Process abnormal behavior detection method based on semantics
By proposing a process abnormal behavior detection method based on semantic feature algorithms and a two-layer detection model, the problems of high false alarm rate and inaccurate detection in existing technologies are solved, achieving more efficient process abnormal behavior detection and improving the accuracy and practicality of detection.
Patent Information
- Application Number
- CN202511244526.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-02
- Publication Date
- 2025-12-12
AI Technical Summary
Existing technologies for detecting abnormal process behavior suffer from high false alarm rates, reliance on expert experience, and difficulty in accurately detecting malicious processes that are adept at disguising themselves.
A semantic-based method for detecting abnormal process behavior is adopted. Semantic features are extracted from process operation data through semantic feature algorithms. Combined with a two-layer detection model and an active learning algorithm, efficient vectorization and detection of process operation data are achieved.
It improves the detection rate, reduces the false alarm rate, and provides dynamic adaptive capabilities in real-world environments, thereby enhancing the accuracy and practicality of detection.
Smart Images
Figure CN121118052A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of process anomaly behavior detection, and particularly relates to a process anomaly behavior detection method based on semantics. BACKGROUND
[0002] Process anomaly behavior detection refers to identifying and analyzing the behavior of processes in a computer system that deviate from normal operation patterns. Normally, processes have a fixed behavior pattern, including:
[0003] (1) Resource usage: memory, CPU, network bandwidth, etc.
[0004] (2) System calls: the way and frequency of interacting with the operating system.
[0005] (3) File access: reading, writing, deleting files.
[0006] (4) Network communication: connected IP addresses, ports, protocols.
[0007] When a process's behavior deviates from the normal pattern, it is considered abnormal. These abnormal behaviors may indicate security threats such as malware, vulnerability exploitation, or configuration errors. Security threats include but are not limited to the following:
[0008] (1) Many malware, such as viruses, Trojans, ransomware, etc., will modify process behavior to achieve attack purposes. For example, malware may run in the background, steal user data, or launch attacks on other computers.
[0009] (2) Attackers may exploit software vulnerabilities to execute malicious code, which usually runs in the form of a process and exhibits abnormal behavior.
[0010] (3) Incorrect software configuration may cause abnormal processes, for example, a database server may be configured to listen on an insecure port, which may lead to unauthorized access.
[0011] (4) Abnormal process behavior may cause system performance degradation, and even system crashes.
[0012] Process anomaly behavior detection is an important means of protecting computer systems from security threats. By using various techniques and tools, potential security threats can be identified and responded to, thereby reducing losses.
[0013] Common process anomaly behavior detection methods include:
[0014] (1) Use tools to monitor the system calls of processes and analyze their behavior patterns.
[0015] (2) Monitor the network connections of the process, analyze its communication objects, protocols, ports, etc., and identify abnormal connections;
[0016] (3) Establish a baseline of process behavior, and then detect behaviors that deviate from the baseline. For example, a process usually only accesses specific files, if it suddenly starts accessing other unrelated files, there may be a problem.
[0017] (4) Use machine learning algorithms (such as anomaly detection algorithms) to analyze a large amount of process data, automatically learn normal behavior patterns, and identify abnormal situations.
[0018] The above detection methods can be summarized as collecting process execution instruction data, computer system resource usage, system calls, file access and network communication, etc., and filtering these data through rules to find abnormal processes. These rules can be summarized as traditional expert rules and feature rules based on machine learning algorithms.
[0019] Expert rules can be divided into black rules and white rules. Black rules are formed by analyzing known process abnormal behaviors and extracting some inherent features of the behaviors to form a rule. In the detection process, these rules are used to filter all processes, if the rule is hit, it is judged that the process has abnormal behavior. White rules are just the opposite, by combining business, defining what kind of process behavior is normal, and abstracting the normal behavior into corresponding rules. Processes that do not fall within the scope of the rules are considered abnormal behaviors.
[0020] From the above principle summary, it can be found that the design of expert rules is extremely important, if the rules are not designed well, there will be a large number of false positives and false negatives, which will greatly disturb the security protection. At the same time, the generation of these rules is extremely dependent on the experience of experts, these experts not only need to understand security, but also need to understand business, which leads to the fact that this process abnormal behavior detection method in actual application process effect far less than expected.
[0021] Feature rules based on machine learning algorithms are essentially a derivative and enhancement of expert rules, and also have black and white models, mainly solving the problem of rule feature extraction depending on expert experience. Experts only need to specify the dimension of the feature, and machine learning algorithms can summarize potential rules from massive data. At the same time, compared with expert rules, feature rules based on machine learning algorithms also provide a certain generalization ability. However, its essence is still a rule-based detection method, which can only analyze some observed data after the process execution instruction, and for malicious processes that are good at disguising, it can still be easily bypassed.
[0022] Therefore, how to more accurately detect process abnormal behavior is a problem that needs to be solved by those skilled in the art. SUMMARY
[0023] The purpose of this invention is to at least address one of the aforementioned technical deficiencies.
[0024] Therefore, the purpose of this invention is to propose a semantic-based method for detecting abnormal process behavior, which can effectively improve the detection rate and reduce the false alarm rate.
[0025] To achieve the above objectives, embodiments of the present invention provide a semantic-based method for detecting abnormal process behavior, comprising the following steps:
[0026] S1 collects process operation data from the host and standardizes the fields of the process operation data.
[0027] S2, based on the designed semantic feature algorithm, semantic features are extracted from the standardized process operation data to vectorize the text data. The process of the semantic feature algorithm is as follows:
[0028] S21, Tokenization operation: Concatenate the execution links of operation records in the process operation data to obtain complete context information; use a tokenizer to switch the complete context information into a token sequence to capture the command structure, natural language words in the parameters, and contextual semantic relationships reflected in the word order;
[0029] S22, Embedding Operation: The token sequence converted in step S21 is used to build a vocabulary using the TF-IDF algorithm. Then, the collected data is sorted and filtered, deduplication is performed, and process operation data with high information content is selected to construct a high-quality dataset. Based on the vocabulary, a high-dimensional discrete vector of the token sequence is generated through mapping. Finally, the high-dimensional discrete vector is input into the FastText neural network to train the embedding model, realizing dimensionality reduction. The words in the discrete vocabulary are mapped to a continuous, low-dimensional vector space. After obtaining the trained vocabulary and embedding model through the above steps, the processed token sequence realizes the transformation from text data to high-dimensional discrete vectors, and then to continuous low-dimensional vectors, finally obtaining a low-dimensional vector representation of the host process operation data.
[0030] S23, Predict token malice rating: Train a rating model based on the high-quality dataset and use the rating model to predict each token-operation type.<token,operation> The probability of malicious activity is scored, and a token maliciousness score is generated.
[0031] S24, Generate Feature Vector: Based on the command embedding size, the number of operation types, the total number of tokens, the number of rare tokens, and the top N values of token malice score, the feature vector length of a single sample data is fixed as follows:
[0032] 3 * command embedding size + 2 + N + number of operation types
[0033] Where N is a positive integer less than or equal to 5;
[0034] S3, based on the processed vectorized data, train a single-record detection model and a multi-record detection model;
[0035] S4, the single record detection model is used to detect the feature vector to obtain the degree of malice of a single record; multiple operation records related to suspicious behavior records are collected according to the degree of malice of a single record and processed into a sample set to be detected. Then, the multi-record detection model performs a second detection on the sample set to be detected and issues an alarm for behavior sequences that are detected as malicious.
[0036] Furthermore, in S1, each operation record of the process operation data is standardized as an instance of an Action object.
[0037] Further, in S23, based on the vocabulary and embedding model, each token is first converted into a corresponding word vector, and then a one-hot encoding of the operation type is appended, with the label being the original label of the entire operation record; a classifier is trained on the constructed dataset, for each token-operation type...<token,operation> Yes, a score representing the probability of malicious intent is given by a trained classifier.
[0038] Furthermore, the classifier is a classifier based on the random forest algorithm.
[0039] Furthermore, in S24, minimum pooling, maximum pooling, and average pooling are combined with the numerical vector obtained after transformation in S22 to construct a fixed-length representation of the entire data; the token score is used as the weight of average pooling to enhance the signal of potential malicious tokens; and the total number of tokens, the number of rare tokens, and the top three values of malicious token scores are added as separate features, along with a one-hot encoded representation of the operation type.
[0040] Furthermore, the single-record detection model is trained on a dataset composed of single feature vectors;
[0041] The dataset for the multi-record detection model was created on a single feature detection dataset using a sliding window mechanism, and the appropriate window size and sliding step size were determined through experimentation.
[0042] Furthermore, in S3, the neural network algorithms for both the single-record detection model and the multi-record detection model are based on a multilayer perceptron (MLP).
[0043] Furthermore, in S4, the degree of malice in obtaining a single record includes:
[0044] (1) If the degree of malice is less than the lower threshold t1: it is judged as normal behavior;
[0045] (2) If the degree of malice exceeds the upper limit of the threshold t2: it is judged as abnormal behavior and an alarm is issued;
[0046] (3) If the level of malice is between t1 and t2, it is judged as suspicious behavior, and the records in the context window of the suspicious behavior are taken for secondary detection.
[0047] Furthermore, it also includes the following steps: using an active learning algorithm to iteratively train real-time data and update the weights of the single-record detection model and the multi-record detection model.
[0048] Furthermore, an iteration using the active learning algorithm includes the following steps:
[0049] (1) A multi-class classifier is trained using a labeled sample set;
[0050] (2) Evaluate the classifier and generate labels for the unlabeled sample set;
[0051] (3) Assign categories to unlabeled samples and calculate anomaly scores;
[0052] (4) Select the unlabeled sample with the highest anomaly score in each category;
[0053] (5) Select the next batch of samples to be labeled, and repeat steps (2) and (3) until the number of samples required for the iteration is collected;
[0054] (6) Analyze the selected samples to obtain the correct labels;
[0055] (7) Add newly labeled data so that it can be used for classifier training in the next iteration.
[0056] Compared with the prior art, the advantages and beneficial effects of the present invention are as follows:
[0057] 1. This invention proposes a semantic feature extraction algorithm, which can effectively extract semantic features from process operation behavior and improve the detection rate of detection algorithms;
[0058] 2. This invention proposes a two-layer detection process based on two detection models: a single-record detection model and a multi-record detection model. This two-layer detection can effectively improve the detection rate and reduce the false alarm rate.
[0059] 3. This invention proposes an active learning algorithm that can continuously iterate the training dataset in a real-world environment, thereby improving the practical accuracy of the model weights. While increasing the detection rate and reducing the false positive rate, it also provides the overall detection algorithm with dynamic adaptive capabilities in real-world environments.
[0060] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description
[0061] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:
[0062] Figure 1 This is a flowchart of a semantic-based process abnormal behavior detection method according to an embodiment of the present invention;
[0063] Figure 2 This is a schematic diagram of semantic feature extraction according to an embodiment of the present invention;
[0064] Figure 3 This is a schematic diagram illustrating two methods for creating datasets according to embodiments of the present invention;
[0065] Figure 4 This is a schematic diagram of the overall detection process according to an embodiment of the present invention. Detailed Implementation
[0066] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.
[0067] This invention proposes a semantic-based method for detecting abnormal process behavior. For captured process execution instructions, abnormal process behavior is detected through a designed semantic feature algorithm and an active learning framework.
[0068] like Figure 1 As shown, the semantic-based process abnormal behavior detection method of this invention includes the following steps:
[0069] S1 collects process operation data from the host and standardizes the fields of the process operation data.
[0070] This step involves collecting raw data and standardizing fields. It collects process operation data from the host and performs field standardization. Each operation record in the process operation data is standardized into an instance of an Action object.
[0071] This invention collects relevant data on process operations by deploying probes on endpoint devices such as servers and hosts, and standardizes each operation record of the process into an instance of an Action object. Table 1 shows the meaning and explanation of the fields of the Action object.
[0072] Table 1. Meaning and Explanation of Fields in the Action Object
[0073]
[0074]
[0075] The meanings and descriptions of the fields in the Execute object within the owner field are shown in Table 2.
[0076] Table 2. Meaning and Explanation of Fields in the Execute Object
[0077] Field Name Type Description path Process path String Full path of the process cmdline Execution command String Command executed by the process
[0078] S2, based on the designed semantic feature algorithm, extracts semantic features from the standardized process operation data to vectorize the text data.
[0079] Specifically, step S1 transforms the collected raw data into standardized process operation data. Then, the designed semantic feature algorithm further processes the standardized data, ultimately converting the text data into quantified feature extraction operations.
[0080] The semantic feature algorithm process is as follows:
[0081] S21, Tokenization operation: Concatenate the execution links of the operation records in the process operation data to obtain complete context information; use a tokenizer to switch the complete context information into a token sequence to capture the command structure, natural language words in the parameters, and contextual semantic relationships reflected in the word order.
[0082] S22, Embedding operation
[0083] Specifically, the embedding operation requires pre-training a vocabulary and an embedding model. First, a large amount of host process operation data in a real-world environment is collected and converted into token sequences through two steps, S1 and S21. Then, a vocabulary is built using the TF-IDF algorithm. Next, the collected data is sorted and filtered, deduplicated, and process operation data with high information content is selected to construct a high-quality dataset. Based on the vocabulary, high-dimensional discrete vectors of token sequences are generated through mapping. Finally, the high-dimensional discrete vectors are input into the FastText neural network to train the embedding model, achieving dimensionality reduction. The words in the discrete vocabulary are mapped to a continuous, low-dimensional vector space.
[0084] After obtaining the trained vocabulary and embedding model through the above steps, the token sequence processed in S21 can realize the transformation from text data to high-dimensional discrete vectors, and then to continuous low-dimensional vectors, ultimately obtaining a low-dimensional vector representation of host process operation data.
[0085] The purpose of this step is to convert text data into vectorized numeric arrays. To achieve this, a carefully constructed vocabulary and embedding model are required. Based on previously collected data, and through the review and selection by security experts, this invention has constructed a high-quality dataset, and based on this dataset, has built and trained a vocabulary and embedding model suitable for this type of task.
[0086] S23, Predicting Token Malice Scoring: A scoring model is trained based on a high-quality dataset, and this model is used to predict the token-operation type for each token.<token,operation> The probability of malicious activity is scored, and a token maliciousness score is generated.
[0087] Based on a vocabulary and embedding model, each token is first converted into a corresponding word vector, and then a one-hot encoding of the operation type is appended, with the label being the original label of the entire operation record. A classifier is trained on the constructed dataset, for each token-operation type...<token,operation> Yes, a score representing the probability of malicious intent is given by a trained classifier. In embodiments of this invention, the classifier is a random forest-based classifier.
[0088] Specifically, a scoring model is trained based on an existing high-quality dataset to predict each...<token,operation> Scoring the probability of malicious activity. During the training phase, based on the vocabulary and embedding model from the previous step, each token is first converted into a corresponding word vector, appended with a one-hot encoding of the operation type, and labeled with the original label of the entire operation record. Then, a classifier based on the Random Forest (RF) algorithm is trained on the constructed dataset. Finally, during the inference phase, for each...<token,operation> Yes, a score representing the probability of malicious intent is given by a trained classifier.
[0089] S24, Generate feature vector: Based on the size of the command embedding, the number of operation types, the total number of tokens, the number of rare tokens, and the top N values of the token malice score, the feature vector of a single sample data is fixed with a length of: 3 * size of command embedding + 2 + N + number of operation types, where N is a positive integer less than or equal to 5.
[0090] Preferably, N is 3, which means taking the top three values of the token's malicious rating.
[0091] At this point, the feature vector length of a single sample data is fixed as: 3 * command embedding size + 5 + number of operation types.
[0092] Specifically, through the preceding steps, the sample data has been transformed into a set of numerical vectors, and token malice scores have been generated. However, each data point contains a different number of tokens. The numerical vectors obtained from the transformation in step S22 (min-pooling, max-pooling, and average-pooling) are used to construct a fixed-length representation of the entire data point. Token scores are used as weights in the average pooling to amplify the signal of potentially malicious tokens. Furthermore, the total number of tokens and the number of rare tokens are added as separate numerical features because these features capture characteristics of malicious behavior (e.g., abnormally long command lines and a large number of rare tokens). Simultaneously, the top 3 malicious score values of the tokens in the sample are used as separate features, along with a one-hot encoded representation of the operation type. Finally, the feature vector length for a single sample data point is fixed at 3*embeddingSize + 5 + operationCount, where embeddingSize is the size of the command embedding, operationCount is the number of operation types, and five separate features (total number of tokens, number of rare tokens, and top 3 malicious token scores).
[0093] It should be noted that rare tokens are identified through a vocabulary, and tokens outside the vocabulary are considered rare tokens; the size of the command embedding is determined by the neural network structure of the embedding model, that is, the dimension of the vector output by the embedding model.
[0094] Figure 2 This paper describes the process of vectorizing text data by extracting semantic features from standardized process operation data using a designed semantic feature algorithm. The algorithm processes text data related to process operations. First, it obtains a token sequence through word segmentation in S21. Then, it obtains a low-dimensional vector representation of the process operation data through embedding in S22. Finally, it obtains the vector representation of each token in the token sequence through S23.<token,operation> The malicious scoring is then used to obtain a fixed-length feature vector of the final process operation data through S24.
[0095] S3, based on the processed vectorized data, train a single-record detection model and a multi-record detection model.
[0096] There are two types of detection models: single-record detection model and multi-record detection model.
[0097] The single-record detection model is trained on a dataset composed of single feature vectors.
[0098] refer to Figure 3The dataset for the multi-record detection model was created on a single feature detection dataset using a sliding window mechanism, and the appropriate window size and sliding step size were determined through multiple trials.
[0099] In the embodiments of the present invention, the neural network algorithms of both the single-record detection model and the multi-record detection model are based on the Multilayer Perceptron (MLP).
[0100] Figure 3 This demonstrates a sliding window mechanism for generating a multi-record detection model dataset. The collected host process data is sorted by execution time; therefore, the sliding window mechanism shown in the diagram preserves the process operation context information of each individual record, forming a multi-record detection model dataset. Datasets of different sizes can be generated based on the window size and sliding step. In a real-world environment, anomaly detection is performed on datasets of different sizes according to the established process, and the final sliding window size and step are determined based on the detection results.
[0101] S4, Design the detection process: Based on the trained dual detection model, formulate a two-round detection process.
[0102] like Figure 4 As shown, firstly, a single record detection model is used to detect the feature vector to obtain the degree of malice of a single record; based on the degree of malice of a single record, multiple operation records related to the suspicious behavior record are collected and processed into a sample set to be detected.
[0103] In embodiments of the present invention, the raw data is preprocessed and converted into feature vectors, which are then detected by a single-record detection model to obtain the degree of malice of a single record. Based on the degree of malice, three cases are identified:
[0104] (1) If the degree of malice is less than the lower threshold t1: it is judged as normal behavior;
[0105] (2) If the degree of malice exceeds the upper limit of the threshold t2: it is judged as abnormal behavior and an alarm is issued;
[0106] (3) If the level of malice is between t1 and t2, it is judged as suspicious behavior, and the records in the context window of the suspicious behavior are taken for secondary detection.
[0107] Collect multiple operation records near suspicious behavior records, process them into a detection sample set, and then use a multi-record detection model to perform a secondary detection on the detection sample set, and issue an alarm for behavior sequences that are detected as malicious.
[0108] S5 employs an active learning algorithm to iteratively train real-time data and update the weights of the single-record detection model and the multi-record detection model.
[0109] In this step, an active learning scheme is designed and developed to dynamically update the detection model.
[0110] The main goal of the active learning algorithm designed in this invention is to continuously iterate the training dataset based on real-time data in a real-world environment, thereby updating the weights of the two models and improving the detection performance.
[0111] In real-world environments, class labels are continuously expanded to differentiate between different types of malicious behavior; these labels are set by analysts. For example, they might be categorized by the attacker's specific behavioral pattern or by more descriptive behaviors (reconnaissance, remote code execution, etc.). During the iterative process of the active learning algorithm, an adaptive sampling strategy selects uncertain and anomalous samples from each category in each iteration.
[0112] An iteration using an active learning algorithm includes the following steps:
[0113] (1) Train a multi-class classifier using the available labeled sample set;
[0114] (2) Evaluate the classifier and generate labels for the unlabeled sample set;
[0115] (3) Assign categories to unlabeled samples and calculate anomaly scores;
[0116] (4) Select the unlabeled sample with the highest anomaly score in each category;
[0117] (5) Select the next batch of samples to be labeled, and repeat steps (2) and (3) until the number of samples required for the iteration is collected;
[0118] (6) Analyze the selected samples to obtain the correct labels;
[0119] (7) Add newly labeled data so that it can be used for classifier training in the next iteration.
[0120] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0121] It will be readily understood by those skilled in the art that this invention includes any combination of the inventive description and specific embodiments outlined in the foregoing specification, as well as the various parts shown in the accompanying drawings. Due to space limitations and for the sake of brevity, not all of these combinations have been described in detail. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
[0122] Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention without departing from the principles and spirit of the invention. The scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. A semantic-based method for detecting abnormal process behavior, characterized in that, Includes the following steps: S1 collects process operation data from the host and standardizes the fields of the process operation data. S2, based on the designed semantic feature algorithm, semantic features are extracted from the standardized process operation data to vectorize the text data. The process of the semantic feature algorithm is as follows: S21, Tokenization operation: Concatenate the execution links of operation records in the process operation data to obtain complete context information; use a tokenizer to switch the complete context information into a token sequence to capture the command structure, natural language words in the parameters, and contextual semantic relationships reflected in the word order; S22, Embedding Operation: The token sequence converted in step S21 is used to build a vocabulary using the TF-IDF algorithm. Then, the collected data is sorted and filtered, deduplication is performed, and process operation data with high information content is selected to construct a high-quality dataset. Based on the vocabulary, a high-dimensional discrete vector of the token sequence is generated through mapping. Finally, the high-dimensional discrete vector is input into the FastText neural network to train the embedding model, realizing dimensionality reduction. The words in the discrete vocabulary are mapped to a continuous, low-dimensional vector space. After obtaining the trained vocabulary and embedding model through the above steps, the processed token sequence realizes the transformation from text data to high-dimensional discrete vectors, and then to continuous low-dimensional vectors, finally obtaining a low-dimensional vector representation of the host process operation data. S23, Predict token malice rating: Train a rating model based on the high-quality dataset and use the rating model to predict each token-operation type.<token,operation> The probability of malicious activity is scored, and a token maliciousness score is generated. S24, Generate Feature Vector: Based on the command embedding size, the number of operation types, the total number of tokens, the number of rare tokens, and the top N values of token malice score, the feature vector length of a single sample data is fixed as follows: 3 * command embedding size + 2 + N + number of operation types Where N is a positive integer less than or equal to 5; S3, based on the processed vectorized data, train a single-record detection model and a multi-record detection model; S4, the single record detection model is used to detect the feature vector to obtain the degree of malice of a single record; multiple operation records related to suspicious behavior records are collected according to the degree of malice of a single record and processed into a sample set to be detected. Then, the multi-record detection model performs a second detection on the sample set to be detected and issues an alarm for behavior sequences that are detected as malicious.
2. The semantic-based process abnormal behavior detection method according to claim 1, characterized in that, In step S1, each operation record of the process operation data is standardized as an instance of an Action object.
3. The semantic-based process abnormal behavior detection method according to claim 1, characterized in that, In S23, based on the vocabulary and embedding model, each token is first converted into a corresponding word vector, and then a one-hot encoding of the operation type is appended, with the label being the original label of the entire operation record; a classifier is trained on the constructed dataset, for each token-operation type...<token,operation> Yes, a score representing the probability of malicious intent is given by a trained classifier.
4. The semantic-based process abnormal behavior detection method according to claim 3, characterized in that, The classifier used is based on the random forest algorithm.
5. The semantic-based process abnormal behavior detection method according to claim 1, characterized in that, In S24, minimum pooling, maximum pooling, and average pooling are combined with the numerical vector obtained after transformation in S22 to construct a fixed-length representation of the entire data. Token scores are used as weights for average pooling to enhance the signal of potential malicious tokens. The total number of tokens, the number of rare tokens, and the top three malicious token scores are added as separate features, along with a one-hot encoded representation of the operation type.
6. The semantic-based process abnormal behavior detection method according to claim 1, characterized in that, In S3, The single record detection model is trained on a dataset composed of single feature vectors; The dataset for the multi-record detection model was created on a single feature detection dataset using a sliding window mechanism, and the appropriate window size and sliding step size were determined through experimentation.
7. The semantic-based process abnormal behavior detection method according to claim 1 or 6, characterized in that, The neural network algorithms for both the single-record detection model and the multi-record detection model are based on the multilayer perceptron (MLP).
8. The semantic-based process abnormal behavior detection method according to claim 1, characterized in that, In S4, the degree of malice in obtaining a single record includes: (1) If the degree of malice is less than the lower threshold t1: it is judged as normal behavior; (2) If the degree of malice exceeds the upper limit of the threshold t2: it is judged as abnormal behavior and an alarm is issued; (3) If the level of malice is between t1 and t2, it is judged as suspicious behavior, and the records in the context window of the suspicious behavior are taken for secondary detection.
9. The semantic-based process abnormal behavior detection method according to claim 1, characterized in that, It also includes the following steps: using an active learning algorithm to iteratively train real-time data and update the weights of the single-record detection model and the multi-record detection model.
10. The semantic-based process abnormal behavior detection method according to claim 9, characterized in that, One iteration of the active learning algorithm includes the following steps: (1) A multi-class classifier is trained using a labeled sample set; (2) Evaluate the classifier and generate labels for the unlabeled sample set; (3) Assign categories to unlabeled samples and calculate anomaly scores; (4) Select the unlabeled sample with the highest anomaly score in each category; (5) Select the next batch of samples to be labeled, and repeat steps (2) and (3) until the number of samples required for the iteration is collected; (6) Analyze the selected samples to obtain the correct labels; (7) Add newly labeled data so that it can be used for classifier training in the next iteration.