Network security early warning method, device, equipment, medium and product

Abstract

The invention provides a network security early warning method and device, equipment, a medium and a product, which are applied to the technical field of network security, and the method comprises the following steps: obtaining behavior data of a user and semantic data of the user; obtaining behavior characteristics of the user based on the behavior data, and obtaining semantic characteristics of the user based on the semantic data; inputting the behavior features and the semantic features into a hyperspherical variational auto-encoder (S-VAE) model, so as to align the behavior features and the semantic features, and recognizing the network behaviors of the user; and when it is identified that the network behavior of the user is abnormal, performing safety early warning on the network behavior of the user. According to the method, the overall efficiency of network security early warning is improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and in particular to a cybersecurity early warning method, device, equipment, medium, and product. Background Technology

[0002] With the rapid development of internet technology, it has deeply penetrated all aspects of social production and life. However, computer malfunctions, information leaks, and network viruses pose a significant threat to network systems, causing substantial economic losses once network systems malfunction. Among various network threats, unknown network threats present a significant challenge to defense efforts due to the lack of sufficient sample information: defenders cannot establish clear detection standards based on existing samples and must first capture relevant traces of unknown threats from real-time detection data sources before they can further pinpoint the threat and achieve network security early warning.

[0003] Most cybersecurity anomaly detection technologies rely on statistical and machine learning methods: they construct a "normal behavior baseline model," then monitor network traffic, system logs, and other behavioral characteristic data in real time, comparing the model with the baseline to identify potential threats. However, these technologies have significant limitations: they focus only on network traffic and system logs—two single-dimensional behavioral characteristic data points. This singular data source makes it difficult for the model to comprehensively depict the complex relationships of network behavior, directly resulting in insufficient accuracy in identifying network threats and ultimately affecting the overall efficiency of cybersecurity early warning. Summary of the Invention

[0004] This application provides a network security early warning method, apparatus, device, medium, and product to address the problem of low overall efficiency in existing network security early warning methods.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows: Firstly, this application provides a network security early warning method, the method comprising: Acquire user behavioral data and the user's semantic data; The user's behavioral characteristics are obtained based on the behavioral data, and the user's semantic characteristics are obtained based on the semantic data; The behavioral features and semantic features are input into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior. If abnormal network behavior of the user is detected, a security warning will be issued for the user's network behavior.

[0006] Optionally, the S-VAE model includes an S-VAE1 sub-model and an S-VAE2 sub-model; The step of inputting the behavioral features and semantic features into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior includes: The behavioral features are input into the S-VAE1 sub-model, and the behavioral features are mapped to the hyperspherical latent feature space through the S-VAE1 sub-model. The semantic features are input into the S-VAE2 sub-model, and the semantic features are mapped to the hyperspherical latent feature space through the S-VAE2 sub-model. In the hyperspherical latent feature space, the latent feature distributions of the behavioral features and the semantic features are aligned to identify the user's network behavior.

[0007] Optionally, the loss function of the S-VAE model is constructed based on the variational autoencoder VAE loss function and the cross-domain loss function.

[0008] Optionally, obtaining the user's behavioral characteristics based on the behavioral data includes: The behavioral data is preprocessed to obtain the user's multivariate temporal feature vector; The multivariate temporal feature vector is input into the graph neural network (GNN) model to obtain the user's predicted behavior feature vector; Based on the predicted behavior feature vector and the user's actual behavior feature vector, a difference vector is obtained, which is used to characterize the user's behavior features.

[0009] Optionally, the GNN model includes a first graph node corresponding to the user, a second graph node corresponding to the device, and a third graph node corresponding to the resource, as well as edges corresponding to the interaction behaviors between the user, the device, and the resource; The features of the first graph node are determined by the user's operation path encoding, and the features of the first graph node are determined by the device's status encoding.

[0010] Optionally, before inputting the behavioral features and semantic features into the hyperspherical variational autoencoder (S-VAE) model, aligning the behavioral features and semantic features, and identifying the user's network behavior, the method further includes: The parameters of the S-VAE model and the GNN model are adjusted using a target optimization algorithm, which is generated based on the Harris Hawk Optimization Algorithm (HHO) and the Sparrow Search Algorithm (SSA).

[0011] Optionally, adjusting the parameters of the S-VAE model and the GNN model using the objective optimization algorithm includes: Generate the first HHO population and the first SSA population; The first HHO population and the first SSA population are iteratively updated respectively; Every K iterations, N first individuals are randomly selected from the second HHO population, and N second individuals are randomly selected from the second SSA population, where K and N are integers greater than 1. The second HHO population is the population obtained by updating the first HHO population after K iterations, and the second SSA population is the population obtained by updating the first SSA population after K iterations. By performing a crossover operation on the N first bodies and the N second bodies, N third bodies are obtained; The N third individuals are used to replace the N first individuals in the second HHO population; Calculate the fitness of the N third individuals in the second HHO population, and update the optimal individual and the target information of the optimal individual in the second HHO population; If the number of iterations exceeds a preset value, the parameters of the S-VAE model and the GNN model are adjusted based on the best individual in the second HHO population and the best fitness value of the best individual.

[0012] Optionally, after issuing a security alert for the user's network behavior when abnormal network behavior is detected, the method further includes: The S-VAE model and the GNN model are updated periodically according to a preset update cycle.

[0013] Secondly, this application also provides a network security early warning device, which includes: The first acquisition module is used to acquire the user's behavioral data and the user's semantic data; The first processing module is used to obtain the user's behavioral characteristics based on the behavioral data, and to obtain the user's semantic characteristics based on the semantic data; The first identification module is used to input the behavioral features and the semantic features into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and the semantic features and identify the user's network behavior. The first early warning module is used to issue a security warning for the user's network behavior when abnormal network behavior is detected.

[0014] Thirdly, this application also provides an electronic device, the electronic device including a processor, the processor being used for: Acquire user behavioral data and the user's semantic data; The user's behavioral characteristics are obtained based on the behavioral data, and the user's semantic characteristics are obtained based on the semantic data; The behavioral features and semantic features are input into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior. If abnormal network behavior of the user is detected, a security warning will be issued for the user's network behavior.

[0015] Fourthly, this application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the above-described network security early warning method.

[0016] Fifthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned network security early warning method.

[0017] Sixthly, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the network security early warning method as described above.

[0018] The network security early warning method described in this application...

[0019] This application includes acquiring user behavior data and user semantic data; obtaining user behavior features based on the behavior data and user semantic features based on the semantic data; inputting the behavior features and semantic features into a hyperspherical variational autoencoder (S-VAE) model to align the behavior features and semantic features, and identifying the user's network behavior; and issuing a security warning for the user's network behavior when anomalies are detected. In this embodiment, not only traditional behavior data is acquired, but user semantic data is also supplemented, forming a dual-dimensional data source that covers dynamic operations and static identity associations in network behavior. This overcomes the limitation of a single data source. By aligning the two types of features through the S-VAE model, it compensates for the shortcomings of traditional models that can only analyze behavior data and cannot associate identity permissions. Anomaly identification based on dual-dimensional features reduces false positives and false negatives caused by incomplete data, thereby improving the accuracy of network threat identification and ultimately enhancing the overall efficiency of network security warnings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the network security early warning method provided in the embodiments of this application; Figure 2 This is a schematic diagram of the network security early warning method provided in the embodiments of this application; Figure 3 This is a structural diagram of a network security early warning device provided in an embodiment of this application; Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] The network security early warning method provided in this application embodiment is referred to [reference needed]. Figure 1 , Figure 1 This is a flowchart of the network security early warning method provided in the embodiments of this application, such as... Figure 1 As shown, it includes the following steps: Step 101: Obtain the user's behavioral data and semantic data; In this step, the user's behavioral data mainly includes the user's log data, which may include device login data, Hypertext Transfer Protocol (HTTP) activity data, email correspondence data, file operation data, and device usage record data. The user's semantic data may include relevant data such as the user's job title, department, and name.

[0024] It should be noted that the user behavior data in this step is obtained after preprocessing the initial user behavior data. User behavior data mainly includes user log records. System log data is characterized by its wide range of sources, large volume, and wide storage distribution. To ensure the accuracy and efficiency of subsequent log data analysis, log data preprocessing should be prioritized. This involves identifying and filtering irrelevant log attributes from the network to reduce invalid data usage and thus lower system storage pressure. Specifically, log data preprocessing mainly includes the following three core steps: (1) Data conversion First, the log data is divided into three main types: configuration management, attack events, and traffic control. Then, based on the different log data types, the corresponding data parsing and analysis attributes are determined. Configuration management logs: These refer to various operation records and information generated by administrators when performing system management-related tasks; Attack event logs: These are records of traces left after the analysis and handling of network attack behaviors. Flow control logs: These are log data used to statistically analyze network traffic volume, flow direction, and other information. (2) Data cleaning After completing the data transformation, first filter and delete redundant attribute values ​​and abnormal log data in the logs, such as format errors and invalid fields; then supplement and improve the missing data in the logs based on the prediction method to avoid the system storing junk log information and further reduce the system storage burden. (3) Data merging By merging data, multiple logs with the same content or similar characteristics are combined and integrated, and finally transformed into a single log data, reducing the amount of redundant data and improving the efficiency of subsequent analysis.

[0025] Step 102: Obtain the user's behavioral characteristics based on the behavioral data, and obtain the user's semantic characteristics based on the semantic data; In this step, behavioral data refers to dynamic operation records generated by users within the network system. This type of data is fragmented and highly time-series oriented. After preprocessing this data, feature extraction transforms it into behavioral features that characterize user operation patterns. Specifically, based on the preprocessed structured data, features can be extracted from three dimensions: statistical, temporal, and correlational. These features must directly serve network security requirements, including: Statistical features are used to quantify the intensity of operations in a certain dimension, such as the number of logins per day, the number of sensitive file operations, and the number of cross-IP accesses. Temporal features are used to capture the temporal correlation patterns of operations, such as the average interval from login to HTTP access to file download. Normal users may have an interval of 10 minutes, while attack behaviors may have an interval of less than 1 minute, which is abnormal. Correlational features are used to connect the correlation between "user-device-resource". For example, if user A uses device X for 90% of the operations and suddenly uses an unfamiliar device Y for 100% of the operations, it can be determined that the device correlation is abnormal. Another example is that user A usually accesses resource Y and suddenly frequently accesses unauthorized resource Z, which can be determined that the resource correlation is abnormal.

[0026] The resulting behavioral characteristics are a set of quantitative indicators that characterize the dynamic operation patterns of users. They can directly reflect the normal patterns and potential abnormal signals of user operations and are the core basis for detecting multi-step attacks.

[0027] Semantic data is fundamental information describing a user's static identity and attribution. This type of data doesn't change dynamically with user actions, but it directly determines the legal boundaries of user actions. Through feature extraction, it can be transformed into semantic features that characterize a user's identity and permissions. Specifically, features can be extracted from three dimensions: identity attributes, permission associations, and business matching. These features need to clearly define the user's expected scope of operations, providing a basis for determining whether an action exceeds their authority. Among these: Identity attributes are used to directly characterize a user's core identity, such as job level and department attributes; permission association features are used to connect the correspondence between identity and operation permissions, such as a preset list of accessible resources, for example, a user A in the technical department can access the business system but cannot access the financial database, or the type of operation that can be performed, for example, ordinary employees can only query data and cannot modify or delete data; business matching features are used to associate the rationality of identity with business scenarios, for example, a user in the financial department should frequently access the financial system, and if they access the technical department's code repository, it is a business mismatch.

[0028] The resulting semantic features are a set of quantitative attributes that characterize a user's static identity and permission boundaries. They clearly define the scope of a user's legitimate operations and are the key basis for judging whether an action exceeds the user's authority.

[0029] Step 103: Input the behavioral features and semantic features into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior; In this step, behavioral features are a quantitative description of a user's dynamic operations, while semantic features are a quantitative description of a user's static identity. These two types of features have completely different dimensions, data types, and distribution patterns. Directly concatenating or separately inputting them into the model would lead to a break in the connection between identity and behavior. For example, it would be impossible to determine whether a technical staff member's access to the financial system is unauthorized or a normal operation, and the model would also be unable to effectively learn the inherent matching logic between identity and behavior. The hyperspherical latent space characteristic of the Spherical Variational Auto-Encoder (S-VAE) can precisely solve this problem. The key advantage of S-VAE is that it encodes features into a hyperspherical latent space, making the distribution of high-dimensional features more compact and distinguishable. By inputting behavioral and semantic features into the S-VAE model, the encoder of the S-VAE maps these two heterogeneous features together into a high-dimensional hyperspherical latent space, generating a fused latent variable. The core function of the hyperspherical constraint is to make the distribution of the latent variable more focused on the consistency between identity and behavior. The core of identifying user network behavior is to determine whether the user's current behavior conforms to the normal behavior pattern corresponding to their identity and permissions. For normal behavior, the fusion latent variables will stabilize within the normal cluster where identity and behavior match, and the reconstruction error is extremely small.

[0030] Step 104: If abnormal network behavior of the user is detected, issue a security warning for the user's network behavior.

[0031] In this step, a security warning mechanism can be activated when abnormal user network behavior is detected. When the system detects a security threat, it needs to immediately and automatically switch to threat handling status and trigger multi-dimensional automated handling operations. This includes sending alarm notifications to keep the security team informed of threat information in a timely manner; blocking malicious signal streams to cut off the propagation path of threats in the network; isolating infected files to prevent the risk from spreading to other systems or resources; and initiating emergency response procedures to ensure the stable operation of the system's core functions.

[0032] In some embodiments, user behavior data and user semantic data are acquired; user behavior features are obtained based on the behavior data, and user semantic features are obtained based on the semantic data; the behavior features and semantic features are input into a hyperspherical variational autoencoder (S-VAE) model to align the behavior features and semantic features and identify the user's network behavior; when abnormal network behavior of the user is detected, a security warning is issued for the user's network behavior. In this embodiment, not only traditional behavior data is acquired, but user semantic data is also supplemented to form a dual-dimensional data source, covering the dynamic operation and static identity association of network behavior. This breaks through the limitation of a single data source. By aligning the two types of features through the S-VAE model, the shortcomings of traditional models that can only analyze behavior data and cannot associate identity permissions are compensated for. Anomaly identification based on dual-dimensional features reduces false positives and false negatives caused by incomplete data, thereby improving the accuracy of network threat identification and thus improving the overall efficiency of network security warning.

[0033] Optionally, the S-VAE model includes an S-VAE1 sub-model and an S-VAE2 sub-model; The step of inputting the behavioral features and semantic features into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior includes: The behavioral features are input into the S-VAE1 sub-model, and the behavioral features are mapped to the hyperspherical latent feature space through the S-VAE1 sub-model. The semantic features are input into the S-VAE2 sub-model, and the semantic features are mapped to the hyperspherical latent feature space through the S-VAE2 sub-model. In the hyperspherical latent feature space, the latent feature distributions of the behavioral features and the semantic features are aligned to identify the user's network behavior.

[0034] In some embodiments, see Figure 2 For behavioral features, they are input into the S-VAE1 sub-model. The S-VAE1 sub-model encodes the behavioral features and maps them to a hyperspherical latent feature space. This hyperspherical latent feature space is a special feature representation space that can better characterize the distribution and other properties of features. For semantic features, they are input into the S-VAE2 sub-model. The S-VAE2 sub-model also processes the semantic features and maps them to the same hyperspherical latent feature space. In the hyperspherical latent feature space, the latent feature distributions of behavioral and semantic features are aligned, so that behavioral and semantic features that might have different distribution spaces in the first place have a unified and coordinated distribution.

[0035] Then, based on the distribution of both in the hyperspherical latent feature space, the normality of the user's network behavior is identified. For example, if the latent feature distributions of behavioral and semantic features do not conform to a normal pattern, abnormal network behavior may be identified. Specifically, risk centers are pre-defined for various known risks in the hyperspherical latent feature space. When a test sample (i.e., the latent features mapped from the aforementioned user behavior and semantic features) is input: if the test sample is close to a certain risk center, it is predicted to belong to that risk category; if the test sample is not close to any risk center, it is determined to be in the safe category.

[0036] The model classification function is shown below: ; In the above formula, Represents the cosine distance.

[0037] For already labeled risk samples, the S-VAE model achieves high accuracy in predicting their labels. If new samples of the same type are then constructed using the predicted risk labels, their latent features should be close to those of the original risk samples in the hyperspherical space. If new samples constructed using the predicted labels are far removed from the original risk samples in the hyperspherical space, it indicates that the sample does not belong to the known risk categories learned by the model, the previous predicted labels were incorrect, and thus it can be inferred that the sample is an unknown malicious sample.

[0038] In this embodiment, behavioral and semantic features differ greatly in type and distribution. By mapping them to the same hyperspherical latent feature space through two S-VAE sub-models, the incompatibility problem of dimensionality and distribution of heterogeneous features is solved. Utilizing the geometric properties of the hypersphere, the hyperspherical space facilitates the measurement of feature correlations through distance, making the feature distribution more compact and enabling a clearer distinction between normal and abnormal patterns.

[0039] Optionally, the loss function of the S-VAE model is constructed based on the variational autoencoder VAE loss function and the cross-domain loss function.

[0040] In some embodiments, to align the latent distributions of semantic and behavioral modalities, this application uses both the Variational Auto-Encoder (VAE) loss function and the cross-domain loss function ca as the loss function of the S-VAE model. The VAE loss function ensures that the VAE decoder reconstructs the sample as closely as possible to the original input sample, and the specific formula is as follows: ; ; ; In the above formula, Let KL divergence be denoted as KL divergence.

[0041] Then, the behavioral features are aligned to the corresponding semantic features, achieving alignment between the two types of features. The specific formula is as follows: ; ; ; The final loss function of the S-VAE model is: .

[0042] In this embodiment, the dual-channel S-VAE model uses latent space alignment technology that combines behavioral features and semantic information to achieve fine-grained identification of risky behaviors through KL divergence constraints and cross-modal reconstruction loss.

[0043] Optionally, obtaining the user's behavioral characteristics based on the behavioral data includes: The behavioral data is preprocessed to obtain the user's multivariate temporal feature vector; The multivariate temporal feature vector is input into the graph neural network (GNN) model to obtain the user's predicted behavior feature vector; Based on the predicted behavior feature vector and the user's actual behavior feature vector, a difference vector is obtained, which is used to characterize the user's behavior features.

[0044] In some embodiments, see continue to see Figure 2 User behavior data is fragmented, unstructured, and dynamic. The preprocessing stage cleans, organizes, and aligns this data temporally, ultimately generating a multivariate temporal feature vector. "Multivariate" can be understood as encompassing multiple behavioral dimensions, and "temporal" as arranged chronologically. This multivariate temporal feature vector is then input into a Graph Neural Network (GNN) model. The core value of GNN lies in its ability to model the dynamic relationships between "user-device-resource," combining historical user behavior patterns, frequently used device associations, and resource access permissions to predict the user's expected normal behavior pattern in the current scenario—that is, the predicted behavior feature vector. The difference between the predicted behavior feature vector output by the GNN and the actual behavior feature vector generated by the user's actual actions is calculated, resulting in a difference vector. This difference vector directly quantifies the degree of deviation between the actual behavior and the normal pattern. The larger the difference, the more the behavior deviates from the user's historical associations and access permissions, and the more likely it contains abnormal behavior. Therefore, the difference vector is ultimately used as a core indicator characterizing user behavior features, providing accurate quantitative evidence for subsequent anomaly detection.

[0045] In this embodiment, a difference vector is obtained by predicting the behavior feature vector and the actual behavior feature vector, which intuitively quantifies the degree of behavior deviation, providing a clearer quantitative basis for subsequent network behavior anomaly detection and effectively reducing false positives and false negatives.

[0046] Optionally, the GNN model includes a first graph node corresponding to the user, a second graph node corresponding to the device, and a third graph node corresponding to the resource, as well as edges corresponding to the interaction behaviors between the user, the device, and the resource; The features of the first graph node are determined by the user's operation path encoding, and the features of the first graph node are determined by the device's status encoding.

[0047] In some embodiments, the GNN model transforms "user, device, resource" and their interaction relationships into a computable graph structure through three types of nodes and corresponding edges. The first graph node corresponds to the user and is the core node representing the user's identity; the second graph node corresponds to the device, representing the terminal the user operates on; and the third graph node corresponds to the resource, representing the object accessed by the user. Edges connect these nodes, representing the interaction behavior between the user, device, and resource. The characteristics of the nodes determine whether the GNN can accurately learn the association patterns. The characteristics of the first graph node are determined by the user's operation path encoding. The operation path refers to the user's complete behavioral sequence. Through encoding, the user node's characteristics include information such as operation order, resource access preferences, and device usage habits. The characteristics of the second graph node are determined by the device's state encoding. The device state includes the device's attributes and dynamic state. Through encoding, the device node's characteristics reflect key information such as "the closeness of the association between the device and the user" and "the device's own security status." This structural design allows the GNN to simultaneously learn the node's own characteristics and the association relationships between nodes, thereby providing accurate association basis for subsequently predicting the user's expected normal behavioral feature vector, improving the rationality and accuracy of behavior prediction.

[0048] Optionally, before inputting the behavioral features and semantic features into the hyperspherical variational autoencoder (S-VAE) model, aligning the behavioral features and semantic features, and identifying the user's network behavior, the method further includes: The parameters of the S-VAE model and the GNN model are adjusted using a target optimization algorithm, which is generated based on the Harris Hawk Optimization Algorithm (HHO) and the Sparrow Search Algorithm (SSA).

[0049] In some embodiments, the parameters of the GNN model include node feature dimensions, edge weight calculation methods, and the number of neurons in the aggregation layer, which directly affect the accuracy of capturing the dynamic relationship between "user-device-resource". The parameters of the S-VAE model include the number of encoder or decoder layers, the dimension of the hyperspherical latent space, and KL divergence weights, which determine the feature alignment effect and anomaly detection sensitivity. Inappropriate parameter settings can severely reduce the model's anomaly detection capability in cybersecurity scenarios. Therefore, it is necessary to use target optimization algorithms to search for the optimal parameter combination to adapt the model to complex network behavior data.

[0050] The objective optimization algorithm is a fusion of the Harris Hawks Optimization (HHO) algorithm and the Sparrow Search Algorithm (SSA), combining the advantages of both algorithms. HHO simulates the hunting strategy of the Harris Hawk, excelling in global search and able to escape local optima. SSA simulates the foraging and anti-predation behavior of sparrows, possessing strong local search capabilities. The hybrid algorithm, through a cooperative mechanism, ensures both the breadth of parameter search and improves search accuracy.

[0051] Optionally, adjusting the parameters of the S-VAE model and the GNN model using the objective optimization algorithm includes: Generate the first HHO population and the first SSA population; The first HHO population and the first SSA population are iteratively updated respectively; Every K iterations, N first individuals are randomly selected from the second HHO population, and N second individuals are randomly selected from the second SSA population, where K and N are integers greater than 1. The second HHO population is the population obtained by updating the first HHO population after K iterations, and the second SSA population is the population obtained by updating the first SSA population after K iterations. By performing a crossover operation on the N first bodies and the N second bodies, N third bodies are obtained; The N third individuals are used to replace the N first individuals in the second HHO population; Calculate the fitness of the N third individuals in the second HHO population, and update the optimal individual and the target information of the optimal individual in the second HHO population; If the number of iterations exceeds a preset value, the parameters of the S-VAE model and the GNN model are adjusted based on the best individual in the second HHO population and the best fitness value of the best individual.

[0052] In some embodiments, the specific steps for generating the first HHO population are as follows: (1) Randomly generate an initial population X, and each individual in the population ,in, The values ​​for each dimension are generated according to the following formula: ; In the above formula, This indicates the generation of random numbers in the interval [0,1]. , This represents the lower bound of the j-th decision variable. Let represent the upper limit of the j-th decision variable. In this application, the root mean square error of the prediction model is selected as the population fitness.

[0053] (2) Perform iterative updates of the HHO population to obtain the first HHO population. Perform stage judgment and conversion probability calculation on the HHO population based on the current iteration number t and the maximum iteration number. Calculate the transition probability p, using the following formula: ; like The HHO individual performs a search operation, randomly selecting three different individuals from the population. Update the individual position according to the following formula: ; Boundary processing is performed on the updated positions to ensure that the values ​​of each dimension are within the search space. Process according to the following formula: like ,but ; like ,but ; Calculate the updated individual fitness value ,like Then use replace ,like Then update simultaneously .

[0054] like Entering the development phase, based on the current optimal individual To update individuals The position is given by the following formula: ; In the above formula, J is a random factor that takes the value 1 or -1.

[0055] The specific steps for generating the first SSA population are as follows: (3) Update the SSA population to obtain the first SSA population. For the population with the first few cells... Individuals acting as discoverers are updated according to the following formula: ; In the above formula, i represents the serial number of the discoverer, and a is a constant, which is generally taken as a suitable positive value.

[0056] For the remaining participants, randomly select one discoverer individual. Update according to the following formula: If rand(0,1)>ST; If rand(0,1) ST; In the above formula, Q is a random number that follows a normal distribution. It is the individual with the worst fitness in the current population. ST is the warning value, which can be set according to actual needs. In this application, it can be set to 0.7.

[0057] Random selection The individual, acting as a vigilant, updates the algorithm according to the following formula when it senses danger: ; In the above formula, The step size control parameter is set to 0.1 in this application.

[0058] (4) Then, iteratively update the first HHO population and the first SSA population respectively. After every K iterations, randomly select N first individuals from the updated second HHO population and N second individuals from the updated second SSA population. Perform crossover operations on the N first individuals and N second individuals to obtain N third individuals. Then, use the N third individuals to replace the N first individuals in the second HHO population; calculate the fitness of the N third individuals in the second HHO population, and update the optimal individual and the target information of the optimal individual in the second HHO population. If the number of iterations exceeds the preset value, the parameters of the S-VAE model and the GNN model can be adjusted based on the optimal individual and the optimal fitness value of the optimal individual in the second HHO population.

[0059] In this embodiment, the global-local co-optimization method that integrates Harris Eagle Optimization (HHO) and Sparrow Algorithm (SSA) can effectively improve the search efficiency and anti-attack capability of the parameters of the S-VAE model and the GNN model.

[0060] Optionally, after issuing a security alert for the user's network behavior when abnormal network behavior is detected, the method further includes: The S-VAE model and the GNN model are updated periodically according to a preset update cycle.

[0061] In some embodiments, the update cycle of the S-VAE model and the GNN model can be set according to the specific use case, and then the training database of the S-VAE model and the GNN model can be updated according to the preset update cycle.

[0062] In this embodiment, a timed update mechanism is used to set an appropriate update cycle according to the specific use case, and the training data is continuously updated to improve the generalization and adaptability of the model.

[0063] See Figure 3 , Figure 3 This is a structural diagram of a network security early warning device provided in an embodiment of this application. Figure 3 As shown, the network security early warning device 300 includes: The first acquisition module 301 is used to acquire user behavior data and the user's semantic data; The first processing module 302 is used to obtain the user's behavioral characteristics based on the behavioral data, and to obtain the user's semantic characteristics based on the semantic data; The first identification module 303 is used to input the behavioral features and the semantic features into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and the semantic features and identify the user's network behavior. The first early warning module 304 is used to provide a security warning for the user's network behavior when abnormal network behavior is detected.

[0064] Optionally, the S-VAE model includes an S-VAE1 sub-model and an S-VAE2 sub-model; The first identification module includes: The first mapping unit is used to input the behavioral features into the S-VAE1 sub-model and map the behavioral features into the hyperspherical latent feature space through the S-VAE1 sub-model. The second mapping unit is used to input the semantic features into the S-VAE2 sub-model and map the semantic features into the hyperspherical latent feature space through the S-VAE2 sub-model; The first identification unit is used to align the latent feature distributions of the behavioral features and the semantic features in the hyperspherical latent feature space to identify the user's network behavior.

[0065] Optionally, the loss function of the S-VAE model is constructed based on the variational autoencoder VAE loss function and the cross-domain loss function.

[0066] Optionally, the first processing module includes: The first processing unit is used to preprocess the behavioral data to obtain the user's multivariate temporal feature vector; The second processing unit is used to input the multivariate temporal feature vector into the graph neural network (GNN) model to obtain the user's predicted behavior feature vector. The third processing unit is used to obtain a difference vector based on the predicted behavior feature vector and the user's actual behavior feature vector, the difference vector being used to characterize the user's behavior features.

[0067] Optionally, the GNN model includes a first graph node corresponding to the user, a second graph node corresponding to the device, and a third graph node corresponding to the resource, as well as edges corresponding to the interaction behaviors between the user, the device, and the resource; The features of the first graph node are determined by the user's operation path encoding, and the features of the first graph node are determined by the device's status encoding.

[0068] Optionally, the device further includes: The first adjustment module is used to adjust the parameters of the S-VAE model and the GNN model using a target optimization algorithm, which is generated based on the Harris Hawk Optimization Algorithm (HHO) and the Sparrow Search Algorithm (SSA).

[0069] Optionally, the first adjustment module includes: The first generation unit is used to generate the first HHO population and the first SSA population; The first update unit is used to iteratively update the first HHO population and the first SSA population respectively; The first selection unit is used to randomly select N first individuals from the second HHO population and N second individuals from the second SSA population every K iterations, where K and N are integers greater than 1. The second HHO population is the population obtained by updating the first HHO population after K iterations, and the second SSA population is the population obtained by updating the first SSA population after K iterations. The first crossover unit is used to perform a crossover operation on the N first bodies and the N second bodies to obtain N third bodies; The first replacement unit is used to replace the N first individuals in the second HHO population with the N third individuals; The second update unit is used to calculate the fitness of the N third individuals in the second HHO population, and update the optimal individual in the second HHO population and the target information of the optimal individual; The first adjustment unit is used to adjust the parameters of the S-VAE model and the GNN model based on the best individual in the second HHO population and the best fitness value of the best individual when the number of iterations exceeds a preset value.

[0070] Optionally, the device further includes: The first update module is used to update the S-VAE model and the GNN model at set intervals according to a preset update cycle.

[0071] This application also provides an electronic device. Since the principle by which the electronic device solves the problem is similar to the network security early warning method in this application, the implementation of this electronic device can be found in the implementation of the method, and repeated details will not be described again. Figure 4 As shown, the electronic device in this embodiment includes a processor 410, configured to read a program from a memory 420 and execute the following processes: Acquire user behavioral data and the user's semantic data; The user's behavioral characteristics are obtained based on the behavioral data, and the user's semantic characteristics are obtained based on the semantic data; The behavioral features and semantic features are input into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior. If abnormal network behavior of the user is detected, a security warning will be issued for the user's network behavior.

[0072] Among them, Figure 4 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 410 and memory represented by memory 420 together. The bus architecture can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides the interface.

[0073] Optionally, the S-VAE model includes an S-VAE1 sub-model and an S-VAE2 sub-model; The processor 410 is used to read the program in the memory 420 and execute the following processes: The step of inputting the behavioral features and semantic features into the hyperspherical variational autoencoder (S-VAE) model to align the behavioral features and semantic features and identify the user's network behavior includes: The behavioral features are input into the S-VAE1 sub-model, and the behavioral features are mapped to the hyperspherical latent feature space through the S-VAE1 sub-model. The semantic features are input into the S-VAE2 sub-model, and the semantic features are mapped to the hyperspherical latent feature space through the S-VAE2 sub-model. In the hyperspherical latent feature space, the latent feature distributions of the behavioral features and the semantic features are aligned to identify the user's network behavior.

[0074] Optionally, the loss function of the S-VAE model is constructed based on the variational autoencoder VAE loss function and the cross-domain loss function.

[0075] Optionally, the processor 410 is configured to read the program from the memory 420 and execute the following processes: The behavioral data is preprocessed to obtain the user's multivariate temporal feature vector; The multivariate temporal feature vector is input into the graph neural network (GNN) model to obtain the user's predicted behavior feature vector; Based on the predicted behavior feature vector and the user's actual behavior feature vector, a difference vector is obtained, which is used to characterize the user's behavior features.

[0076] Optionally, the GNN model includes a first graph node corresponding to the user, a second graph node corresponding to the device, and a third graph node corresponding to the resource, as well as edges corresponding to the interaction behaviors between the user, the device, and the resource; The features of the first graph node are determined by the user's operation path encoding, and the features of the first graph node are determined by the device's status encoding.

[0077] Optionally, the processor 410 is configured to read the program from the memory 420 and execute the following processes: The parameters of the S-VAE model and the GNN model are adjusted using a target optimization algorithm, which is generated based on the Harris Hawk Optimization Algorithm (HHO) and the Sparrow Search Algorithm (SSA).

[0078] Optionally, the processor 410 is configured to read the program from the memory 420 and execute the following processes: Generate the first HHO population and the first SSA population; The first HHO population and the first SSA population are iteratively updated respectively; Every K iterations, N first individuals are randomly selected from the second HHO population, and N second individuals are randomly selected from the second SSA population, where K and N are integers greater than 1. The second HHO population is the population obtained by updating the first HHO population after K iterations, and the second SSA population is the population obtained by updating the first SSA population after K iterations. By performing a crossover operation on the N first bodies and the N second bodies, N third bodies are obtained; The N third individuals are used to replace the N first individuals in the second HHO population; Calculate the fitness of the N third individuals in the second HHO population, and update the optimal individual and the target information of the optimal individual in the second HHO population; If the number of iterations exceeds a preset value, the parameters of the S-VAE model and the GNN model are adjusted based on the best individual in the second HHO population and the best fitness value of the best individual.

[0079] Optionally, the processor 410 is configured to read the program from the memory 420 and execute the following processes: The S-VAE model and the GNN model are updated periodically according to a preset update cycle.

[0080] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described network security early warning method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0081] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0082] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0083] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0084] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A network security early warning method, characterized in that, The method comprises: obtaining behavior data of a user and semantic data of the user; obtaining behavior features of the user based on the behavior data and obtaining semantic features of the user based on the semantic data; inputting the behavior features and the semantic features into a hyperspherical variational autoencoder S-VAE model to align the behavior features and the semantic features and identify network behavior of the user; in the case of identifying abnormal network behavior of the user, performing a security warning on the network behavior of the user.

2. The network security early warning method of claim 1, wherein, The S-VAE model comprises an S-VAE1 submodel and an S-VAE2 submodel. The inputting of the behavior features and the semantic features into the hyperspherical variational autoencoder S-VAE model to align the behavior features and the semantic features and identify network behavior of the user comprises: inputting the behavior features into the S-VAE1 submodel and mapping the behavior features into a hyperspherical latent feature space through the S-VAE1 submodel; inputting the semantic features into the S-VAE2 submodel and mapping the semantic features into the hyperspherical latent feature space through the S-VAE2 submodel; aligning latent feature distributions of the behavior features and the semantic features in the hyperspherical latent feature space to identify network behavior of the user.

3. The network security early warning method of claim 2, wherein, The loss function of the S-VAE model is constructed based on a variational autoencoder VAE loss function and a cross-domain loss function.

4. The network security early warning method of claim 2, wherein, The obtaining of the behavior features of the user based on the behavior data comprises: preprocessing the behavior data to obtain a multivariate time series feature vector of the user; inputting the multivariate time series feature vector into a graph neural network GNN model to obtain a predicted behavior feature vector of the user; obtaining a difference vector based on the predicted behavior feature vector and an actual behavior feature vector of the user, the difference vector being used to represent the behavior features of the user.

5. The network security early warning method of claim 4, wherein, The GNN model comprises a first graph node corresponding to the user, a second graph node corresponding to a device and a third graph node corresponding to a resource, and an edge corresponding to an interaction behavior between the user, the device and the resource; wherein a feature of the first graph node is determined by operation path encoding of the user and a feature of the first graph node is determined by state encoding of the device.

6. The network security early warning method of claim 4, wherein, Before the inputting of the behavior features and the semantic features into the hyperspherical variational autoencoder S-VAE model to align the behavior features and the semantic features and identify network behavior of the user, the method further comprises: adjusting parameters of the S-VAE model and parameters of the GNN model by using a target optimization algorithm, the target optimization algorithm being generated based on a Harris hawk optimization algorithm HHO and a sparrow search algorithm SSA.

7. The network security early warning method of claim 6, wherein, The adjusting of the parameters of the S-VAE model and the parameters of the GNN model by using the target optimization algorithm comprises: generating a first HHO population and a first SSA population; iteratively updating the first HHO population and the first SSA population respectively; Randomly select N first individuals from the second HHO population and N second individuals from the second SSA population after every K iterations, wherein K and N are integers greater than 1, the second HHO population is a population obtained after K iterations of updating the first HHO population, and the second SSA population is a population obtained after K iterations of updating the first SSA population; Perform a crossover operation on the N first individuals and the N second individuals correspondingly to obtain N third individuals; Replace the N first individuals in the second HHO population with the N third individuals; Calculate the fitness of the N third individuals in the second HHO population, and update the optimal individual in the second HHO population and target information of the optimal individual; If the number of iterations is greater than a preset value, adjust parameters of an S-VAE model and parameters of a GNN model based on the optimal individual in the second HHO population and an optimal fitness value of the optimal individual.

8. The network security early warning method of claim 4, wherein, After the security warning is given to the network behavior of the user in the case where the network behavior of the user is identified as abnormal, the method further includes: The S-VAE model and the GNN model are updated at a preset update period.

9. A network security early warning device, characterized in that, The apparatus includes: A first obtaining module configured to obtain behavior data of a user and semantic data of the user; A first processing module configured to obtain behavior features of the user based on the behavior data and obtain semantic features of the user based on the semantic data; A first identifying module configured to input the behavior features and the semantic features into an S-VAE model to align the behavior features and the semantic features, and identify a network behavior of the user; A first warning module configured to give a security warning to the network behavior of the user in the case where the network behavior of the user is identified as abnormal.

10. An electronic device, comprising: The electronic device includes a processor configured to: Obtain behavior data of a user and semantic data of the user; Obtain behavior features of the user based on the behavior data and obtain semantic features of the user based on the semantic data; Input the behavior features and the semantic features into an S-VAE model to align the behavior features and the semantic features, and identify a network behavior of the user; Give a security warning to the network behavior of the user in the case where the network behavior of the user is identified as abnormal.

11. An electronic device, comprising: The computer program is executed by the processor to implement the steps of the network security warning method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium and is executed by the processor to implement the steps of the network security warning method according to any one of claims 1 to 8.

13. A computer program product, characterised in that, The computer program is executed by the processor to implement the steps of the network security warning method according to any one of claims 1 to 8.

Images