the acquired data and the original logs through MD5 checksums, and re-acquires data if the verification fails. After the preprocessing module marks the missing data, it will attach the missing window position information to the output data to facilitate subsequent modules to identify data integrity. In the knowledge constraint loss calculation of the conditional sequence GAN training module, if the synthesized anomalous sequence violates the organizational knowledge graph permission rules, such as an engineer accessing non-project documents, the compliance probability of the sequence is reduced and the loss value is increased. The generator is then optimized in reverse to reduce the number of violating sequences. Before transmitting model parameters, both the federated parameter aggregation module and the federated parameter update module use the Paillier homomorphic encryption algorithm to process the parameters to avoid parameter leakage. In addition to temporal behavioral features, the subgraph node attributes of the cross-domain subgraph construction module also include node risk level labels, which are automatically generated based on historical attack records and job permissions, such as "high-risk device" and "ordinary user". It also supports subgraph compression and merges repeated interaction edges of the same user in the same time period. The subgraph feature extraction module adopts a 2-4 layer graph convolutional network architecture, and the weights of each layer are adaptively optimized through backpropagation. When outputting features, a feature importance score is attached, based on the node's contribution to attack detection. The causal inference algorithm of the spatiotemporal causal attention fusion module records the intervention experiment process, and the change in attack probability after fixing the behavioral characteristics of a certain node is used as the basis for subsequent weight calculation. The attention weight can be dynamically adjusted, and the weight of frequently associated attack node pairs is calculated first. The attack probability threshold of the attack detection inference module supports adaptive optimization and is adjusted to the range of 0.7-0.9 through historical false positive rate and false negative rate. The attack chain is visualized on the timeline. In the local incremental training module's mini-batch gradient descent, the batch size can be adjusted according to the amount of data at each node. The learning rate is initially set to 0.001 and decays by 10% every 10 rounds. The federated parameter update module has a model version management function, storing the model parameters and performance metrics after each optimization, including accuracy and recall. When the model performance degrades, it can be rolled back to the historical best version.

[0106] Example 3 Based on the same inventive concept as the security defense method based on behavioral sequence analysis provided in the embodiments of this application, the embodiments of this application also provide a computer device. If there is anything unclear about the content in the device embodiments, please refer to the corresponding content in the method embodiments.

[0107] A computer device includes: at least one processor 101; a memory 102 communicatively connected to the at least one processor; and a network interface 103; wherein the processor, memory, and network interface are communicatively connected to each other via a system bus 104, and the memory stores instructions executable by the processor to implement the above-described method.

[0108] Those skilled in the art will understand that the computer device 100 described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), digital processors, embedded devices, etc. The computer device 100 can be a desktop computer, a laptop, or a cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0109] The memory 102 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory, random access memory, static random access memory, read-only memory, electrically erasable programmable read-only memory, programmable read-only memory, magnetic memory, magnetic disk, optical disk, etc. The memory 102 can be an internal storage unit or an external storage device of the computer device 100. In this embodiment, the memory 102 is typically used to store the operating system and various application software installed on the computer device 100, such as computer-readable instructions for methods. Furthermore, the memory 102 can also be used to temporarily store various types of data that have been output or will be output.

[0110] The processor 101 may be a central processing unit, a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 101 is typically used to control the overall operation of the computer device 100. In this embodiment, the processor 101 is used to execute computer-readable instructions stored in the memory 102 or to process data, such as executing computer-readable instructions of the methods provided in this embodiment.

[0111] The network interface 103 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the computer device 100 and other electronic devices.

[0112] Furthermore, the following components are connected to the network interface 103: an input section 105 including a keyboard, mouse, etc.; an output section 106 including a cathode ray tube, liquid crystal display, etc., and speakers, etc.; a storage section 107 including a hard disk, etc.; and a communication section 108 including a network interface card such as a LAN card, modem, etc. The communication section 108 performs communication processing via a network such as the Internet. A drive 109 is also connected to the network interface 103 as needed. A removable medium 110, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 109 as needed so that computer programs read from it can be installed into the storage section 107 as needed.

[0113] It should be pointed out that, Figure 3Only a computer device 100 with components 101-110 is shown in the illustration, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0114] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute the methods of the various embodiments of this application.

[0115] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A security defense method based on behavioral sequence analysis, characterized in that, Includes the following steps: Collect heterogeneous data from multiple sources from terminal systems, network devices, and business systems, perform data cleaning, missing value completion, feature normalization, and time series window division, and generate a time series behavior sequence in a unified format; Under the federated learning framework, each node trains a conditional sequence GAN model based on local temporal behavior sequences, combined with organizational structure knowledge graphs and business rule constraints, to generate synthetic anomaly sequences. Each node encrypts and uploads the model parameters of the conditional sequence GAN to the federated server for aggregation, resulting in a globally converged conditional sequence GAN generation model. This constructs a synthetic anomaly sample library to supplement the anomaly samples required for attack detection. By integrating multi-source data to construct a cross-domain knowledge graph, each node maps the local temporal behavior sequence to a subgraph. Features are extracted through graph convolutional networks and uploaded to a federated server to construct a global graph. A spatiotemporal causal attention mechanism is introduced to focus on causal related nodes. Based on the global graph pooling features, the attack probability of the sequence to be detected is inferred using the FC-GNN model, and the attack chain and new samples are output. The federated server performs time-series consistency assessment and filtering on new samples uploaded from each domain to obtain compliant time-series samples. It then updates the FC-GNN model parameters through federated incremental learning, thereby achieving continuous optimization of the FC-GNN model and forming a closed-loop defense system of detection, updating, and optimization.

2. The security defense method based on behavioral sequence analysis according to claim 1, characterized in that, The multi-source heterogeneous data includes: user login time, file access path, and permission operation type extracted from terminal logs; source IP address, destination IP address, request frequency, and data transmission volume obtained from network device logs; and user department, job permissions, and business operation time period extracted from the business system. The data cleaning uses the 3σ criterion to remove outliers in numerical fields, the missing value completion uses interpolation to complete missing time series data, and the feature normalization performs Min-Max standardization on numerical features and one-hot encoding on categorical features. The time-series behavior sequences include normal behavior sequences and real abnormal sequences.

3. The security defense method based on behavioral sequence analysis according to claim 1, characterized in that, The federated learning framework includes multiple domain nodes and a federated server. Each node locally deploys a conditional sequence generative adversarial network. The generator takes random noise and real anomaly features as input to generate synthetic sequences, and the discriminator is used to distinguish between real and synthetic sequences.

4. The security defense method based on behavioral sequence analysis according to claim 3, characterized in that, The conditional sequence GAN model includes a generator and a discriminator. The generator takes real abnormal sequence features and random noise as input to generate synthetic abnormal sequences. The discriminator is used to distinguish between real sequences and synthetic sequences. The training process jointly optimizes the model through temporal adversarial loss and knowledge constraint loss. In the local temporal behavior sequence, the normal behavior sequence is used to assist the discriminator in distinguishing between real normal and synthetic abnormal sequences. The real abnormal sequence provides the generator with attack feature references to generate synthetic abnormal sequences. The federated server uses a sample-weighted average method to aggregate the conditional sequence GAN model parameters of each domain node. The model parameters include the weight matrix and bias vector of the generator and the weight matrix and bias vector of the discriminator. The model parameters are processed using a homomorphic encryption algorithm before transmission.

5. The security defense method based on behavioral sequence analysis according to claim 1, characterized in that, The domain knowledge graph stores the association relationships between domain, resource, user, device, and attack stage in the form of triples. The subgraph uses users, devices, and resources as nodes and temporal interaction relationships as edges. The edge attributes of the subgraph include interaction time and interaction type. The graph convolutional network extracts local structural features of the subgraph by updating node feature vectors. The local structural features of the subgraph include the temporal behavior features of the nodes themselves and the association features between nodes.

6. The security defense method based on behavioral sequence analysis according to claim 5, characterized in that, The spatiotemporal causal attention mechanism determines attention weights by calculating the causal correlation probability between nodes. The causal correlation probability is determined based on the results of intervention experiments on node behavior. A preset attack probability threshold is used to determine whether the temporal behavior sequence at the current time is an attack. If it is determined to be an attack, the sequence is marked as a new abnormal sample. The output attack chain must include the node interaction sequence, attack stage labels, and the basis for the violation rules. If it is determined to be normal, the sequence is marked as a new normal sample. The new samples include new anomalous samples, new normal samples, and newly generated unlabeled temporal behavior sequences in each domain.

7. The security defense method based on behavioral sequence analysis according to claim 4, characterized in that, The time-series consistency assessment calculates a score by measuring the deviation between the actual operation interval of a sample and the historical average interval, and only retains samples with a score ≥ the time-series consistency threshold. Incremental training only updates the parameters of the model's classification and attention layers, while retaining the parameters of the graph convolutional layers; The federated incremental learning update of model parameters includes: each node, based on its own selected local compliant time-series samples, uses the FC-GNN model trained on the node as the initial value, incrementally trains the FC-GNN model parameters using mini-batch gradient descent, then encrypts and uploads the updated parameters for aggregation to obtain the optimized global model. The federated server aggregates the parameters and distributes them to each node to update the FC-GNN model parameters, forming a closed loop.

8. A security defense system based on behavioral sequence analysis, used in the security defense method based on behavioral sequence analysis as described in any one of claims 1 to 7, characterized in that, include: Multi-source heterogeneous data acquisition module: Deployed in enterprise terminal systems, network devices and business systems, it collects terminal, network and business data in real time and outputs raw multi-source data; Preprocessing module: Cleans the raw multi-source data, completes missing values, normalizes features, and divides time-series windows, outputting normalized features; The time-series sequence construction module concatenates normalized features in chronological order to form a time-series behavior sequence and outputs the time-series behavior sequence. Federation framework initialization module: used to build a federated learning architecture that includes multiple domain nodes and a federated server; Conditional Sequence GAN Training Module: Deployed on each domain node, it trains the conditional sequence generative adversarial network based on local temporal behavior sequences and outputs encrypted model parameters; Federation parameter aggregation module: Deployed on the federation server, it aggregates encrypted model parameters uploaded by nodes and outputs a global model; Cross-domain knowledge graph construction module: used to build a knowledge graph containing the relationships between domain, resource, user, device, and attack phase; Cross-domain subgraph construction module: maps local temporal behavior sequences to graph structures and outputs subgraphs; Subgraph feature extraction module: Extracts subgraph features through graph convolutional networks and outputs local structural features of the subgraph; Spatiotemporal causal attention fusion module: Constructs a global graph, introduces a causal attention mechanism into the global graph, and outputs a set of causal attention weights; Attack detection inference module: Calculates attack probability based on FC-GNN model and outputs attack chain and new sample; Sample quality assessment module: assesses the temporal consistency of new samples and outputs compliant time-series samples; Local incremental training module: Performs incremental training on the model based on compliant time series samples and outputs locally updated model parameters; Federated parameter update module: Aggregates the model parameters after incremental training and updates the global model.

9. The security defense system based on behavioral sequence analysis according to claim 8, characterized in that, The multi-source heterogeneous data acquisition module supports sensitive field desensitization and has data integrity verification function; after the preprocessing module marks the missing data, the output data includes the missing window position information; Before transmitting model parameters, the federated parameter aggregation module and the federated parameter update module use Paillier homomorphic encryption to process the parameters. In the cross-domain subgraph construction module, subgraph nodes include temporal behavioral features and node risk level labels, and subgraph compression is supported; the subgraph feature extraction module adopts a graph convolutional network architecture and outputs feature importance scores. The spatiotemporal causal attention fusion module uses a causal inference algorithm to record the intervention experiment process and dynamically adjust the attention weights; the attack probability threshold of the attack detection inference module supports adaptive optimization. The local incremental training module performs mini-batch gradient descent, with the batch size adjusted according to the amount of data at each node. The Federation parameter update module has model version management capabilities.

10. A computer device, characterized in that, include: At least one processor; A memory that is communicatively connected to at least one of the processors; as well as Network interface; The processor, memory, and network interface are interconnected via a system bus. The memory stores instructions that can be executed by the processor to implement the security defense method based on behavioral sequence analysis as described in any one of claims 1 to 5.

Images