Network security defense system based on collaborative intrusion detection

Abstract

The invention discloses a network security defense system based on collaborative intrusion detection, which relates to the technical field of network security and comprises a behavior data acquisition module, an anomaly analysis module, a behavior evaluation module, a joint risk evaluation module and a security defense module. The behavior data acquisition module is used for acquiring related access behavior information of a user; the anomaly analysis module is used for analyzing the user login time and the deviation degree of the fingerprint of the current login equipment; the behavior evaluation module is used for analyzing the deviation degree of the user access behavior to judge whether the current user access behavior is abnormal or not, and sending an access risk analysis instruction; the joint risk assessment module is used for analyzing the risk degree of the abnormal internal access behavior of the current user; and the security defense module is used for judging whether the abnormal internal access behavior of the current user has a risk or not so as to obtain and execute a security defense instruction of a corresponding level.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security defense system based on collaborative intrusion detection. Background Technology

[0002] With the diversification of enterprise office models, remote work has become one of the important ways for enterprises to operate. Users access the enterprise intranet through VPN remote terminals, which significantly increases the security risks. In order to ensure the secure and stable operation of enterprise information systems under remote access conditions, there is an urgent need for a network security defense system that integrates intrusion identification methods with multi-dimensional behavior judgment and dynamic feedback mechanisms.

[0003] However, existing defense systems are mostly based on static rules, mainly focusing on abnormal traffic, illegal port calls, and repeated failed login attempts. They lack the ability to effectively deal with attacks that use legitimate credentials to log in but exhibit abnormal behavior. Especially in remote work scenarios, attackers bypass traditional authentication mechanisms by stealing account passwords and simulating device fingerprints. Existing defense systems often struggle to identify such intrusions and lack dynamic judgment mechanisms based on user behavior characteristics (operation time offset, geographical location offset, device differences, and abnormal paths).

[0004] In remote access environments, users are geographically widespread, access times are unstable, devices are diverse, and usage is frequently switched. Without dynamic behavior modeling and collaborative judgment mechanisms, highly covert intrusion channels can easily form where credentials are legitimate but behavior is abnormal. Once such attacks occur, they are often accompanied by serious consequences such as data leakage, abuse of privileges, and control of critical systems. When attackers bypass two-factor authentication by simulating user logins outside of working hours and quickly obtain highly sensitive privilege resources, business data can be dumped or operation logs can be tampered with, causing major security incidents. Therefore, there is an urgent need for an intrusion identification method that integrates multi-dimensional behavior judgment and dynamic feedback mechanisms to improve the defense system's ability to perceive and respond to attack scenarios where static credentials are compliant but dynamic behavior is abnormal. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a network security defense system based on collaborative intrusion detection, which solves the problems mentioned in the background technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network security defense system based on collaborative intrusion detection, comprising a behavior data acquisition module, an anomaly analysis module, a behavior assessment module, a joint risk assessment module, and a security defense module;

[0007] The behavior data collection module is used to collect relevant access behavior information of users;

[0008] The anomaly analysis module is used to analyze the user's login time and the degree of deviation of the fingerprint of the currently logged-in device;

[0009] The behavior assessment module is used to analyze the degree of deviation of user access behavior in order to determine whether the current user access behavior is abnormal and to issue access risk analysis instructions.

[0010] The joint risk assessment module is used to analyze the risk level of the current user's abnormal internal access behavior after receiving an access risk analysis instruction;

[0011] The security defense module is used to determine whether the current user's abnormal internal access behavior poses a risk, and to obtain and execute the corresponding level of security defense instructions.

[0012] Preferably, the behavior data acquisition module includes a deployment unit and a behavior data acquisition unit;

[0013] The deployment unit is used to deploy multiple sets of detection devices in a layered manner in the communication transmission architecture of remote office according to the detection requirements of potential intrusion behavior. The multiple sets of detection devices deployed in a layered manner include deep packet inspection sensors embedded in VPN access nodes in the user access layer, distributed intrusion detection probes configured in the transmission link layer, collaborative identification hub components deployed on the server communication bus, and data interaction cache pools and preprocessing task schedulers set up at the boundaries between the enterprise internal network and remote access.

[0014] Deep packet inspection sensors are used to acquire IP identifiers, timestamps, geographical locations, and device fingerprint information in user login requests in real time; distributed intrusion detection probes are used to synchronously replicate command streams, API call sequences, and session data paths in the communication link; the collaborative identification hub component is used to aggregate, match, and risk score multi-source behavioral data, while introducing a behavior correction feedback mechanism; the data interaction cache pool and preprocessing task scheduler are used to perform data cleaning, standardization, and vector encoding preprocessing operations on the collected multi-source behavioral data, and to store the data.

[0015] Preferably, the behavior data acquisition unit is used to monitor the login time status of users remotely accessing the intranet via VPN based on the deep packet inspection sensor embedded in the VPN access node of the user access layer, and obtain relevant timestamp data information. Based on IP reverse lookup and combined with the user's historical permanent geographical area, it collects the distance between the user's login location and commonly used location when remotely accessing the intranet via VPN, and obtains relevant location distance data information. Relying on the browser fingerprint extraction and client environment detection technology of the access terminal, it collects the device fingerprint information of the user remotely accessing the intranet via VPN, and obtains relevant fingerprint feature data information. Among them, the relevant timestamp data information includes the current user login time Tyd, the relevant location distance data information includes the current IP address offset distance Lpy, and the relevant fingerprint feature data information includes the current login device fingerprint vector Xzw.

[0016] Preferably, the anomaly analysis module includes a time offset analysis unit and a device fingerprint offset analysis unit;

[0017] The time offset analysis unit is used to obtain the historical login time Tss of each user based on the user's historical login time stored in the data interaction cache pool and the preprocessing task scheduler after feature extraction. Combined with a statistical averaging algorithm, the historical average login time Tss is obtained. avg ;

[0018] The relevant timestamp data information obtained from the behavior data collection unit is compared with the historical average login time Tss. avg After correlation and dimensionless processing, the deviation of the user's login time when remotely accessing the intranet via VPN from the user's historical login time is analyzed to obtain the login time deviation coefficient Xsj, which is obtained through the following formula:

[0019]

[0020] In the formula, Tyd represents the current user login time, and σTss represents the standard deviation of the historical login times of each user.

[0021] Preferably, the device fingerprint offset analysis unit is used to obtain the user's registered device fingerprint vector Xdj based on the record of the user's first authorized login device information, combined with browser fingerprint extraction and client environment detection technology;

[0022] By performing feature recognition on relevant fingerprint feature data, the extracted fingerprint vector Xzw of the currently logged-in device is correlated with the fingerprint vector Xdj of the user's registered device. After dimensionless processing, the deviation of the current logged-in device fingerprint from the user's registered device fingerprint is analyzed to obtain the device fingerprint offset coefficient Xzw, which is obtained through the following formula:

[0023] Xzw = 1 - cos(Xzw, Xdj);

[0024] In the formula, cos(Xzw, Xdj) represents the cosine similarity between the fingerprint vector Xzw of the currently logged-in device and the fingerprint vector Xdj of the user's registered device.

[0025] Preferably, the behavior assessment module includes an assessment unit and an anomaly detection unit;

[0026] The evaluation unit is used to extract features from the acquired location distance data. It correlates the extracted current IP address offset distance Lpy with the acquired login time deviation coefficient Xsj and device fingerprint offset coefficient Xzw. After dimensionless processing, it analyzes the degree of deviation in the user's behavior when remotely accessing the intranet via VPN, obtaining the access behavior deviation coefficient Zxw, which is specifically obtained using the following formula:

[0027] Zxw=α1*Lpy+α2*Xsj+α3*Xzw;

[0028] In the formula, α1, α2 and α3 represent the weight values ​​of the current IP address offset distance Lpy, the login time deviation coefficient Xsj and the device fingerprint offset coefficient Xzw, respectively.

[0029] Preferably, the anomaly detection unit is used to compare and analyze the acquired access behavior deviation coefficient Zxw with the preset deviation threshold R, determine whether the current user's behavior of remotely accessing the intranet via VPN is abnormal, and issue an access risk analysis command, the specific content of which is as follows:

[0030] If the access behavior deviation coefficient Zxw ≥ deviation threshold R, it is determined that the current user's behavior of remotely accessing the internal network via VPN is abnormal, indicating that the current user's behavior of remotely accessing the internal network via VPN is abnormal internal access. At this time, an access risk analysis command is issued to the outside.

[0031] If the access behavior deviation coefficient Zxw < deviation threshold R, it is determined that the current user's behavior of remotely accessing the intranet via VPN is not abnormal, indicating that the current user's behavior of remotely accessing the intranet via VPN is normal internal access, and no additional access risk analysis command is issued at this time.

[0032] Preferably, the joint risk assessment module includes a trajectory analysis unit and a risk assessment unit;

[0033] The trajectory analysis unit, upon receiving an access risk analysis command, configures distributed intrusion detection probes at the transmission link layer. Combining user operation path capture and command call chain analysis technologies, it records in real-time page access, function calls, and page jumps during abnormal internal access behavior of a user remotely accessing the intranet via VPN. The unit sorts the user's operation steps chronologically and, using behavior path compression and encoding mechanisms, merges duplicate paths, invalid clicks, and background task behaviors. Each operation step's unique identifier is represented by a numerical code, forming the current behavior trajectory encoding value sequence Fa, in the form Fa = {Fa1, Fa2, Fa3, ..., Fa...}. n Based on the user's historical normal internal access behavior, a stable sequence of historical behavior trajectory encoding values ​​Fs is extracted and clustered, in the form of Fs={Fs1, Fs2, Fs3, ..., Fs n};

[0034] By correlating the current behavior trajectory encoding value sequence Fa with the historical behavior trajectory encoding value sequence Fs, the deviation between the current user's behavior trajectory of remotely accessing the intranet via VPN and the historical normal internal access behavior trajectory is analyzed, and the behavior trajectory deviation coefficient Xgj is obtained, which is specifically obtained through the following formula:

[0035]

[0036] In the formula, Fa i Let Fs be the i-th step encoded value of the current behavior trajectory encoded value sequence. i Let represent the i-th step encoded value in the sequence of historical behavioral trajectory encoded values, where i = 1, 2, 3, ..., n, and n represents the step number in the sequence of behavioral trajectory encoded values. Then, |Fa i -Fs i | represents the difference between the current behavior trajectory encoding value sequence and the historical behavior trajectory encoding value sequence at the i-th step, specifically the degree of deviation between the two at each operation step.

[0037] Preferably, the risk assessment unit is used to correlate the obtained access behavior deviation coefficient Zxw with the behavior trajectory offset coefficient Xgj. After dimensionless processing, it analyzes the risk level of the current user's abnormal internal access behavior through VPN remote access to the intranet, and obtains the joint access risk assessment index Zpg, which is specifically obtained through the following formula:

[0038]

[0039] In the formula, β1 and β2 both represent weight values.

[0040] Preferably, the security defense module compares the joint access risk assessment index Zpg with the preset risk assessment threshold P to determine whether the current user's abnormal internal access behavior of remotely accessing the intranet via VPN poses a risk, and obtains and executes the corresponding level of security defense instructions, as detailed below:

[0041] If the risk assessment index Zpg ≥ risk assessment threshold P, then the current user's abnormal internal access behavior via VPN to remotely access the intranet is deemed risky. A Level 1 security defense instruction will be obtained and executed, which includes: immediately terminating the user's current VPN session connection; freezing the current user's account and prohibiting subsequent login attempts; notifying the system administrator and security response center to generate an emergency alert event; simultaneously reporting the current multi-source behavioral data to the threat intelligence center and including it in the behavior blacklist system; and tracing and locking the data access operation logs of the current user.

[0042] If the joint access risk assessment index Zpg < risk assessment threshold P, it is determined that the current user's abnormal internal access behavior of remotely accessing the intranet via VPN does not pose a risk. The secondary security defense instruction is then obtained and executed. The execution content is as follows: dynamically downgrade the current user's access permissions, retain only basic operation permissions, and restrict access to highly sensitive resource directories; start a real-time session behavior monitoring mechanism to continuously track its subsequent behavior.

[0043] This invention provides a network security defense system based on collaborative intrusion detection, which has the following beneficial effects:

[0044] (1) By constructing a multi-dimensional behavior modeling mechanism that integrates time offset analysis, geographical location comparison, device fingerprint recognition and behavior trajectory sequence matching, and combining the access behavior deviation coefficient Zxw calculation and the joint access risk assessment index Zpg evaluation method, the perception capability and response accuracy of intrusion behavior with valid credentials but abnormal behavior in remote office environment are significantly improved. The system achieves collaborative linkage in the user login behavior stage, session behavior stage and risk response stage, and constructs a complete closed-loop mechanism with multi-source data acquisition, feature modeling analysis, risk level output and security policy linkage. It effectively overcomes the problem of insufficient detection capability of traditional static rule defense system for advanced disguise behavior, and enhances the security protection capability and event response efficiency of enterprises in remote access scenarios.

[0045] (2) By introducing three dimensions—the current IP address offset distance Lpy, the obtained login time deviation coefficient Xsj, and the device fingerprint offset coefficient Xzw—the system collects features and models the behavior deviation of users accessing the VPN remotely, constructs the access behavior deviation coefficient Zxw, and realizes the quantitative expression of the micro-behavioral variation of user access behavior, which has high behavioral sensitivity and timeliness. Combined with dimensionless normalization processing and weighted association mechanism, the system can accurately identify access behaviors such as login during abnormal time periods, significant location jumps, and obvious deviations in device characteristics. Even when the user identity authentication is successful, it can also realize the proactive identification and initial risk judgment of abnormal access patterns, effectively making up for the technical shortcomings of the existing system in lacking a judgment mechanism for dynamic behavior.

[0046] (3) Based on the access deviation judgment, the system further combines the user's operation path trajectory in the current session with the historical behavior trajectory sequence for encoding and comparison, constructs the behavior trajectory deviation coefficient Xgj, and calculates it together with the access behavior deviation coefficient Zxw to form the joint access risk assessment index Zpg, thereby realizing a multi-dimensional and progressive risk assessment of abnormal behavior from initial deviation to deep intrusion attempt. This mechanism not only improves the system's identification granularity of highly concealed behavior variations, but also supports the dynamic adjustment of risk level and the implementation of graded response strategies, enhancing the accurate identification and defense capabilities against complex attack behaviors. Attached Figure Description

[0047] Figure 1 This is a block diagram of a network security defense system based on collaborative intrusion detection according to the present invention;

[0048] Figure 2 This is a logical diagram of a network security defense system based on collaborative intrusion detection according to the present invention.

[0049] Figure 3 This is a diagram showing the device connection relationships of the communication transmission architecture of this invention. Detailed Implementation

[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Example 1

[0052] Please see Figure 1 and Figure 2This invention provides a network security defense system based on collaborative intrusion detection, including a behavior data acquisition module, an anomaly analysis module, a behavior assessment module, a joint risk assessment module, and a security defense module;

[0053] The behavior data collection module is used to collect relevant access behavior information of users;

[0054] The anomaly analysis module is used to analyze the user's login time and the degree of deviation of the fingerprint of the currently logged-in device;

[0055] The behavior assessment module is used to analyze the degree of deviation of user access behavior in order to determine whether the current user access behavior is abnormal and to issue access risk analysis instructions.

[0056] The joint risk assessment module is used to analyze the risk level of the current user's abnormal internal access behavior after receiving an access risk analysis instruction;

[0057] The security defense module is used to determine whether the current user's abnormal internal access behavior poses a risk, and to obtain and execute the corresponding level of security defense instructions.

[0058] In this embodiment, by constructing a multi-module collaborative structure encompassing behavioral data collection, anomaly analysis, behavioral assessment, joint risk assessment, and security defense, the system achieves end-to-end dynamic monitoring and response capabilities for remote access behavior, from collection to defense. Based on multi-dimensional information about user access behavior, and combined with key indicators such as login time deviation and device fingerprint similarity, the system establishes an abnormal behavior judgment mechanism. This mechanism can accurately identify potential intrusion risks even when user credentials are valid but behavior is abnormal, effectively avoiding misjudgments and missed detections caused by traditional static rule-based defense systems. Simultaneously, the system introduces a joint risk assessment mechanism, further comprehensively analyzing user behavior based on the judgment of behavioral deviation. By analyzing the deviation between user behavior patterns and historical operating patterns, a more accurate and in-depth risk index is formed, effectively improving the ability to identify advanced persistent threats and disguised attack behaviors. Compared with existing technologies, the outstanding advantages of this system are: it can not only continuously track behavioral dynamics after authentication, but also provide early warnings before risks occur. Through the security defense module, it can automatically respond according to the risk level and execute differentiated emergency defense measures, including privilege downgrading, session interruption, and account banning. It truly realizes the transformation from post-event defense to behavior perception-driven in-event prevention and control, thereby significantly enhancing the security control capabilities and proactive response of the network boundary in remote office scenarios.

[0059] Example 2

[0060] Please refer to Figure 1 and Figure 3 Specifically: the behavior data acquisition module includes a deployment unit and a behavior data acquisition unit;

[0061] The deployment unit is used to deploy multiple sets of detection devices in a layered manner in the communication transmission architecture of remote office according to the detection requirements of potential intrusion behavior. The multiple sets of detection devices deployed in a layered manner include deep packet inspection sensors embedded in VPN access nodes in the user access layer, distributed intrusion detection probes configured in the transmission link layer, collaborative identification hub components deployed on the server communication bus, and data interaction cache pools and preprocessing task schedulers set up at the boundaries between the enterprise internal network and remote access.

[0062] Deep packet inspection sensors are used to acquire IP identifiers, timestamps, geographical locations, and device fingerprint information in user login requests in real time; distributed intrusion detection probes are used to synchronously replicate command streams, API call sequences, and session data paths in the communication link; the collaborative identification hub component is used to aggregate, match, and risk score multi-source behavioral data, while introducing a behavior correction feedback mechanism; the data interaction cache pool and preprocessing task scheduler are used to perform data cleaning, standardization, and vector encoding preprocessing operations on the collected multi-source behavioral data, and to store the data.

[0063] Specifically, the behavior data acquisition unit monitors the login time status of users remotely accessing the intranet via VPN based on the deep packet inspection sensor embedded in the VPN access node of the user access layer, and obtains relevant timestamp data information. Based on IP reverse lookup and combined with the user's historical permanent geographical area, it collects the distance between the user's login location and commonly used location when remotely accessing the intranet via VPN, and obtains relevant location distance data information. Relying on the browser fingerprint extraction and client environment detection technology of the access terminal, it collects the device fingerprint information of the user remotely accessing the intranet via VPN, and obtains relevant fingerprint feature data information. Among them, the relevant timestamp data information includes the current user login time Tyd, the relevant location distance data information includes the current IP address offset distance Lpy, and the relevant fingerprint feature data information includes the current login device fingerprint vector Xzw.

[0064] It should be noted that the current user login time Tyd refers to the precise login timestamp triggered when the current user remotely accesses the enterprise intranet via VPN, expressed in second-level time format. It is a basic indicator for identifying whether the user's login behavior is within its historical behavior time window. Combined with the historical login time statistical model, it can be used to calculate the time offset coefficient Xsj to determine whether there are abnormal login times (early morning and non-working hours). The deep packet inspection sensor embedded in the VPN access node records the time field attached to the user's access behavior in real time, which is automatically collected through the access event log without user intervention.

[0065] The current login device fingerprint vector Xzw refers to the hardware and software environment feature vector presented by the terminal device used by the current user during the login process. It usually includes a combination vector representation of several features of the device, such as browser type, operating system version, time zone setting, font, plugins, and screen resolution. It is used to compare with the device fingerprint vectors registered by the user in the past. By calculating the vector similarity, the device fingerprint offset coefficient Xzw is obtained, which in turn determines whether the current terminal is an authenticated device. This helps to identify disguised intrusion behaviors such as impersonating accounts and using unauthorized devices. Based on deep packet inspection sensors and combined with fingerprint extraction technology (Canvas fingerprint, WebGL fingerprint) and client environment detection mechanism, it is automatically collected and encoded during the user login interaction stage and extracted by a lightweight probe on the terminal device side.

[0066] The current IP address offset distance Lpy represents the physical distance between the geographical location of the public IP address used by the current user during login and the user's commonly used geographical area, expressed in meters. It is used to determine whether the user's login location is abnormal, including sudden logins from different locations or countries. It can reveal potential cross-regional spoofing access risks and is an important basis for assessing access credibility. The geographical coordinates of the current IP are obtained through reverse geospatial resolution technology, and then the spatial distance is calculated with the user's historical resident IP address location. This is generally automated by integrating an IP geolocation database.

[0067] In this embodiment, the design of the behavior data acquisition module fully reflects the high-precision perception capability of potential intrusion behaviors in a remote office environment. Through the collaborative work of the deployment unit and the behavior data acquisition unit, it constructs a full-link, hierarchical, and highly perceptive access behavior data acquisition system. The deployment unit, combined with the characteristics of remote communication structure, sets up multiple types of dedicated detection devices at the user access layer, transmission link layer, server communication bus, and network boundary, realizing multi-point data synchronization and composite monitoring throughout the entire process from access to command execution. In particular, the collaborative deployment of deep packet inspection sensors embedded in VPN access nodes, distributed intrusion probes in the link, and collaborative identification hub components on the server side enables the system to collect login IP, timestamp, geographical location, and device fingerprint in real time. Based on the basic connection parameters, it can accurately reconstruct the operation trajectory and command flow behavior during the user session, constructing a high-dimensional, high-density behavioral information foundation. On this basis, the behavioral data acquisition unit, based on browser fingerprint extraction and client environment detection technology, combined with IP reverse resolution and user historical permanent geographic model, achieves high-precision acquisition of device fingerprint vector Xzw, IP address offset distance Lpy, and current login time Tyd. The advantage of this mechanism is that it can not only capture the user's explicit login behavior, but also achieve early detection of highly concealed intrusion signs such as potential fake login, location jump, and terminal switching through cross-analysis of environmental parameters and device characteristics, thus providing a solid data foundation for subsequent abnormal behavior judgment and risk index construction.

[0068] Example 3

[0069] Please refer to Figure 1 Specifically: the anomaly analysis module includes a time offset analysis unit and a device fingerprint offset analysis unit;

[0070] The time offset analysis unit is used to obtain the historical login time Tss of each user based on the user's historical login time stored in the data interaction cache pool and the preprocessing task scheduler after feature extraction. Combined with a statistical averaging algorithm, the historical average login time Tss is obtained. avg ;

[0071] It should be noted that the historical login time (Tss) for each user is used to characterize the distribution pattern of the user's daily login behavior over time, and is used in subsequent calculations of the historical average login time (Tss). avg The key basis; the acquisition method of each user's historical login time (TSS) relies on the deep packet inspection sensor, which is embedded in the VPN access node. After each user initiates a remote login request and successfully authenticates, the precise timestamp of the login is automatically recorded. The collected time data is uploaded to the data interaction cache pool through the transmission link for unified management, and under the call of the preprocessing task scheduler, time feature extraction and serialization storage are performed.

[0072] The relevant timestamp data information obtained from the behavior data collection unit is compared with the historical average login time Tss. avg After correlation and dimensionless processing, the deviation of the user's login time when remotely accessing the intranet via VPN from the user's historical login time is analyzed to obtain the login time deviation coefficient Xsj, which is obtained through the following formula:

[0073]

[0074] In the formula, Tyd represents the current user login time, and σTss represents the standard deviation of the historical login times of each user.

[0075] It should be noted that the formula in the behavioral data collection unit effectively measures the degree to which the current login behavior deviates from the user's normal behavior pattern in the time dimension by normalizing the difference between the current login time and the user's own login behavior mean. Addressing the issue pointed out in the background technology that existing defense systems lack effective means to identify intrusions using legitimate credentials but exhibiting abnormal behavior, especially in remote work scenarios where attackers can bypass credential authentication for highly covert intrusions, this formula establishes a personalized benchmark model of user time behavior to quantitatively determine whether the current login occurs outside the user's usual login time range, thereby achieving accurate identification of time-drifting abnormal access. The login time deviation coefficient Xsj transforms easily overlooked time features in login behavior into measurable risk parameters. Even if an attacker uses genuine credentials, logging in at atypical times (early morning and non-working hours) can be identified as a high-risk event by the system. This mechanism effectively compensates for the insufficient ability of traditional systems to model user dynamic behavior, providing crucial support for achieving intrusion identification based on behavioral features.

[0076] Specifically, the device fingerprint offset analysis unit is used to obtain the user's registered device fingerprint vector Xdj based on the user's first authorized login device information record, combined with browser fingerprint extraction and client environment detection technology;

[0077] It should be noted that the user-registered device fingerprint vector Xdj refers to a set of standardized vector data extracted and saved when a user successfully logs into the enterprise intranet for the first time through a trusted terminal device and is granted system trust. This data identifies the environmental characteristics of the device. The user-registered device fingerprint vector Xdj consists of multiple static parameters, including the operating system type, browser version, time zone setting, font rendering characteristics, plugin information, screen resolution, and hardware ID of the registered device, reflecting the unique usage environment of the device. The acquisition process of the user-registered device fingerprint vector Xdj relies on browser fingerprint extraction technology and client environment detection mechanisms. During the user's initial login interaction, the above parameters are automatically collected based on deep packet inspection sensors and fingerprint extraction technologies (Canvas fingerprint, WebGL fingerprint), and encoded into a structured feature vector. This vector is then stored in the behavior data recognition center and bound to the user's account. The user-registered device fingerprint vector Xdj serves as the device identity benchmark in subsequent behavior recognition. It is used to compare with the fingerprint vector of the currently accessing device to determine whether the terminal is a registered device, thereby identifying potential intrusion behaviors such as credential misuse and device spoofing.

[0078] By performing feature recognition on relevant fingerprint feature data, the extracted fingerprint vector Xzw of the currently logged-in device is correlated with the fingerprint vector Xdj of the user's registered device. After dimensionless processing, the deviation of the current logged-in device fingerprint from the user's registered device fingerprint is analyzed to obtain the device fingerprint offset coefficient Xzw, which is obtained through the following formula:

[0079] Xzw = 1 - cos(Xzw, Xdj);

[0080] In the formula, cos(Xzw, Xdj) represents the cosine similarity between the fingerprint vector Xzw of the currently logged-in device and the fingerprint vector Xdj of the user's registered device.

[0081] It should be noted that the formula in the device fingerprint offset analysis unit calculates the similarity of the angle between device feature vectors and takes its inverse value to obtain a standardized device fingerprint offset coefficient Xzw, which reflects the degree of deviation between the current device and historically authenticated devices. This formula directly addresses the technical shortcomings of attackers bypassing authentication by simulating device fingerprints in the background technology. Traditional systems typically rely only on account passwords and authentication tokens for identity verification, lacking the ability to continuously identify devices. The device fingerprint offset coefficient Xzw introduces vectorized analysis of device environment parameters (operating system, browser, plugins, resolution, and font) and evaluates the consistency between the current device and historically trusted devices in the multi-dimensional fingerprint feature space through cosine similarity, thereby effectively identifying access behavior where the credentials are legitimate but the device is abnormal. Its function is that even if the attacker has the correct credentials, as long as the device features are not highly restored, the high offset value of the device fingerprint offset coefficient Xzw can be used to achieve intrusion identification and early warning. Therefore, this mechanism significantly enhances the system's defense capabilities against device spoofing attacks, account sharing behavior, and terminal hijacking in remote office environments.

[0082] In this embodiment, the anomaly analysis module significantly improves the system's ability to identify potential abnormal patterns in user remote access behavior, especially when the user has already been authenticated with valid credentials, it can still make accurate judgments based on deviations in their behavioral characteristics. A deviation measurement model based on behavioral stability is established through the time offset analysis unit and the device fingerprint offset analysis unit. The time offset analysis unit calculates the historical average login time Tss by calling the historical login times Tss recorded in the data interaction cache pool and the preprocessing task scheduler, combined with statistical methods. avg The system normalizes the current user login time using its standard deviation to obtain the login time deviation coefficient Xsj. This not only considers changes in login time but also incorporates the fluctuation range of the user's own behavior, enabling sensitive identification of abnormal access behavior outside of working hours. The device fingerprint offset analysis unit then calls the user's registered device fingerprint vector Xdj from the first trusted device and combines it with the obtained current login device fingerprint vector Xzw, using cosine similarity to calculate the device fingerprint offset coefficient Xzw to determine whether the current device is a user's historically frequently used terminal. The advantage of the above dual-path analysis mechanism is that even if an attacker obtains user credentials and passes authentication, it is difficult to completely simulate the user's typical login time and device characteristics, thus exposing the deviation characteristics of the hidden intrusion at the behavioral level. This enables early identification and warning of users with statically legitimate identities but abnormal dynamic behaviors, effectively compensating for the blind spots of traditional authentication security methods in defending against pseudo-legitimate access, and enhancing the system's behavioral cognition depth and pre-judgment capabilities.

[0083] Example 4

[0084] Please refer to Figure 1 Specifically: the behavior assessment module includes an assessment unit and an anomaly detection unit;

[0085] The evaluation unit is used to extract features from the acquired location distance data. It correlates the extracted current IP address offset distance Lpy with the acquired login time deviation coefficient Xsj and device fingerprint offset coefficient Xzw. After dimensionless processing, it analyzes the degree of deviation in the user's behavior when remotely accessing the intranet via VPN, obtaining the access behavior deviation coefficient Zxw, which is specifically obtained using the following formula:

[0086] Zxw=α1*Lpy+α2*Xsj+α3*Xzw;

[0087] In the formula, α1, α2 and α3 represent the weight values ​​of the current IP address offset distance Lpy, the login time deviation coefficient Xsj and the device fingerprint offset coefficient Xzw, respectively.

[0088] It should be noted that the formula in the evaluation unit weights and fuses multiple key behavioral deviation dimensions to quantify the overall deviation of the user's current behavior from its normal behavior model within a multi-dimensional feature space. This addresses the difficulty existing systems face in identifying remote intrusion behaviors with legitimate credentials but abnormal behavior, as pointed out in the background technology, especially when attackers bypass traditional authentication mechanisms through account sharing, geographical drift, and terminal spoofing. This formula transforms previously isolated and easily circumvented single behavioral indicators into a unified access behavior deviation coefficient Zxw, enabling a comprehensive assessment of anomalies from multiple behavioral dimensions. Its function is to identify attack behaviors with a certain degree of concealment but significant overall deviation (login from a different location using an unfamiliar device during non-working hours), promptly triggering subsequent risk analysis and defense response mechanisms. This enhances the system's ability to identify cross-dimensional abnormal behaviors and is a crucial core formula supporting intelligent behavior determination.

[0089] Specifically, the anomaly detection unit compares and analyzes the acquired access behavior deviation coefficient Zxw with the preset deviation threshold R to determine whether the current user's behavior of remotely accessing the intranet via VPN is abnormal, and issues an access risk analysis command, the details of which are as follows:

[0090] If the access behavior deviation coefficient Zxw ≥ deviation threshold R, it is determined that the current user's behavior of remotely accessing the internal network via VPN is abnormal, indicating that the current user's behavior of remotely accessing the internal network via VPN is abnormal internal access. At this time, an access risk analysis command is issued to the outside.

[0091] If the access behavior deviation coefficient Zxw < deviation threshold R, it is determined that the current user's behavior of remotely accessing the intranet via VPN is not abnormal, indicating that the current user's behavior of remotely accessing the intranet via VPN is normal internal access, and no additional access risk analysis command is issued at this time.

[0092] In this embodiment, the behavior evaluation module constructs a multi-factor fusion judgment mechanism for the degree of deviation of remote access behavior. By performing correlation modeling and comprehensive evaluation of different types of offset data, the system's accuracy in identifying abnormal access behavior is enhanced. The evaluation unit first normalizes the IP address offset distance Lpy, login time deviation coefficient Xsj, and device fingerprint offset coefficient Xzw associated with the user's current login behavior, and calculates the access behavior deviation coefficient Zxw through the behavior fusion formula, forming a composite behavior coefficient that can comprehensively reflect the user's login location, time stability, and terminal consistency. It does not rely on any single abnormal behavior to trigger a response, but judges whether the user is in a significant behavior by aggregating behavior trends. The drift state provides stronger false alarm suppression and robustness in anomaly detection. The anomaly detection unit uses the system-set deviation threshold R as a benchmark to compare and analyze the deviation coefficient Zxw of access behavior, realizing an automated mechanism for initial judgment of abnormal behavior and issuance of access risk commands. The advantages of this mechanism are: it establishes an adaptive threshold judgment system based on the fluctuation of actual behavior parameters, which can not only identify highly abnormal single access behaviors, but also effectively capture low-frequency but long-term deviation characteristics of abnormal access tendencies, avoiding the problem of being ignored by existing systems due to the fragmentation and concealment of attack behaviors; it realizes a unified identification framework for multiple potential intrusion behaviors such as disguised access, cross-location remote login, and unauthorized terminal access, improving the overall intelligence level and judgment reliability of intrusion detection in remote office scenarios.

[0093] Example 5

[0094] Please refer to Figure 1 Specifically: the joint risk assessment module includes a trajectory analysis unit and a risk assessment unit;

[0095] The trajectory analysis unit, upon receiving an access risk analysis command, configures distributed intrusion detection probes at the transmission link layer. Combining user operation path capture and command call chain analysis technologies, it records in real-time page access, function calls, and page jumps during abnormal internal access behavior of a user remotely accessing the intranet via VPN. The unit sorts the user's operation steps chronologically and, using behavior path compression and encoding mechanisms, merges duplicate paths, invalid clicks, and background task behaviors. Each operation step's unique identifier is represented by a numerical code, forming the current behavior trajectory encoding value sequence Fa, in the form Fa = {Fa1, Fa2, Fa3, ..., Fa...}.n Based on the user's historical normal internal access behavior, a stable sequence of historical behavior trajectory encoding values ​​Fs is extracted and clustered, in the form of Fs={Fs1, Fs2, Fs3, ..., Fs n};

[0096] It should be noted that the current behavior trajectory encoding value sequence Fa refers to all page accesses, function calls, and module jumps of the current user in this remote login session. These actions are ordered according to their execution time sequence, and each operation step is mapped to a unique numerical identifier (function ID, page code, API call number) through a behavior path compression and encoding mechanism, ultimately forming a structured encoding value sequence used to accurately describe the user's current behavior path. The historical behavior trajectory encoding value sequence Fs is the behavior trajectory extracted from the user's previous normal login sessions. Through preprocessing operations such as path feature alignment, duplicate behavior deduplication, and invalid operation removal, combined with behavior clustering technology, multiple normal behavior paths are classified and modeled to extract representative behavior path sequences with stable structures.

[0097] By correlating the current behavior trajectory encoding value sequence Fa with the historical behavior trajectory encoding value sequence Fs, the deviation between the current user's behavior trajectory of remotely accessing the intranet via VPN and the historical normal internal access behavior trajectory is analyzed, and the behavior trajectory deviation coefficient Xgj is obtained, which is specifically obtained through the following formula:

[0098]

[0099] In the formula, Fa i Let Fs be the i-th step encoded value of the current behavior trajectory encoded value sequence. i Let represent the i-th step encoded value in the sequence of historical behavioral trajectory encoded values, where i = 1, 2, 3, ..., n, and n represents the step number in the sequence of behavioral trajectory encoded values. Then, |Fa i -Fs i | represents the difference between the current behavior trajectory encoding value sequence and the historical behavior trajectory encoding value sequence at the i-th step, specifically the degree of deviation between the two at each operation step.

[0100] It should be noted that the formula in the trajectory analysis unit is used to calculate the behavior trajectory offset coefficient Xgj. By averaging the offset values ​​of each operation encoding step, it measures the overall deviation between the current session behavior path and the user's historical normal behavior path. This formula addresses the technical deficiency pointed out in the background technology that existing systems have difficulty identifying abnormal access behavior after authentication. In remote work scenarios, even if an attacker obtains legitimate credentials and simulates the device environment, after initial authentication, they may still exhibit path characteristics in their operation behavior that are completely different from the user's normal access mode, including executing abnormal function jumps and bypassing normal navigation processes for sensitive access. The role of the path behavior and behavior trajectory offset coefficient Xgj is to introduce structured comparative analysis of the operation process. Based on the difference in the order of functional module calls, the path deviation is quantified. It can not only identify high-risk behavior sequences, but also serve as a key indicator for the system to trigger further risk assessment and defense response. Its advantage is that even if the attack behavior is compliant at the authentication and environment level, if its operation chain is significantly inconsistent with normal behavior, it can be identified with high accuracy. This mechanism effectively fills the gap in the existing defense system for deep path behavior analysis, enabling the system to have stronger intrusion intent recognition capabilities and behavior pattern perception capabilities, and improving the identification efficiency of disguised access behavior.

[0101] Specifically, the risk assessment unit correlates the obtained access behavior deviation coefficient Zxw with the behavior trajectory offset coefficient Xgj. After dimensionless processing, it analyzes the risk level of the current user's abnormal internal access behavior via VPN remote access to the intranet, and obtains the joint access risk assessment index Zpg, which is obtained through the following formula:

[0102]

[0103] In the formula, β1 and β2 both represent weight values.

[0104] It should be noted that the formula in the risk assessment unit weights and integrates the degree of behavioral deviation and differences in behavioral path structure, and combines the risk intensity in the form of a sum of squares to finally output the Joint Access Risk Assessment Index Zpg. This index measures the overall abnormality and security risk level of current remote access behavior. This formula is designed to address the problem raised in the background technology that existing systems struggle to identify deep behavioral anomalies even when credentials are valid. Traditional systems often misjudge and allow covert intrusion behaviors (simulated operation paths and atypical device logins) after authentication due to the lack of a comprehensive behavioral modeling mechanism. The role of the Joint Access Risk Assessment Index Zpg is... The key lies in: collaboratively evaluating the deviation of users' multi-dimensional characteristics during the login phase (geographic location, device fingerprint, and time anomalies) with the degree of deviation from their operational path structure, thereby forming a highly robust and high-resolution joint access risk assessment index Zpg. The joint access risk assessment index Zpg not only considers access entry behavior but also integrates access process behavior, realizing an advancement from judging behavioral compliance to judging behavioral intent. It can effectively identify deep threat behaviors such as potential spoofing, internal network reconnaissance, and sensitive redirection, serving as a quantitative basis for whether the system triggers defense strategies, thus improving the accuracy and dynamic judgment capability of remote access security defense systems in responding to complex intrusion scenarios.

[0105] In this embodiment, the joint risk assessment module expands the analytical depth from behavioral deviation identification to behavioral risk quantification. Through the coordinated processing of the trajectory analysis unit and the risk assessment unit, it achieves path-level perception and comprehensive risk assessment of abnormal user access behavior. The trajectory analysis unit relies on distributed intrusion detection probes deployed at the transmission link layer, combined with operation path capture and instruction call chain analysis technology, to acquire in real time the user's page access, function call, and jump behavior during VPN remote access, and reconstructs the operation process through time sequence. The system adopts a behavior path compression and encoding mechanism to merge repetitive operations, invalid jumps, and background instructions into a unified representation and convert them into a sequence of encoded value sequences Fa with a sequence structure. Then, it is compared with the historical behavior trajectory encoded value sequence Fs generated by clustering to calculate the behavior trajectory offset coefficient Xgj. This quantifies the structural deviation between the current operation process and the historical normal pattern. The risk assessment unit then weights and fuses the access behavior deviation coefficient Zxw and the behavior trajectory offset coefficient Xgj to generate a joint access risk assessment index Zpg, which serves as the output indicator for the system's final risk level assessment. The advantage of this mechanism lies in that it not only assesses the deviation of the user's pre-login behavior but also introduces, for the first time, a semantic structure comparison of the complete operation path. This enables the system to identify highly disguised intrusion behaviors where credentials are legitimate, devices are disguised, but the behavior path is abnormal. This avoids the risk of attackers evading security detection by simulating login and then performing sophisticated intranet operations. While maintaining real-time performance, it achieves a defense advancement from behavioral anomalies to intent recognition, significantly improving the accuracy of risk classification and the decision-making capability of the defense system in remote access scenarios.

[0106] Example 6

[0107] Please refer to Figure 1 Specifically: The security defense module compares the joint access risk assessment index Zpg with the preset risk assessment threshold P to determine whether the current user's abnormal internal access behavior of remotely accessing the intranet via VPN poses a risk, and then obtains and executes the corresponding level of security defense instructions. The specific content is as follows:

[0108] If the risk assessment index Zpg ≥ risk assessment threshold P, then the current user's abnormal internal access behavior via VPN to remotely access the intranet is deemed risky. A Level 1 security defense instruction will be obtained and executed, which includes: immediately terminating the user's current VPN session connection; freezing the current user's account and prohibiting subsequent login attempts; notifying the system administrator and security response center to generate an emergency alert event; simultaneously reporting the current multi-source behavioral data to the threat intelligence center and including it in the behavior blacklist system; and tracing and locking the data access operation logs of the current user.

[0109] If the joint access risk assessment index Zpg < risk assessment threshold P, it is determined that the current user's abnormal internal access behavior of remotely accessing the intranet via VPN does not pose a risk. The secondary security defense instruction is then obtained and executed. The execution content is as follows: dynamically downgrade the current user's access permissions, retain only basic operation permissions, and restrict access to highly sensitive resource directories; start a real-time session behavior monitoring mechanism to continuously track its subsequent behavior.

[0110] In this embodiment, the security defense module constructs an adaptive response mechanism based on the Joint Access Risk Assessment Index (Zpg). By introducing a risk level determination and graded response command execution strategy, it achieves a closed-loop linkage from behavior identification to practical protection. Based on the comparison result between the Joint Access Risk Assessment Index (Zpg) and the preset risk threshold P, it automatically determines whether the current user's behavior of remotely accessing the internal network via VPN is high-risk, and selects to execute first-level security defense commands and second-level security defense commands accordingly. When the security defense command exceeds the risk threshold P, it will be identified as a major security threat, and the first-level security defense command will be executed immediately, including interrupting the VPN session connection, freezing the user account, reporting the behavior to the threat intelligence platform, and locking its access logs, ensuring that potential intruders cannot continue to penetrate or spread the attack path after triggering key risk behaviors. When the joint access risk assessment index Zpg does not exceed the risk threshold P, the system triggers a level-two security defense command. This dynamically downgrades access permissions, restricts access to sensitive directories, and initiates subsequent behavior tracking, achieving prudent control and continuous monitoring of abnormal behavior. The advantage lies in the fact that the security defense response mechanism is not a one-size-fits-all approach of complete blocking or full access, but rather a flexible, tiered control strategy built on risk quantification. This allows the system to maintain high security while also balancing business continuity and user experience. Furthermore, through data backtracking and locking mechanisms and blacklist synchronization, it not only provides real-time blocking but also ensures post-incident evidence collection and multi-system joint defense capabilities. This truly realizes intelligent decision-making, dynamic deployment, and multi-domain linkage of security policies, improving the system's comprehensive defense effectiveness against advanced persistent threats and disguised attacks.

[0111] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network security defense system based on collaborative intrusion detection, characterized in that: It includes a behavioral data collection module, an anomaly analysis module, a behavioral assessment module, a joint risk assessment module, and a security defense module; The behavior data collection module is used to collect relevant access behavior information of users; The anomaly analysis module is used to analyze the user's login time and the degree of deviation of the fingerprint of the currently logged-in device; The behavior assessment module is used to analyze the degree of deviation of user access behavior in order to determine whether the current user access behavior is abnormal and to issue access risk analysis instructions. The joint risk assessment module is used to analyze the risk level of the current user's abnormal internal access behavior after receiving an access risk analysis instruction; The security defense module is used to determine whether the current user's abnormal internal access behavior poses a risk, and to obtain and execute the corresponding level of security defense instructions.

2. The network security defense system based on collaborative intrusion detection according to claim 1, characterized in that: The behavior data acquisition module includes a deployment unit and a behavior data acquisition unit; The deployment unit is used to deploy multiple sets of detection devices in a layered manner in the communication transmission architecture of remote office according to the detection requirements of potential intrusion behavior. The multiple sets of detection devices deployed in a layered manner include deep packet inspection sensors embedded in VPN access nodes in the user access layer, distributed intrusion detection probes configured in the transmission link layer, collaborative identification hub components deployed on the server communication bus, and data interaction cache pools and preprocessing task schedulers set up at the boundaries between the enterprise internal network and remote access. Deep packet inspection sensors are used to acquire IP identifiers, timestamps, geographical locations, and device fingerprint information in user login requests in real time; distributed intrusion detection probes are used to synchronously replicate command streams, API call sequences, and session data paths in the communication link; the collaborative identification hub component is used to aggregate, match, and risk score multi-source behavioral data, while introducing a behavior correction feedback mechanism; the data interaction cache pool and preprocessing task scheduler are used to perform data cleaning, standardization, and vector encoding preprocessing operations on the collected multi-source behavioral data, and to store the data.

3. A network security defense system based on collaborative intrusion detection according to claim 2, characterized in that: The behavior data acquisition unit is used to monitor the login time status of users remotely accessing the intranet via VPN based on the deep packet inspection sensor embedded in the VPN access node of the user access layer, and obtain relevant timestamp data information. Based on IP reverse lookup and combined with the user's historical permanent geographical area, it collects the distance between the user's login location and commonly used location when remotely accessing the intranet via VPN, and obtains relevant location distance data information. Relying on the browser fingerprint extraction and client environment detection technology of the access terminal, it collects the device fingerprint information of the user remotely accessing the intranet via VPN, and obtains relevant fingerprint feature data information. Among them, the relevant timestamp data information includes the current user login time Tyd, the relevant location distance data information includes the current IP address offset distance Lpy, and the relevant fingerprint feature data information includes the current login device fingerprint vector Xzw.

4. A network security defense system based on collaborative intrusion detection according to claim 3, characterized in that: The anomaly analysis module includes a time offset analysis unit and a device fingerprint offset analysis unit; The time offset analysis unit is used to obtain the historical login time Tss of each user based on the user's historical login time stored in the data interaction cache pool and the preprocessing task scheduler after feature extraction. Combined with a statistical averaging algorithm, the historical average login time Tss is obtained. avg ; The relevant timestamp data information obtained from the behavior data collection unit is compared with the historical average login time Tss avg After correlation and dimensionless processing, the deviation of the user's login time when remotely accessing the intranet via VPN from the user's historical login time is analyzed to obtain the login time deviation coefficient Xsj, which is obtained through the following formula: In the formula, Tyd represents the current user login time, and σTss represents the standard deviation of the historical login times of each user.

5. A network security defense system based on collaborative intrusion detection according to claim 4, characterized in that: The device fingerprint offset analysis unit is used to obtain the user's registered device fingerprint vector Xdj based on the user's first authorized login device information record, combined with browser fingerprint extraction and client environment detection technology; By performing feature recognition on relevant fingerprint feature data, the extracted fingerprint vector Xzw of the currently logged-in device is correlated with the fingerprint vector Xdj of the user's registered device. After dimensionless processing, the deviation of the current logged-in device fingerprint from the user's registered device fingerprint is analyzed to obtain the device fingerprint offset coefficient Xzw, which is obtained through the following formula: Xzw = 1 - cos(Xzw, Xdj); In the formula, cos(Xzw, Xdj) represents the cosine similarity between the fingerprint vector Xzw of the currently logged-in device and the fingerprint vector Xdj of the user's registered device.

6. A network security defense system based on collaborative intrusion detection according to claim 5, characterized in that: The behavior assessment module includes an assessment unit and an anomaly detection unit; The evaluation unit is used to extract features from the acquired location distance data. It correlates the extracted current IP address offset distance Lpy with the acquired login time deviation coefficient Xsj and device fingerprint offset coefficient Xzw. After dimensionless processing, it analyzes the degree of deviation in the user's behavior when remotely accessing the intranet via VPN, obtaining the access behavior deviation coefficient Zxw, which is specifically obtained using the following formula: Zxw=α1*Lpy+α2*Xsj+α3*Xzw; In the formula, α1, α2 and α3 represent the weight values ​​of the current IP address offset distance Lpy, the login time deviation coefficient Xsj and the device fingerprint offset coefficient Xzw, respectively.

7. A network security defense system based on collaborative intrusion detection according to claim 6, characterized in that: The anomaly detection unit compares and analyzes the acquired access behavior deviation coefficient Zxw with the preset deviation threshold R to determine whether the current user's behavior of remotely accessing the intranet via VPN is abnormal, and issues an access risk analysis command, the details of which are as follows: If the access behavior deviation coefficient Zxw ≥ deviation threshold R, it is determined that the current user's behavior of remotely accessing the internal network via VPN is abnormal, indicating that the current user's behavior of remotely accessing the internal network via VPN is abnormal internal access. At this time, an access risk analysis command is issued to the outside. If the access behavior deviation coefficient Zxw < deviation threshold R, it is determined that the current user's behavior of remotely accessing the intranet via VPN is not abnormal, indicating that the current user's behavior of remotely accessing the intranet via VPN is normal internal access, and no additional access risk analysis command is issued at this time.

8. A network security defense system based on collaborative intrusion detection according to claim 7, characterized in that: The joint risk assessment module includes a trajectory analysis unit and a risk assessment unit; The trajectory analysis unit, upon receiving an access risk analysis command, configures distributed intrusion detection probes at the transmission link layer. Combining user operation path capture and command call chain analysis technologies, it records in real-time page access, function calls, and page jumps during abnormal internal access behavior of a user remotely accessing the intranet via VPN. The unit sorts the user's operation steps chronologically and, using behavior path compression and encoding mechanisms, merges duplicate paths, invalid clicks, and background task behaviors. Each operation step's unique identifier is represented by a numerical code, forming the current behavior trajectory encoding value sequence Fa, in the form Fa = {Fa1, Fa2, Fa3, ..., Fa...}. n Based on the user's historical normal internal access behavior, a stable sequence of historical behavior trajectory encoding values ​​Fs is extracted and clustered, in the form of Fs={Fs1, Fs2, Fs3, ..., Fs n }; By correlating the current behavior trajectory encoding value sequence Fa with the historical behavior trajectory encoding value sequence Fs, the deviation between the current user's behavior trajectory of remotely accessing the intranet via VPN and the historical normal internal access behavior trajectory is analyzed, and the behavior trajectory deviation coefficient Xgj is obtained, which is specifically obtained through the following formula: In the formula, Fa i Let Fs be the i-th step encoded value of the current behavior trajectory encoded value sequence. i Let i represent the i-th step of the historical behavior trajectory encoding value sequence, where i = 1, 2, 3, ..., n, and n represents the step number in the behavior trajectory encoding value sequence.

9. A network security defense system based on collaborative intrusion detection according to claim 8, characterized in that: The risk assessment unit correlates the obtained access behavior deviation coefficient Zxw with the behavior trajectory offset coefficient Xgj. After dimensionless processing, it analyzes the risk level of abnormal internal access behavior of current users remotely accessing the intranet via VPN, and obtains the joint access risk assessment index Zpg, which is specifically obtained through the following formula: In the formula, β1 and β2 both represent weight values.

10. A network security defense system based on collaborative intrusion detection according to claim 9, characterized in that: The security defense module compares the joint access risk assessment index Zpg with the preset risk assessment threshold P to determine whether the current user's abnormal internal access behavior of remotely accessing the intranet via VPN poses a risk. It then obtains and executes the corresponding level of security defense instructions, as detailed below: If the joint access risk assessment index Zpg ≥ risk assessment threshold P, then the current user's abnormal internal access behavior via VPN to remotely access the intranet is determined to be risky. A Level 1 security defense instruction will be obtained and executed, the content of which is as follows: Immediately terminate the user's current VPN session connection; freeze the current user account and prohibit subsequent login attempts; The system administrator and security response center are notified to generate emergency alerts; at the same time, current multi-source behavioral data is reported to the threat intelligence center and included in the behavioral blacklist system; and the data access operation logs of the current user are traced and locked. If the joint access risk assessment index Zpg < risk assessment threshold P, then it is determined that the current user's abnormal internal access behavior via VPN to remotely access the intranet does not pose a risk. The system then obtains and executes a Level 2 security defense instruction, the execution content of which is as follows: Dynamically downgrade the current user's access permissions, retaining only basic operation permissions and restricting access to highly sensitive resource directories; Activate a real-time session behavior monitoring mechanism to continuously track subsequent behavior.

Images