Security defense method, system and device based on behavior sequence analysis

Abstract

The application belongs to the technical field of network security, and provides a security defense method, system and equipment based on behavior sequence analysis, which comprises data preprocessing and feature engineering, abnormal sample expansion under privacy protection, complex attack correlation detection and model dynamic optimization; the method generates a conditional sequence of an adversarial network through local training of each node under a federal learning framework, generates a compliant time sequence abnormal sample under the premise of protecting data privacy, effectively solves the problem of insufficient model training caused by the scarcity of abnormal samples, improves the generalization ability of the detection model, models each domain behavior sequence as a graph structure, and introduces a causal attention mechanism, so that the application can identify complex attack chains across resources and time periods, such as the whole process of APT attacks, and significantly improves the detection ability of attack behaviors with strong concealment and long duration.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a security defense method, system and device based on behavior sequence analysis. BACKGROUND

[0002] Behavior sequence analysis refers to analyzing sequences formed by operation behaviors of various subjects in a network in time sequence to identify abnormal or attack behaviors that may exist in the sequences. In the field of network security, by analyzing the behavior sequences, the operation rules and abnormal points can be grasped from the time sequence dimension, thereby providing a basis for security defense.

[0003] Existing behavior sequence analysis security defense technologies mainly focus on detection of single-domain data, such as analyzing terminal data or network data, and using traditional feature matching or simple machine learning algorithms, for example, a rule-based intrusion detection system judges whether there is an attack by using a pre-set attack feature rule library; or some single-domain anomaly detection models use historical data in a single domain to train the model for detection.

[0004] However, these existing technologies have obvious defects. On the one hand, single-domain detection is difficult to deal with complex attacks across domains, such as APT attacks often involve interactive operations of multiple domains, and single-domain detection cannot completely identify attack chains; on the other hand, attack samples are often scarce, and traditional methods have low detection rates due to the lack of sufficient abnormal samples, and the model is difficult to adapt to changes in business scenarios, and is prone to failure due to behavior drift; in addition, there is a risk of data privacy leakage in the process of data sharing and model training, and direct transmission of cross-domain data will lead to exposure of enterprise sensitive information. SUMMARY

[0005] The purpose of the embodiments of the present application is to propose a security defense method, system and device based on behavior sequence analysis to solve the technical problem that single-domain detection is difficult to deal with complex attacks across domains.

[0006] In order to solve the above technical problems, the embodiments of the present application provide a security defense method based on behavior sequence analysis, which adopts the following technical solution:

[0007] The security defense method based on behavior sequence analysis comprises the following steps:

[0008] Collecting multi-source heterogeneous data from terminal systems, network devices and business systems, performing data cleaning, missing value completion, feature normalization and time sequence window division to generate time sequence behaviors in a unified format;

[0009] Under the federated learning framework, each domain node generates synthetic abnormal sequences based on local time series behavior sequences, combined with organizational architecture knowledge graph and business rule constraints, and uploads the model parameters to the federated server for aggregation to obtain a globally converged generative model, which constructs a synthetic abnormal sample library to supplement the abnormal samples required for attack detection.

[0010] The multi-source data is integrated to construct a cross-domain knowledge graph, each domain node maps the local time series behavior sequence to a subgraph, extracts features through a graph convolution network and uploads them to the federated server to construct a global graph, introduces a spatiotemporal causal attention mechanism to focus on causally related nodes, and infers the attack probability of the sequence to be detected based on the global graph pooling features, and outputs the attack chain and new samples.

[0011] The federated server performs temporal consistency evaluation and filtering on the new samples uploaded by each domain to obtain compliant time series samples, updates the model parameters through federated incremental learning to realize continuous optimization of the model, and forms a closed-loop defense system of detection, update and optimization.

[0012] Preferably, the multi-source heterogeneous data includes: user login time, file access path and permission operation type extracted from terminal logs; source IP address, destination IP address, request frequency and data transmission volume obtained from network device logs; user department, post permission and business operation period extracted from business systems; data cleaning uses the 3σ criterion to remove outliers in numerical fields, interpolation method is used to complete missing time series data, and Min-Max standardization is performed on numerical features and one-hot encoding is performed on categorical features; the time series behavior sequence includes normal behavior sequence and real abnormal sequence.

[0013] Preferably, the federated learning framework includes multiple domain nodes and a federated server, each node locally deploys a conditional sequence generative adversarial network, the generator generates synthetic sequences with random noise and real abnormal features as input, and the discriminator is used to distinguish between real and synthetic sequences.

[0014] Preferably, the conditional sequence GAN includes a generator and a discriminator, the generator generates synthetic abnormal sequences with real abnormal sequence features and random noise as input, and the discriminator is used to distinguish between real and synthetic sequences, the training process optimizes the model through the joint optimization of the temporal adversarial loss and the knowledge constraint loss, the normal behavior sequence in the local time series behavior sequence is used to assist the discriminator to distinguish between real normal and synthetic abnormal sequences, and the real abnormal sequence provides attack feature reference for the generator to generate synthetic abnormal sequences; the federated server aggregates the model parameters of each domain node using the sample size weighted average method; the model parameters are processed using the homomorphic encryption algorithm before transmission.

[0015] Preferably, the domain knowledge graph stores the association relationship of domain-resource-user-device-attack stage in the form of triple, the subgraph takes user, device and resource as nodes, and takes time sequence interaction relationship as edges, the edge attribute of the subgraph includes interaction time and interaction type, the graph convolution network extracts the local structure features of the subgraph by updating the node feature vector, and the local structure features of the subgraph include the time sequence behavior features of the nodes themselves and the association features between the nodes.

[0016] Preferably, the spatio-temporal causal attention mechanism determines the attention weight by calculating the causal correlation probability between nodes, the causal correlation probability is determined based on the intervention experiment result of the node behavior, the attack probability is mapped to the [0, 1] interval through an activation function, a preset probability threshold is used to determine whether the time sequence behavior sequence of the current time is an attack, if it is determined to be an attack, the sequence is labeled as a new abnormal sample, and the output attack chain needs to include the node interaction time sequence, the attack stage label and the violation rule basis; if it is determined to be normal, the sequence is labeled as a new normal sample; the new sample includes the new abnormal sample, the new normal sample, and the unlabeled time sequence behavior sequence newly generated in each domain.

[0017] Preferably, the time sequence consistency evaluation obtains a score by calculating the deviation of the actual operation interval of the sample and the historical average interval, and only the samples with a score greater than or equal to a time sequence consistency threshold are retained; the incremental training only updates the classification layer and the attention layer parameters of the model, and retains the graph convolution layer parameters; the federated incremental learning updates the model parameters, including: each domain node updates the local compliance time sequence sample based on the self-screening, takes the existing model as the initial value, performs incremental training on the key parameters by using small batch gradient descent, and then uploads and aggregates the updated parameters after encryption to obtain an optimized global model; the federated server aggregates the parameters and then distributes them to each domain node to replace the original model parameters, thereby forming a closed loop.

[0018] To solve the above technical problems, the embodiment of the application further provides a security defense system based on behavior sequence analysis, which comprises:

[0019] A multi-source heterogeneous data acquisition module is deployed in an enterprise terminal system, network equipment and a business system, and is used for collecting terminal, network and business data in real time and outputting original multi-source data.

[0020] A preprocessing module is used for receiving the original multi-source data, removing numerical outliers by using a 3 sigma criterion or an IQR method, interpolating to complete missing time sequence data, normalizing numerical features by using a Min-Max method, and one-hot encoding category features, and outputting normalized features.

[0021] A time sequence sequence construction module is used for receiving the normalized features, splicing single-user or single-device features in time sequence to form a time sequence behavior sequence, generating a zero vector and marking a silent window if there is no behavior in a window, labeling normal behavior sequences and real abnormal sequences, and outputting the time sequence behavior sequence.

[0022] Federal framework initialization module: build an architecture containing multiple domain nodes and a federal server, the federal server is deployed in an enterprise private cloud or a local data center, each node deploys a conditional sequence GAN sub-model, the federal server aggregates parameters without storing original data, and outputs framework configuration information;

[0023] Conditional sequence GAN training module: receive time series behavior sequence and framework configuration information, combine organizational architecture knowledge graph and business rules, train conditional sequence GAN locally in each node, generator inputs real abnormal sequence features and random noise, generates synthetic abnormal sequence, discriminator distinguishes real sequence and synthetic sequence, optimizes model through time series adversarial loss and knowledge constraint loss, and outputs encrypted conditional sequence GAN model parameters;

[0024] Federal parameter aggregation module: receives encrypted model parameters, aggregates parameters using sample size weighted average method, outputs aggregated global conditional sequence GAN model parameters to each node, and outputs global converged conditional sequence GAN model;

[0025] Cross-domain knowledge graph construction module: receives synthetic abnormal sequence and time series behavior sequence, integrates business topology data, attack knowledge base, and organizational permission data, constructs and outputs a three-tuple cross-domain knowledge graph containing "domain-resource-user-device-attack stage" association relationships;

[0026] Cross-domain subgraph construction module: receives time series behavior sequence and cross-domain knowledge graph, maps local time series behavior sequence to subgraph, and outputs subgraph;

[0027] Subgraph feature extraction module: receives subgraph, updates node feature vector using graph convolution network, extracts local structure features reflecting node's own time series features and node's interrelated features, and outputs subgraph local structure features;

[0028] Spacetime causal attention fusion module: receives subgraph local structure features and cross-domain knowledge graph, constructs a global graph in the federal server, introduces causal inference algorithm to distinguish node correlation and causality, calculates causal attention weight focusing attack related node pairs, and outputs global graph and causal attention weight set;

[0029] Attack detection reasoning module: receives time series behavior sequence to be detected, spacetime causal attention global graph and attention weight set, calculates attack probability through FC-GNN model, determines attack or normal according to preset threshold, outputs attack chain and new sample, and triggers active defense action, new sample includes new abnormal sample, new normal sample, and unlabeled time series behavior sequence;

[0030] The sample quality evaluation module receives a new sample, synthesizes an abnormal sequence, calculates a timing consistency score of the new sample, filters a non-compliant timing sample with a score less than a timing consistency threshold, and outputs a compliant timing sample;

[0031] The local incremental training module receives the compliant timing sample, takes an existing FC-GNN model as an initial value, updates a model classification layer and an attention layer parameter using a small batch gradient descent, and outputs a locally updated model parameter.

[0032] The federated parameter updating module receives the locally updated model parameter, aggregates the parameter using a sample quantity weighted average method, outputs an optimized global FC-GNN model parameter to each domain node, realizes model dynamic optimization, and forms a defense closed loop.

[0033] Preferably, the multi-source heterogeneous data acquisition module supports sensitive field desensitization processing and has a data integrity verification function; the preprocessing module labels missing data and outputs data with missing window position information;

[0034] In the conditional sequence GAN training module, when the synthesized abnormal sequence violates the organization architecture knowledge graph permission rule, the compliance probability is reduced, and the loss value is increased to optimize the generator; the federated parameter aggregation module and the federated parameter updating module use Paillier homomorphic encryption to process the parameter before transmitting the model parameter.

[0035] The subgraph node of the cross-domain subgraph construction module includes a timing behavior feature and a node risk level label, and supports subgraph compression; the subgraph feature extraction module uses a graph convolution network architecture and outputs features with feature importance scores.

[0036] The causal inference algorithm of the spatio-temporal causal attention fusion module records the intervention experiment process and dynamically adjusts the attention weight; the attack probability threshold of the attack detection reasoning module supports adaptive optimization.

[0037] In the small batch gradient descent of the local incremental training module, the batch size is adjusted according to the node data quantity; the federated parameter updating module has a model version management function.

[0038] In order to solve the above technical problems, the embodiment of the application also provides a computer device, which comprises at least one processor, a memory in communication connection with the at least one processor, and a network interface; wherein the processor, the memory and the network interface are mutually communicated and connected through a system bus, the memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to realize the above-mentioned method.

[0039] The beneficial effects of the application are as follows:

[0040] The application provides a security defense method based on behavior sequence analysis, generates an adversarial network of a conditional sequence through local training of each node under a federated learning framework, generates a compliance time sequence anomaly sample under the premise of protecting data privacy, effectively solves the problem of insufficient model training caused by few anomaly samples, and improves the generalization ability of a detection model.

[0041] The method models each domain behavior sequence as a graph structure, introduces a causal attention mechanism, can identify complex attack chains across resources and time periods, such as the whole process of an APT attack, and significantly improves the detection ability of attack behaviors with strong concealment and long duration.

[0042] The method adopts a federated incremental learning mechanism, dynamically updates model parameters based on new samples, avoids full retraining, saves computing resources, and enables the model to quickly adapt to behavior drift and new business scenarios, forming a closed-loop optimized adaptive defense system. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the scheme in the application, the drawings needed in the description of the embodiments of the application will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0044] Figure 1 is a flow chart of the security defense method provided by the embodiments of the application;

[0045] Figure 2 is an exemplary system architecture diagram to which the application can be applied;

[0046] Figure 3 is a principle block diagram of one embodiment of a computer device according to the application. DETAILED DESCRIPTION

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the application belongs; the terms used in the specification of the application are only for the purpose of describing specific embodiments and are not intended to limit the application; the specification and claims of the application and the above description of the drawings include and have as well as any variations thereof, are intended to cover non-exclusive inclusion. The terms first, second, etc. in the specification and claims of the application or the above description of the drawings are used to distinguish different objects, not to describe a specific order.

[0048] Reference herein to an embodiment means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. As will be apparent to those of ordinary skill in the art, embodiments described herein can be combinable with other embodiments.

[0049] In order to better understand the technical scheme of the present application, the technical scheme in the embodiments of the present application will be clearly and completely described below with reference to the drawings.

[0050] Embodiment one

[0051] The security defense method based on behavior sequence analysis includes steps 1-4, wherein:

[0052] Step 1: data preprocessing and feature engineering: collecting multi-source heterogeneous data from terminal systems, network devices and business systems, performing data cleaning, missing value completion, feature normalization and time window division, generating standardized time sequence behavior sequences in a unified format, including normal behavior sequences and real abnormal sequences.

[0053] Further, the multi-source heterogeneous data includes: user login time, file access path and permission operation type extracted from terminal logs; source IP address, destination IP address, request frequency and data transmission volume obtained from network device logs; user department, post permission and business operation period extracted from business systems;

[0054] Data cleaning uses 3σ criterion to remove abnormal values in numerical fields, missing value completion uses interpolation method to complete missing time sequence data, and feature normalization performs Min-Max standardization on numerical features and one-hot encoding on category features.

[0055] Collect the original behavior sequence data of each domain node, clean, normalize and extract features from multi-source heterogeneous raw data, and generate time sequence behavior sequences in a unified format.

[0056] Step 1.1: Collect multi-source heterogeneous raw data: collect logs in real time through enterprise SIEM system, or extract data from database in batches using API interface. The data collection frequency is every 5 minutes to ensure time sequence.

[0057] Extract terminal data from terminal operating system logs, file management system logs and permission management modules, get user login time T login , file access path P file , permission operation type O perm .

[0058] Collect network data from network device logs, traffic monitoring tools, and obtain source IP address IP src , destination IP address IP dst , request frequency F req , data transmission volume V data .

[0059] Extract business data from enterprise business systems, obtain user department D dept , post permission R role , business operation period T biz .

[0060] Step 1.2: Data cleaning: remove outliers, complete missing time series data, ensure data integrity and accuracy, and obtain cleaned multi-source data.

[0061] Outlier removal: use 3σ criterion to remove records in numerical fields that exceed "mean ± 3 times standard deviation". For example, if the mean of a user's file access time is 2s and the standard deviation is 1s, then "single time consumption > 2+3×1=5s" is judged as an outlier and deleted.

[0062] It should be noted that the 3σ criterion requires the data to be approximately normally distributed. If the data is not normal, use the IQR (interquartile range) method. There are two ways to determine whether the data is approximately normally distributed. One is the visualization method, which draws a Q-Q plot (quantile-quantile plot). If the data points approximately fall on the straight line, the data is approximately normally distributed. The second is the statistical test method, which uses the Shapiro-Wilk test. This is a prior art knowledge and will not be described here.

[0063] Missing value completion: use interpolation method to complete the missing short time series data. For long-term missing data greater than 30 minutes, use linear interpolation combined with historical mean to fill. If there is no historical data in the missing period, mark it as missing and skip the window.

[0064] Example: If the login record from 9:00 to 9:05 is missing, it is filled by interpolating the login frequency of the adjacent time periods (8:55-9:00, 9:05-9:10).

[0065] Step 1.3: Feature normalization: divide the cleaned multi-source data into numerical features and categorical features, and perform standardization conversion respectively. For numerical features such as request frequency F req , data transmission volume V data , use Min-Max normalization to map feature values to the [0, 1] interval to eliminate the influence of dimension; for categorical features such as operation type O perm , department D dept , use one-hot encoding to convert to numerical vector to obtain normalized features.

[0066] Step 1.4: Time Series Construction: Using a time window Δt as the unit, the normalized features of a single user or single device are concatenated in chronological order to form a time series behavior sequence S, reflecting the temporal correlation of behaviors. The time window is set to 5 minutes and can be adjusted according to the business scenario. S=[x1,x2,...,x] n ], where x i Let be the feature vector of dimension d for the i-th time window, where d = the total number of normalized features. Each sequence corresponds to the continuous behavior of a single user or device. If there is no behavior within the time window Δt, a zero vector is generated as x. i And mark it as a silent window in the sequence.

[0067] Time series construction is achieved through sliding time windows:

[0068] Let the time window Δt = 5 min, the sliding step size = Δt, and the window be non-overlapping. Concatenate the feature vectors of the time intervals [t0, t0 + Δt], [t0 + Δt, t0 + 2Δt], ..., [t0 + (n-1)Δt, t0 + nΔt] in sequence to form S. Example: User A's behavioral sequence S from 9:00 to 10:00. A =[x1(9:00-9:05),x2(9:05-9:10),...,x 12 (9:55-10:00)).

[0069] Sequences of normal behavior S are selected from S that conform to the company's business rules and are risk-free operation records, such as daily user logins, access to files within the department's authorized scope, and business operations during work hours. After being marked as normal by manual or automated rules, normal behavior sequences S are obtained. normal The automation rules include: 1. User login time matching Tbiz, such as 9:00-18:00; 2. File access path (Pfile) conforming to departmental permissions, such as R&D domain users only accessing the project directory; 3. Operation type (Operation) not high-risk, such as deletion or modification. Meeting all rules indicates normal operation.

[0070] From historical security incident logs and handled attack cases, identify risky operations (S), such as internal privilege abuse, abnormal logins or data transmissions in the early stages of an APT attack. After being marked as abnormal by the security administrator, the actual abnormal sequence S is obtained. abnormal .

[0071] Step 2: Anomaly sample expansion under privacy protection: In the federated learning framework, each domain node generates synthetic abnormal sequences based on local time series behavior sequences, combined with organizational architecture knowledge graph and business rule constraints to train conditional sequence GAN. Each node uploads the encrypted conditional sequence GAN model parameters to the federated server for aggregation, including the weights and biases of the conditional sequence GAN generator and discriminator. A globally converged conditional sequence GAN generation model is obtained, and a synthetic abnormal sample library is constructed to supplement the required abnormal samples for attack detection.

[0072] Further, the federated learning framework includes multiple domain nodes and a federated server. Each node locally deploys a conditional sequence generative adversarial network. The generator generates synthetic sequences with random noise and real abnormal features as input. The discriminator is used to distinguish between real and synthetic sequences.

[0073] Further, the conditional sequence GAN includes a generator and a discriminator. The generator generates synthetic abnormal sequences with real abnormal sequence features and random noise as input. The discriminator is used to distinguish between real and synthetic sequences. The training process optimizes the model through a combination of time series adversarial loss and knowledge constraint loss. Local time series behavior sequences include normal behavior sequences and real abnormal sequences. Normal behavior sequences are used to assist the discriminator in distinguishing between real normal and synthetic abnormal sequences. Real abnormal sequences provide attack feature references for the generator to generate synthetic abnormal sequences.

[0074] Further, the federated server aggregates model parameters from each domain node using sample size weighted averaging. Nodes with larger sample sizes have higher contribution weights to global model parameters. Homomorphic encryption algorithm is used to process model parameters before transmission to avoid original data leakage.

[0075] Under the federated learning framework, each domain node locally trains a conditional sequence GAN to generate abnormal samples that conform to the time series logic and attack features, expanding the training data set and addressing the problem of insufficient abnormal samples while avoiding the storage of sensitive data in the central server.

[0076] Step 2.1: Federated framework initialization: Build a federated learning architecture, define the roles and responsibilities of each node, deploy local models, and ensure that raw data is not transmitted across nodes.

[0077] The federated learning architecture includes K domain nodes and 1 federated server. The federated server is deployed in the enterprise private cloud or local data center, uses HTTPS communication, and ensures secure transmission between nodes. Domain nodes include the enterprise's R&D domain, finance domain, and production domain. Each node locally deploys a conditional sequence GAN (Generative Adversarial Network) submodel, which includes a generator G and a discriminator D. The generator G is used to generate synthetic abnormal sequences, and the discriminator D is used to distinguish between real and synthetic sequences. The federated server is responsible for aggregating model parameters and does not store raw data.

[0078] After the initialization of the federated framework, each domain node deploys the conditional sequence GAN sub-model, and the federated server completes the communication configuration and can receive the model parameters uploaded by the nodes.

[0079] Step 2.2: Conditional sequence GAN local training: Each domain node trains the generator G and discriminator D of the conditional sequence GAN based on local data and domain knowledge constraints to ensure that the generated synthetic sequence is realistic and consistent with business logic. Local data includes normal behavior sequence S normal , real abnormal sequence S abnormal .

[0080] Domain knowledge constraints include organizational architecture knowledge graph KG org , business rules R biz , and KG org is constructed based on enterprise HR systems and permission management systems and stored in the form of triples. R biz is defined by security administrators in combination with enterprise business scenarios or generated from historical normal behavior data.

[0081] Generator G training: Take the real abnormal sequence feature vector c and random noise z as input to generate a synthetic abnormal sequence S gen =G(z|c), c is the feature summary of S abnormal , such as abnormal operation type and attack period, and c is generated by statistical mean of the features of Sabnor mal. Through knowledge graph constraints, S gen is ensured to comply with business logic, such as embedding the department-document permission relationship in KG org when generating an engineer accessing non-project document sequence.

[0082] Discriminator D training: Input real sequence and synthetic abnormal sequence S gen , output the probability P real ∈[0,1] that the sequence is real, the goal is to distinguish real sequence from synthetic sequence, and real sequence is the set of S normal +S abnormal .

[0083] Loss function optimization: Adopt joint optimization of time series adversarial loss L T and knowledge constraint loss L KG to ensure that S gen is realistic and consistent with business logic.

[0084] Time series adversarial loss L T is divided into discriminator loss L D,T and generator loss L G,T . The total time series adversarial loss is the sum of the losses of the generator and the discriminator in the time series dimension, i.e. L T =L D,T+L G,T .

[0085] Formula 1: L D,T =-E S,pdata [logD(S)]-E Sgen,pgen [log(1-D(S gen ))]

[0086] wherein: L D,T is the discriminator loss; E is the mathematical expectation, averaged over all input sequences; S is the real sequence; p data is the probability distribution of the real sequence; D(S) is the output probability of the discriminator on S; S gen is the synthetic abnormal sequence; p gen is the probability distribution of S gen ; D(S gen ) is the output probability of the discriminator on S gen ; and log is the natural logarithm.

[0087] Formula 2: L G,T =-E Sgen,pgen [logD(S gen )]

[0088] wherein: L G,T is the generator loss.

[0089] Formula 3: L KG =1-P comply

[0090] wherein: L KG is the knowledge graph constraint loss; P comply is the permission compliance probability of S gen , calculated based on the triple rules in the knowledge graph KG org , if the user U in S gen accesses the document D in compliance with the rule <U, accessible, D>, then P comply =1; if it is completely illegal, then P comply =0, if it is partially illegal, then P comply =the number of behavior steps in compliance with permissions / the total number of behavior steps, taking values [0-1], example: Sgen contains 5 behavior steps, 3 of which are compliant, then P comply =3 / 5=0.6. L KG measures the degree of fit of the synthetic sequence to the domain knowledge constraints, the smaller L KG is, the more the synthetic sequence complies with the business logic.

[0091] Formula 4: L total =L T +λ·L KG

[0092] wherein: Ltotal The total loss of the GAN needs to minimize the generator loss and maximize the discriminator loss; L T The temporal adversarial loss measures the temporal similarity between the synthesized sequence and the real sequence, ensuring that the time logic of the synthesized sequence is consistent with the real one; λ is a weight coefficient determined by cross-validation, with an empirical value of 0.3-0.5, used to balance L T and L KG .

[0093] It should be noted that when the generator G generates S gen , it first queries the permission triples of the current user in KG org , such as <engineer E, can access, project document P>. If the generated behavior sequence contains "E accesses non-project document Q", the knowledge constraint verification is triggered: calculate P comply , at this time P comply =0, because Q is not within the accessible range of E; L KG =1-0=1, increase the total loss by formula 4, optimize the generator G through backpropagation, reduce the generation of illegal sequences, and form a causal chain of "knowledge constraint → loss adjustment → generator optimization".

[0094] Step 2.3: Federated parameter aggregation: each node trains for E rounds, such as 10 rounds, then uploads the parameters of the generator G and the discriminator D through Paillier homomorphic encryption to the federated server, including weights W and biases b; the server aggregates the conditional sequence GAN model parameters using weighted average, and issues them to each node as the initial parameters for the next round of training, and repeats until the conditional sequence GAN model converges.

[0095] Taking the generator weight W G as an example, formula 5:

[0096] Where: W G global is the global generator weight aggregated by the federated server; K is the number of domain nodes, such as research and development, finance, and production, K=3; n k is the local training sample size of the kth node, such as n1=1000 for the research and development domain and n2=800 for the finance domain; W G local,k is the generator weight of the kth node after local training, which is uploaded after Paillier encryption.

[0097] The aggregated W G global is issued to each node as the initial weight for the next round of training, ensuring that each node model converges to the global optimum while avoiding the upload of raw data to protect privacy.

[0098] After the above processing, a globally convergent federated conditional sequence GAN model is obtained, which includes a generator G global and a discriminator D global , G global can generate a synthetic anomaly sample library S gen,lib that conforms to the timing logic and business rules, such as 100,000 different types of misuse of authority and APT initial operation sequences.

[0099] Step 3: Complex attack association detection: integrate multi-source data to build a cross-domain knowledge graph, map local timing behavior sequences to subgraphs for each domain node, extract features through a graph convolution network and upload them to the federated server, build a global graph and introduce a spatiotemporal causal attention mechanism to focus on causally related nodes, based on the global graph pooling features, use the FC-GNN model to infer the attack probability of the detected sequence, output the attack chain and new samples, and achieve complex attack recognition.

[0100] Further, the domain knowledge graph stores the association relationship between domain-resource-user-device-attack stage in the form of triple, the subgraph takes user, device and resource as node, and takes timing interaction relationship as edge, the edge attribute of the subgraph includes interaction time and interaction type, the graph convolution network extracts the local structure features of the subgraph by updating the node feature vector, which includes the timing behavior features of the node itself and the association features between nodes.

[0101] Further, the spatiotemporal causal attention mechanism determines the attention weight by calculating the causal correlation probability between nodes, focusing on the node interaction relationship that has a direct impact on the attack result, the causal correlation probability is determined based on the intervention experiment results of node behavior, and the attack probability is mapped to the [0, 1] interval through an activation function, a preset probability threshold is used to determine whether the timing behavior sequence at the current time is an attack, if it is determined to be an attack, the sequence is labeled as a new abnormal sample, and the output attack chain needs to include node interaction timing, attack stage label and violation rule basis; if it is determined to be normal, the sequence is labeled as a new normal sample; the new sample includes new abnormal sample, new normal sample, and newly generated unlabeled timing behavior sequence in each domain.

[0102] Under the federated framework, the behavior sequences of each domain are modeled as subgraphs, and the cross-domain features and spatiotemporal causal relationships are fused through FC-GNN (federated graph neural network) to identify complex attack chains across resources and time periods, such as the reconnaissance-penetration-data theft whole process of APT attack.

[0103] The security administrator or the knowledge graph construction algorithm integrates the multi-source data of the enterprise, including business topology data, attack knowledge base, and organization permission data, to build a triple form containing domain-resource-user-device-attack stage association, forming a cross-domain knowledge graph KG crossKGcross adopts a rule-based and machine learning combined construction algorithm, and the specific steps include: 1. Data preprocessing, entity recognition and relationship extraction are performed on business topology data, attack knowledge base and organization permission data; 2. Rule construction, basic rules such as user-department and device-domain ownership relationship rules are defined by security administrators; 3. Knowledge fusion, entity redundancy in multi-source data is eliminated through entity linking; 4. Knowledge completion, the missing relationship is predicted by using the TransE model, such as according to the user A belongs to the research and development domain, the research and development domain equipment can access the project document, the relationship that the user A can access the project document is supplemented, and finally the KG in the form of triple is formed cross .

[0104] Step 3.1: Cross-domain subgraph construction: each domain node maps the local behavior sequence into a subgraph G k = (V k ,E k ), which represents the time sequence interaction relationship of "user-device-resource" in the form of graph structure, and lays the foundation for subsequent feature extraction. Wherein:

[0105] V k is a node, including a user node u, a device node d and a resource node r, and the attribute of each node is the feature vector x i generated in step 1;

[0106] E k is an edge, representing the time sequence interaction between nodes, such as user u accessing device d at time t, and the edge attribute is the interaction time t and the interaction type type.

[0107] Step 3.2: subgraph structure feature extraction: each node uses GCN (graph convolutional network) to extract the local structure feature h k of the subgraph G v , which reflects the interaction relationship between the node and the neighbor, and avoids transmitting the original subgraph data.

[0108] GCN node feature update, formula 6:

[0109] Wherein: h v (l) is the feature vector of node v in the lth layer network, when the initial layer l=0, h v (0) is the node attribute vector x i generated in step 1; h v (l+1) is the updated feature vector of node v in the l+1th layer network; h u (l)Let be the feature vector of node u in the l-th layer network; u is a neighboring node of node v; N(v) is the set of neighboring nodes of node v, such as device nodes that interact with user v; W (l) b is the trainable weight matrix of layer l, optimized through backpropagation; (l) Let l be the bias vector of the l-th layer; normalized adjacency matrix The elements corresponding to nodes v and u are selected to avoid the influence of node degree. =D -1 / 2 AD -1 / 2 A is a subgraph G k The adjacency matrix is ​​given by A[v,u] = 1 if nodes v and u interact, otherwise A[v,u] = 0; D is the degree matrix, D[v,v] = ∑ u A[v,u]; σ is the ReLU activation function.

[0110] After the above processing, the local structural feature set {h} of each domain node is obtained. v Each node corresponds to a structural feature vector.

[0111] Step 3.3: Fusion of Spatiotemporal Causal Attention Mechanisms: The federated server constructs a global graph, introduces a causal inference algorithm to distinguish between correlation and causality, and focuses on causally related node pairs through an attention mechanism, providing a basis for attack chain reconstruction.

[0112] Global Graph Construction: The federated server will incorporate cross-domain structural features h v gather ， Constructing the global graph G global =(∪V k ,∪E k ), where: ∪V k It is the set of nodes of all domains, ∪E k Based on KG cross Supplementary cross-domain edges. A causal inference algorithm (Do-Calculus) is introduced to distinguish between correlation and causality. For example, user u downloading code → external IP transmitting data is a causal relationship, while unrelated logins at the same time are correlational. Attention weight α is used to further differentiate between these relationships. ij Focusing on causal pairs of nodes, the attack chain is reconstructed.

[0113] Spatiotemporal causal attention weight calculation: Combining Do-Calculus and attention mechanisms in causal inference, causal attention weights are introduced to quantify the strength of causal associations between nodes.

[0114] Formula 7:

[0115] α ij =exp(Do(P(y|do(x i ),x j))) / ∑ m∈N(i) exp(Do(P(y|do(x i ),x m )))

[0116] Where: α ij x represents the causal attention weight between node i and node j, with values ​​ranging from [0,1]. Larger values ​​indicate a stronger causal relationship. i x is the temporal behavior feature vector of node i; j Let be the temporal behavior feature vector of node j; y is the attack result variable, y=1 for attack, y=0 for normal; m is the index of the node's neighbor nodes; Do(P(y|do(x)) i ),x j Intervention x for the Do operator computation i After that, x j The causal probability of y; N(i) is the global neighbor set of node i; exp is an exponential function to ensure that the weights are non-negative.

[0117] The attack result variable y is defined as follows: y=1 (attack) must satisfy "existence of a cross-domain knowledge graph KG". cross The attack phase characteristics defined in the document include "abnormal IP scanning during the reconnaissance phase, privilege escalation during the penetration phase, and large-scale data transfer during the data theft phase"; y=0 must satisfy "all behaviors conform to the organizational structure knowledge graph KG". org Rbiz defines permission rules and business rules. Permission rules include rules such as "User U, can access, document D", and business rules include rules such as "operation during working hours".

[0118] Do operator computation steps: From the global graph G global Filter the subset of behavior sequences containing nodes i and j; perform the intervention operation do(x) on this subset. i That is, fix x i Behavioral characteristics, such as "user u downloads code"; the proportion of samples with y=1 in the subset after statistical intervention, which is Do(P(y|do(x)). i ),x j )).

[0119] α ij This is used to focus on causally related node pairs in a cross-domain graph, such as key nodes in an attack chain. After the above processing, a global graph G is obtained. global The set of causal attention weights {α ij}

[0120] Step 3.4: Attack Detection Inference: Input the sequence of behaviors to be detected, S test S test That is, the probability P of a current time sequence of actions S being an attack behavior is calculated using the FC-GNN model.attack , according to the threshold value τ decision result, and output attack chain.

[0121] Formula 8: P attack =Sigmoid(W final ·h global +b final )

[0122] Where: P attack is the probability of the sequence to be detected as an attack behavior, the value range [0,1], the closer to 1, the higher the possibility of attack; h global is the global graph G global pooling features, by averaging all nodes of the global graph structure features are obtained; W final is the weight of the final classification layer; b final is the bias of the final classification layer, which is obtained by back propagation optimization; Sigmoid is the activation function.

[0123] Determine the threshold value τ=0.8 by cross validation. If P attack >τ, it is determined as an attack, and the subsequent processing: 1. Active defense: automatically execute defense measures, such as: isolation of infected equipment, revoke user rights, block malicious IP; 2. Alarm and record: trigger alarm to inform the security administrator, record the attack chain, such as node interaction sequence, attack stage, to the security event library; 3. Sample marking: mark the sequence as a new abnormal sample S new,abn , input step 4 for model incremental update.

[0124] If P attack ≤τ, it is determined as normal, and the subsequent processing: 1. Monitoring and recording: mark the sequence as a new normal sample S new,norm , if the sequence belongs to a new business scenario, such as remote office new operation, input step 4 for model adaptation update; 2. Defense maintenance: no additional action, maintain the current security policy.

[0125] New samples include S new,abn , S new,norm and each domain new unlabeled time series behavior sequence, S new,abn and S new,norm periodically feedback to step 2, used to update the federated GAN and knowledge graph, ensure the model self-adaptation to new threats.

[0126] Step 4: model dynamic optimization: the federated server does time series consistency evaluation and filtering on the new samples uploaded by each domain, obtains compliant time series samples, updates the parameters of FC-GNN model through federated incremental learning, realizes the continuous optimization of FC-GNN model, forms a closed-loop self-adaptive defense system of detection, update and optimization.

[0127] Further, the timing consistency evaluation obtains a score by calculating the deviation of the actual operation interval of the sample from the historical average interval, and only samples with a score greater than or equal to the timing consistency threshold are retained; the incremental training only updates the classification layer and attention layer parameters of the model, and retains the graph convolution layer parameters to avoid overfitting.

[0128] Further, the federated incremental learning updates the model parameters, including: each domain node performs incremental training on the key parameters based on the local compliant timing samples screened by itself, using the existing model as the initial value, and then encrypts and uploads the updated parameters for aggregation to obtain an optimized global model; the federated server aggregates the parameters and then distributes them to each domain node to replace the original model parameters, forming a closed loop.

[0129] Step 4.1: Sample quality evaluation: the federated server performs timing reasonableness verification on the new samples S new uploaded by each domain, calculates the timing consistency score of the samples, filters non-compliant timing samples, and ensures the quality of the incremental training data. The new samples S new include S new,abn and S new,norm .

[0130] Formula 9:

[0131] wherein: S consist is the timing consistency score of the new sample, with a value range of (0, 1], and the closer to 1, the more reasonable the timing; n is the number of time steps of the new sample sequence S new ; t i is the operation time of the i-th time step; is the average interval of the operation of this type, such as the average interval of normal login = 10 min, which is obtained from historical normal samples; is the deviation of the actual interval from the average interval; exp is the exponential function, which ensures that the score is in the interval (0, 1], and the smaller the deviation, the closer the score to 1.

[0132] Through historical sample statistics verification, when S consist ≥ 0.5, the matching degree of the sample to the timing rules of normal behavior or abnormal behavior reaches more than 85%, such as normal login interval deviation ≤ 5 min; when S consist <0.5, the sample timing deviation is more than 10 min, and 90% of them are data collection errors or noises, such as log timestamp disorder or misoperation, so 0.5 is set as the timing consistency threshold, forming a causal relationship of "timing deviation → low score → poor sample quality".

[0133] S consist is used to filter non-compliant timing samples, and if S consist <0.5, it is determined that the timing is unreasonable and is filtered; only samples with Sconsist The compliance timing samples of ≥0.5 are used for subsequent training.

[0134] Step 4.2: Local incremental training:

[0135] Each domain node takes the current FC-GNN model parameter θ current as the initial value, and performs incremental training on the filtered new samples through small batch gradient descent, only updating part of the key parameters of the FC-GNN model, i.e., the classification layer and attention layer parameters of the FC-GNN model, to avoid full retraining and save resources, and obtains the locally updated parameters θ local,update .

[0136] The model parameters θ current include the GCN weights W (l) , the attention weights α ij , the classification layer parameters W final and b final .

[0137] Mini-batch gradient descent (Mini-Batch SGD) is adopted, and the new samples are grouped according to the batch size B, B is empirically taken as 32, which can be adjusted, and 1 batch is input each time for training, and the parameters are updated gradually. The adjustment of the small batch size B needs to be combined with the data volume and hardware performance of the domain node: in terms of data volume, if the number of new samples on the domain node is <100, B is taken as 16; 100≤sample number <500, B is taken as 32; and sample number ≥500, B is taken as 64, to avoid large training fluctuations due to too small B or insufficient memory due to too large B; in terms of hardware performance, if the GPU memory of the domain node is <8GB, B is taken as a maximum of 32; and if the GPU memory is ≥8GB, B can be increased to 64, to ensure that there is no memory overflow problem in the training process. After adjustment, the model convergence speed needs to be tested through the validation set, and if the convergence speed is too slow, B value can be appropriately reduced and the learning rate can be increased.

[0138] Parameter update range: only the classification layer W final , b final and the attention layer α ij parameters are updated, and the GCN layer parameters are retained, because the feature extraction capability of the GCN layer has been stable, to avoid overfitting.

[0139] Formula 10: L ce =-(1 / B)∑ b=1 B [y b ·log(P attack,b )+(1-y b )·log(1-P attack,b )]

[0140] Where: L ceThe average cross-entropy loss of the batch sample is in the range [0, +∞), and the smaller the value is, the closer the model prediction value is to the true label; B is the batch size, the number of samples input each time for training; y b is the label of the b-th sample, y b = 1 indicates an abnormal sample, y b = 0 indicates a normal sample; P attack,b is the attack probability output of the FC-GNN for the b-th sample; log is the natural logarithm.

[0141] Formula 11: θ new = θ old - η·▽ θ L ce

[0142] Where: θ new is the updated model parameter; θ old is the model parameter before updating, such as W final , b final and α ij ; η is the learning rate, which is empirically set to 0.001;▽ θ L ce is the gradient of the loss function L ce with respect to the parameter θ, indicating the direction of the parameter change affecting the loss.

[0143] Take W final update as an example: calculate the gradient▽ ce L final of L Wfina with respect to W ce ; update according to the formula W final,new = W final,old - η·▽ Wfina L ce .

[0144] Step 4.3: Federal parameter update:

[0145] Each node uploads the encrypted FC-GNN model parameter θ local,update after incremental training to the federal server, and the server aggregates it into θ global,update using the weighted average formula in step 2, and then distributes it to each node to replace the original θ current , completing the dynamic optimization of the FC-GNN model.

[0146] The updated global FC-GNN model θ global,update : Each domain node uses this model as input for the next round of detection, forming a closed loop of detection -> new sample -> incremental update -> detection again. All new samples need to go through quality assessment and incremental training to ensure that the model continues to adapt to behavior changes.

[0147] Embodiment two

[0148] Based on the same inventive concept as the security defense method based on behavior sequence analysis provided in the embodiments of the present application, the embodiments of the present application also provide a security defense system based on behavior sequence analysis. For the content in the system embodiments, if there is any ambiguity, reference can be made to the corresponding content in the method embodiments.

[0149] The security defense system based on behavior sequence analysis comprises:

[0150] The multi-source heterogeneous data collection module is deployed in an enterprise terminal system, network equipment and a business system, collects logs or API interface batch data in real time through an enterprise SIEM system, and collects data at a frequency of once every 5 minutes to ensure the time sequence, and collects terminal data, network data and business data, and outputs multi-source heterogeneous raw data.

[0151] The terminal data includes user login time, file access path and permission operation type, the network data includes source IP address, destination IP address, request frequency and data transmission volume, and the business data includes user department, post permission and business operation period.

[0152] The preprocessing module receives the raw multi-source data, adopts the 3σ criterion when the data is approximately normally distributed, adopts the IQR method when the data is not normal, eliminates the abnormal values of the numerical fields, fills in the short-time missing time sequence data by the interpolation method, fills in the long-time missing data of more than 30 minutes by linear interpolation combined with the historical mean, marks the missing data and skips the corresponding window when there is no historical data, performs Min-Max standardization mapping to the [0, 1] interval for the numerical features, converts the category features into numerical vectors by one-hot encoding, and outputs the normalized features.

[0153] The time sequence construction module receives the normalized features, takes 5 minutes as an adjustable time window, splices single-user or single-device features in time sequence to form a time sequence behavior sequence, generates a zero vector and marks it as a silent window when there is no behavior in the window, filters the normal behavior sequence and the real abnormal sequence, and outputs the time sequence behavior sequence; the normal behavior sequence conforms to the business rules and has no risk operation, and the real abnormal sequence comes from historical security events and disposed attack cases.

[0154] The federated framework initialization module builds an architecture comprising a plurality of domain nodes and a federated server, the federated server is deployed in an enterprise private cloud or a local data center and adopts HTTPS communication, each domain node deploys a conditional sequence GAN submodel, the federated server is responsible for aggregating model parameters and does not store raw data, and outputs framework configuration information; the domain nodes include a research and development domain, a finance domain and a production domain, and the submodel comprises a generator and a discriminator.

[0155] Conditional sequence GAN training module: receives the time series behavior sequence and the framework configuration information, combines the organizational architecture knowledge graph and the business rules, trains the conditional sequence GAN locally at each domain node, the generator generates a synthetic abnormal sequence with the real abnormal sequence features and random noise as input, the discriminator distinguishes between real sequences and synthetic sequences, the model is optimized by combining the time series adversarial loss and the knowledge constraint loss, and the encrypted conditional sequence GAN model parameters after local training are output; the knowledge graph triple stores the department-user-permission relationship, and the model parameters include weights and biases;

[0156] Federal parameter aggregation module: receives the encrypted model parameters, aggregates the parameters using the sample size weighted average method, the larger the node sample size, the higher the weight, and outputs the aggregated global conditional sequence GAN model parameters to each domain node to update the conditional sequence GAN sub-model, and outputs the globally converged conditional sequence GAN model;

[0157] Cross-domain knowledge graph construction module: receives the synthetic abnormal sequence from the global GAN model and the time series behavior sequence, integrates business topology data, attack knowledge base and organizational permission data, constructs a triple cross-domain knowledge graph containing "domain-resource-user-device-attack stage" association relationships, and outputs the cross-domain knowledge graph;

[0158] Cross-domain subgraph construction module: receives the time series behavior sequence and the cross-domain knowledge graph, maps the local time series behavior sequence to a subgraph, and outputs the subgraph; the nodes of the subgraph are users, devices and resources, and the edges are time series interaction relationships containing interaction time and type attributes;

[0159] Subgraph feature extraction module: receives the subgraph, updates the node feature vector using the graph convolution network, extracts the local structure features reflecting the node's own time series features and the correlation between nodes, and outputs the subgraph local structure features;

[0160] Spacetime causal attention fusion module: receives the subgraph local structure features and the cross-domain knowledge graph, constructs a global graph on the federal server, introduces a causal inference algorithm to distinguish the correlation and causality between nodes, calculates the causal attention weight focusing on attack-related node pairs, and outputs the global graph and the causal attention weight set;

[0161] Attack detection reasoning module: receives the time series behavior sequence to be detected, the spacetime causal attention global graph and the attention weight set, calculates the attack probability through the FC-GNN model, maps it to the [0, 1] interval through the activation function, determines the attack or normal according to the preset threshold, marks the new abnormal sample as attack, marks the new normal sample as normal, outputs the attack chain and the new sample, and triggers the active defense action at the same time; the attack chain contains node interaction time series, attack stage label and violation rule, the new sample includes new abnormal, new normal and unlabeled sequence, and the defense action includes isolating devices, blocking IP, etc.

[0162] Sample quality evaluation module: receives new samples, synthesizes abnormal sequences, calculates new sample timing consistency score, filters non-compliant timing samples with a score less than the timing consistency threshold based on actual operation interval deviation from historical average interval, and outputs compliant timing samples;

[0163] Local incremental training module: receives compliant timing samples, uses existing FC-GNN model as initial value, updates model classification layer and attention layer parameters using mini-batch gradient descent, preserves graph convolution layer parameters to avoid overfitting, and outputs locally updated model parameters;

[0164] Federal parameter update module: receives locally updated model parameters, aggregates parameters using sample size weighted average method, outputs optimized global FC-GNN model parameters to each domain node, replaces original model parameters, implements model dynamic optimization, and forms a defense closed loop.

[0165] Further, the multi-source heterogeneous data collection module supports sensitive field desensitization processing, uses hash algorithm to desensitize sensitive information such as user ID number and financial data, and has data integrity verification function, which verifies the consistency of collected data and original log through MD5 check code, and re-collects if verification fails; After the preprocessing module marks the missing data, it will attach the missing window position information in the output data, which is convenient for the subsequent module to identify the data integrity;

[0166] In the knowledge constraint loss calculation of the conditional sequence GAN training module, if the synthesized abnormal sequence violates the organizational structure knowledge graph permission rules, such as an engineer accessing non-project documents, the compliance probability of the sequence is reduced and the loss value is increased, and the generator is optimized in the opposite direction to reduce the illegal sequence; Before transmitting the model parameters, the federal parameter aggregation module and the federal parameter update module both use Paillier homomorphic encryption algorithm to process the parameters to avoid parameter leakage;

[0167] In addition to the time series behavior characteristics, the subgraph node attributes of the cross-domain subgraph construction module also include node risk level labels, which are automatically generated based on historical attack records and job permissions, such as "high-risk equipment" and "ordinary user", and support subgraph compression, merging repeated interaction edges of the same user in the same period; The subgraph feature extraction module uses a 2-4 layer graph convolution network architecture, each layer's weight is optimized adaptively through backpropagation, and the feature importance score is attached when outputting the feature based on the contribution of node pairs to attack detection;

[0168] The causal inference algorithm of the spatio-temporal causal attention fusion module records the intervention experiment process, the change of attack probability after fixing a node behavior feature, as a basis for subsequent weight calculation, and the attention weight can be dynamically adjusted, with node pairs frequently associated with attacks being given priority in weight calculation; The attack probability threshold of the attack detection reasoning module supports adaptive optimization, which is adjusted to the 0.7-0.9 interval through historical false positive rate and false negative rate, and the attack chain is visualized on the time axis.

[0169] In the mini-batch gradient descent of the local incremental training module, the batch size can be adjusted according to the amount of node data, the learning rate is initially set to 0.001 and is attenuated by 10% every 10 rounds; the federal parameter update module has a model version management function, stores the model parameters and performance indicators after each optimization, including accuracy and recall rate, and can roll back to the historical optimal version when the model performance decreases.

[0170] Embodiment three

[0171] Based on the same inventive concept as the security defense method based on behavior sequence analysis provided in the embodiments of the present application, the embodiments of the present application also provide a computer device. For the content in the device embodiments, if there is any ambiguity, reference can be made to the corresponding content in the method embodiments.

[0172] A computer device, comprising: at least one processor 101; a memory 102 in communication with the at least one processor; and a network interface 103; wherein the processor, the memory, and the network interface are in communication connection with each other through a system bus 104, the memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned method.

[0173] As understood by those skilled in the art in the technical field, the computer device 100 herein is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits, programmable gate arrays, digital processors, embedded devices, etc. The computer device 100 can be a desktop computer, a notebook computer, a cloud server, and other computing devices. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad, or a voice control device.

[0174] The memory 102 at least includes one type of readable storage medium, which includes flash memory, hard disk, multimedia card, card-type memory, random access memory, static random access memory, read-only memory, electrically erasable programmable read-only memory, programmable read-only memory, magnetic memory, magnetic disk, optical disk, etc. The memory 102 can be an internal storage unit or an external storage device of the computer device 100, and in the embodiments of the present application, the memory 102 is usually used to store the operating system and various application software installed in the computer device 100, such as computer readable instructions of the method, etc. In addition, the memory 102 can also be used to temporarily store various data that have been output or will be output.

[0175] The processor 101 can be a central processing unit, a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 101 is generally used to control the overall operation of the computer device 100. In the embodiments of the present application, the processor 101 is used to run computer readable instructions stored in the memory 102 or process data, for example, computer readable instructions of the method provided by the embodiments of the present application.

[0176] The network interface 103 can include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 100 and other electronic devices.

[0177] Further, the following components are connected to the network interface 103: an input part 105 including a keyboard, a mouse, and the like; an output part 106 including a display such as a cathode ray tube, a liquid crystal display, and the like, and a speaker, and the like; a storage part 107 including a hard disk, and the like; and a communication part 108 including a network interface card such as a LAN card, a modem, and the like. The communication part 108 performs communication processing via a network such as the Internet. A drive 109 is also connected to the network interface 103 as needed. A removable medium 110 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 109 as needed, so that a computer program read therefrom is installed in the storage part 107 as needed.

[0178] It should be noted that, Figure 3 Only the computer device 100 having the components 101-110 is shown in the figure, but it should be understood that it is not required to implement all of the shown components, and more or fewer components can be alternatively implemented.

[0179] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software plus a necessary general hardware platform, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium, and includes several instructions for making a terminal device execute the methods of the various embodiments of the present application.

[0180] Obviously, the above-described embodiments are only some embodiments but not all the embodiments of the present application, the preferred embodiments of the present application are shown in the drawings, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent replacements to some technical features therein. Any equivalent structure made by using the content of the specification and drawings, directly or indirectly applied to other related technical fields, is also within the patent protection scope of the present application.

Claims

1. A security defense method based on behavior sequence analysis, characterized by, The method comprises the following steps: Collecting multi-source heterogeneous data from terminal systems, network devices and business systems, performing data cleaning, missing value completion, feature normalization and time window division to generate time series behavior sequences in a unified format; Under the federated learning framework, each node trains a conditional sequence GAN model based on the local time series behavior sequence, combines the organizational architecture knowledge graph and business rule constraints, generates synthetic abnormal sequences, and uploads the model parameters of the conditional sequence GAN to the federated server for aggregation to obtain a globally converged conditional sequence GAN generation model, and constructs a synthetic abnormal sample library to supplement abnormal samples required for attack detection; Integrating multi-source data to construct a cross-domain knowledge graph, each node maps the local time series behavior sequence to a subgraph, extracts features through a graph convolution network and uploads them to the federated server to construct a global graph, introduces a spatiotemporal causal attention mechanism to focus on causally related nodes, and based on the global graph pooling features, uses an FC-GNN model to infer the attack probability of the sequence to be detected and outputs the attack chain and new samples; The federated server performs time series consistency evaluation and filtering on the new samples uploaded by each domain to obtain compliant time series samples, updates the FC-GNN model parameters through federated incremental learning to realize continuous optimization of the FC-GNN model, and forms a closed-loop defense system of detection, update and optimization.

2. The security defense method based on behavior sequence analysis according to claim 1, characterized in that, The multi-source heterogeneous data includes user login time, file access path and permission operation type extracted from terminal logs, source IP address, destination IP address, request frequency and data transmission volume obtained from network device logs, and user department, post permission and business operation period extracted from business systems; The data cleaning uses the 3σ criterion to remove abnormal values in numerical fields, the missing value completion uses the interpolation method to complete the missing time series data, and the feature normalization performs Min-Max standardization on numerical features and one-hot encoding on categorical features; The time series behavior sequence includes normal behavior sequences and real abnormal sequences.

3. The security defense method based on behavior sequence analysis according to claim 1, characterized in that, The federated learning framework includes multiple domain nodes and a federated server, each node locally deploys a conditional sequence generative adversarial network, the generator generates synthetic sequences with random noise and real abnormal features as input, and the discriminator is used to distinguish real and synthetic sequences.

4. The security defense method based on behavior sequence analysis according to claim 3, characterized in that, The conditional sequence GAN model includes a generator and a discriminator, the generator generates synthetic abnormal sequences with real abnormal sequence features and random noise as input, and the discriminator is used to distinguish real sequences and synthetic sequences, the training process optimizes the model through the joint optimization of the time series adversarial loss and the knowledge constraint loss, the normal behavior sequence in the local time series behavior sequence is used to assist the discriminator in distinguishing real normal and synthetic abnormal sequences, and the real abnormal sequence provides attack feature reference for the generator to generate synthetic abnormal sequences; The federated server aggregates the conditional sequence GAN model parameters of each domain node using the sample size weighted average method, the model parameters include the weight matrix and bias vector of the generator and the weight matrix and bias vector of the discriminator; the model parameters are processed using a homomorphic encryption algorithm before transmission.

5. The security defense method based on behavior sequence analysis according to claim 1, characterized in that, The domain knowledge graph stores the association relationship of domain-resource-user-device-attack stage in the form of triple, the sub-graph takes user, device and resource as nodes, and time sequence interaction relationship as edges, the edge attribute of the sub-graph includes interaction time and interaction type, the graph convolution network extracts the local structure features of the sub-graph by updating the node feature vector, and the local structure features of the sub-graph include the time sequence behavior features of the nodes and the association features between the nodes.

6. The security defense method based on behavior sequence analysis according to claim 5, characterized in that, The spatio-temporal causal attention mechanism determines the attention weight by calculating the causal association probability between nodes, the causal association probability is determined based on the intervention experiment result of the node behavior, a preset attack probability threshold is used to determine whether the time sequence behavior sequence of the current time is an attack, if it is determined that the attack, the sequence is labeled as a new abnormal sample, and the output attack chain needs to include the node interaction time sequence, the attack stage label and the violation rule basis; if it is determined that the normal, the sequence is labeled as a new normal sample; The new sample includes the new abnormal sample, the new normal sample, and the unlabeled time sequence behavior sequence newly generated in each domain.

7. The security defense method based on behavior sequence analysis according to claim 4, characterized in that, The time sequence consistency evaluation obtains a score by calculating the deviation of the actual operation interval of the sample and the historical average interval, and only the samples with a score greater than or equal to a time sequence consistency threshold are retained; The incremental training only updates the classification layer and the attention layer parameters of the model, and retains the graph convolution layer parameters; The federated incremental learning updates the model parameters, including: each node updates the local compliance time sequence sample based on the self-screening, takes the FC-GNN model trained on the node as the initial value, performs incremental training on the FC-GNN model parameters by using the small batch gradient descent, encrypts and uploads the updated parameters for aggregation, obtains the optimized global model, the federated server aggregates the parameters and then distributes them to each node to update the FC-GNN model parameters, thereby forming a closed loop.

8. A security defense system based on behavior sequence analysis, for the security defense method based on behavior sequence analysis according to any one of claims 1 to 7, characterized in that, It comprises: A multi-source heterogeneous data acquisition module: deployed in enterprise terminal systems, network devices and business systems, which acquires terminal, network and business data in real time and outputs original multi-source data; A preprocessing module: which cleans, fills in missing values, normalizes features and divides time sequence windows for the original multi-source data, and outputs normalized features; A time sequence sequence construction module: which concatenates the normalized features in time sequence to form a time sequence behavior sequence, and outputs the time sequence behavior sequence; A federated framework initialization module: which is used to build a federated learning architecture comprising multiple domain nodes and a federated server; A conditional sequence GAN training module: which is deployed on each domain node, trains a conditional sequence generative adversarial network based on the local time sequence behavior sequence, and outputs encrypted model parameters; A federated parameter aggregation module: which is deployed on the federated server, aggregates the encrypted model parameters uploaded by the nodes, and outputs a global model; A cross-domain knowledge graph construction module: which is used to construct a knowledge graph comprising domain-resource-user-device-attack stage association relationship; A cross-domain sub-graph construction module: which maps the local time sequence behavior sequence into a graph structure, and outputs a sub-graph; A sub-graph feature extraction module: which extracts sub-graph features by using a graph convolution network, and outputs local structure features of the sub-graph; A spatio-temporal causal attention fusion module: which constructs a global graph, introduces a causal attention mechanism in the global graph, and outputs a set of causal attention weights. Attack detection inference module: calculate attack probability based on FC-GNN model and output attack chain and new sample; Sample quality evaluation module: evaluate the temporal consistency of new samples and output compliant temporal samples; Local incremental training module: incrementally train the model based on compliant temporal samples and output updated local model parameters; Federal parameter update module: aggregate the incrementally trained model parameters and update the global model.

9. The security defense system based on behavior sequence analysis of claim 8, wherein, The multi-source heterogeneous data collection module supports sensitive field desensitization processing and has data integrity verification function; the preprocessing module marks the missing data and outputs the data with missing window position information; The federal parameter aggregation module and the federal parameter update module use Paillier homomorphic encryption to process the parameters before transmitting the model parameters; In the cross-domain subgraph construction module, the subgraph nodes include temporal behavior features and node risk level labels, and support subgraph compression; the subgraph feature extraction module uses graph convolution network architecture to output feature importance score; The spatio-temporal causal attention fusion module uses causal inference algorithm to record the intervention experiment process and dynamically adjusts the attention weight; the attack probability threshold of the attack detection inference module supports adaptive optimization; The local incremental training module performs small batch gradient descent, and the batch size is adjusted according to the node data volume; The federal parameter update module has model version management function.

10. A computer device, comprising: It includes: At least one processor; Memory connected in communication with the at least one processor; And Network interface; Wherein, the processor, memory, network interface are mutually communicated and connected through system bus, the memory has the instructions which can be executed by the processor, the instructions are used to be executed by the processor to realize the security defense method based on behavior sequence analysis in any one of claims 1 to 5.

Images