Host anomaly detection method based on time domain and frequency domain feature fusion
By fusing time-domain and frequency-domain features and utilizing convolutional neural networks and multi-head cross-attention mechanisms, the false positive and false negative problems of HIDS under single-dimensional modeling are solved, and efficient detection of host anomalies is achieved.
Patent Information
- Application Number
- CN202510991864.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-18
- Publication Date
- 2025-11-18
AI Technical Summary
Existing host intrusion detection systems (HIDS) struggle to fully capture complex attack patterns when detecting host anomalies, resulting in high false positive and false negative rates. This is mainly due to insufficient feature representation of system call sequences, with existing methods often employing single-dimensional modeling in the time or frequency domain.
A method based on the fusion of time-domain and frequency-domain features is adopted. The time-domain feature vector is extracted by a convolutional neural network, combined with the frequency-domain feature vector of the n-gram sequence, and the feature is fused by a multi-head cross-attention mechanism to generate anomaly detection results.
It significantly reduces false positive and false negative rates, improves the accuracy and comprehensiveness of host anomaly detection, and can more accurately identify complex attack models.
Smart Images
Figure CN120974362A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network information security technology, and in particular to a host anomaly detection method based on the fusion of time-domain and frequency-domain features. Background Technology
[0002] With the rapid development of information technology, cybersecurity threats are becoming increasingly severe, with a surge in attacks targeting host systems and cloud environments. The misuse of technologies such as generative artificial intelligence has lowered the barrier to entry for attacks, making attack methods more complex. At the same time, the widespread adoption of remote work and cloud computing has expanded the exposure of hosts, making them a critical link in security protection.
[0003] Currently, a Host-based Intrusion Detection System (HIDS) is a security tool installed on a single host or device. It can be used to monitor and analyze the host's internal activities (such as files, processes, logs, system calls, etc.) in real time, detect potential malicious behavior or security threats, and issue alerts or take timely response measures.
[0004] HIDS typically identifies intrusion behavior by monitoring system call sequences such as system calls and file operations. However, existing anomaly detection technologies have the following drawbacks: insufficient feature representation of system call sequences; existing methods mostly use single-dimensional modeling in the time or frequency domain, which makes it difficult to fully capture complex attack patterns, resulting in high false positive and false negative rates.
[0005] Therefore, there is currently a lack of a method that can accurately and comprehensively identify host anomalies. Summary of the Invention
[0006] This application provides a host anomaly detection method based on the fusion of time-domain and frequency-domain features to address the shortcomings of the aforementioned related technologies. The technical solution is as follows: In a first aspect, embodiments of this application provide a host anomaly detection method based on the fusion of time-domain and frequency-domain features, including: Obtain the system call sequence; The system call sequence is processed by a trained convolutional neural network to obtain the corresponding temporal feature vector; Multiple sets of n-gram sequences are extracted based on the system call sequence, and frequency domain feature vectors are extracted based on all the n-gram sequences. The time-domain feature vector and the frequency-domain feature vector are fused based on a multi-head cross-attention mechanism to obtain the fused attention features; Anomaly detection results are obtained based on the fused attention features.
[0007] In one alternative embodiment of the first aspect, processing the system call sequence using a trained convolutional neural network to obtain a corresponding temporal feature vector includes: The system call sequence is length-normalized to obtain a system call sequence adjusted to a preset length; The system call vector is constructed by processing each discrete value in the adjusted system call sequence based on the preset mapping function to obtain the corresponding vector representation. The system call vector is convolved by a multi-scale convolution kernel group to extract fused convolution features of multiple scales; Max pooling is performed based on the fused convolutional features to obtain the dimensionality-reduced temporal feature vector.
[0008] In one alternative of the first aspect, the multi-scale convolutional kernel group includes multiple convolutional kernels of different sizes; The process of convolving the system call vector with a multi-scale convolution kernel group to extract fused convolutional features at multiple scales includes: Each scale of the convolutional kernel slides on the system call vector based on a preset sliding window to extract the convolutional feature map corresponding to the system call vector; The convolutional feature maps obtained by splicing the convolutional kernels at each scale are obtained to obtain the fused convolutional features.
[0009] In one alternative embodiment of the first aspect, the extraction of multiple sets of n-gram sequences based on the system call sequence includes: Each discrete value in the system call sequence is segmented based on multiple different n values to obtain an n-gram sequence of length n consisting of n consecutive discrete values. Each subsequence of length n is integrated to obtain a set of n-gram sequences corresponding to the value of n; Where n is a positive integer.
[0010] In one alternative to the first aspect, the extraction of the frequency domain feature vector based on all the n-gram sequences includes: A feature dictionary is built based on each group of n-gram sequences, and all n-gram sequences are recorded through the feature dictionary; The frequency of each n-gram sequence in the feature dictionary in the system call sequence is counted to obtain the frequency sequence corresponding to the feature dictionary; Statistical features are extracted based on the frequency sequence, and the frequency domain feature vector is obtained based on the statistical features. The statistical characteristics include: The quartiles and maximum frequency of occurrence of each n-gram sequence, the quartiles and maximum frequency of occurrence of each n-gram sequence, the standard deviation and standard error of occurrence of occurrence of each n-gram sequence, the skewness and kurtosis of occurrence of occurrence of each n-gram sequence, and the skewness and kurtosis of occurrence of occurrence of each n-gram sequence.
[0011] In one alternative embodiment of the first aspect, the fusion of the time-domain feature vector and the frequency-domain feature vector based on the multi-head cross-attention mechanism to obtain the fused attention features includes: Multi-head cross-attention calculation is performed based on the time-domain feature vector and the frequency-domain feature vector, with the time-domain feature vector as the query vector and the frequency-domain feature vector as the key vector and value vector; Based on the query vector, the key vector, and the value vector, the attention of each attention head is calculated respectively; The attention features of each attention head are spliced together and integrated through a linear layer to obtain the fused attention features.
[0012] In one alternative to the first aspect, obtaining the anomaly detection result based on the fused attention features includes: The fused attention features are input into a fully connected layer for nonlinear transformation; The result of the nonlinear transformation is input into the softmax function, which outputs the probability distribution vector for each anomaly category. Based on the maximum value in the probability distribution vector, the corresponding anomaly category is determined, and the anomaly detection result is output.
[0013] Secondly, embodiments of this application also provide a host anomaly detection device based on the fusion of time-domain and frequency-domain features, comprising: The data acquisition unit is used to acquire the system call sequence; The temporal feature processing unit is used to process the system call sequence through a trained convolutional neural network to obtain the corresponding temporal feature vector; The frequency domain feature processing unit is used to extract n n-gram sequences based on the system call sequence, and to extract a frequency domain feature vector based on all the n-gram sequences. An attention processing unit is used to fuse the time-domain feature vector and the frequency-domain feature vector based on a multi-head cross-attention mechanism to obtain fused attention features; An anomaly detection unit is used to obtain anomaly detection results based on the fused attention features.
[0014] Thirdly, embodiments of this application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method provided by the first aspect or any implementation thereof of the embodiments of this application.
[0015] Fourthly, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method provided by the first aspect of the embodiments of this application or any implementation thereof.
[0016] The beneficial effects of the technical solutions provided in some embodiments of this application include at least the following: This application provides a host anomaly detection method based on the fusion of time-domain and frequency-domain features. In the system call sequence processing stage, a well-trained convolutional neural network can effectively capture the temporal dependencies and deep time-domain features between system calls, overcoming the shortcomings of traditional methods in modeling long-range dependencies.
[0017] Furthermore, frequency domain feature extraction based on n-gram sequences transforms discrete system calls into a statistical feature space through multi-granularity language pattern analysis (from single instructions to complex instruction combinations). This not only preserves the normal operating patterns that occur frequently, but also highlights the rare sequence combinations unique to abnormal behaviors, thus making up for the shortcoming of pure time domain analysis being insensitive to frequency domain features.
[0018] By using a multi-dimensional analysis method that integrates time-domain and frequency-domain features, complex attack models can be accurately identified. Compared with the single-dimensional methods used in related technologies, it significantly reduces the false alarm rate (misjudging normal high-frequency operations as abnormal) and the false negative rate (failing to detect low-frequency but dangerous attack sequences), and significantly improves the accuracy and comprehensiveness of host anomaly detection. It can provide more reliable host security protection capabilities for cloud environments and remote office scenarios. Attached Figure Description
[0019] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0020] Figure 1 This is a flowchart illustrating a host anomaly detection method based on the fusion of time-domain and frequency-domain features provided in an embodiment of this application. Figure 2 This is a schematic diagram of the structure of a host anomaly detection device based on the fusion of time-domain and frequency-domain features provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation
[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0022] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not limited to the steps or modules listed, but may optionally include steps or modules not listed, or may optionally include other steps or modules inherent to such process, method, product, or apparatus.
[0023] It should be noted that the terms "first" and "second" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects. It is understood that "first" and "second" can be interchanged in a specific order or sequence where permitted. It should be understood that the objects distinguished by "first" and "second" can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in an order other than those described or illustrated herein.
[0024] It should be noted that when using HIDS to identify abnormal behavior, the relevant technologies only use one of the time domain or frequency domain, making it difficult to capture both local time-series patterns and global frequency domain features simultaneously.
[0025] If only system time-domain characteristics are statistically analyzed, such as call frequency, high-frequency but normal log writing operations may be misjudged as abnormal, leading to false alarms. In contrast, low-frequency malicious code injection may be ignored, resulting in missed anomalies.
[0026] If only the frequency domain characteristics of the system are statistically analyzed, it may be possible to detect the distribution of abnormal features, but it is difficult to pinpoint the time point when the abnormality occurred, and thus it is impossible to distinguish between the abnormal operation time interval and the normal operation time interval.
[0027] This application embodiment extracts time-domain feature vectors through convolutional neural networks, obtains frequency-domain feature vectors through statistical feature extraction of n-gram sequences, and fuses time-domain and frequency-domain feature vectors through an attention mechanism. This enables accurate identification of complex attack models based on fused features. Compared with the single-dimensional methods used in related technologies, this significantly reduces the false positive rate and false negative rate, and significantly improves the accuracy and comprehensiveness of host anomaly detection.
[0028] The present application will now be described in detail with reference to specific embodiments.
[0029] Next, combine Figure 1 This paper introduces a host anomaly detection method based on the fusion of time-domain and frequency-domain features, provided by embodiments of this application. For details, please refer to... Figure 1 , Figure 1 This illustration shows a flowchart of a host anomaly detection method based on the fusion of time-domain and frequency-domain features provided in an embodiment of this application. Figure 1 As shown, the method includes the following steps: S101, Obtain the system call sequence; S102, The system call sequence is processed by a trained convolutional neural network to obtain the corresponding temporal feature vector; S103, multiple sets of n-gram sequences are extracted based on the system call sequence, and frequency domain feature vectors are extracted based on all the n-gram sequences; S104, Based on the multi-head cross-attention mechanism, the time-domain feature vector and the frequency-domain feature vector are fused to obtain the fused attention features; S105, an anomaly detection result is obtained based on the fused attention features.
[0030] It should be noted that the system call sequence in S101 refers to a chronological sequence of interface calls provided by the operating system kernel to applications. When an application performs file operations, process management, network communication, or other operations, it must interact with the kernel through system calls. For example, an ordered combination of system calls such as opening a file, writing data, and creating a process constitutes a system call sequence.
[0031] For example, a sequence of system calls can be represented as: open(), read(), write(), close(), fork(), exit(). This sequence of system calls can reflect the dynamic behavior of the program, and thus can serve as the basis for Host Intrusion Detection System (HIDS) to analyze abnormal activities.
[0032] In some embodiments, in S102, the system call sequence is processed using a trained convolutional neural network, wherein: A well-trained convolutional neural network can be trained on a pre-defined training set. The convolutional neural network processes the input sample data sequence to obtain the predicted temporal feature vector. The difference between the predicted temporal feature vector and the sample data sequence determines whether the convolutional neural network has converged. The weight parameters of the converged convolutional neural network are used to obtain the trained convolutional neural network. The convolutional neural network includes a multi-scale convolutional kernel group.
[0033] S102 specifically includes the following steps: S1021, The system call sequence is length standardized to obtain a system call sequence adjusted to a preset length.
[0034] For example, the acquired system call sequence can be represented as Length normalization allows us to define the length of a sequence, for example, a preset length L, which corresponds to L discrete values. This allows us to integrate the system call sequence S into a sequence of L discrete values. The length of the sequence is length L.
[0035] For example, if the length of the original system call sequence is less than the preset length L, the length can be increased by padding with zeros. If the length of the original system call sequence is greater than the preset length L, the sequence of length L can be obtained by truncation. This application does not limit this.
[0036] S1022, adjust the system call sequence in S1021 based on the preset mapping function. Each discrete value is processed to obtain its corresponding vector representation, and the system call vector is constructed.
[0037] Specifically, this can be achieved through trainable embedding layers. Each discrete value is transformed into a d-dimensional dense vector representation. The embedded sequence E, which is also the system call vector, is represented as: ; in, For embedded mapping functions.
[0038] S1023, The system call vector is convolved by a multi-scale convolution kernel group to extract fused convolution features of multiple scales.
[0039] Specifically, the multi-scale convolutional kernel group includes multiple convolutional kernels of different sizes, and the process of extracting fused convolutional features includes: The system call vector E is convolved using multiple convolutional kernels of different sizes. These kernels have different receptive fields, enabling them to perceive temporal features of varying local sizes.
[0040] The result obtained through the convolution operation can be represented as: ; Each scale of the convolutional kernel slides across the system call vector based on a preset sliding window, extracting the convolutional feature map c corresponding to the system call vector, which can be represented as: ; Each convolutional kernel of a different scale can generate convolutional feature maps of different sizes. Finally, the convolutional feature maps obtained from the convolutional kernels at each scale are concatenated to form a comprehensive feature representation. The fused convolutional features are obtained.
[0041] in, Here is the weight matrix of the corresponding convolution kernel. The dimension of the weight matrix is represented by h, the size of the convolution kernel is represented by m, and the dimension of the input vector is represented by m. For bias terms, Let be the output scalar of the convolution operation at position j, and K represent the K convolution kernels of different scales.
[0042] S1024, Based on the fused convolutional features, perform max pooling to obtain the dimensionality-reduced temporal feature vector, which can be expressed as: .
[0043] In some embodiments, S103, the process of extracting frequency domain feature vectors based on n-gram sequences and extracting multiple sets of n-gram sequences based on system call sequences includes: S1031, Sequence segmentation: Segment each discrete value in the system call sequence based on multiple different n values to obtain an n-gram sequence of length n consisting of n consecutive discrete values; Each subsequence of length n is integrated to obtain a set of n-gram sequences corresponding to the value of n; where n is a positive integer.
[0044] For example, three sets of n-gram sequences can be obtained by dividing the sequence according to n=1, 2, 3. Taking n=1 as an example, each discrete value in the system call sequence is selected as a 1-gram sequence. By integrating all the 1-gram sequences, a set of 1-gram sequences corresponding to n=1 can be obtained. Taking n=2 as an example, in the system call sequence, according to the order of the discrete values, every two consecutive discrete value elements are selected as a 2-gram sequence. Every two 2-gram sequences can have repeated discrete values. This application does not limit this. By integrating all the 2-gram sequences, a set of 2-gram sequences corresponding to n=2 can be obtained.
[0045] Furthermore, the process of extracting frequency domain feature vectors based on all the aforementioned n-gram sequences includes: S1032, Feature dictionary construction: Building a feature dictionary based on each group of n-gram sequences. All n-gram sequences are recorded through the feature dictionary.
[0046] S1033, Frequency Statistics: Count the frequency of each n-gram sequence in the feature dictionary within the system call sequence to obtain the frequency sequence corresponding to the feature dictionary, denoted as... .
[0047] S1034, Statistical feature calculation: Extract statistical features based on the frequency sequence. The statistical features may include, but are not limited to, the quartiles and maximum frequency of occurrence of each n-gram sequence, the quartiles and maximum frequency of occurrence of each n-gram sequence, the standard deviation and standard error of occurrence of each n-gram sequence, the skewness and kurtosis of occurrence of each n-gram sequence, and the skewness and kurtosis of occurrence of each n-gram sequence.
[0048] Furthermore, frequency domain feature vectors can be calculated based on statistical characteristics. .
[0049] In some embodiments, S104, the time-domain feature vector and the frequency-domain feature vector are fused based on a multi-head cross-attention mechanism to obtain fused attention features, specifically including: S1041, based on the time-domain feature vector and the frequency domain feature vector Perform multi-head cross-attention calculation using the time-domain feature vector. As the query vector Q, the frequency domain feature vector As the key vector K and the value vector V; S1042, based on the query vector, the key vector, and the value vector, calculate the attention of each attention head, including: The vectors Q, K, and V are each split into h subspaces of dimension D / h, and h sets of cross-attention are computed in parallel. The attention of each head is calculated as follows: ; ; Thus, the attention of h attention heads can be calculated.
[0050] S1043, perform feature fusion by concatenating the outputs of h attention heads and integrating them through a linear layer, applying the formula: ; In this way, multi-headed attention can be obtained.
[0051] Next, step S105 is executed, which obtains anomaly detection results based on the fused attention features, including: S1051, The fused attention features are input into the fully connected layer for nonlinear transformation; S1052, the result of the nonlinear transformation is input into the softmax function, and the softmax function outputs the probability distribution vector of each anomaly category, which can be expressed as: , where C is the number of anomaly categories and P is the probability distribution vector for each anomaly category.
[0052] S1053, based on the maximum value in the probability distribution vector Apply the formula: ; The corresponding anomaly category is determined based on the mapping relationship between the anomaly probability value and the anomaly category, and the anomaly detection result is output.
[0053] It should be noted that the categories of anomalies include, but are not limited to, privilege escalation attacks, malicious process injection, data leakage, and hidden backdoors, and the embodiments of this application do not limit these.
[0054] The following are apparatus embodiments of this application, which can be used to execute the method embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the method embodiments of this application.
[0055] Please see below. Figure 2This is a schematic diagram of a host anomaly detection device based on time-domain and frequency-domain feature fusion, provided as an exemplary embodiment of this application. This device can be implemented as all or part of a terminal through software, hardware, or a combination of both, or it can be integrated as an independent module on a server. The host anomaly detection device based on time-domain and frequency-domain feature fusion in this embodiment can be applied to a terminal or the cloud. The device includes a data acquisition unit, a time-domain feature processing unit, a frequency-domain feature processing unit, an attention processing unit, and an anomaly detection unit, wherein: The data acquisition unit is used to acquire the system call sequence; The temporal feature processing unit is used to process the system call sequence through a trained convolutional neural network to obtain the corresponding temporal feature vector; The frequency domain feature processing unit is used to extract n n-gram sequences based on the system call sequence, and to extract a frequency domain feature vector based on all the n-gram sequences. An attention processing unit is used to fuse the time-domain feature vector and the frequency-domain feature vector based on a multi-head cross-attention mechanism to obtain fused attention features; An anomaly detection unit is used to obtain anomaly detection results based on the fused attention features.
[0056] It should be noted that the apparatus provided in the above embodiments, when executing a host anomaly detection method based on the fusion of time-domain and frequency-domain features, is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the apparatus provided in the above embodiments and the host anomaly detection method embodiment based on the fusion of time-domain and frequency-domain features belong to the same concept, and their implementation process is detailed in the method embodiment, which will not be repeated here.
[0057] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the methods described above.
[0058] Please see Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of this application.
[0059] like Figure 3 As shown, the electronic device 300 includes a processor 301 and a memory 302.
[0060] In this embodiment, the processor 301 is the control center of the computer system, and can be a processor of a physical machine or a processor of a virtual machine. The processor 301 may include one or more processing cores, such as a 4-core processor or an 8-core processor. The processor 301 can be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array).
[0061] Processor 301 may also include a main processor and a coprocessor. The main processor is a processor used to process data in the wake-up state, also known as a CPU (Central Processing Unit). The coprocessor is a low-power processor used to process data in the standby state.
[0062] Memory 302 may include one or more computer-readable storage media, which may be non-transitory. Memory 302 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments of this application, the non-transitory computer-readable storage media in memory 302 is used to store at least one instruction, which is executed by processor 301 to implement the method in the embodiments of this application.
[0063] In some embodiments, the electronic device 300 further includes a peripheral device interface 303 and at least one peripheral device 304. The processor 301, memory 302, and peripheral device interface 303 can be connected via a bus or signal line. Each peripheral device 304 can be connected to the peripheral device interface 303 via a bus, signal line, or circuit board. Specifically, the peripheral device 304 includes: a display screen, a camera, and audio circuitry. The peripheral device interface 303 can be used to connect at least one I / O (Input / Output) related peripheral device to the processor 301 and memory 302.
[0064] In some embodiments of this application, the processor 301, memory 302, and peripheral device interface 303 are integrated on the same chip or circuit board; in other embodiments of this application, any one or two of the processor 301, memory 302, and peripheral device interface 303 can be implemented on separate chips or circuit boards. This application does not specifically limit the implementation in this regard.
[0065] The block diagram of the electronic device shown in the embodiments of this application does not constitute a limitation on the electronic device 300. The electronic device 300 may include more or fewer components than shown, or combine certain components, or use different component arrangements.
[0066] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the methods in any of the foregoing embodiments. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.
[0067] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of software products. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0068] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. A host anomaly detection method based on the fusion of time-domain and frequency-domain features, characterized in that, include: Obtain the system call sequence; The system call sequence is processed by a trained convolutional neural network to obtain the corresponding temporal feature vector; Multiple sets of n-gram sequences are extracted based on the system call sequence, and frequency domain feature vectors are extracted based on all the n-gram sequences. The time-domain feature vector and the frequency-domain feature vector are fused based on a multi-head cross-attention mechanism to obtain the fused attention features; Anomaly detection results are obtained based on the fused attention features.
2. The host anomaly detection method based on time-domain and frequency-domain feature fusion according to claim 1, characterized in that, The process of processing the system call sequence using a trained convolutional neural network to obtain the corresponding temporal feature vector includes: The system call sequence is length-normalized to obtain a system call sequence adjusted to a preset length; The system call vector is constructed by processing each discrete value in the adjusted system call sequence based on the preset mapping function to obtain the corresponding vector representation. The system call vector is convolved by a multi-scale convolution kernel group to extract fused convolution features of multiple scales; Max pooling is performed based on the fused convolutional features to obtain the dimensionality-reduced temporal feature vector.
3. The host anomaly detection method based on time-domain and frequency-domain feature fusion according to claim 2, characterized in that, The multi-scale convolution kernel group includes multiple convolution kernels of different sizes; The process of convolving the system call vector with a multi-scale convolution kernel group to extract fused convolutional features at multiple scales includes: Each scale of the convolutional kernel slides on the system call vector based on a preset sliding window to extract the convolutional feature map corresponding to the system call vector; The convolutional feature maps obtained by splicing the convolutional kernels at each scale are obtained to obtain the fused convolutional features.
4. The host anomaly detection method based on time-domain and frequency-domain feature fusion according to claim 1, characterized in that, The extraction of multiple sets of n-gram sequences based on the system call sequence includes: Each discrete value in the system call sequence is segmented based on multiple different n values to obtain an n-gram sequence of length n consisting of n consecutive discrete values. Each subsequence of length n is integrated to obtain a set of n-gram sequences corresponding to the value of n; Where n is a positive integer.
5. The host anomaly detection method based on time-domain and frequency-domain feature fusion according to claim 4, characterized in that, The extraction of frequency domain feature vectors based on all the n-gram sequences includes: A feature dictionary is built based on each group of n-gram sequences, and all n-gram sequences are recorded through the feature dictionary; The frequency of each n-gram sequence in the feature dictionary in the system call sequence is counted to obtain the frequency sequence corresponding to the feature dictionary; Statistical features are extracted based on the frequency sequence, and the frequency domain feature vector is obtained based on the statistical features. The statistical characteristics include: The quartiles and maximum frequency of occurrence of each n-gram sequence, the quartiles and maximum frequency of occurrence of each n-gram sequence, the standard deviation and standard error of occurrence of occurrence of each n-gram sequence, the skewness and kurtosis of occurrence of occurrence of each n-gram sequence, and the skewness and kurtosis of occurrence of occurrence of each n-gram sequence.
6. The host anomaly detection method based on time-domain and frequency-domain feature fusion according to claim 1, characterized in that, The multi-head cross-attention mechanism is used to fuse the time-domain feature vector and the frequency-domain feature vector to obtain the fused attention features, including: Multi-head cross-attention calculation is performed based on the time-domain feature vector and the frequency-domain feature vector, with the time-domain feature vector as the query vector and the frequency-domain feature vector as the key vector and value vector; Based on the query vector, the key vector, and the value vector, the attention of each attention head is calculated respectively; The attention features of each attention head are spliced together and integrated through a linear layer to obtain the fused attention features.
7. The host anomaly detection method based on time-domain and frequency-domain feature fusion according to claim 6, characterized in that, The anomaly detection result obtained based on the fused attention features includes: The fused attention features are input into a fully connected layer for nonlinear transformation; The result of the nonlinear transformation is input into the softmax function, which outputs the probability distribution vector for each anomaly category. Based on the maximum value in the probability distribution vector, the corresponding anomaly category is determined, and the anomaly detection result is output.
8. A host anomaly detection device based on the fusion of time-domain and frequency-domain features, characterized in that, include: The data acquisition unit is used to acquire the system call sequence; The temporal feature processing unit is used to process the system call sequence through a trained convolutional neural network to obtain the corresponding temporal feature vector; The frequency domain feature processing unit is used to extract n n-gram sequences based on the system call sequence, and to extract a frequency domain feature vector based on all the n-gram sequences. An attention processing unit is used to fuse the time-domain feature vector and the frequency-domain feature vector based on a multi-head cross-attention mechanism to obtain fused attention features; An anomaly detection unit is used to obtain anomaly detection results based on the fused attention features.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.