An intrusion detection method and system based on hierarchical interpretable behavior sequence modeling and a storage medium

Abstract

The application provides an intrusion detection method and system based on hierarchical interpretable behavior sequence modeling and a storage medium, the method comprising: a data vectorization representation step: network attack data is vectorized by using a sliding window strategy; a field level feature learning step of a single piece of data: a feedforward neural network is used to learn the field level feature of a single piece of data; a behavior sequence modeling step between multiple pieces of data: a feedforward neural network is used to model the behavior sequence between multiple pieces of data; an intrusion behavior rule summary step: according to the model classification output and the field level feature attention and the event level attention, an event and an internal feature of the event serving as a model judgment basis are found, key features and reasonable thresholds of the features are found according to the attention, and rules are manually written, and the maintenance and update of an attack knowledge base are regularly performed.The application has the beneficial effect that complex attack sequences spanning multiple log events can be accurately captured, and the correlation analysis of complex multi-step attack chains can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cyberspace security, and particularly relates to an intrusion detection method and system based on hierarchical interpretable behavior sequence modeling and a storage medium. BACKGROUND

[0002] With the rapid development of information technology, network attacks are increasingly complex and concealed, and the importance of intrusion detection systems as the core defense line of network security is increasingly prominent. At present, detection methods based on machine learning and deep learning have become mainstream, but they also face many challenges in actual deployment. These intrusion detection models based on supervised learning are heavily dependent on a large amount of labeled training data. However, new / unknown attack methods (APT attacks, zero-day exploit, etc.) often have only a small number of samples or even no samples at the initial stage. Directly training the model using such data is likely to cause overfitting, and the model cannot effectively generalize to unknown attack variants. Although data augmentation is a common method, traditional methods are difficult to generate high-quality and diversified attack samples while keeping the semantics unchanged. In addition, the data labeling for new attacks requires very professional knowledge, unlike natural image data that most people can understand and label, so it is not realistic to label a large amount of such data. In terms of data utilization, many existing methods analyze single logs or network packets as independent events. However, modern complex attacks are usually composed of a series of ordered malicious activities, which are confused in a large number of normal behaviors. Focusing only on isolated single logs cannot capture the coordinated malicious behavior across multiple logs and multiple system components in the attack chain, resulting in low detection rate for slow horizontal movement and multi-stage attacks. Complex models represented by deep learning are often regarded as a "black box", although the detection accuracy of these methods is generally high, but the alarm decision made by the model is difficult for security analysts to understand, and the lack of interpretability makes it difficult for analysts to quickly locate the root cause of the attack and understand the attack path, thereby delaying emergency response. More importantly, the model cannot convert the knowledge it has learned into human understandable and operable expert rules or threat indicators, hindering the accumulation of knowledge and the sedimentation of capabilities of the security operation team.

[0003] Neural networks can only handle numerical data, and for text data, it needs to be converted into numerical data first. Embedding is a technique that maps discrete, high-dimensional categorical data into a low-dimensional, dense continuous vector space. Through embedding, semantically similar values are also closer in the vector space. Text data is often converted into numerical data through embedding. Attention is often used in the same model as embedding. Attention mechanism is a resource allocation model that simulates human cognitive attention. In neural networks, it allows the model to dynamically and differentially focus on different parts of the input when processing a single unit of information. For example, when analyzing SSH brute force cracking, the model can automatically learn that the RET (return value) field is more important than the TID (thread ID) field; when analyzing attack behavior sequences, the model can determine which events are key steps in the entire abnormal behavior. Attention weights not only improve model performance, but also naturally provide interpretability. In addition, the interaction between features can also convey important information. Factorization Machines (FM) is a model that can efficiently model feature interactions (combination effects). It can not only learn the importance of each feature itself (first-order interaction), but also learn the impact of any two feature combinations (second-order interaction). For example, in Linux system logs, EVENT=setuid and RET=-1 (failure) alone may not be abnormal, but their combination (setuid failure) is a high-risk signal. FM can automatically capture such patterns.

[0004] The main problem in the prior art is that system logs or network traffic records are processed as isolated events or only time series analysis is performed, without combining features within a single data and multiple time series data for analysis, and without converting the learned knowledge into human understandable and operable expert rules. Modern complex attacks are essentially "attack chains" that contain multiple logical steps, such as initial intrusion, privilege escalation, lateral movement, and data leakage. Rule-based methods can capture predefined temporal patterns, but are not flexible and scalable, and cannot adapt to unknown attack paths; while pure deep learning can learn sequence patterns, but its internal decision-making process is not transparent, and most of them do not effectively integrate the rich field information within the event, resulting in low detection rate for coordinated attack behaviors that span multiple logs and multiple system components. SUMMARY

[0005] To solve the problems in the prior art, the present application provides an intrusion detection method based on hierarchical interpretable behavior sequence modeling, comprising:

[0006] Data vectorization representation step: before inputting network attack data into a neural network, the network attack data is vectorized by adopting a sliding window strategy;

[0007] Single data field level feature learning step: a feedforward neural network is adopted to learn the field level features of single data;

[0008] Multi-data behavior sequence modeling step: a feedforward neural network is adopted to model the behavior sequence between multiple data;

[0009] Intrusion behavior rule summary step: according to the model classification output y and the field level feature attention and the event level attention, the events and the internal features of the events serving as the basis for the model judgment are found, the key features and the reasonable threshold of these features are found according to the field level feature attention and the event level attention, the rules are artificially written, and the maintenance and update of the attack knowledge base are regularly carried out.

[0010] As a further improvement of the application, the data vectorization representation step is specifically:

[0011] According to the ASCII code table, each character is mapped to the corresponding number and spliced, and according to the actual situation of the data, a fixed embedding representation dimension is set ， The average value or mode of the feature length is used for text with a length greater than The pre-trained symmetric variational autoencoder is used for encoding and reconstruction, and the middle layer is taken as the representation of the text, and the middle layer is set to dimension; for text with a length less than 0 is used for padding; for numerical numbers, it is directly filled into a fixed dimension , so as to obtain the vectorization representation of each field feature of each data .

[0012] As a further improvement of the application, in the data vectorization representation step, the padding situation of the data is represented by using an attention mask, and the mask length is set to .

[0013] As a further improvement of the application, the single data field level feature learning step is specifically:

[0014] For each field feature of single data, the first-order interaction information is learned through an attention mechanism:

[0015] As a further improvement of the application, the single data field level feature learning step is specifically:

[0016] For each field feature of single data, the first-order interaction information Learning through attention mechanisms:

[0017] As a further improvement of the present invention, the field-level feature learning step for a single data entry is specifically as follows:

[0018] For each field feature of a single data entry, its first-order interaction information Learning through attention mechanisms:

[0019] ,

[0020] in These are learnable model attention parameters. This represents the number of features in a single data entry. Indicates the first Each feature; calculates the second-order interaction information between the features of each field in a single data entry. :

[0021] (2),

[0022] in This represents the Hadamard product, i.e., feature vectors of different fields. and Multiply the values ​​at corresponding positions, Indicates the first Features ;

[0023] Combining first-order and second-order interaction information, a single data point Represented as:

[0024] (3),

[0025] in Indicates the first Data entries.

[0026] As a further improvement of the present invention, the behavioral sequence modeling step among multiple data points specifically includes:

[0027] Using a feedforward neural network, for each event embedding in the sequence, its importance score relative to the current context is calculated to perform sequence modeling of attack behavior:

[0028] ,

[0029] in s Indicates using The results of modeling attack behavior. T This indicates the total number of data entries. Indicates an event The importance of the event, that is, the importance of the event Attention:

[0030] ,

[0031] ,

[0032] Representing different neural network layers, and Both indicate that the model represents the event. The intermediate weights of the learning process, in Formula 5, are used to distinguish between the sum of individual events and the sum of all events. Label the weight of a single event using... The weight of the sum of all labeled events.

[0033] As a further improvement of the present invention, in order to reduce false alarms, a dynamic threshold based on historical behavior baseline is introduced in the behavioral sequence modeling step among multiple data points. Classify and output the model With dynamic threshold The comparison is performed to determine whether it constitutes an attack. If the model classifies the output... Greater than the dynamic threshold This is considered an attack behavior; if the model's classification output... Less than the dynamic threshold If it is not an attack, then it is not an attack behavior; dynamic threshold Calculated using the following formula:

[0034] (7)

[0035] Where μ and σ are the model values ​​for the event. Historical judgment value y h The mean and standard deviation are given, and α is an adjustable sensitivity parameter.

[0036] The present invention also discloses an intrusion detection system based on hierarchical interpretable behavioral sequence modeling, comprising: a memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method described in the present invention when invoked by the processor.

[0037] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0038] The beneficial effects of the present application are: 1. The present application can accurately capture complex attack sequences (such as lateral movement, persistent attack) spanning multiple log events, realize the correlation analysis of complex multi-step attack chain, and to some extent alleviate the attack chain missing report problem caused by the traditional isolated event analysis mode; 2. The present application realizes the "inside-out" hierarchical modeling technology through the hierarchical explainable network, the field-level extractor deeply mines the abnormal signs inside a single data by fusing first-order and second-order feature interactions; the event-level extractor dynamically captures the key steps and context dependence in the historical event sequence; 3. The present application can help summarize the rule knowledge of new / unknown complex attacks, the field-level attention directly identifies the high-risk feature values in the event, and the event-level attention automatically locates the key event nodes in the entire behavior sequence, improves the explainability of the model, and realizes the continuous accumulation of security operation experience and self-evolution of system capability; 4. The present application adopts a dynamic threshold based on historical behavior baseline, which can adapt to the data distribution changes caused by different attack environments, attacker behaviors and other differences of the same type of data, and has good flexibility; 5. The present application is not only a detection system, but also a knowledge management system. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 The present application is a field-level and event-level attention diagram. DETAILED DESCRIPTION

[0040] The present application belongs to the field of network space security, specifically to the problem of intrusion detection, and specifically relates to operating system security, network attack and defense knowledge, and the design and application of neural networks. Based on network attack and defense and operating system knowledge, the system logs and traffic data generated by attacks can be understood, and embedded representation, factor decomposition, attention mechanism and other neural network related knowledge are needed.

[0041] The technical problems to be solved by the present application are:

[0042] The present application proposes an intrusion detection method based on hierarchical explainable behavior sequence modeling, which can mine the characteristics of a single event while jointly detecting intrusions and summarizing knowledge based on the behavior sequence characteristics of multiple events. When performing feature representation, text data embedding processing is needed, and a suitable embedding method is needed to embed the text data such as attack payload which has large differences, and the correlation between single features and multiple features is calculated through factor analysis. At the same time, a suitable attention mechanism is needed to calculate the importance of different features and different events to intrusion detection. Finally, the detection results of single events and the sequence modeling results of multiple events are combined to make intrusion detection judgments and form rules or threat indicators.

[0043] The application discloses an intrusion detection method based on layered interpretable behavior sequence modeling, which can be divided into four parts of a data vectorization representation step, a field level feature learning step of a single piece of data, a behavior sequence modeling step between multiple pieces of data, and an intrusion behavior rule summarization step.

[0044] The data vectorization representation step is as follows:

[0045] The network attack produces complex and diverse data such as traffic and system logs, containing numerical data such as return values, port numbers, process IDs, and character data such as attack payloads and protocol types. Before inputting the neural network for processing, the relevant data needs to be vectorized. Considering the complexity of attack means, the character data has large differences in content and length, and some long attack payloads contain more key information. The application adopts a sliding window strategy, first maps each character to the corresponding number according to the ASCII code table and concatenates them, and then sets a fixed embedding representation dimension according to the actual data , The average or mode of the feature length can be used. For longer texts, a pre-trained symmetric variation auto encoder (Variation Auto Encoder) is used for encoding and reconstruction, and the middle layer (set to ) is taken as the representation of the text. Longer texts refer to texts with lengths greater than . In actual scenarios , the length is usually about 200, and the length of longer texts is even more than 1000. For shorter texts, 0 is used for padding. Shorter texts refer to texts with lengths less than . For numerical data, it is directly filled into a fixed dimension . An attention mask is used to represent the padding of the data, and the mask length is also . For example, attention_mask=[1,1,…1] represents a long text, and attention_mask=[1,1,0,…,0] represents that the first two bits are valid bits and the rest are padding bits. Thus, the vectorization representation of each field feature of each piece of data is obtained .

[0046] The field level feature learning step of a single piece of data is as follows:

[0047] A feedforward neural network is designed to learn the field level features of a single piece of data. For each field feature of a single piece of data, the first-order interaction information , that is, the importance of itself, can be learned through an attention mechanism:

[0048] ,

[0049] wherein is a learnable model attention parameter, represents the number of features of a single data itself, represents the th feature. Some features are not abnormal alone, but are abnormal when combined. At this time, the second-order interaction information between the features of each field of a single data needs to be calculated :

[0050] (2),

[0051] wherein represents the Hadamard product, that is, the values of different field feature vectors and at corresponding positions are multiplied, represents the th feature .

[0052] Combining the first-order and second-order interaction information, a single data can be represented as:

[0053] (3),

[0054] wherein represents the th data.

[0055] The behavior sequence modeling step between multiple data:

[0056] Similarly, a feedforward neural network is used to embed each event in the sequence and calculate the importance score of the event relative to the current context, and sequence modeling is performed on the attack behavior:

[0057] ,

[0058] wherein s represents the result of modeling the attack behavior with , represents the total number of data, T represents the importance of the event , that is, the attention to the event :

[0059] ,

[0060] ,

[0061] represents different neural network layers, and different design methods such as fully connected neural networks or more complex models such as LSTM and Transformer can be used according to needs,​ and Both indicate that the model represents the event. The intermediate results of the learning weights, in Formula 5, are used to distinguish between the sum of individual events and the sum of all events. Label the weight of a single event using... The weight of the sum of all labeled events.

[0062] To reduce false alarms, a dynamic threshold based on historical behavior baselines is introduced. Classify and output the model With dynamic threshold The comparison is performed to determine whether it is an attack. If the model classifies the output... Greater than the dynamic threshold This is considered an attack behavior; if the model's classification output... Less than the dynamic threshold If so, it is not an attack. This dynamic threshold... Calculated using the following formula:

[0063] (7)

[0064] Where μ and σ are the model values ​​for the event. (Or similar events, such as all being SSH brute-force attacks) Historical judgment values y h The mean and standard deviation are given, and α is an adjustable sensitivity parameter. This allows the model to adapt to differences in the same event caused by different operational behaviors.

[0065] Summary of Intrusion Behavior Rules and Steps:

[0066] like Figure 1 As shown, based on the model's classification output and field-level feature attention and event-level attention, the events and their internal features are identified as the main basis for the model's judgment. Key features and reasonable thresholds for these features are found based on field-level and event-level feature attention, and these are manually written into rules. The attack knowledge base is maintained and updated regularly. Both key features and reasonable thresholds are determined based on the attention results. Key features refer to behavioral patterns that define a specific attack pattern or abnormal state. For example, in SSH brute-force attacks, a large number of SSHD connections in a short period are key features. Reasonable thresholds refer to the critical values ​​that quantify and separate the above behavioral patterns from normal behavior. For example, more than three SSHD connections within one second; three is a reasonable threshold, as normal user operation would not be possible at that speed. There are many other examples; different attack behaviors have different features and judgment thresholds.

[0067] The application proposes an intrusion detection method based on layered explainable behavior sequence modeling, which simultaneously utilizes the features of single data and the time sequence features between multiple data, and finds out the attack key features through the attention mechanism, thereby helping to summarize the attack rules.

[0068] Key points of the application:

[0069] 1. In view of the fact that the existing scheme analyzes attack sequence events in isolation or only analyzes attack sequence events in combination, ignoring the internal information of events, the application proposes a layered explainable behavior sequence modeling method, which can simultaneously realize feature learning at the event internal field level and behavior sequence modeling between events, overcoming the shortcomings of the existing scheme;

[0070] 2. In view of the fact that the existing deep learning-based scheme lacks explainability and cannot realize continuous accumulation and self-evolution of security operation knowledge, the application adopts an ''inside-out'' attention learning scheme, simultaneously outputs field-level attention weights and event-level attention weights, and helps to summarize attack rules;

[0071] 3. In view of the fact that traffic and system log data text data have great differences in length and content, the application designs a data vectorization method, which first maps text data to ASCII code and compresses it to a fixed dimension using a variational autoencoder, and then fills the shorter length to a fixed length with attention mask to represent the padding condition of the data;

[0072] 4. In view of the fact that the threshold for determining whether the model output is an attack is fixed in the existing method, which is difficult to adapt to data distribution changes, the application designs a dynamic threshold method based on historical behavior baseline, which can dynamically adjust the determination threshold according to the historical data of the same type of behavior, and better adapt to the data distribution changes caused by different network environments and attacker operations.

[0073] The above is a further detailed description of the application in combination with specific preferred embodiments, and the specific implementation of the application cannot be limited to these descriptions. For ordinary skilled persons in the technical field to which the application belongs, some simple deductions or substitutions can be made without departing from the concept of the application, and all of them should be regarded as falling within the protection scope of the application.

Claims

1. An intrusion detection method based on hierarchical interpretable behavioral sequence modeling, characterized in that, include: Data vectorization representation steps: Before inputting network attack data into the neural network, a sliding window strategy is used to vectorize the network attack data; The steps for learning field-level features for a single data entry are as follows: A feedforward neural network is used to learn the field-level features of a single data entry. Steps for modeling behavioral sequences among multiple data points: Use a feedforward neural network to model behavioral sequences among multiple data points; The steps for summarizing intrusion behavior rules are as follows: Based on the model classification output y and field-level feature attention and event-level attention, find the events and internal features of the events that serve as the basis for model judgment. The model classification output y refers to the final output of the model after learning field-level feature attention and event-level attention. Based on field-level feature attention and event-level attention, find the key features and reasonable thresholds for these features, write them into rules, and regularly maintain and update the attack knowledge base. The specific steps for learning field-level features of a single data entry are as follows: For each field feature of a single data entry, its first-order interaction information Learning through attention mechanisms: , in These are learnable model attention parameters. This represents the number of features in a single data entry. Indicates the first Each feature; calculates the second-order interaction information between the features of each field in a single data entry. : (2), in This represents the Hadamard product, i.e., feature vectors of different fields. and Multiply the values ​​at corresponding positions, Indicates the first Features ; Combining first-order and second-order interaction information, a single data point Represented as: (3), in Indicates the first Data items; The specific steps for modeling the behavioral sequence among multiple data points are as follows: Using a feedforward neural network, for each event embedding in the sequence, its importance score relative to the current context is calculated to perform sequence modeling of attack behavior: , in s Indicates using The results of modeling attack behavior. T This indicates the total number of data entries. Indicates an event The importance of the event, that is, the importance of the event Attention: , , Representing different neural network layers, and Both indicate that the model represents the event. The intermediate weights of the learning process, in Formula 5, are used to distinguish between the sum of individual events and the sum of all events. Label the weight of a single event using... The weight of the sum of all labeled events.

2. The intrusion detection method according to claim 1, characterized in that... The data vectorization representation step is specifically as follows: Each character is mapped to its corresponding number according to the ASCII code table and then concatenated. A fixed embedding dimension is set based on the actual data. ， It is the average or mode of the characteristic length, for length ratios Large texts are encoded and reconstructed using a pre-trained symmetric variational autoencoder. The intermediate layers are then used as the text representation, and these intermediate layers are set to... Dimension; for length ratio Small text is padded with 0; For numerical values, simply fill them into the fixed dimension. This yields a vectorized representation of the features of each field in each data entry. .

3. The intrusion detection method according to claim 2, characterized in that... In the data vectorization representation step, an attention mask is used to represent the data padding, and the mask length is set to... .

4. The intrusion detection method according to claim 1, characterized in that... In the behavioral sequence modeling step among multiple data points, a dynamic threshold based on historical behavioral baselines is introduced to reduce false alarms. Classify and output the model With dynamic threshold The comparison is performed to determine whether it constitutes an attack. If the model classifies the output... Greater than the dynamic threshold This is considered an attack behavior; if the model's classification output... Less than the dynamic threshold If it is not an attack, then it is not an attack behavior; dynamic threshold Calculated using the following formula: (7), Where μ and σ are the model values ​​for the event. Historical judgment value y h The mean and standard deviation are given, and α is an adjustable sensitivity parameter.

5. An intrusion detection system based on hierarchical interpretable behavioral sequence modeling, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-4 when invoked by the processor.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-4 when invoked by a processor.

Images