Network risk behavior identification method, electronic equipment, storage medium and program

Abstract

The embodiment of the invention discloses a network risk behavior identification method, electronic equipment, a storage medium and a program. The method comprises the following steps: generating a comprehensive network behavior vector sequence according to multi-dimensional network behavior feature data; generating a dynamic baseline matrix of the multi-dimensional network behavior feature data according to multi-dimensional base line influence factors and the comprehensive network behavior vector sequence; and generating a network risk probability matched with the target network behavior under the condition of determining that the behavior characteristic value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix. According to the technical scheme of the embodiment of the invention, the accuracy of network risk behavior identification can be improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network security, and particularly relate to a network risk behavior identification method and device, electronic equipment, storage medium and program. BACKGROUND

[0002] With the rapid development of Internet technology, various network attack behaviors are increasingly rampant, bringing huge security risks to individuals and enterprises.

[0003] Currently, existing network attack behavior prevention tools mainly rely on blacklist filtering and static feature detection. The blacklist filtering method is to block network risks by intercepting specific domain names or keywords. The static feature detection method identifies potential network risks by analyzing the static features of network traffic or system files, such as binary code structure or function calls, and is mainly applied to the field of malware detection.

[0004] The inventors found that the prior art has the following defects in the process of implementing the present application: The blacklist filtering method and the static feature detection method are often based on fixed historical data to set a unified alarm threshold in baseline construction. Although it can identify known network risk behaviors to some extent, it cannot effectively identify new or transformed network risk behaviors, resulting in low accuracy of network risk behavior identification. SUMMARY

[0005] Embodiments of the present application provide a network risk behavior identification method, device, electronic equipment, storage medium and program, which can improve the accuracy of network risk behavior identification.

[0006] According to an aspect of the present application, a network risk behavior identification method is provided, comprising:

[0007] generating a comprehensive network behavior vector sequence according to multi-dimensional network behavior feature data;

[0008] generating a dynamic baseline matrix of the multi-dimensional network behavior feature data according to multi-dimensional baseline influencing factors and the comprehensive network behavior vector sequence;

[0009] generating a network risk probability matched with the target network behavior in a case where the behavior feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix.

[0010] According to another aspect of the present application, a network risk behavior identification device is provided, comprising:

[0011] a comprehensive network behavior vector sequence generation module configured to generate a comprehensive network behavior vector sequence according to multi-dimensional network behavior feature data;

[0012] a dynamic baseline matrix generation module configured to generate a dynamic baseline matrix of the multi-dimensional network behavior feature data according to the multi-dimensional baseline influencing factors and the sequence of comprehensive network behavior vectors;

[0013] a network risk probability generation module configured to generate a network risk probability matched with the target network behavior when it is determined that the behavior feature value of the target network behavior deviates from a corresponding target dynamic baseline in the dynamic baseline matrix.

[0014] According to another aspect of the present application, an electronic device is provided, which comprises:

[0015] at least one processor; and

[0016] a memory connected to the at least one processor in communication; wherein,

[0017] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network risk behavior identification method according to any one of the embodiments of the present application.

[0018] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the network risk behavior identification method according to any one of the embodiments of the present application when executed by the processor.

[0019] According to another aspect of the present application, a computer program product is also provided, which comprises a computer program for implementing the network risk behavior identification method according to any one of the embodiments of the present application when executed by a processor.

[0020] The embodiments of the present application generate a sequence of comprehensive network behavior vectors according to multi-dimensional network behavior feature data, generate a dynamic baseline matrix of the multi-dimensional network behavior feature data according to multi-dimensional baseline influencing factors and the sequence of comprehensive network behavior vectors, and further generate a network risk probability matched with the target network behavior when it is determined that the behavior feature value of the target network behavior deviates from a corresponding target dynamic baseline in the dynamic baseline matrix. The above technical solution can achieve accurate and dynamic adaptation of the normal network behavior benchmark by constructing a dynamic baseline matrix of multi-dimensional network behavior feature data and adjusting the baseline threshold in real time according to the context in combination with multi-dimensional baseline influencing factors, solve the problem that the existing network attack behavior identification method adopts a fixed baseline and is difficult to adapt to complex scenarios, and improve the accuracy of network risk behavior identification.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a method for identifying network risk behaviors provided in an embodiment of the present invention;

[0024] Figure 2 This is a flowchart of another method for identifying network risk behaviors provided in an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of a process for generating a dynamic baseline provided in an embodiment of the present invention;

[0026] Figure 4 This is a flowchart of another method for identifying network risk behaviors provided in an embodiment of the present invention;

[0027] Figure 5 This is a schematic diagram of a process for generating network risk propagation probability according to an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of a process for actively intervening in network behavior and triggering verification, provided by an embodiment of the present invention;

[0029] Figure 7 This is a schematic diagram of the overall process for identifying and preventing network risk behaviors provided in an embodiment of the present invention;

[0030] Figure 8 This is a schematic diagram of a network risk behavior identification device provided in an embodiment of the present invention;

[0031] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first," "second," "third," and "fourth," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] Figure 1 This is a flowchart of a network risk behavior identification method provided by an embodiment of the present invention. This embodiment is applicable to situations where network risk behaviors are accurately identified based on a dynamic baseline matrix. The method can be executed by a network risk behavior identification device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. This electronic device can be a terminal device or a server device, as long as it can execute the network risk behavior identification method. This embodiment of the present invention does not limit the specific type of electronic device. Correspondingly, as... Figure 1 As shown, the method includes the following operations:

[0035] S110. Generate a comprehensive network behavior vector sequence based on multidimensional network behavior feature data.

[0036] The multidimensional network behavior feature data can be various feature data that reflect network behavior, such as, but not limited to, front-end interaction behavior feature data, network layer behavior feature data, and network interaction content feature data. This embodiment of the invention does not limit the specific data type and content of the multidimensional network behavior feature data. The comprehensive network behavior vector sequence can be a vector sequence generated based on the multidimensional network behavior feature data, which can reflect network behavior features from multiple dimensions.

[0037] In this embodiment of the invention, the terminal agent program can first collect multi-dimensional behavioral feature data associated with the interactive behavior of network interaction objects (such as users) in real time as multi-dimensional network behavioral feature data, and then perform fusion processing and vectorization processing on the multi-dimensional network behavioral feature data to generate a comprehensive network behavior vector sequence of network interaction objects.

[0038] S120. Generate a dynamic baseline matrix of the multidimensional network behavior feature data based on the multidimensional baseline influencing factors and the comprehensive network behavior vector sequence.

[0039] The multidimensional baseline influencing factors can be factors affecting the baseline threshold in multiple dimensions. These factors may include, but are not limited to, operational permissions of network interaction objects, network environment risks, and periodic adaptability, as long as they are relevant to adjusting the baseline threshold. This embodiment of the invention does not limit the specific type of multidimensional baseline influencing factors. The dynamic baseline matrix can be a matrix composed of dynamically adjustable baselines. In this embodiment, the "baseline" can be a reference value used to measure whether the behavioral characteristic values ​​of network behavior are normal.

[0040] In real-world network environments, multiple reference factors often influence the evaluation of network behavior characteristics. For example, different user permissions, network environments, or periodicity of network behaviors will result in different baseline values. Therefore, after generating a comprehensive network behavior vector sequence, multi-dimensional baseline influencing factors can be used to comprehensively analyze the network behavior feature data of each dimension in the sequence, thereby generating dynamic baselines corresponding to the network behavior feature data of each dimension. A dynamic baseline refers to a baseline whose values ​​can be dynamically adjusted as needed, rather than remaining fixed. In other words, a dynamic baseline matrix can consist of multiple dynamic baselines, each of which can be used to determine whether a particular dimension of network behavior characteristic is normal.

[0041] S130. When the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, generate the network risk probability matching the target network behavior.

[0042] The target network behavior can be any behavior that requires risk identification and assessment. The target dynamic baseline can be a dynamic baseline that can be used to assess the risk of the target network behavior.

[0043] After generating the dynamic baseline matrix, the risk status of network behavior can be identified in real time. Specifically, when the behavioral characteristic value of a target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, it indicates that the probability of the target network behavior being risky is relatively high. At this time, a network risk probability matching the target network behavior can be generated to identify the degree of risk of the target network behavior. This can effectively identify various types of network risk behaviors, such as including but not limited to phishing attacks, malware intrusions, and internal network threats. This embodiment of the invention does not limit the types of network risk behaviors.

[0044] Correspondingly, the network risk probability matched by the target network behavior can be used as reference data to control the risk of the target network behavior, such as suspending the target network behavior to ensure network security, or requiring the behavior to enter the behavior verification stage to verify the behavior, so as to ensure the legality and compliance of the target network behavior.

[0045] This invention generates a comprehensive network behavior vector sequence based on multidimensional network behavior feature data. Then, based on multidimensional baseline influencing factors and the comprehensive network behavior vector sequence, it generates a dynamic baseline matrix of multidimensional network behavior feature data. Furthermore, when the behavioral feature value of a target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, it generates a network risk probability matching the target network behavior. This technical solution, by constructing a dynamic baseline matrix of multidimensional network behavior feature data and combining it with multidimensional baseline influencing factors, can adjust the baseline threshold in real time according to the context. This enables accurate characterization and dynamic adaptation of normal network behavior benchmarks, solving the problem that existing network attack behavior identification methods using fixed baselines are difficult to adapt to complex scenarios, and improving the accuracy of network risk behavior identification.

[0046] Figure 2 This is a flowchart of another network risk behavior identification method provided by an embodiment of the present invention. This embodiment is based on the above embodiment and is further specified. In this embodiment, various specific optional implementation methods are given for generating a comprehensive network behavior vector sequence based on multidimensional network behavior feature data and generating a dynamic baseline matrix of multidimensional network behavior feature data based on multidimensional baseline influencing factors and the comprehensive network behavior vector sequence. Correspondingly, such as Figure 2 As shown, the method in this embodiment may include:

[0047] S210. Standardize the multidimensional network behavior feature data to obtain standard multidimensional network behavior feature data.

[0048] Among them, standard multidimensional network behavior feature data can be standardized multidimensional network behavior feature data obtained by standardizing multidimensional network behavior feature data.

[0049] S220. Determine the fusion weights of the standard multidimensional network behavior feature data.

[0050] Among them, the fusion weight can be used to fuse standard multidimensional network behavior feature data.

[0051] S230. Perform vector fusion on the standard multidimensional network behavior feature data according to the fusion weights of the standard multidimensional network behavior feature data to obtain the comprehensive network behavior vector sequence.

[0052] In this embodiment of the invention, since the multidimensional network behavior feature data belongs to feature data with different dimensions and scales, the multidimensional network behavior feature data can first be standardized, such as mapping the multidimensional network behavior feature data to the [0,1] interval to eliminate the influence of scale, thus obtaining standard multidimensional network behavior feature data. Further, the fusion weights corresponding to the different dimensions of network behavior feature data in the standard multidimensional network behavior feature data are determined, so that the standard multidimensional network behavior feature data can be vector-fused according to the fusion weights of the standard multidimensional network behavior feature data to obtain a comprehensive network behavior vector sequence.

[0053] In an optional embodiment of the present invention, the multidimensional network behavior feature data may include page interaction behavior data, network layer behavior data, and network content feature data; wherein: the page interaction behavior data may include mouse trajectory acceleration change rate, page focus switching interval, and input box deletion frequency; the network layer behavior data may include DNS (Domain Name System) request timing correlation, TLS (Transport Layer Security) certificate chain abnormal jumps, and cross-domain resource loading topology; the network content feature data may include sender domain similarity, URL (Uniform Resource Locator) path depth deviation value, and emergency inducement word density.

[0054] Among them, page interaction behavior data can be the interaction behavior data of network interaction objects on the network page, such as user interaction behavior data.

[0055] Specifically, when a network interaction object performs operations such as mouse movement, page switching, and input, the terminal agent program can record raw data of the page interaction behavior according to a preset sampling interval (e.g., 10ms), and generate page interaction behavior data based on this raw data. For example, the rate of change of mouse trajectory acceleration in the page interaction behavior data can be calculated by averaging the acceleration differences of multiple consecutive (e.g., 5) mouse trajectory sampling points in the raw data. The page focus switching interval in the page interaction behavior data can be determined based on the time difference between two adjacent focus switching events recorded in the raw data. The input box deletion frequency in the page interaction behavior data can be statistically analyzed based on the number of deletion operations per minute in the raw data.

[0056] Simultaneously, raw network layer behavior data can be captured when a network request is initiated. The timing correlation of DNS requests can be calculated based on the variance of the time intervals between multiple consecutive (e.g., three) requests within this raw network layer behavior data. Assuming the time intervals of three consecutive DNS requests are t1, t2, and t3, the average time interval of the three consecutive DNS requests is... The formula for calculating the time sequence correlation of DNS requests can be:

[0057]

[0058] The formula for calculating the timing correlation of DNS requests above quantifies the timing stability of multiple DNS requests by calculating the deviation of the time interval between DNS requests from the mean. A larger value for σ indicates a weaker timing correlation. Abnormal jumps in the TLS certificate chain in network layer behavioral data can be calculated using the trust chain matching degree between the certificate issuer and its superior issuer, included in the original network layer behavioral data. Cross-domain resource loading topology relationships in network layer behavioral data can be calculated using the domain name hierarchy depth of the loaded resources recorded in the original network layer behavioral data.

[0059] Optionally, raw web content feature data can be extracted when receiving emails or accessing URLs. The sender domain similarity in the web content feature data can be calculated using the string edit distance between the sender domain and the trusted domain in the raw web content feature data. The URL path depth deviation in the web content feature data can be calculated using the hierarchical difference between normal paths recorded in the raw web content feature data. The density of emergency-inducing words in the web content feature data can be calculated using the ratio of the number of emergency words recorded in the raw web content feature data to the total vocabulary.

[0060] Furthermore, the collected page interaction behavior data, network layer behavior data, and network content feature data are standardized. A min-max standardization method can be used to map all data, including page interaction behavior data, network layer behavior data, and network content feature data, to the [0,1] interval to eliminate the influence of dimensions. Then, based on the fusion weights of the standard multidimensional network behavior feature data, vector fusion is performed on the standard multidimensional network behavior feature data according to the formula: V = w1×U + w2×Q + w3×C, to obtain a comprehensive network behavior vector sequence. Here, V is the comprehensive network behavior vector sequence, U is the standardized page interaction behavior data, Q is the standardized network layer behavior data, and C is the standardized network content feature data. w1, w2, and w3 are the fusion weights of the three types of data, and w1 + w2 + w3 = 1. Optionally, the fusion weights can be set according to the identification contribution of the three types of data—page interaction behavior data, network layer behavior data, and network content feature data—in historical network behavior attack data. By performing vector fusion on standard multidimensional network behavior feature data according to the fusion weights, numerical differences between different types of data can be eliminated, enabling the comprehensive network behavior vector sequence to accurately reflect the comprehensive characteristics of network behavior. The comprehensive network behavior vector sequence can be arranged in chronological order and input into a dynamic baseline engine. The dynamic baseline engine will then establish a normal behavior baseline based on the comprehensive network behavior vector sequence, providing a foundation for subsequent identification of abnormal behavior by comparing the baseline.

[0061] S240. Generate historical baseline values ​​for each single-dimensional network behavior in the comprehensive network behavior vector sequence.

[0062] One-dimensional network behavior refers to a single type of network behavior, such as mouse trajectory behavior, page focus switching behavior, or DNS request behavior. Historical baseline values ​​refer to the baseline values ​​of historical data on one-dimensional network behavior.

[0063] For each single-dimensional network behavior in the comprehensive network behavior vector sequence, a corresponding calculation method can be used to calculate the historical baseline value for each type of single-dimensional network behavior. The calculation method for the corresponding historical baseline value may differ depending on the type of single-dimensional network behavior. For example, for mouse trajectory behavior, the historical steady-state mean of the rate of change of mouse trajectory acceleration can be calculated as the historical baseline value for mouse trajectory behavior. For DNS request behavior, the normal fluctuation range of the temporal correlation of DNS requests can be calculated as the historical baseline value for DNS request behavior.

[0064] S250. Determine the multidimensional influence coefficient of each of the single-dimensional network behaviors based on the multidimensional baseline influencing factors, and determine the coefficient weight of each single-dimensional influence coefficient in the multidimensional influence coefficient.

[0065] The multidimensional influence coefficient can be a type of coefficient that adjusts the baseline of network behavior from different dimensions. The coefficient weight can be the weight assigned to each single-dimensional influence coefficient in the multidimensional influence coefficient.

[0066] S260. Generate a dynamic baseline matrix of the multidimensional network behavior feature data based on the historical baseline values ​​of each of the single-dimensional network behaviors, the multidimensional influence coefficients of each of the single-dimensional network behaviors, and the coefficient weights of each single-dimensional influence coefficient in the multidimensional influence coefficients.

[0067] For example, multidimensional baseline influencing factors may include, but are not limited to, factors such as the role profile of network interaction objects, network environment risks, and historical behavior cycles. Correspondingly, the multidimensional influence coefficients of each single-dimensional network behavior determined based on the multidimensional baseline influencing factors may include, but are not limited to, the role permission sensitivity coefficient of network interaction objects, the network environment risk coefficient, and the cycle adaptation coefficient.

[0068] Specifically, for each unidimensional network behavior, a dynamic baseline can be generated based on the historical baseline value of each unidimensional network behavior, the multidimensional influence coefficient of each unidimensional network behavior, and the coefficient weights of each unidimensional influence coefficient within the multidimensional influence coefficient. Correspondingly, the dynamic baselines corresponding to each unidimensional network behavior are fused to obtain a dynamic baseline matrix of the multidimensional network behavior feature data.

[0069] Figure 3 This is a schematic diagram of a process for generating a dynamic baseline according to an embodiment of the present invention. In a specific example, such as... Figure 3 As shown, it is assumed that the sensitivity level of the job permissions of network interaction objects can be extracted based on the role profile of the network interaction objects, thereby determining the role permission sensitivity coefficient R. The role permission sensitivity coefficient can characterize the sensitivity of the job permissions of the network interaction objects. It can be understood that the higher the job permissions of the network interaction objects, the larger the value of R. For example, the closer the job of the network interaction object is to the core data operation position, the closer the value of R is to 1; the closer the job of the network interaction object is to the basic position, the closer the value of R is to 0. Regarding network environment risks, the network environment risk coefficient can be calculated through threat intelligence and endpoint vulnerabilities. For example, the closer the network risk calculated by threat intelligence and endpoint vulnerabilities is to a high-risk environment, the closer the value of E is to 1; the closer the network risk calculated by threat intelligence and endpoint vulnerabilities is to a low-risk environment, the closer the value of E is to 0. Furthermore, the historical behavior cycle of network behavior can be analyzed using temporal convolutional networks to obtain the cycle adaptation coefficient. For example, the closer the date corresponding to the network behavior is to a workday, the closer the value of H is to 0.8; the closer the date corresponding to the network behavior is to a rest day, the closer the value of H is to 1.2.

[0070] For example, the formula for calculating the dynamic baseline of a certain one-dimensional network behavior can be: T = B × (wR ×R+w E ×E+w H ×H), where T represents the dynamic baseline of the one-dimensional network behavior, which may include alarm thresholds at the upper and lower boundaries, w R w E and w H It can be the coefficient weight of each single-dimensional influence coefficient, and satisfy w R +w E +w H =1. R represents the role-based access control sensitivity coefficient, w R The coefficient weights for role-based access control sensitivity coefficients; E represents the network environment risk coefficient, w E The coefficient weights are the network environment risk coefficients; H represents the periodic adaptation coefficient, w H The coefficient weights for the periodic adaptation coefficients are used. The coefficient weights of different single-dimensional influence coefficients can be dynamically optimized based on the contribution of each dimension to the identification of abnormal behavior in network attack and defense scenarios. The above dynamic baseline calculation formula, through weighted fusion of three context dimensions, adjusts the alarm thresholds for network behavior characteristics such as mouse trajectory acceleration change rate and abnormal jumps in TLS certificate chains in real time according to the sensitivity of the role, the intensity of environmental threats, and historical behavior patterns. For example, the network behavior output by core personnel on workdays in high-risk environments has higher R and E values ​​and lower H values, which compresses the threshold range to achieve accurate capture of abnormal network behavior. On the other hand, the threshold range of the dynamic baseline is more lenient for basic personnel on rest days in low-risk environments to avoid misjudgment. This dynamic baseline adjustment mechanism solves the problem that fixed baselines are difficult to adapt to complex scenarios, improving the accuracy of subsequent network risk behavior identification from the source.

[0071] S270. When the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, generate the network risk probability matching the target network behavior.

[0072] The above technical solution, based on role profiles, environmental risk levels, and historical behavior cycles, extracts historical baseline values ​​of behavioral characteristics and integrates role permission sensitivity coefficients, environmental risk coefficients, and cycle adaptation coefficients. It dynamically optimizes the coefficient weights according to the contribution of each dimension to abnormal network identification in network attack and defense scenarios, and generates floating alarm thresholds for each network behavior feature using a dynamic baseline calculation formula. This enables the dynamic baseline to be dynamically adjusted with the context, allowing the alarm thresholds of the dynamic baseline corresponding to each network behavior to be adjusted in real time according to role sensitivity, environmental threat intensity, and historical behavior patterns. This solves the problem that fixed baselines are difficult to adapt to complex scenarios and improves the sensitivity of identifying network risk behaviors.

[0073] Figure 4This is a flowchart of another network risk behavior identification method provided by an embodiment of the present invention. This embodiment is based on the above embodiment and is further specified. In this embodiment, various specific optional implementation methods are given for generating the network risk probability of the target network behavior match and the operations that can be performed after generating the network risk probability. Accordingly, as Figure 4 As shown, the method in this embodiment may include:

[0074] S310. Generate a comprehensive network behavior vector sequence based on multidimensional network behavior feature data.

[0075] S320. Generate a dynamic baseline matrix of the multidimensional network behavior feature data based on the multidimensional baseline influencing factors and the comprehensive network behavior vector sequence.

[0076] S330. When the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, a communication behavior relationship diagram matching the target network behavior is generated.

[0077] Among them, the communication behavior relationship diagram can be a graph structure used to reflect the communication behaviors associated with the target network behavior.

[0078] In this embodiment of the invention, if the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, it indicates that the target network behavior is likely to be a risky behavior. In this case, a graph neural network approach can be used, taking the current network interaction object corresponding to the target network behavior as the current node, determining the recent communication objects associated with the current node as associated nodes, and generating a communication behavior relationship graph matching the target network behavior based on the communication relationships between nodes. This communication behavior relationship graph can be used to perform network risk transmission analysis on the current network interaction object based on other communication objects, thereby determining the network risk probability matching the target network behavior.

[0079] S340. Determine the fusion edge weights based on the communication association data of each associated node in the communication behavior relationship diagram.

[0080] S350. Calculate the attention coefficients between nodes in the communication behavior relationship graph based on the fusion edge weights.

[0081] In this context, associated nodes can be any nodes in the communication behavior relationship graph. Communication-related data can be data related to communication between associated nodes in the communication behavior relationship graph, such as, but not limited to, communication frequency, transferred files, and email keywords. This embodiment of the invention does not limit the specific data type and content of the communication-related data. The fusion edge weight can be a weight determined by comprehensively considering the weights of different dimensions of the edges between associated nodes in the communication behavior relationship graph. For example, the fusion edge weight can include various different types of weights, such as communication frequency weight, file transfer weight, and semantic association weight. The communication frequency weight can be represented by the ratio of recent communication frequency to the total historical frequency, reflecting the probability of risk transmission between associated nodes. The file transfer weight can be represented by the difference between the transferred file type and commonly used types, reflecting the probability of risk transmission between associated nodes through file transfer between nodes. The semantic association weight can be represented by the overlap between keywords in the email text and high-frequency words in historical communications, reflecting the probability of risk transmission between associated nodes through the semantic information of the node's network behavior. The inter-node attention coefficient can be the attention coefficient between nodes.

[0082] Specifically, after generating the communication behavior relationship graph, the weights of the edges between the associated nodes in the graph are quantified. Figure 5 This is a schematic diagram illustrating the process of generating network risk propagation probability according to an embodiment of the present invention. In a specific example, such as... Figure 5 As shown, the communication frequency weights of edges between the current node and other associated nodes can be calculated first based on the number of communications of the current node. For example, this can be based on the formula: Calculate the communication frequency weight of the edges between the current node and other associated nodes, where F represents the communication frequency weight, f m This represents the number of communications between the current node and its associated nodes in the past m days. The value of m can be configured according to actual needs, for example, it can be 7. H This represents the total number of historical communications between the current node and its associated nodes, avoiding division by zero in the denominator. Additionally, the file transfer weights of the edges between the current node and other associated nodes can be calculated based on the current node's file transfer history. For example, this can be based on the formula: Calculate the file transfer weights of the edges between the current node and other associated nodes, where D1 represents the file transfer weight, G is the set of file types transferred between the current node and associated nodes, and U is the set of commonly used file types for the current node. Semantic association weights of the edges between the current node and other associated nodes can also be calculated based on the current node's email processing history. For example, this can be based on the formula: The semantic association weights of the edges between the current node and other associated nodes are calculated, where S1 is the semantic association weight of the edges between the current node and other associated nodes, K represents the set of email keywords between the current node and associated nodes, and H1 is the set of historical high-frequency words of the current node. The above risk transmission analysis method based on graph neural networks can achieve accurate analysis of network risk propagation paths.

[0083] After obtaining the communication frequency weight, file transfer weight, and semantic association weight, these weights can be fused. Accordingly, this can be done based on the formula: w ij =aF+bD1+cS1 to calculate the fused edge weights, where w ij This represents the weights of the merged edges, where a, b, and c are constants whose values ​​can be configured according to actual needs. For example, a = 0.4, b = 0.3, c = 0.3, etc.

[0084] like Figure 5 As shown, after obtaining the fused edge weights, these weights can be input into a graph attention network to calculate the inter-node attention coefficients between nodes in the communication behavior graph. For example, this can be based on formula α. ij =σ1(W·[h i ||h j ||w ij Calculate the inter-node attention coefficient α between nodes in the communication behavior graph. ij , where h i h is the sequence of comprehensive network behavior vectors for the current node i. j The sequence of network behavior vectors associated with node j is the weight matrix of the graph attention network, and σ1 is the ReLU (Rectified Linear Unit) activation function.

[0085] S360. Calculate the network risk probability of the target network behavior matching based on the attention coefficients between nodes in the communication behavior relationship diagram.

[0086] After calculating the attention coefficients between nodes in the communication behavior relationship graph, the network risk probability of matching the target network behavior can be further calculated based on the attention coefficients between nodes in the communication behavior relationship graph.

[0087] In an optional embodiment of the present invention, the multidimensional influence coefficient includes a role permission sensitivity coefficient and a network environment risk coefficient; the step of calculating the network risk probability matching the target network behavior based on the attention coefficient between each node in the communication behavior relationship graph may include: calculating the initial network risk probability of the target network behavior based on the attention coefficient between each node in the communication behavior relationship graph; calibrating the initial network risk probability based on the network environment risk coefficient to obtain a first calibrated network risk probability; determining the sensitive operation judgment value of the target network behavior based on the resource permission level of the target network behavior and the role permission sensitivity coefficient; and calibrating the first calibrated network risk probability a second time based on the first calibrated network risk probability, the sensitive operation environment linkage coefficient, the sensitive operation judgment value, and the network environment risk coefficient to obtain a second calibrated network risk probability.

[0088] The initial network risk probability can be a preliminary calculation based on the attention coefficients between nodes. The first calibration network risk probability can be the network risk probability obtained after calibrating the initial network risk probability. The sensitive operation judgment value is reference data used to assess whether an operation is sensitive. The sensitive operation environment linkage coefficient can be the coefficient of linkage between the sensitive operation and the network environment. The second calibration network risk probability can be the network risk probability obtained after recalibrating the first calibration network risk probability.

[0089] Specifically, such as Figure 5 As shown, the initial network risk probability of a target network behavior can be calculated based on the attention coefficients between nodes in the communication behavior relationship graph, combined with the network risk labeling information of each associated node. For example, this can be based on the formula: P = ∑α ij ·l j Calculate the initial network risk probability of the target network behavior. Where P represents the initial network risk probability, l j This represents the network risk labeling information of the associated node j. For example, l j Network risk labeling information may include, for example, phishing labeling information, malware information, and insider threat information. This embodiment of the invention does not limit the specific information type and labeling value of network risk labeling information.

[0090] Accordingly, after initially calculating the initial network risk probability of the target network behavior, to improve the accuracy of the network risk probability, a network environment risk coefficient can be introduced to calibrate the initial network risk probability, resulting in a first calibrated network risk probability. For example, this can be based on the formula: P cal =P·(1+0.5E) is used to calibrate the initial network risk probability P once, resulting in the first calibrated network risk probability P.cal Here, E represents the network environment risk coefficient, and its value can be dynamically configured according to the network environment risk situation. When the network environment is at high risk, the value of E tends to be 1. The above formula for calculating the probability of the first calibration network risk can amplify the probability of network risk transmission in a high-risk network environment, making the probability of network risk transmission in the medium-risk range, such as 60% ≤ P, more favorable. cal A network risk probability range of ≤80% can more accurately cover potential network attack chains.

[0091] Accordingly, after completing the first calibration calculation to obtain the first calibration network risk probability of the target network behavior, in order to further improve the accuracy of the network risk probability, a role-based access control sensitivity coefficient can be introduced to calibrate the first calibration network risk probability again, resulting in a second calibration network risk probability after secondary calibration. For example, the sensitive operation judgment value of the target network behavior can be determined first based on the resource access control level and the role-based access control sensitivity coefficient. For instance, the sensitive operation judgment value S can be calculated based on the formula: S = N² × R. Here, N² represents the resource access control level of the target network behavior, and its range can be [0,1]. The higher the access control level of the network resources involved in the target network behavior, the larger the value of N². For example, if the network resources involved in the target network behavior are core data resources, then N² = 0.9; if the network resources involved in the target network behavior are basic resources, then N² = 0.3. The sensitive operation judgment value can assess the sensitivity of the network behavior; the larger the value of S, the more sensitive the network behavior. Correspondingly, the sensitive operation judgment value can be calculated based on the formula: P... 传校 =P cal ×(1+α×E×S) represents the risk probability P of the first calibration network. cal A second calibration is performed to obtain the second calibration network risk probability P. 传校 Where α represents the sensitive operation environment linkage coefficient, which can optionally be 0.2, etc. The second calibration network risk probability calculation formula introduces sensitive operation weights based on network environment risk calibration. When the target network behavior is in a high-risk network environment (e.g., E = 0.8) and the operation is sensitive (e.g., S = 0.7), P... 传校 =P cal ×(1+0.2×0.8×0.7)=P cal ×1.112, meaning the lower limit of the medium risk probability is calibrated from 60% to 66.7%, can further compress the network risk tolerance space and ensure that the risk assessment of sensitive operations in high-risk scenarios is more rigorous and accurate.

[0092] In an optional embodiment of the present invention, after generating the network risk propagation probability matching the target network behavior, the method may further include: determining the target network behavior as a medium-risk sensitive operation behavior if the network risk propagation probability matching the target network behavior is within a medium-risk range and the role permission sensitivity coefficient is greater than or equal to a first threshold; determining the target network behavior as a high-risk sensitive operation behavior if the network risk propagation probability matching the target network behavior is within a medium-risk range and the sensitive operation judgment value of the target network behavior is greater than or equal to a second threshold; and pausing the target network behavior and displaying a preset verification interface on the current operation page of the target network behavior if the target network behavior is determined to be either the medium-risk sensitive operation behavior or the high-risk sensitive operation behavior.

[0093] The range of medium risk, the first threshold and the second threshold can be configured according to actual needs. This embodiment of the invention does not limit the specific values ​​of the range of medium risk, the first threshold and the second threshold.

[0094] After generating the network risk propagation probability matching the target network behavior, the target network behavior can be judged based on the calculated network risk propagation probability. Figure 6 This is a schematic diagram illustrating a process for actively intervening in network behavior and triggering verification, provided by an embodiment of the present invention. In a specific example, such as... Figure 6 As shown, if the network risk propagation probability of the target network behavior is within the medium risk range, and the role-permission sensitivity coefficient is greater than or equal to the first threshold, such as when 60% ≤ P cal When the probability of network risk transmission is ≤80% and R≥0.8, the target network behavior can be determined as a medium-risk sensitive operation, and an operation to suspend the target network behavior can be triggered. If the network risk transmission probability matched by the target network behavior is within the medium-risk range, and the sensitive operation judgment value of the target network behavior is greater than or equal to the second threshold, such as when 60%≤P cal When the probability is ≤80% and S≥0.6, the target network behavior can be determined as a high-risk sensitive operation, which can trigger an operation to suspend the target network behavior. The method of determining high-risk sensitive operations not only continues the influence of role sensitivity on risk, but also quantifies the degree of operation sensitivity through values, which can avoid excessive intervention such as suspending non-sensitive operations, even network behaviors with moderate probability.

[0095] When the target network behavior is paused, a preset verification interface can be displayed on the current operation page of the target network behavior to guide the current network interaction object to perform security verification of the target network behavior.

[0096] In an optional embodiment of the present invention, displaying a preset verification interface on the current operation page of the target network behavior may include: calculating the compatibility between the current preset verification interface and the target network behavior based on the current preset verification behavior type; displaying the current preset verification interface as a preset verification interface when the compatibility between the current preset verification interface and the target network behavior is determined to be less than or equal to a third threshold; wherein the preset verification interface is used to determine the security of the target network behavior based on the current verification behavior; and switching the current preset verification behavior type when the compatibility between the current preset verification interface and the target network behavior is determined to be greater than the third threshold, and returning to perform the operation of calculating the compatibility between the current preset verification interface and the target network behavior based on the current preset verification behavior type, until it is determined that the compatibility between the current preset verification interface and the target network behavior is less than or equal to the third threshold.

[0097] The third threshold can be configured according to actual needs, and the specific value of the third threshold is not limited in the embodiments of the present invention.

[0098] In this embodiment of the invention, the verification of the target network behavior can employ a variety of selectable preset verification behaviors, and the context adaptability of the preset verification behaviors can be quantified using a scenario adaptability algorithm. Specifically, the adaptability between the current preset verification interface and the target network behavior can be calculated based on the current preset verification behavior type. Assume the operation scenario type of the target network behavior is O, and the verification behavior type is V. 验 If the target network behavior is clicking on an email attachment, then O = 1; if the target network behavior is accessing an abnormal domain, then O = 2; for other network behavior types, O = 0. Calculate the compatibility A between the current preset verification interface and the target network behavior based on the current preset verification behavior type: A = |OV 验 |×k+M×0.1. Where k can be the scenario-verification type matching coefficient, and M can be the feature correlation between the preset verification behavior and the operation scenario. For example, when email operations are associated with input-type verification behaviors, M = 0.9; when associated with gesture-type verification behaviors, M = 0.3. When A ≤ 0.3, it indicates that the current preset verification behavior type meets the adaptation requirements of the target network behavior. For example, when a network interaction object clicks on a suspicious email attachment, V... 验=1. If the current preset verification behavior type uses dynamic verification code, then A = |1-1|×0.1+0.9×0.1 = 0.09≤0.3. In this case, it indicates that the dynamic verification code behavior verification method meets the adaptation requirements for clicking suspicious email attachments. The current preset verification interface corresponding to the current preset verification behavior type can be displayed as the preset verification interface. The network interaction object can execute the current verification behavior in the preset verification interface. If the verification behavior passes, the target network behavior is determined to be secure; if the verification behavior fails, the target network behavior is determined to be insecure. If the current preset verification behavior type uses mouse gestures, then V... 验 =2, at this point A = |1-2|×0.8+0.3×0.1 = 0.83>0.3, indicating that the mouse gesture verification method does not meet the adaptation requirements for clicking suspicious email attachments. At this point, the current preset verification behavior type can be automatically switched, such as from mouse gestures to dynamic verification codes, and the process returns to calculate the compatibility between the current preset verification interface and the target network behavior based on the current preset verification behavior type. This continues until the compatibility between the current preset verification interface and the target network behavior is determined to be less than or equal to the third threshold, thus finding a preset verification behavior type that is compatible with the target network behavior.

[0099] The above scheme associates the type of verification behavior (such as dynamic CAPTCHA input or specific mouse trajectory drawing) with the current operation scenario. If the network interaction object attempts to click on a suspicious email attachment, the verification behavior is to input a one-time CAPTCHA generated by the system via a secure keyboard, with the character intervals of the CAPTCHA conforming to the 90% confidence interval of historical input rhythms. If the network interaction object attempts to access an abnormal domain name, the verification behavior is to execute a preset mouse gesture, such as clicking the upper left corner of the page three times consecutively, with intervals conforming to its historical average operation ±0.3 seconds. The completion degree of the verification behavior is determined by the similarity between the behavior vector sequence and the preset template (e.g., cosine similarity ≥ 0.8). If the similarity is insufficient, secondary verification is triggered or the system is directly blocked.

[0100] The aforementioned method for quantifying pre-defined verification behaviors ensures the correlation between verification behaviors and operational scenarios by quantifying the matching degree between network behavior operation scenarios and verification behaviors, thus avoiding cognitive confusion caused by the disconnect between verification and operation.

[0101] In an optional embodiment of the present invention, the method may further include: calculating a verification deviation value between the current verification behavior and the verification behavior baseline based on the current verification behavior feature vector and the verification behavior baseline vector; updating the threshold boundary in the dynamic baseline matrix based on an adjustment coefficient and the verification deviation value if the verification deviation value is determined to be less than or equal to a fourth threshold; and training an adversarial network module using the feature vector of the target network behavior as a noise sample if the verification deviation value is determined to be greater than the fourth threshold. The adversarial network module is used to update the threshold boundary in the dynamic baseline matrix based on the training results.

[0102] The current verification behavior feature vector can be the feature vector of the current verification behavior. The verification behavior baseline vector can be the feature vector of the verification behavior baseline. The verification behavior baseline is used to detect whether the verification behavior is normal. The verification deviation value can characterize the deviation between the current verification behavior and the verification behavior baseline. The fourth threshold can be configured according to actual needs, and the specific value of the fourth threshold is not limited in this embodiment of the invention.

[0103] After completing behavior verification based on the preset verification interface and the current verification behavior, the verification deviation value between the current verification behavior and the verification behavior baseline can be calculated based on the feature vector of the current verification behavior and the baseline vector of the verification behavior. For example, the verification deviation value between the current verification behavior and the verification behavior baseline can be calculated using weighted Manhattan distance: D=∑(W×|v i -x i |). Where D represents the verification deviation between the current verification behavior and the baseline verification behavior, W is the weight matrix of the trained graph attention network used to calculate the attention coefficients between nodes, and v i To verify the behavioral feature vector; x i This is the feature vector used to verify the baseline behavior. If the verification deviation value is less than or equal to the fourth threshold, for example, D≤0.5, the verification behavior of the current preset verification interface can be determined as a legal operation. Figure 7 This is a schematic diagram of the overall process for identifying and preventing network risk behaviors according to an embodiment of the present invention. In a specific example, such as Figure 7 As shown, when the verification behavior is determined to be a valid operation, the threshold boundary in the dynamic baseline matrix can be updated based on the adjustment coefficient and the verification deviation value. For example, it can be based on formula T. 新 =T 原 The tolerance range of the behavioral features corresponding to the dynamic baseline matrix is ​​updated using the formula ×(1+β×(1-D)). Here, β=0.1 is the adjustment coefficient; T 原 T represents the tolerance range of the original behavioral features in the dynamic baseline matrix, i.e., the alarm threshold corresponding to the original upper and lower boundaries of the dynamic baseline; 新This represents the tolerance range for the updated behavioral characteristics, i.e., the alarm threshold corresponding to the upper and lower boundaries after the dynamic baseline update.

[0104] For example, if the anomaly threshold of the dynamic baseline corresponding to the original mouse trajectory is [0.2, 0.6], and the verification deviation is 0.3, then the update threshold of the dynamic baseline corresponding to the mouse trajectory is [0.2 × 1.07, 0.6 × 1.07] = [0.214, 0.642]. The dynamic baseline threshold expansion is dynamically adjusted by the verification deviation value to avoid overly widening the baseline due to a single verification action, while ensuring appropriate adjustment to fluctuations in the algorithm's behavior.

[0105] Correspondingly, if the verification deviation value is greater than the fourth threshold, such as D > 0.5, it indicates that the verification behavior of the current preset verification interface is an illegal operation. In this case, the feature vector of the target network behavior can be used as noise samples to train the adversarial network module, so that the adversarial network module can update the threshold boundary in the dynamic baseline matrix based on the training results. Optionally, the sample label of the adversarial network module can be calculated using the following formula: Z = D × E, where Z is the noise intensity and E is the network environment risk coefficient. The larger Z is, the stronger the sample's potential to interfere with the dynamic baseline, which can improve the targeting of adversarial training.

[0106] Optionally, a generative adversarial network can be introduced as an adversarial network module to simulate the attacker's noise injection behavior. The generator constructs a risk operation sequence that conforms to the statistical characteristics of normal behavior (such as slowly inducing clicks), and the discriminator judges the authenticity based on the dynamic baseline matrix. After each round of adversarial training, the parameters of the dynamic baseline matrix are updated using the discriminator gradient, thereby improving the recognition accuracy of network risk behaviors such as slow attacks and bypass methods.

[0107] Optionally, in the interaction design of pausing the target network behavior operation and the verification behavior, the cognitive burden can also be quantified by cue interference, as shown in the following formula:

[0108] I = λ × (L / 10) + (1 - λ) × (T³ / 3)

[0109] Where L is the number of characters in the prompt text, which can be controlled within 30 characters, i.e., L / 10≤3; T3 is the number of verification operation steps, which can be controlled within 2 steps, i.e., T3 / 3≤0.67; λ=0.6 is the text length weight. I≤1.5 can be set, with 1.5 being the interference threshold. For example, if the prompt text in the verification interface is 20 characters (L=20, L / 10=2) and the verification operation has 1 step (T3=1, T3 / 3≈0.33), then I=0.6×2+0.4×0.33≈1.33≤1.5, which meets the low-burden requirement. Meanwhile, the UI (User Interface) isolation technology of the verification interface can be quantified by layered rendering coefficients, as follows: K3=1-(S 重 / S 总), where S 重 To verify the overlap area between the interface and the target network behavior operation page; S 总 This represents the total screen area. K3 can be configured to be ≥0.8 (i.e., overlap area ≤20%) to avoid visual interference. This quantifiable metric ensures focused attention while also constraining rendering effects through value constraints, thus avoiding cognitive load.

[0110] When the network risk probability calculated by the graph neural network is within the medium risk threshold range (60%-80%) and the target network behavior involves sensitive operations, the operation entry point can be set to a "grayed-out disabled state" using front-end rendering technology. Simultaneously, a non-intrusive prompt (such as a semi-transparent pop-up) is displayed on the current interface, requiring the verification behavior to be completed within a specified time window. If the network interaction object does not operate within the verification window or the verification fails, it is determined to be an attack, and subsequent behavior is blocked. If the verification is successful, the operation entry point is restored to its usable state, and the verification behavior characteristics are recorded in the baseline matrix.

[0111] The interactive design of pausing operations and verification behaviors can avoid cognitive burden. The prompts for verification behaviors include a network risk briefing and verification timeout rules. The verification interface is rendered in layers with the original web page through UI isolation technology, ensuring that attention is focused on the verification process. At the same time, the background records the interface element characteristics of the network risk page to provide evidence for subsequent evidence collection.

[0112] The above technical solution calculates network risk probability by using the current node of the target network behavior as the center and extending two-hop communication objects into the communication behavior relationship graph. For example, sender → recipient → associated contact. Each edge in the communication behavior relationship graph is assigned a dynamic weight: communication frequency weight, file transfer weight, and semantic association weight. These three types of weights are then used to construct a fused edge weight and input into a graph attention network. The initial network risk probability is generated through a weighted summation using an attention mechanism. The initial network risk probability is then calibrated a second time using network environment risk coefficients and role / permission sensitivity coefficients. The calibrated probability value serves as the basis for whether to trigger a pause operation. Simultaneously, the above technical solution achieves a linkage between proactive intervention and adaptive optimization of the dynamic baseline matrix. After a network interaction object completes a verification action, the feature vector of the verification action is compared with the feature vector of normal behavior as the verification action baseline vector. If the deviation between the verification action feature vector and the verification action baseline vector is less than a preset threshold, it is determined to be a legitimate operation, and the tolerance range of the corresponding behavior feature in the dynamic baseline matrix is ​​updated. If the deviation between the verification behavior feature and the verification behavior baseline vector exceeds a threshold, the verification behavior is marked as a possible noisy behavior sample of the attacker and input into the adversarial training module to generate adversarial samples, thereby improving the robustness of the baseline matrix to noisy behavior.

[0113] Table 1 lists the network risk behavior identification and verification results of the embodiments of the present invention. As shown in Table 1, the scheme of the embodiments of the present invention presents the expected simulation verification results based on the design logic derivation of the technical solution of the embodiments of the present invention from three core dimensions: identification accuracy, reasonableness of misjudgment and intervention, and adaptive and risk blocking. In terms of identification accuracy, relying on the context adaptation capability of the multiple dynamic baseline matrix and the optimization effect of the adversarial training module, the identification accuracy of bypass operations and the identification coverage in specific scenarios are significantly improved in the simulation. In terms of reasonableness of misjudgment and intervention, through the scenario adaptation verification mechanism and secondary calibration of risk probability, the false interception rate of legitimate operations and the proportion of invalid intervention are effectively controlled at a low level. In terms of adaptive and risk blocking, with the help of the linkage optimization of baseline and intervention and risk transmission analysis, the response speed to new network attack methods is accelerated, and the risk spread can be effectively blocked.

[0114] Table 1. List of Verification Results for Identifying Network Risk Behaviors

[0115]

[0116] The technical solution of this invention is based on a risk transmission analysis and proactive intervention mechanism using graph neural networks, achieving precise interception and controllable intervention of potential network risk attack chains. A behavioral relationship graph is constructed centered on the current node of the target network behavior. Risk transmission probability is calculated using three types of dynamic weights—communication frequency, file transfer, and semantic association—and a graph attention network. Secondary calibration is performed using environmental risk coefficients and sensitive operation judgment values ​​to ensure stricter risk assessment in high-risk scenarios. Intervention is triggered when the network risk transmission probability matching the target network behavior is within the medium-risk range, and the sensitive operation judgment value of the target network behavior is greater than or equal to a second threshold. Combined with context-adaptive verification behavior, this approach not only blocks risks at the initial attack stage but also avoids excessive intervention in non-sensitive operations, achieving the dual effect of precise interception and minimal interference. The linkage between proactive intervention and baseline optimization, along with user-friendly interactive design, enhances system robustness while ensuring a good user experience. Upon successful verification, the system updates the tolerance of the dynamic baseline matrix based on the verification deviation value, allowing the dynamic baseline to adapt to fluctuations in legitimate behavior. Upon verification failure, abnormal behavior is used as noise samples for adversarial training, enhancing the ability to identify bypass risk measures. Meanwhile, the system controls cognitive load by using a prompt interference formula and ensures minimal visual interference through UI isolation technology, thus guaranteeing smooth operation and continuously improving the system's ability to defend against network attacks through closed-loop optimization.

[0117] It should be noted that the relevant information (including but not limited to user device information, user personal information, user behavior information, and role profile information) and data (including but not limited to data used for display and analysis) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, and do not violate public order and good morals.

[0118] It should be noted that any arrangement or combination of the technical features in the above embodiments also falls within the protection scope of this invention.

[0119] Figure 8 This is a schematic diagram of a network risk behavior identification device provided in an embodiment of the present invention, such as... Figure 8 As shown, the device includes: a comprehensive network behavior vector sequence generation module 410, a dynamic baseline matrix generation module 420, and a network risk probability generation module 430, wherein:

[0120] The integrated network behavior vector sequence generation module 410 is used to generate an integrated network behavior vector sequence based on multidimensional network behavior feature data.

[0121] The dynamic baseline matrix generation module 420 is used to generate a dynamic baseline matrix of the multidimensional network behavior feature data based on the multidimensional baseline influencing factors and the integrated network behavior vector sequence.

[0122] The network risk probability generation module 430 is used to generate a network risk probability matching the target network behavior when the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix.

[0123] This invention generates a comprehensive network behavior vector sequence based on multidimensional network behavior feature data. Then, based on multidimensional baseline influencing factors and the comprehensive network behavior vector sequence, it generates a dynamic baseline matrix of multidimensional network behavior feature data. Furthermore, when the behavioral feature value of a target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, it generates a network risk probability matching the target network behavior. This technical solution, by constructing a dynamic baseline matrix of multidimensional network behavior feature data and combining it with multidimensional baseline influencing factors, can adjust the baseline threshold in real time according to the context. This enables accurate characterization and dynamic adaptation of normal network behavior benchmarks, solving the problem that existing network attack behavior identification methods using fixed baselines are difficult to adapt to complex scenarios, and improving the accuracy of network risk behavior identification.

[0124] Optionally, the integrated network behavior vector sequence generation module 410 is further configured to: standardize the multidimensional network behavior feature data to obtain standard multidimensional network behavior feature data; determine the fusion weight of the standard multidimensional network behavior feature data; and perform vector fusion on the standard multidimensional network behavior feature data according to the fusion weight of the standard multidimensional network behavior feature data to obtain the integrated network behavior vector sequence.

[0125] Optionally, the multidimensional network behavior feature data includes page interaction behavior data, network layer behavior data, and network content feature data; wherein: the page interaction behavior data includes mouse trajectory acceleration change rate, page focus switching interval, and input box deletion frequency; the network layer behavior data includes DNS request timing correlation, TLS certificate chain abnormal jumps, and cross-domain resource loading topology; the network content feature data includes sender domain similarity, URL path depth deviation value, and emergency inducement word density.

[0126] Optionally, the dynamic baseline matrix generation module 420 is further configured to: generate historical baseline values ​​for each single-dimensional network behavior in the integrated network behavior vector sequence; determine the multidimensional influence coefficients of each single-dimensional network behavior based on the multidimensional baseline influencing factors; determine the coefficient weights of each single-dimensional influence coefficient in the multidimensional influence coefficients; and generate a dynamic baseline matrix of the multidimensional network behavior feature data based on the historical baseline values ​​of each single-dimensional network behavior, the multidimensional influence coefficients of each single-dimensional network behavior, and the coefficient weights of each single-dimensional influence coefficient in the multidimensional influence coefficients.

[0127] Optionally, the network risk probability generation module 430 is further configured to: generate a communication behavior relationship graph matching the target network behavior; determine the fusion edge weights based on the communication association data of each associated node in the communication behavior relationship graph; wherein the fusion edge weights include communication frequency weights, file transfer weights, and semantic association weights; calculate the attention coefficients between each node in the communication behavior relationship graph based on the fusion edge weights; and calculate the network risk probability matching the target network behavior based on the attention coefficients between each node in the communication behavior relationship graph.

[0128] Optionally, the multidimensional influence coefficient includes a role permission sensitivity coefficient and a network environment risk coefficient; the network risk probability generation module 430 is further configured to: calculate the initial network risk probability of the target network behavior based on the attention coefficients between nodes in the communication behavior relationship graph; calibrate the initial network risk probability once based on the network environment risk coefficient to obtain a first calibrated network risk probability; determine the sensitive operation judgment value of the target network behavior based on the resource permission level of the target network behavior and the role permission sensitivity coefficient; and calibrate the first calibrated network risk probability a second time based on the first calibrated network risk probability, the sensitive operation environment linkage coefficient, the sensitive operation judgment value, and the network environment risk coefficient to obtain a second calibrated network risk probability.

[0129] Optionally, the above device further includes a behavior verification module, configured to: determine the target network behavior as a medium-risk sensitive operation behavior when the probability of network risk transmission matching the target network behavior is within the medium-risk range and the sensitivity coefficient of the role permission is greater than or equal to a first threshold; determine the target network behavior as a high-risk sensitive operation behavior when the probability of network risk transmission matching the target network behavior is within the medium-risk range and the sensitivity operation judgment value of the target network behavior is greater than or equal to a second threshold; and pause the target network behavior and display a preset verification interface on the current operation page of the target network behavior when the target network behavior is determined to be either the medium-risk sensitive operation behavior or the high-risk sensitive operation behavior.

[0130] Optionally, the behavior verification module is further configured to: calculate the compatibility between the current preset verification interface and the target network behavior based on the current preset verification behavior type; if the compatibility between the current preset verification interface and the target network behavior is less than or equal to a third threshold, display the current preset verification interface as a preset verification interface; wherein the preset verification interface is used to determine the security of the target network behavior based on the current verification behavior; if the compatibility between the current preset verification interface and the target network behavior is greater than the third threshold, switch the current preset verification behavior type, and return to perform the operation of calculating the compatibility between the current preset verification interface and the target network behavior based on the current preset verification behavior type, until it is determined that the compatibility between the current preset verification interface and the target network behavior is less than or equal to the third threshold.

[0131] Optionally, the above apparatus further includes a dynamic baseline matrix update module, configured to: calculate the verification deviation value between the current verification behavior and the verification behavior baseline based on the current verification behavior feature vector and the verification behavior baseline vector; update the threshold boundary in the dynamic baseline matrix based on the adjustment coefficient and the verification deviation value if the verification deviation value is determined to be less than or equal to a fourth threshold; and train the adversarial network module using the feature vector of the target network behavior as noise samples if the verification deviation value is determined to be greater than the fourth threshold; wherein the adversarial network module is configured to update the threshold boundary in the dynamic baseline matrix based on the training results.

[0132] The aforementioned network risk behavior identification device can execute the network risk behavior identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the network risk behavior identification method provided in any embodiment of the present invention.

[0133] Since the network risk behavior identification device described above is an apparatus capable of executing the network risk behavior identification method in the embodiments of the present invention, those skilled in the art can understand the specific implementation methods and various variations of the network risk behavior identification device in this embodiment based on the network risk behavior identification method described in the embodiments of the present invention. Therefore, how the network risk behavior identification device implements the network risk behavior identification method in the embodiments of the present invention will not be described in detail here. Any apparatus used by those skilled in the art to implement the network risk behavior identification method in the embodiments of the present invention falls within the scope of protection of this application.

[0134] Figure 9 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0135] like Figure 9As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0136] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0137] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as methods for identifying network risk behaviors.

[0138] Optionally, the network risk behavior identification method may include: generating a comprehensive network behavior vector sequence based on multidimensional network behavior feature data; generating a dynamic baseline matrix of the multidimensional network behavior feature data based on multidimensional baseline influencing factors and the comprehensive network behavior vector sequence; and generating a network risk probability matching the target network behavior when the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix.

[0139] In some embodiments, the network risk behavior identification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network risk behavior identification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network risk behavior identification method by any other suitable means (e.g., by means of firmware).

[0140] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0141] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0142] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0143] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0144] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0145] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0146] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0147] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying network risk behaviors, characterized in that, include: Generate a comprehensive network behavior vector sequence based on multidimensional network behavior feature data; A dynamic baseline matrix of the multidimensional network behavior feature data is generated based on the multidimensional baseline influencing factors and the comprehensive network behavior vector sequence. When the behavioral feature value of the target network behavior deviates from the corresponding target dynamic baseline in the dynamic baseline matrix, a network risk probability matching the target network behavior is generated.

2. The method according to claim 1, characterized in that, The step of generating a comprehensive network behavior vector sequence based on multidimensional network behavior feature data includes: The multidimensional network behavior feature data is standardized to obtain standard multidimensional network behavior feature data; Determine the fusion weights of the standard multidimensional network behavior feature data; The standard multidimensional network behavior feature data is fused into vectors based on the fusion weights of the standard multidimensional network behavior feature data to obtain the comprehensive network behavior vector sequence.

3. The method according to claim 2, characterized in that, The multidimensional network behavior feature data includes page interaction behavior data, network layer behavior data, and network content feature data; wherein: The page interaction behavior data includes mouse trajectory acceleration change rate, page focus switching interval, and input box deletion frequency; The network layer behavioral data includes DNS request timing correlation, TLS certificate chain abnormal jumps, and cross-domain resource loading topology. The network content feature data includes sender domain similarity, Uniform Resource Locator (URL) path depth deviation, and emergency inducement word density.

4. The method according to claim 1, characterized in that, The process of generating the dynamic baseline matrix of the multidimensional network behavior feature data based on the multidimensional baseline influencing factors and the comprehensive network behavior vector sequence includes: Generate historical baseline values ​​for each single-dimensional network behavior in the comprehensive network behavior vector sequence; Determine the multidimensional influence coefficient of each of the single-dimensional network behaviors based on the multidimensional baseline influencing factors; Determine the coefficient weight of each single-dimensional influence coefficient in the multidimensional influence coefficient; A dynamic baseline matrix of the multidimensional network behavior feature data is generated based on the historical baseline values ​​of each of the single-dimensional network behaviors, the multidimensional influence coefficients of each of the single-dimensional network behaviors, and the coefficient weights of each single-dimensional influence coefficient in the multidimensional influence coefficients.

5. The method according to claim 1, characterized in that, The generation of the network risk probability matching the target network behavior includes: Generate a communication behavior relationship graph matching the target network behavior; The fusion edge weights are determined based on the communication association data of each associated node in the communication behavior relationship graph; wherein, the fusion edge weights include communication frequency weights, file transfer weights, and semantic association weights. Calculate the attention coefficients between nodes in the communication behavior graph based on the fusion edge weights; The network risk probability of matching the target network behavior is calculated based on the attention coefficients between nodes in the communication behavior relationship diagram.

6. The method according to claim 4, characterized in that, The multidimensional impact coefficient includes the role-permission sensitivity coefficient and the network environment risk coefficient; The step of calculating the network risk probability of the target network behavior matching based on the attention coefficients between nodes in the communication behavior relationship graph includes: The initial network risk probability of the target network behavior is calculated based on the attention coefficients between nodes in the communication behavior relationship diagram. The initial network risk probability is calibrated once based on the network environment risk coefficient to obtain the first calibrated network risk probability; The sensitive operation judgment value of the target network behavior is determined based on the resource permission level of the target network behavior and the role permission sensitivity coefficient; The first calibration network risk probability is calibrated a second time based on the first calibration network risk probability, the sensitive operating environment linkage coefficient, the sensitive operation judgment value, and the network environment risk coefficient to obtain the second calibration network risk probability.

7. The method according to claim 6, characterized in that, After generating the network risk propagation probability matching the target network behavior, the method further includes: If the probability of network risk transmission matching the target network behavior is determined to be within the medium risk range, and the sensitivity coefficient of the role permission is determined to be greater than or equal to the first threshold, the target network behavior is determined to be a medium risk sensitive operation behavior. If the probability of network risk transmission matching the target network behavior is determined to be within the medium risk range, and the sensitive operation judgment value of the target network behavior is determined to be greater than or equal to the second threshold, the target network behavior is determined to be a high-risk sensitive operation behavior. If the target network behavior is determined to be a medium-risk sensitive operation or a high-risk sensitive operation, the target network behavior is paused, and a preset verification interface is displayed on the current operation page of the target network behavior.

8. The method according to claim 7, characterized in that, The step of displaying a preset verification interface on the current operation page of the target network behavior includes: Calculate the compatibility between the current preset verification interface and the target network behavior based on the current preset verification behavior type; If the compatibility between the current preset verification interface and the target network behavior is determined to be less than or equal to a third threshold, the current preset verification interface is displayed as a preset verification interface; wherein, the preset verification interface is used to determine the security of the target network behavior based on the current verification behavior; If it is determined that the fit between the current preset verification interface and the target network behavior is greater than the third threshold, the current preset verification behavior type is switched, and the operation of calculating the fit between the current preset verification interface and the target network behavior based on the current preset verification behavior type is returned, until it is determined that the fit between the current preset verification interface and the target network behavior is less than or equal to the third threshold.

9. The method according to claim 8, characterized in that, Also includes: The verification deviation value between the current verification behavior and the verification behavior baseline is calculated based on the current verification behavior feature vector and the verification behavior baseline vector. If the verification deviation value is determined to be less than or equal to the fourth threshold, the threshold boundary in the dynamic baseline matrix is ​​updated according to the adjustment coefficient and the verification deviation value; If the verification deviation value is determined to be greater than the fourth threshold, the feature vector of the target network behavior is used as a noise sample to train the adversarial network module; wherein, the adversarial network module is used to update the threshold boundary in the dynamic baseline matrix according to the training result.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor to enable the at least one processor to perform the network risk behavior identification method according to any one of claims 1-9.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network risk behavior identification method according to any one of claims 1-9.

12. A computer program product comprising a computer program / instructions, wherein, When the computer program / instruction is executed by the processor, it implements the network risk behavior identification method according to any one of claims 1-9.

Images