Abnormal detection method and device, electronic equipment and storage medium

Abstract

The invention discloses an anomaly detection method and device, electronic equipment and a storage medium, and the main technical scheme comprises the steps: responding to a received user behavior log, constructing an initial adjacency matrix according to the user behavior log, carrying out the enhancement processing according to the interaction relation between user nodes in the initial adjacency matrix, generating an enhanced adjacency matrix, and storing the enhanced adjacency matrix in a database; and extracting an initial feature vector of each user node in the user behavior log, performing random perturbation processing on a local feature dimension of the initial feature vector to obtain a perturbation feature vector, and determining an abnormal user node and / or an abnormal behavior according to the enhanced adjacency matrix and the perturbation feature vector. According to the method and the device, the recognition of multi-hop propagation and implicit propagation paths among the user nodes is enhanced through the enhancement processing of the initial adjacent matrix, the method and the device are suitable for complex and dynamic internal abnormal scenes, in addition, the protection of privacy sensitive features is realized through the disturbance processing of the initial feature vector, and the detection accuracy and robustness are enhanced.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and particularly relates to an anomaly detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] As an important part of the network security field, threat detection is widely used in enterprise information governance, Internet of Things system security and critical infrastructure protection. With the development of deep learning technology, behavior modeling methods based on graph neural networks (GNN) have shown significant advantages in depicting user interaction relationships and behavior chains, and have become a hot research and application direction. Specifically, this technology system covers the whole process from user behavior log collection, graph structure construction, feature representation learning to anomaly behavior identification, including key links such as explicit graph modeling based on user interaction, multi-source behavior feature fusion, and attention mechanism optimization.

[0003] However, in the related art internal threat detection method, a static graph structure and initial behavior features are directly used for modeling, and the dynamic evolution of user behavior and privacy protection requirements are not fully considered, which may lead to incomplete depiction of multi-hop propagation paths or cause privacy leakage risks in sensitive data scenarios. SUMMARY

[0004] The present disclosure provides an anomaly detection method, device, electronic equipment and storage medium. The main purpose is to solve the problem that in the related art internal threat detection method, a static graph structure and initial behavior features are directly used for modeling, and the dynamic evolution of user behavior and privacy protection requirements are not fully considered, which may lead to incomplete depiction of multi-hop propagation paths or cause privacy leakage risks in sensitive data scenarios.

[0005] According to a first aspect of the present disclosure, an anomaly detection method is provided, comprising:

[0006] In response to the received user behavior log, an initial adjacency matrix is constructed according to the user behavior log, and an enhanced adjacency matrix is generated by performing enhancement processing on the interaction relationship between user nodes in the initial adjacency matrix;

[0007] An initial feature vector of each user node in the user behavior log is extracted, and a local feature dimension of the initial feature vector is randomly disturbed to obtain a disturbed feature vector;

[0008] According to the enhanced adjacency matrix and the disturbed feature vector, an abnormal user node and / or an abnormal behavior are determined.

[0009] In some embodiments, the enhancing processing according to the interaction relationship between the user nodes in the initial adjacency matrix to generate an enhanced adjacency matrix comprises:

[0010] calculating a global influence score of each user node based on a preset transfer algorithm between user nodes to generate the enhanced adjacency matrix to complete the multi-hop path between user nodes.

[0011] In some embodiments, the calculation of the global influence score of each user node based on the preset transfer algorithm between user nodes to generate the enhanced adjacency matrix to complete the multi-hop path between user nodes comprises:

[0012] normalizing the initial adjacency matrix by row and constructing a transfer probability matrix based on the transfer probability between user nodes and the out-degree of the user nodes;

[0013] calculating the global influence score of each user node in the transfer probability matrix by a preset transfer algorithm between user nodes;

[0014] generating the enhanced adjacency matrix according to the global influence score of each user node and the edge weight between two user nodes in the initial adjacency matrix.

[0015] In some embodiments, after the local feature dimension of the initial feature vector is randomly disturbed to obtain a disturbed feature vector, the method further comprises:

[0016] calibrating the disturbed feature vector by an unbiased mapping function to obtain a calibrated feature vector;

[0017] calculating the feature recovery variance of the calibrated feature vector to quantify the uncertainty of the disturbance processing.

[0018] In some embodiments, the determination of the abnormal user node and / or abnormal behavior according to the enhanced adjacency matrix and the disturbed feature vector comprises:

[0019] aggregating the enhanced adjacency matrix and the disturbed feature vector to obtain a multi-hop feature vector;

[0020] detecting the multi-hop feature vector through a pre-trained graph processing model to obtain the abnormal user node and / or abnormal behavior.

[0021] In some embodiments, the training method of the graph processing model comprises:

[0022] disturbing the user node label to obtain a disturbed user node label;

[0023] The denoising supervision signal is constructed by combining the multi-hop confidence weighted aggregation and the entropy control mechanism.

[0024] The graph processing model is trained based on the disturbed user node label and the denoising supervision signal to obtain the pre-trained graph processing model.

[0025] In some embodiments, the training of the graph processing model based on the disturbed user node label and the denoising supervision signal to obtain the pre-trained graph processing model comprises:

[0026] A prediction consistency loss function is constructed by the denoising supervision signal, the disturbed user node label and the prediction consistency soft label.

[0027] The graph processing model is trained based on the prediction consistency loss function to obtain the pre-trained graph processing model.

[0028] According to a second aspect of the present disclosure, an anomaly detection apparatus is provided, comprising:

[0029] A construction unit is configured to construct an initial adjacency matrix according to a received user behavior log.

[0030] An enhancement processing unit is configured to perform enhancement processing according to the interaction relationship between user nodes in the initial adjacency matrix to generate an enhanced adjacency matrix.

[0031] An extraction unit is configured to extract an initial feature vector of each user node in the user behavior log.

[0032] A disturbance processing unit is configured to perform random disturbance processing on a local feature dimension of the initial feature vector to obtain a disturbed feature vector.

[0033] A detection unit is configured to determine an abnormal user node and / or an abnormal behavior according to the enhanced adjacency matrix and the disturbed feature vector.

[0034] In some embodiments, the enhancement processing unit is further configured to calculate a global influence score of each user node based on a preset user node inter-transfer algorithm to generate the enhanced adjacency matrix to complete the multi-hop path between user nodes.

[0035] In some embodiments, the enhancement processing unit comprises:

[0036] A normalization processing module is configured to perform row normalization processing on the initial adjacency matrix.

[0037] A construction module is configured to construct a transfer probability matrix based on the transfer probability between user nodes and the out-degree of the user nodes.

[0038] a calculation module configured to calculate the global influence scores of each user node in the transition probability matrix by a preset user node inter-transition algorithm;

[0039] a generation module configured to generate the enhanced adjacency matrix according to the global influence scores of each user node and edge weights between two user nodes in the initial adjacency matrix.

[0040] In some embodiments, the apparatus further comprises:

[0041] a calibration unit configured to calibrate the perturbed feature vector by an unbiased mapping function to obtain a calibrated feature vector after the perturbation processing unit performs random perturbation processing on the local feature dimension of the initial feature vector;

[0042] a calculation unit configured to calculate a feature recovery variance of the calibrated feature vector to quantify the uncertainty of the perturbation processing.

[0043] In some embodiments, the detection unit comprises:

[0044] an aggregation processing module configured to perform aggregation processing on the enhanced adjacency matrix and the perturbed feature vector to obtain a multi-hop feature vector;

[0045] a detection module configured to perform identification detection on the multi-hop feature vector via a pre-trained graph processing model to obtain the abnormal user node and / or abnormal behavior.

[0046] In some embodiments, the apparatus further comprises a training unit, wherein the training unit comprises:

[0047] a perturbation module configured to perform perturbation processing on a user node label to obtain a perturbed user node label;

[0048] a construction module configured to construct a denoising supervision signal in combination with multi-hop confidence weighted aggregation and an entropy control mechanism;

[0049] a training module configured to train the graph processing model based on the perturbed user node label and the denoising supervision signal to obtain the pre-trained graph processing model.

[0050] In some embodiments, the training module is further configured to:

[0051] construct a prediction consistency loss function by the denoising supervision signal, the perturbed user node label, and a predicted consistency soft label;

[0052] train the graph processing model based on the prediction consistency loss function to obtain the pre-trained graph processing model.

[0053] According to a third aspect of the present disclosure, an electronic device is provided, comprising:

[0054] at least one processor; and

[0055] a memory connected with the at least one processor in communication; wherein,

[0056] the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of the first aspect.

[0057] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to perform the method of the first aspect.

[0058] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the method of the first aspect.

[0059] The anomaly detection method, device, electronic device and storage medium provided by the present disclosure, in response to the received user behavior log, constructs an initial adjacency matrix according to the user behavior log, and performs enhancement processing according to the interaction relationship between the user nodes in the initial adjacency matrix to generate an enhanced adjacency matrix, extracts the initial feature vector of each user node in the user behavior log, and performs random disturbance processing on the local feature dimension of the initial feature vector to obtain a disturbed feature vector, determines the abnormal user node and / or abnormal behavior according to the enhanced adjacency matrix and the disturbed feature vector. The present disclosure enhances the identification of multi-hop propagation and implicit propagation paths between user nodes through the enhancement processing of the initial adjacency matrix, is suitable for complex and dynamic internal anomaly scenarios, in addition, through the disturbance processing of the initial feature vector, the protection of privacy sensitive features is realized, and the detection accuracy and robustness are enhanced.

[0060] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0061] The accompanying drawings are used to better understand the present scheme and do not limit the present disclosure. Among them:

[0062] Figure 1 A flowchart of an anomaly detection method provided by an embodiment of the present disclosure;

[0063] Figure 2 A schematic diagram of an abnormality detection system provided by an embodiment of the present disclosure;

[0064] Figure 3 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure;

[0065] Figure 4 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure;

[0066] Figure 5 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure;

[0067] Figure 6 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure;

[0068] Figure 7 A structural schematic diagram of an abnormality detection apparatus provided by an embodiment of the present disclosure;

[0069] Figure 8 A structural schematic diagram of an abnormality detection apparatus provided by an embodiment of the present disclosure;

[0070] Figure 9 A schematic block diagram of an example electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0071] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to assist in understanding, which should be considered in a descriptive sense only. It will thus be recognized by those of ordinary skill that the embodiments described herein can be carried out in a variety of ways, and that the embodiments described herein can be implemented in software and / or hardware and other ways not specifically described herein without departing from the scope and spirit of the disclosure. Likewise, it will be appreciated that features described herein as being implemented in combination with one another are also implementable on individual bases independently of other features. Accordingly, the disclosure is not to be seen as being limited to the embodiments described herein, but rather is to be understood to include all embodiments that are within the scope and spirit of the disclosure.

[0072] An abnormality detection method, apparatus, electronic device, and storage medium of an embodiment of the present disclosure are described below with reference to the accompanying drawings.

[0073] Figure 1 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure;

[0074] As shown in Figure 1 , the method comprises the following steps:

[0075] Step 101, in response to a received user behavior log, constructing an initial adjacency matrix according to the user behavior log, and performing enhancement processing according to the interaction relationship between user nodes in the initial adjacency matrix to generate an enhanced adjacency matrix.

[0076] The construction of the initial adjacency matrix (initial graph structure) takes the user behavior log as input, takes the user as a user node in the graph, and takes the interaction behavior (such as mail communication, file access, system login, etc.) between users as an edge. Specifically, through log analysis and entity recognition technology, user entities and their behavior relationships are extracted to construct the initial adjacency matrix A. The initial adjacency matrix is usually a sparse matrix, only reflecting the direct interaction relationship between users, and it is difficult to capture indirect influence paths. In order to enhance the expression ability of the graph structure, the interaction relationship between user nodes in the initial adjacency matrix A is enhanced to generate an enhanced adjacency matrix A', which effectively amplifies the connection strength between high-influence user nodes through the enhancement processing method, and helps to identify potential threat propagation paths.

[0077] Through the enhancement processing of the interaction relationship between user nodes in the initial adjacency matrix, the perception ability of the graph neural network to the user behavior chain is improved, and the missing high-order connection information in the initial graph structure (initial adjacency matrix) is effectively completed. Compared with the traditional graph model based on only first-order adjacency relationship, the embodiment of the disclosure is more hierarchical and recursive in describing the user node influence propagation path, thereby enhancing the recognition ability of complex threat behaviors.

[0078] In some embodiments, when the enhancement processing of the interaction relationship between user nodes in the initial adjacency matrix is processed, the enhancement processing can be performed through a graph neural network, and the enhancement processing can also be performed through a preset algorithm, and the specific embodiment of the disclosure is not limited thereto.

[0079] Step 102, extracting the initial feature vector of each user node in the user behavior log, and performing random perturbation processing on the local feature dimension of the initial feature vector to obtain a perturbed feature vector.

[0080] The initial feature vector x v Noise is added to achieve privacy protection, that is, a selective perturbation mechanism is used to randomly perturb the local feature dimension, that is, s (s This mechanism belongs to the feature protection strategy under the local differential privacy (Local Differential Privacy, LDP) framework, and is suitable for the privacy processing of user node features in the graph neural network (GNN).

[0081] In some implementations, the initial feature vector is usually a high-dimensional sparse or dense vector representing the behavior characteristics of the user, such as access frequency, operation type, time distribution, etc. To achieve privacy protection, the feature perturbation encoder first randomly selects part of the dimensions from the feature vector for perturbation. The perturbation ratio can be set to 20% to 50% of the total number of feature dimensions, depending on the value range of the privacy budget ε (usually ε ∈ (0.1, 1.0)). For the selected feature dimensions, the perturbation result is mapped to a binary value through a Bernoulli distribution, that is, the feature value is mapped to 1 or -1 with a certain probability. The perturbation probability is positively correlated with the size of the initial feature value, so as to ensure that the perturbation has directionality and numerical sensitivity.

[0082] Under the premise of perturbing part of the dimensions of the initial feature vector, an effective balance between feature privacy protection and model performance is achieved.

[0083] Step 103, determining an abnormal user node and / or abnormal behavior according to the enhanced adjacency matrix and the perturbed feature vector.

[0084] By perturbing the enhanced adjacency matrix containing multi-hop propagation paths (also known as user behavior chains) and the perturbed feature vector that guarantees the data privacy of user behavior, an abnormal user node (abnormal user) or abnormal behavior is identified.

[0085] In some embodiments, the abnormal user or abnormal behavior includes but is not limited to the following:

[0086] The first type is data leakage behavior: for example, a user frequently accesses customer information in the database and exports a large amount of data to the local device in a short time. If this behavior is not authorized, it may constitute a sensitive data leak, and the behavior trajectory usually presents abnormal timing characteristics such as high frequency, short time, and multiple points in the access log.

[0087] The second type is resource abuse behavior: a user uses internal system resources to handle non-business needs, such as performing encryption data or running high-computing tasks for a long time on a server. This type of behavior may cause system resource shortage and affect normal business services.

[0088] The third type is privilege abuse behavior: for example, a user accesses core business data unrelated to his / her responsibilities, or copies multiple system configurations and data files, which is obviously beyond his / her responsibility boundary and has significant potential harm.

[0089] The fourth type is system destruction behavior: some users may use their access rights to scan and detect vulnerabilities of the internal network structure, with the intention of implanting threat plugins or destroying the system.

[0090] It should be noted that the above abnormal user or abnormal user behavior is only an exemplary example and is not a limitation of the abnormal user or abnormal user behavior.

[0091] In some embodiments, Figure 1 The method shown can be implemented by a graph neural network as a form of implementation, inputting user behavior logs into a graph neural network to obtain abnormal user nodes and / or abnormal behaviors,

[0092] When constructing a graph neural network, such as Figure 2 The method shown mainly includes the following contents:

[0093] (1) A graph neural network modeling mechanism is proposed, which combines structure reconstruction and privacy protection, breaks through the limitations of existing methods in structure modeling granularity and behavior chain identification, and improves the modeling ability of complex abnormal paths;

[0094] (2) The local differential privacy (LDP) mechanism and the feature calibration module are introduced to realize efficient and unbiased feature representation under the premise of protecting data privacy;

[0095] (3) A label perturbation and denoising joint training strategy is designed to enhance the training stability and detection accuracy of the graph neural model in the privacy protection scenario;

[0096] Finally, a new internal anomaly detection method is realized, which takes into account the integrity of structured information expression and user data privacy protection, and can be applied to Internet of Things security scenarios with high compliance requirements.

[0097] In some embodiments, the graph neural model (anomaly detection network) includes the following modules:

[0098] Structure reconstruction module: based on the improved PageRank algorithm, a structure reconstruction mechanism is constructed to identify the importance of user nodes in the graph, strengthen the potential high-order connection relationship between user nodes, complete the multi-hop propagation path not explicitly embodied in the initial adjacency matrix, and improve the ability of the graph neural model to describe complex behavior chains (corresponding to step 101).

[0099] Feature privacy encoding module: design a feature perturbation encoder and a feature calibrator under the local differential privacy (LDP) mechanism, perturb the user feature data while preserving its statistical properties and discriminative ability, and achieve a balance between protecting privacy-sensitive features and efficient modeling (corresponding to step 102).

[0100] Label perturbation and denoising training module: introduce a label perturbation mechanism to improve the privacy protection level in the supervised stage, and construct a multi-hop aggregation and confidence weighted denoising learning strategy to improve the stability and detection accuracy of the model under label perturbation. After the training of this module is completed, abnormal user nodes and / or abnormal behaviors can be identified according to the enhanced adjacency matrix and the perturbed feature vector (corresponding to step 103).

[0101] Through the organic fusion of the above three modules, the embodiments of the present disclosure enhance the graph structure modeling capability, realize the double privacy protection of feature dimension and supervision dimension, have good security, universality and actual deployment ability, and are suitable for various high-risk internal anomaly (or threat) detection scenarios.

[0102] Based on Figure 1 As shown in the embodiment, step 101 is further explained. When the enhanced adjacency matrix is generated by enhancing the interaction relationship between user nodes in the initial adjacency matrix, the global influence score of each user node is calculated based on a preset transition algorithm between user nodes to generate the enhanced adjacency matrix to complete the multi-hop path between user nodes.

[0103] The following methods can be used, but are not limited to, Figure 3 The method can include the following steps:

[0104] Step 201, the initial adjacency matrix is normalized by row, and a transition probability matrix is constructed based on the transition probability between user nodes and the out-degree of the user node.

[0105] The embodiments of the present disclosure introduce a preset transition algorithm (PageRank algorithm) between user nodes based on the initial adjacency matrix A to simulate the random walk process between user nodes and mine the global influence score (global importance and potential influence) of the user node.

[0106] First, the initial adjacency matrix A is normalized by row to construct the transition probability matrix, which is a key preprocessing link in the structure reconstruction module of the present disclosure. The technical implementation is based on the random walk modeling idea of graph structure, which aims to provide basic input for subsequent user node influence calculation of the PageRank algorithm.

[0107] By normalizing the adjacency matrix by row, the transition probability matrix P is constructed, and the calculation formula is:

[0108]

[0109] Where, p i,j represents the probability of transition from user node i to user node j, represents the out-degree of user node i. This normalization process reflects the importance of interaction frequency, that is, the user node with frequent interaction has greater influence in the propagation process.

[0110] At the application scenario level, this step is applicable to the internal anomaly detection system for constructing user behavior graph. For example, in an enterprise network, user behaviors such as email communication, file access, system login between users can be modeled as a graph structure, and the edge weight in the initial adjacency matrix can represent the interaction frequency or behavior intensity. By constructing a transition probability matrix through row normalization, the propagation tendency of user behavior can be more accurately reflected, providing a reasonable probability basis for subsequent preset user node transition algorithm calculation of user node influence.

[0111] By converting the adjacency relationship into a probabilistic transition form, the user node influence calculation has statistical significance, thereby more effectively identifying potential threat user nodes in a multi-hop propagation path. In addition, this normalization method is compatible with various graph neural network models (such as GCN, GAT, etc.), providing a standardized input interface for the subsequent fusion of structure reconstruction and privacy protection modules, enhancing the scalability and robustness of the model.

[0112] Step 202, calculating the global influence score of each user node in the transition probability matrix through a preset user node transition algorithm.

[0113] Through the following preset user node transition algorithm PageRank iterative calculation formula, the stable importance score of each user node in the overall network is obtained:

[0114]

[0115] where p is the PageRank score vector, p i represents the global influence score of user node i; α is the damping factor, controlling the balance between the probability of continuing to randomly walk along the graph edge and the probability of jumping to any user node; N is the total number of user nodes in the graph, and I is the normalized random jump vector, used to ensure the convergence of PageRank.

[0116] Step 203, generating the enhanced adjacency matrix according to the global influence score of each user node and the edge weight value between two user nodes in the initial adjacency matrix.

[0117] After obtaining the PageRank score of each user node, an enhanced structure adjacency matrix A' is further constructed to comprehensively consider the existence of edges and the global importance (global influence score) of connected user nodes. The specific calculation method is as follows:

[0118]

[0119] where A ij represents the edge weight value between user node i and user node j in the initial adjacency matrix, p i and p jPageRank scores of user nodes i and j respectively, and the average value is used to weight the influence degree of the edge. This operation effectively amplifies the edge weight associated with high-influence user nodes, highlighting the core propagation path and potential abnormal (or threat) channels in the graph.

[0120] This structure reconstruction mechanism not only optimizes the adjacency matrix, but also essentially introduces a structure importance modeling mechanism, breaking the traditional graph model's dependence on local connections. By using the global influence score of user nodes, the graph structure is recursively optimized, enhancing the model's ability to identify multi-hop propagation and implicit propagation paths, making it suitable for complex and dynamic internal anomaly (or threat) scenarios.

[0121] In summary, the PageRank score vector is used to construct a structure-enhanced adjacency matrix, which strengthens the connection between high-influence user nodes in the graph by weighting and fusing the initial edge weight with the user node score. This operation significantly improves the graph neural network's ability to perceive multi-hop propagation paths, helping to identify hidden and cross-level propagation internal abnormal behaviors, such as attack paths that gradually penetrate the core system through low-privilege accounts.

[0122] Based on Figure 1 As shown in the embodiments, the present disclosure also provides an anomaly detection method, as shown in Figure 4 As shown, the method comprises:

[0123] Step 301, in response to the received user behavior log, constructing an initial adjacency matrix according to the user behavior log, and performing enhancement processing on the interaction relationship between user nodes in the initial adjacency matrix to generate an enhanced adjacency matrix.

[0124] For details of step 301, refer to the detailed description of step 101, which will not be repeated here.

[0125] Step 302, extracting the initial feature vector of each user node in the user behavior log, and performing random perturbation processing on the local feature dimension of the initial feature vector to obtain a perturbed feature vector.

[0126] In order to effectively protect user feature data privacy in internal threat detection tasks, the present disclosure proposes a feature perturbation encoding module based on the local differential privacy (Local Differential Privacy, LDP) mechanism. The module consists of two parts: a feature perturbation encoder, a feature calibrator, and a multi-hop aggregation denoising mechanism. This module not only protects feature privacy, but also preserves the discriminability of features as much as possible, improving the model's practicality and accuracy under privacy constraints.

[0127] This step corresponds to Figure 2the feature perturbation encoder in the feature privacy encoding module in the method.

[0128] The core goal of the feature perturbation encoder is to perturb the initial feature vector x v Noise is added to achieve privacy protection and is encoded as applicable to vector representation. It is assumed that the feature of each user node is a d-dimensional vector, and the value range is between [min, max].

[0129] The embodiments of the present disclosure design the encoder based on a 1-bit perturbation mechanism that selectively perturbs in the feature dimension, that is, randomly selects s dimensions from the d-dimensional feature vector for perturbation processing, thereby reducing the performance loss caused by perturbation. For each selected feature dimension, the perturbation result is determined whether to be mapped to 1 or -1 through the following Bernoulli probability distribution:

[0130]

[0131] where b i is the probability of mapping the initial feature value x i to 1, and ò f is the privacy budget at the feature level. When x i tends to the max value, the probability is greater, and vice versa, thereby ensuring that the perturbation has numerical sensitivity and directionality. Then, the perturbed feature vector x

[0132]

[0133] where s i ∈{0,1} indicates whether the i-th dimension is perturbed (1 indicates perturbation, and 0 indicates no perturbation). This method realizes an effective balance between feature privacy protection and model performance on the premise of only perturbing part of the dimensions, and lays a foundation for subsequent feature recovery and aggregation operations.

[0134] In step 303, the perturbed feature vector is calibrated by an unbiased mapping function to obtain a calibrated feature vector.

[0135] Since the perturbation mechanism in step 302 introduces statistical bias, in order to ensure the statistical consistency of the feature representation, the embodiments of the present disclosure further design a feature calibrator to restore the expected value of the perturbed feature vector x fp , so that it is consistent with the initial feature vector x, that is, satisfies E[x'] = x. The calibration operation is realized in the following way:

[0136]

[0137] where x fpLet x' be the perturbed feature vector, and x' be the calibrated feature vector; s is the number of dimensions perturbed, ò is the privacy budget, and [min, max] is the range of feature values. The mapping function Calior(x) fp It maps the perturbed features back to an approximately unbiased state while retaining some privacy protection capabilities brought about by the perturbation.

[0138] This step plays a crucial role in the overall technical solution. On one hand, it provides privacy-preserving input features for subsequent graph neural networks, ensuring that user behavior data is not directly exposed in the model. On the other hand, through unbiased reconstruction and variance evaluation mechanisms, the model can still learn discriminative feature representations, thus maintaining high detection performance under privacy constraints. In practical deployments, this mechanism can be applied to the processing of sensitive data such as internal user behavior logs and access control records, and is particularly suitable for IoT and enterprise security scenarios where data remains within the domain and compliance requirements are high. The model maintains high behavioral modeling accuracy even when processing privacy-perturbed data, effectively improving the robustness and practicality of internal anomaly detection.

[0139] Step 304: Calculate the feature recovery variance of the calibrated feature vector to quantify the uncertainty of the perturbation processing.

[0140] The feature calibrator also evaluates the feature recovery variance Var[(x′) for each dimension. v ) i ] is used to quantify the uncertainty caused by disturbances, and its expression is as follows:

[0141]

[0142] The smaller the variance, the more accurate the features recovered from the perturbation, which helps the model maintain high detection performance under privacy constraints.

[0143] based on Figure 1 The illustrated embodiment further explains step 103. Figure 5 This may include the following steps:

[0144] Step 401: Aggregate the enhanced adjacency matrix and the perturbation feature vector to obtain a multi-hop feature vector.

[0145] Continue reading Figure 2 Although the feature calibrator can achieve statistically unbiased recovery, the randomness introduced by the perturbation itself can still interfere with training. Therefore, embodiments of this disclosure further design a multi-hop neighbor aggregation mechanism to mitigate the impact of perturbation noise on training.

[0146] In Graph Convolutional Neural Networks (GCNs), user node representations are updated iteratively through the aggregation of neighbor features.

[0147] To enhance the denoising ability of the aggregation process, the embodiments of the present disclosure extend the aggregation range to k-hop neighbors on the GCN basic framework, and the core calculation method is as follows:

[0148]

[0149] wherein, represents the initial calibration feature vector, N(v) is the neighbor set of user node v in the reconstructed graph, and Aggregate(·) is an aggregation function, usually a linear function such as average or weighted sum.

[0150] To avoid repeated amplification of the disturbance value in the aggregation process, the embodiments of the present disclosure exclude self-loop connections, i.e., do not participate in aggregation with the self feature, thereby reducing the cumulative effect of the disturbance and improving the stability and effectiveness of the feature information propagation. The multi-hop aggregation mechanism described in the embodiments of the present disclosure not only has good denoising effect, but also is compatible with the standard graph convolutional network structure, and can adjust the aggregation step number k according to the actual application to achieve a dynamic balance between the structure information propagation ability and the disturbance suppression ability.

[0151] Step 402, the multi-hop feature vector is detected by a pre-trained graph processing model to obtain the abnormal user node and / or abnormal behavior.

[0152] The pre-trained graph processing model is obtained by training through the disturbance and denoising learning module.

[0153] Specifically, the training method of the graph processing model is as shown in Figure 6 , which includes:

[0154] Step 501, performing disturbance processing on the user node label to obtain a disturbed user node label.

[0155] In the implementation of the privacy protection internal threat detection task, the supervision label is a key training signal, and if the initial data is directly exposed or used, there is a serious risk of privacy leakage. Therefore, the embodiments of the present disclosure propose a label disturbance and denoising joint learning mechanism, which maintains label privacy while achieving effective correction of the disturbed label and improving learning stability through multi-hop information transmission in the graph structure. This module mainly consists of two parts: a label disturbance mechanism and a label denoising learning mechanism.

[0156] To achieve label privacy protection in the supervision phase, the embodiments of the present disclosure use a randomized response mechanism (Randomized Response) to disturb the user node label. Let the initial label be y, and the disturbed label be y p , and the disturbance distribution satisfies the following conditions:

[0157]

[0158] wherein ol represents the label privacy budget, and c is the number of label categories. The larger ol is, the lower the perturbation degree is, and the label is closer to the true value; the smaller ol is, the perturbation is enhanced, and the privacy protection capability is improved. This mechanism introduces controllable label randomness to avoid direct leakage of the true label.

[0159] Step 502, combining the multi-hop confidence weighted aggregation and the entropy control mechanism to construct a denoising supervision signal.

[0160] Since the perturbed label y p Training the model will lead to unstable learning and even accuracy degradation, therefore, the embodiment of the present disclosure further proposes a multi-hop label aggregation and confidence denoising mechanism to restore a more reliable supervision signal on the basis of structural consistency.

[0161] Firstly, the denoising label y′ is constructed, and the perturbed label y p is aggregated through multi-hop aggregation of neighbor user nodes, and the aggregation function is a multi-hop label consistency function with confidence weighting:

[0162]

[0163] wherein F aggr represents a multi-hop confidence weighted aggregation function, and the specific calculation is as follows:

[0164]

[0165] wherein is the posterior probability based on the perturbed label , which is obtained through Bayes inference, and r u is the label confidence of the user node u, and the calculation method is as follows:

[0166]

[0167] wherein δ(·) is a consistency index function, which represents the stability of the label in the multi-hop propagation process.

[0168] To determine the appropriate aggregation depth hop y , the embodiment of the present disclosure introduces an entropy-based adaptive aggregation step selection mechanism, and the specific calculation is as follows:

[0169]

[0170] wherein H(N k (v)) represents the entropy value of the label distribution in the k-hop neighborhood of the user node v, and the calculation formula is as follows:

[0171]

[0172] The mechanism ensures that the label propagation path with the most stable aggregation and the most concentrated distribution is selected as the denoising reference.

[0173] In step 503, the graph processing model is trained based on the disturbed user node label and the denoising supervision signal to obtain the pre-trained graph processing model.

[0174] In step 503, the graph processing model is trained based on the disturbed user node label and the denoising supervision signal to obtain the pre-trained graph processing model, including: constructing a prediction consistency loss function through the denoising supervision signal, the disturbed user node label and the prediction consistency soft label; training the graph processing model based on the prediction consistency loss function to obtain the pre-trained graph processing model.

[0175] To further weaken the disturbance bias in y', the embodiment of the disclosure introduces a prediction consistency soft label By applying the same aggregation mechanism to the current prediction result of the model The definitions are as follows:

[0176]

[0177] The soft label can be regarded as a self-supervised signal, avoiding overfitting to a single, possibly distorted y'.

[0178] The embodiment of the disclosure adopts a prediction consistency loss function as the model training target, which is defined as follows:

[0179]

[0180] The loss function avoids overfitting of the model to a single disturbed label y p , while having the smoothing property of the soft label, improving the stability and generalization ability of the model, and being particularly suitable for maintaining training robustness in the disturbed label scenario.

[0181] Through the above mechanism, the label disturbance and denoising learning module constructs high-quality training signals without revealing the true supervision information, effectively improving the performance of internal threat detection and the level of privacy security protection.

[0182] In summary, the embodiment of the disclosure has the following beneficial effects:

[0183] 1. PageRank-based structure reconstruction mechanism: by introducing the PageRank algorithm to modify the initial adjacency matrix, the global modeling of node influence is realized, the multi-hop propagation path and implicit connection relationship are effectively completed, and the completeness and hierarchy of the structure representation are improved.

[0184] 2. Feature perturbation and calibration mechanism based on local differential privacy: design a feature perturbation encoder, only perturb the dimension of a subset of features with probability, introduce a feature calibrator to realize statistically unbiased reconstruction, while ensuring node feature privacy and retaining discriminability, balancing privacy and effectiveness.

[0185] 3. Denoising supervised learning mechanism under perturbed labels: adopt a random response mechanism to perturb node labels, combine multi-hop confidence weighted aggregation and adaptive entropy control propagation mechanism to realize denoising recovery of perturbed labels; introduce a prediction consistency soft label to further improve the training stability of the model in a privacy scenario.

[0186] Corresponding to the above abnormality detection method, the embodiment of the disclosure also proposes an abnormality detection device. Since the device embodiment of the embodiment of the disclosure corresponds to the above-mentioned method embodiment, for details not disclosed in the device embodiment, please refer to the above-mentioned method embodiment, which will not be described in detail in the embodiment of the disclosure.

[0187] Figure 7 The structure diagram of an abnormality detection device provided by the embodiment of the disclosure is shown in Figure 7 , which includes:

[0188] The construction unit 61 is configured to construct an initial adjacency matrix according to the received user behavior log in response to the received user behavior log;

[0189] The enhancement processing unit 62 is configured to perform enhancement processing according to the interaction relationship between user nodes in the initial adjacency matrix to generate an enhanced adjacency matrix;

[0190] The extraction unit 63 is configured to extract an initial feature vector of each user node in the user behavior log;

[0191] The perturbation processing unit 64 is configured to perform random perturbation processing on the local feature dimension of the initial feature vector to obtain a perturbed feature vector;

[0192] The detection unit 65 is configured to determine an abnormal user node and / or an abnormal behavior according to the enhanced adjacency matrix and the perturbed feature vector.

[0193] Further, in a possible implementation manner of the embodiment of the disclosure, as shown in Figure 8 , the enhancement processing unit is further configured to calculate a global influence score of each user node based on a preset user node transition algorithm to generate the enhanced adjacency matrix to complete the multi-hop path between user nodes.

[0194] Further, in a possible implementation manner of the embodiment of the disclosure, as shown in Figure 8 , the enhancement processing unit 62 includes:

[0195] The normalization processing module 621 is configured to normalize the initial adjacency matrix by row.

[0196] The construction module 622 is configured to construct a transition probability matrix based on the transition probability between user nodes and the out-degree of the user nodes.

[0197] The calculation module 623 is configured to calculate the global influence score of each user node in the transition probability matrix by using a preset transition algorithm between user nodes.

[0198] The generation module 624 is configured to generate the enhanced adjacency matrix according to the global influence score of each user node and the edge weight between two user nodes in the initial adjacency matrix.

[0199] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 8 The device further includes:

[0200] The calibration unit 66 is configured to, after the disturbance processing unit performs random disturbance processing on the local feature dimension of the initial feature vector to obtain a disturbed feature vector, calibrate the disturbed feature vector by using an unbiased mapping function to obtain a calibrated feature vector.

[0201] The calculation unit 67 is configured to calculate a feature recovery variance of the calibrated feature vector to quantify the uncertainty of the disturbance processing.

[0202] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 8 The detection unit 65 includes:

[0203] The aggregation processing module 651 is configured to perform aggregation processing on the enhanced adjacency matrix and the disturbed feature vector to obtain a multi-hop feature vector.

[0204] The detection module 652 is configured to perform identification detection on the multi-hop feature vector by using a pre-trained graph processing model to obtain the abnormal user node and / or the abnormal behavior.

[0205] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 8 The device further includes a training unit 68, and the training unit includes:

[0206] The disturbance module 681 is configured to perform disturbance processing on the user node label to obtain a disturbed user node label.

[0207] The construction module 682 is configured to construct a denoising supervision signal by combining a multi-hop confidence weighted aggregation and an entropy control mechanism.

[0208] The training module 683 is configured to train the graph processing model based on the disturbed user node label and the denoising supervision signal, to obtain the pre-trained graph processing model.

[0209] Further, in a possible implementation of the embodiment of the present disclosure, as shown in Figure 8 The training module 683 is further configured to:

[0210] construct a prediction consistency loss function based on the denoising supervision signal, the disturbed user node label, and the predicted consistency soft label;

[0211] train the graph processing model based on the prediction consistency loss function, to obtain the pre-trained graph processing model.

[0212] It should be noted that the foregoing explanation and description of the method embodiments are also applicable to the apparatus of the present disclosure, and the principle is the same, which is not limited in the present disclosure.

[0213] According to the embodiments of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium, and a computer program product.

[0214] Figure 9 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present disclosure described and / or claimed in this document.

[0215] As shown in Figure 9 The electronic device 700 includes a computing unit 701 that can perform various appropriate actions and processes in accordance with a computer program stored in a ROM (Read-Only Memory) 702 or a computer program loaded into a RAM (Random Access Memory) 703 from a storage unit 708. Various programs and data required for the operation of the electronic device 700 can also be stored in the RAM 703. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An I / O (Input / Output) interface 705 is also connected to the bus 704.

[0216] A plurality of components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0217] The computing unit 701 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a CPU (Central Processing Unit), a GPU (Graphic Processing Unit), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, a DSP (Digital Signal Processor), and any appropriate processor, controller, microcontroller, etc. The computing unit 701 performs various methods and processes described above, such as the method of detecting anomalies. For example, in some embodiments, the method of detecting anomalies can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded to the RAM 703 and executed by the computing unit 701, one or more steps of the methods described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the aforementioned method of detecting anomalies by other any appropriate means, such as by means of firmware.

[0218] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a Field Programmable Gate Array (FPGA), an Application-Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a System on a Chip (SOC), a Complex Programmable Logic Device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0219] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general or special purpose computer, such that the program code, when executed by the processor or controller, causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be implemented in a wholly in machine language, in partially in machine language, in partially in a high level language, and other combinations thereof. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server.

[0220] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0221] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0222] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0223] The computer system can include clients and servers. This relationship can be between a client and a server that are typically remote from each other and typically interact through a communication network. The relationship between client and server exists by virtue of computer programs running on the respective computer systems and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS (Virtual Private Server, or VPS for short) services. The server can also be a server of a distributed system, or a server combined with a blockchain.

[0224] It should be noted that artificial intelligence is a discipline that studies enabling computers to simulate some thinking processes and intelligent behaviors of people (such as learning, reasoning, thinking, planning, etc.), both hardware and software technologies. Artificial intelligence hardware technology generally includes technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing, etc.; artificial intelligence software technology mainly includes computer vision technology, speech recognition technology, natural language processing technology, and machine learning / deep learning, big data processing technology, knowledge graph technology, etc. several major directions.

[0225] It should be understood that the various forms of the flow shown above can be used to reorder, add or delete steps. For example, each step described in the present disclosure can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, which is not limited herein.

[0226] The above detailed description does not constitute a limitation on the scope of protection of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present disclosure shall be included in the scope of protection of the present disclosure.

Claims

1. An abnormality detection method characterized by comprising: The method comprises the following steps: In response to the received user behavior log, an initial adjacency matrix is constructed according to the user behavior log, and an enhanced adjacency matrix is generated through enhanced processing of the interaction relationship between user nodes in the initial adjacency matrix; Extract the initial feature vector of each user node in the user behavior log, and perform random perturbation processing on the local feature dimension of the initial feature vector to obtain a perturbed feature vector; According to the enhanced adjacency matrix and the perturbed feature vector, determine the abnormal user node and / or abnormal behavior.

2. The method of claim 1, wherein, The enhanced processing of the interaction relationship between user nodes in the initial adjacency matrix to generate the enhanced adjacency matrix comprises: Based on a preset user node transfer algorithm, the global influence score of each user node is calculated to generate the enhanced adjacency matrix to complete the multi-hop path between user nodes.

3. The method of claim 2, wherein, The global influence score of each user node in the transfer probability matrix is calculated through a preset user node transfer algorithm. According to the global influence score of each user node and the edge weight between two user nodes in the initial adjacency matrix, the enhanced adjacency matrix is generated. After the random perturbation processing on the local feature dimension of the initial feature vector to obtain the perturbed feature vector, the method further comprises: Calibrate the perturbed feature vector through an unbiased mapping function to obtain a calibrated feature vector; 4. The method of claim 1, wherein, Calculate the feature recovery variance of the calibrated feature vector to quantify the uncertainty of the perturbation processing. The determination of the abnormal user node and / or abnormal behavior according to the enhanced adjacency matrix and the perturbed feature vector comprises: Aggregate the enhanced adjacency matrix and the perturbed feature vector to obtain a multi-hop feature vector; 5. The method of claim 1, wherein, The multi-hop feature vector is identified and detected through a pre-trained graph processing model to obtain the abnormal user node and / or abnormal behavior. The training method of the graph processing model comprises: Perturb the user node label to obtain a perturbed user node label; 6. The method of claim 5, wherein, Combine multi-hop confidence weighted aggregation and entropy control mechanism to construct a denoising supervision signal; Based on the perturbed user node label and the denoising supervision signal, the graph processing model is trained to obtain the pre-trained graph processing model. The training of the graph processing model based on the perturbed user node label and the denoising supervision signal to obtain the pre-trained graph processing model comprises: Construct a prediction consistency loss function through the denoising supervision signal, the perturbed user node label and the predicted consistency soft label; 7. The method of claim 6, wherein, Based on the prediction consistency loss function, the graph processing model is trained to obtain the pre-trained graph processing model. The method comprises the following steps: ​ 8. An abnormality detection device characterized by comprising: ​ A construction unit is configured to construct an initial adjacency matrix according to the received user behavior log; An enhancement processing unit is configured to perform enhancement processing according to the interaction relationship between user nodes in the initial adjacency matrix, and generate an enhanced adjacency matrix; An extraction unit is configured to extract an initial feature vector of each user node in the user behavior log; A perturbation processing unit is configured to perform random perturbation processing on a local feature dimension of the initial feature vector to obtain a perturbed feature vector; A detection unit is configured to determine an abnormal user node and / or an abnormal behavior according to the enhanced adjacency matrix and the perturbed feature vector.

9. An electronic device, comprising: comprise: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-7.

Images