Behavior detection method and device, equipment, medium and program product

Abstract

The invention provides a behavior detection method and device, equipment, a medium and a program product, which can be applied to the distributed field. The behavior detection method comprises the following steps: obtaining network nodes in a target system, wherein a flow interaction behavior exists between the network nodes in a target time period; based on the network nodes in the target system, a network topological graph is constructed, and the network topological graph comprises information of the network nodes; generating a detection result based on a preset network topological graph and local feature similarity and global feature similarity of the network topological graph, the local feature similarity being determined based on local features of the preset network topological graph and local features of the network topological graph, the global feature similarity is determined based on the global feature of a preset network topological graph and the global feature of the network topological graph, the abnormal network behavior does not exist in the target system in the preset network topological graph, and the detection result represents the existence condition of the abnormal network behavior in the target system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of distribution, and particularly to a behavior detection method, device, equipment, medium and program product. BACKGROUND

[0002] In a distributed system, network abnormal behavior detection of devices in the system is mainly performed by capturing keywords information including node running logs, command execution returns, and execution directories, and prompting the existence of network abnormal behavior when suspicious behavior keywords information is captured. The devices in the Internet of Things can also be referred to as network nodes.

[0003] However, the related technology has limitations in detecting abnormal attack behavior of network nodes. SUMMARY

[0004] In view of the above problems, the present application provides a behavior detection method, device, equipment, medium and program product.

[0005] According to a first aspect of the present application, a behavior detection method is provided, comprising: acquiring network nodes in a target system, wherein the network nodes have traffic interaction behavior in a target period; constructing a network topology graph based on the network nodes in the target system, wherein the network topology graph includes information of the network nodes; generating a detection result based on a local feature similarity and a global feature similarity between a preset network topology graph and the network topology graph, wherein the local feature similarity is determined based on a local feature of the preset network topology graph and a local feature of the network topology graph, the global feature similarity is determined based on a global feature of the preset network topology graph and a global feature of the network topology graph, the preset network topology graph does not have abnormal network behavior in the target system, and the detection result represents the existence of abnormal network behavior in the target system.

[0006] According to an embodiment of the present application, the generating of the detection result based on the local feature similarity and the global feature similarity between the preset network topology graph and the network topology graph comprises: determining a first similarity between the network topology graph and the preset network topology graph based on an Euclidean distance between features of the network topology graph and the preset network topology graph, wherein the features of the network topology graph include a first local feature and a first global feature of the network topology graph; generating a second similarity between the network topology graph and the preset network topology graph based on a graph similarity calculation model and the network topology graph, wherein the graph similarity calculation model is trained based on features of the preset network topology graph; and performing weighted summation on the first similarity and the second similarity to obtain a target similarity; wherein in a case where the target similarity is greater than a preset similarity threshold, it is determined that the detection result represents the existence of abnormal network behavior in the target system.

[0007] According to an embodiment of this application, the information of the network node includes at least one of node type information, network node traffic transmission direction, network node data transmission volume per unit time, and network node average response time per unit time; the first local feature is obtained in the following manner: based on the node type information, the network node traffic transmission direction, the network node data transmission volume per unit time, and the average response time per unit time, vector feature information of the network node is constructed respectively; the vector feature information of the network node is combined to obtain the first local feature of the network topology graph.

[0008] According to an embodiment of this application, the features of the preset network topology graph include local features of the preset network topology graph; determining the first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph includes: determining the similarity between the first local feature and the features of the multiple sets of local features based on the Euclidean distance between the first local feature and the features of the multiple sets of local features, wherein the features of the sets of local features are obtained by classifying them according to the Euclidean distance between the local features of the preset network topology graph; performing a weighted summation of the similarities between the first local feature and each set of local features to obtain the first local similarity, wherein the weights corresponding to the similarities between the first local feature and each set of local features are based on the proportion of the elements in the local feature sets in all elements of the preset network topology graph; and obtaining the first similarity based on the first local similarity.

[0009] According to an embodiment of this application, the features of the preset network topology graph further include global features of the preset network topology graph, which are obtained based on a feature vector construction method; obtaining the first similarity based on the first local similarity includes: determining the similarity between the first global feature and the features of the multiple global feature sets based on the Euclidean distance between the first global feature and the multiple global feature sets, wherein the global feature sets are obtained by classifying them according to the Euclidean distance between the global features of the preset network topology graph; performing a weighted summation of the similarities between the first global feature and each global feature set to obtain the first global similarity, wherein the weights corresponding to the similarities between the first global feature and each global feature set are based on the proportion of elements in the global feature sets among all elements of the preset network topology graph; and determining the first similarity based on the first local similarity, the first global similarity, the preset weights of the first local similarity and the preset weights of the first global similarity.

[0010] According to an embodiment of this application, the graph similarity calculation model includes a convolutional layer, which is used to capture at least one of the following: node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time of the network topology graph; generating a second similarity between the network topology graph and the preset network topology graph based on the graph similarity calculation model and the network topology graph includes: processing a second global feature in the network topology graph using the graph similarity calculation model to obtain a second global similarity, wherein the second global feature includes information of all network nodes in the network topology graph; processing a second local feature in the network topology graph using the graph similarity calculation model to obtain a second local similarity, wherein the second local feature includes information of some network nodes in the network topology graph; and determining the second similarity based on the second local similarity, the second global similarity, a preset weight of the second local similarity, and a preset weight of the second global similarity.

[0011] A second aspect of this application provides a behavior detection device, comprising: an acquisition module for acquiring network nodes within a target system, wherein traffic interaction behavior exists between the network nodes during a target time period; a construction module for constructing a network topology map based on the network nodes within the target system, wherein the network topology map includes information about the network nodes; and a detection module for generating a detection result based on the local feature similarity and global feature similarity between a preset network topology map and the network topology map, wherein the local feature similarity is determined based on the local features of the preset network topology map and the local features of the network topology map, and the global feature similarity is determined based on the global features of the preset network topology map and the global features of the network topology map, wherein there is no abnormal network behavior within the target system in the preset network topology map, and the detection result characterizes the existence of abnormal network behavior within the target system.

[0012] According to an embodiment of this application, the information of a network node includes at least one of node type information, network node traffic transmission direction, network node data transmission volume per unit time, and network node average response time per unit time; the first local feature is obtained in the following manner: based on the node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time, vector feature information of the network node is constructed respectively; the vector feature information of the network node is combined to obtain the first local feature of the network topology graph.

[0013] According to embodiments of this application, the detection module further includes an Euclidean distance detection submodule and a model detection submodule. The Euclidean distance detection submodule is used to determine a first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph. The features of the network topology graph include a first local feature and a first global feature of the network topology graph. The model detection submodule is used to generate a second similarity between the network topology graph and the preset network topology graph based on a graph similarity calculation model and the network topology graph. The graph similarity calculation model is trained based on the features of the preset network topology graph. The first similarity and the second similarity are weighted and summed to obtain a target similarity. Wherein, if the target similarity is greater than a preset similarity threshold, the detection result is determined to indicate the existence of abnormal network behavior in the target system.

[0014] According to an embodiment of this application, the features of the preset network topology graph include local features of the preset network topology graph; the Euclidean distance detection submodule determines the first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph in the following manner: based on the Euclidean distance between the first local feature and the features of multiple local feature sets, the similarity between the first local feature and the features of multiple local feature sets is determined respectively, and the features of the local feature sets are obtained by classifying them according to the Euclidean distance between the local features of the preset network topology graph; the first local similarity is obtained by weighted summation of the similarity between the first local feature and each local feature set, and the weight corresponding to the similarity between the first local feature and each local feature set is based on the proportion of the elements in the local feature sets in all elements of the preset network topology graph; the first similarity is obtained based on the first local similarity.

[0015] According to an embodiment of this application, the features of the preset network topology graph further include global features of the preset network topology graph, which are obtained based on the feature vector construction method. The Euclidean distance detection submodule obtains the first similarity based on the first local similarity in the following manner: determining the similarity between the first global feature and the features of the multiple global feature sets based on the Euclidean distance between the first global feature and the multiple global feature sets, wherein the features of the global feature sets are obtained by classifying them according to the Euclidean distance between the global features of the preset network topology graph; performing a weighted summation of the similarities between the first global feature and each global feature set to obtain the first global similarity, wherein the weights corresponding to the similarities between the first global feature and each global feature set are based on the proportion of elements in the global feature sets in all elements of the preset network topology graph; and determining the first similarity based on the first local similarity, the first global similarity, the preset weights of the first local similarity and the preset weights of the first global similarity.

[0016] According to an embodiment of this application, the graph similarity calculation model includes a convolutional layer, which is used to capture at least one of the following: node type information of the network topology graph, traffic transmission direction of network nodes, amount of data sent by network nodes per unit time, and average response time per unit time. The model detection submodule generates a second similarity between the network topology graph and a preset network topology graph based on the graph similarity calculation model and the network topology graph in the following manner: the graph similarity calculation model is used to process the second global features in the network topology graph to obtain a second global similarity, wherein the second global features include information of all network nodes in the network topology graph; the graph similarity calculation model is used to process the second local features in the network topology graph to obtain a second local similarity, wherein the second local features include information of some network nodes in the network topology graph; and the second similarity is determined based on the second local similarity, the second global similarity, the preset weights of the second local similarity and the second global similarity.

[0017] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0018] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0019] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0020] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 This illustration schematically depicts an application scenario of the behavior detection method and apparatus according to embodiments of this application;

[0022] Figure 2 A flowchart illustrating a behavior detection method according to an embodiment of this application is shown schematically.

[0023] Figure 3 A schematic diagram illustrating the structure of a behavior detection device according to an embodiment of this application is shown; and

[0024] Figure 4 A block diagram schematically illustrates an electronic device suitable for implementing a behavior detection method according to an embodiment of this application. Detailed Implementation

[0025] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0029] With the development of fintech, there is a need to monitor network nodes and their traffic behavior in the distributed systems of financial institutions. However, current technologies primarily address anomalous attacks, including penetration attacks, by capturing traffic transmission data from network nodes within the distributed network and judging whether the node transmitting the data exhibits anomalous behavior based on the data content. For example, in the office collaboration service scenario of a basic office system, a user's act of downloading and sending scripts or database files from one network node to other network nodes in a distributed system would be identified as a penetration attack such as "database file injection," "command script leakage," or "command script execution," leading to frequent false alarms of anomalous attacks. In other words, there are limitations to the ability to detect anomalous attacks in distributed networks.

[0030] Furthermore, related technologies involve constructing network topology graphs corresponding to distributed networks. These graphs include network node information and information on traffic transmission between nodes. The network node information serves as nodes in the topology graph, while the traffic transmission information serves as edges. Additionally, a graph similarity calculation model is trained using a pre-defined network topology graph representing the absence of anomalous attack behavior. This trained model is then used to perform similarity detection on network topology graphs generated based on recent traffic interactions within the distributed network, determining whether anomalous attack behavior exists in the recently generated network topology graphs.

[0031] However, the similarity calculation models in related technologies only perform similarity detection on global features in the network topology graph. Abnormal traffic behavior of local network nodes in the network topology graph is treated as noise and removed by the similarity calculation model, resulting in poor performance of abnormal attack behavior detection based on the network topology graph.

[0032] Based on this, embodiments of this application provide a behavior detection method, including: acquiring network nodes within a target system, and identifying traffic interaction behaviors between these network nodes during a target time period; constructing a network topology graph based on the network nodes within the target system, the network topology graph including information about the network nodes; and generating detection results based on the local feature similarity and global feature similarity of the network topology graph, the detection results characterizing the existence of abnormal network behaviors within the target system. By using global and local features of the network topology graph for detection, anomaly detection results are obtained, integrating global and local features of the traffic topology to detect attack behaviors in the network topology graph, thus improving the accuracy of detection.

[0033] It should be noted that the behavior detection methods, apparatus, devices, media, and program products defined in this application can be used in the fields of distributed technology and fintech, and can also be used in a variety of other fields besides distributed technology and fintech. The application fields of the behavior detection methods, apparatus, devices, media, and program products provided in the embodiments of this application are not limited.

[0034] In scenarios where personal information is used for automated decision-making, the code detection method, device, and system provided in this application all offer users corresponding operation entry points, allowing them to choose to agree to or reject the automated decision-making result; if the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0035] Figure 1 The illustration shows an application scenario of the behavior detection method and apparatus according to embodiments of this application.

[0036] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0037] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0038] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0039] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0040] It should be noted that the behavior detection method provided in this application embodiment can generally be executed by server 105. Correspondingly, the behavior detection device provided in this application embodiment can generally be located in server 105. The behavior detection method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the behavior detection device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0041] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0042] The following will be based on Figure 1 The described scene, through Figure 2 The behavior detection method according to the embodiments of this application will be described in detail.

[0043] Figure 2 A flowchart illustrating a behavior detection method according to an embodiment of this application is shown schematically.

[0044] like Figure 2 As shown, the behavior detection method of this embodiment includes operations S210 to S230.

[0045] During operation S210, network nodes within the target system are obtained, and traffic interaction behavior exists between these network nodes during the target time period.

[0046] Network nodes can be terminal devices, servers, and routers in the target system.

[0047] The target system is a distributed system in a financial institution. The target system includes multiple network nodes that can communicate with each other. The communication process between network nodes can be called traffic interaction behavior.

[0048] The target time period can be a specified time period included in the received behavior detection instruction, or it can be a preset time period before the current time.

[0049] In operation S220, a network topology map is constructed based on the network nodes within the target system. The network topology map includes information about the network nodes.

[0050] Before obtaining target information about network nodes and their information, consent or authorization from the administrator of the target system or the user of the network nodes can be obtained. For example, before operating S210 or S220, a request can be sent to the administrator of the target system or the user of the network nodes to obtain information about the network nodes and their information in the target system. If the user consents or authorizes the acquisition of user information, operation S220 is executed.

[0051] A network topology graph consists of vertices representing network nodes and edges connecting two vertices. The edges of the network topology graph represent the traffic interaction behavior between network nodes. Vertices and edges can represent information about network nodes and traffic interaction behavior through different sizes, lengths, shapes, widths, and directions.

[0052] In operation S230, based on the preset network topology map and the local and global feature similarities of the network topology map, detection results are generated, which characterize the existence of abnormal network behavior in the target system.

[0053] Abnormal network behavior can be the traffic interaction behavior of a network attacker who, after successfully intruding into a target system's network nodes, uses those network nodes to send illegal data or communicate with other network nodes that should not be communicating with them.

[0054] The preset network topology can be at least one network topology that has undergone behavior detection and whose detection results indicate that there is no abnormal network behavior in the target system, or it can be at least one network topology determined based on expert experience or preset rules and used as a standard positive sample.

[0055] Local feature similarity is determined based on the local features of the preset network topology graph and the local features of the network topology graph. Global feature similarity is determined based on the global features of the preset network topology graph and the global features of the network topology graph.

[0056] The similarity between the preset network topology and the local features of the network topology can be based on the local features of the preset network topology and the local features of the network topology. The local features of the network topology can be a part of the network topology image, which includes at least one of network nodes and traffic interaction behaviors. Alternatively, it can be feature information that can be used for behavior detection after feature extraction operations are performed on the image.

[0057] By constructing a network topology map from network nodes exhibiting traffic interaction behavior within the target time period, the resulting target topology map includes information about traffic interaction behavior and related network nodes within the target time period. This reduces useless information from network nodes without traffic interaction behavior within the target time period, thus reducing the information content of the network topology map. Furthermore, by using the global feature similarity between the network topology map and a preset network topology map, it is determined whether the overall topological structure of the network topology map matches the preset network topology map representing the correct network topology structure, enabling abnormal attack behavior detection based on the global features of the network topology map. In addition, by using the local feature similarity between the network topology map and the preset network topology map, it is determined whether there are anomalies in some nodes, some traffic interaction behaviors, or traffic links composed of some nodes and some traffic interaction behaviors in the network topology map. This enables abnormal behavior detection based on the local features of the network topology map, improving the robustness of abnormal behavior detection in the target system and reducing the false positive rate of abnormal behavior detection.

[0058] In addition to information about network nodes and traffic interactions, network topology diagrams can also include coordinate information to help determine the location of each network node and the length of traffic interactions. For example, using the skeleton network construction method, a network topology diagram is established with a pre-specified master network node as the origin. During the construction of the network topology diagram using the skeleton network construction method, directed lines can be used to represent traffic behavior information. The length of the directed line represents the average response time per unit time for a network node to send traffic data to another network node, the width of the directed line represents the amount of data sent per unit time by a network node to another network node, and the direction of the directed line represents the data sender and data receiver of the traffic behavior information.

[0059] According to embodiments of this application, the information of a network node includes at least one of node type information, network node traffic transmission direction, network node data transmission volume per unit time, and network node average response time per unit time. The network node traffic transmission direction, network node data transmission volume per unit time, and network node average response time per unit time can be a collection of traffic interaction behaviors connected to the network node.

[0060] According to an embodiment of this application, the first local feature can be obtained in the following way: based on node type information, network node traffic transmission direction, network node data transmission volume per unit time and average response time per unit time, vector feature information of network nodes is constructed respectively; the vector feature information of network nodes is combined to obtain the first local feature of the network topology graph.

[0061] Vector transformations can be performed on node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time to obtain their respective vector feature information. These vectors can then be combined to obtain the overall vector feature information of the network node. For example, node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time can be combined as different dimensional features to obtain 4-dimensional vector feature information, which can then be used as the vector feature information of the network node.

[0062] To improve the robustness of the vector feature information of network nodes, denoising and enhancement operations can be performed on node type information features, network node traffic transmission direction features, network node data transmission volume per unit time features, and average response time features per unit time features. For example, the mean, median, and variance of node type information features, network node traffic transmission direction features, network node data transmission volume per unit time features, and average response time features per unit time features are obtained respectively, resulting in 12 sets of vector feature information. These 12 sets of vector feature information are then combined to obtain 12-dimensional vector feature information as the vector feature information of the network node.

[0063] For example, calculate the arithmetic mean (x), median (Me), and variance (x, y, y) of the node type information (Pa), traffic transmission direction (Va-d), data transmission volume per unit time (Va-w), and average response time per unit time (Va-l) of network node a. The final 12-dimensional vector feature value V (corresponding to the first local feature) is obtained as: V = [x(Pa), Me(Pa), (Pa), x(Va-d), Me(Va-d), (Va-d), x(Va-w), Me(Va-w), (Va-w), x(Va-l), Me(Va-l), (Va-l)].

[0064] By extracting node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time, and using these as information for network nodes, the local information corresponding to each network node can be determined. This avoids interference from information other than the network node information in similarity calculation, thus making the local information of network nodes highly robust.

[0065] Various similarity determination methods can be used to determine the similarity between a network topology graph and a preset network topology graph, based on both local and global features. These methods can include Scale-invariant Feature Transform (SIFT), Euclidean distance similarity calculation, cosine similarity calculation, and deep learning neural network models. The following sections will explain how to determine the similarity between a network topology graph and a preset network topology graph using two methods: Euclidean distance similarity calculation and deep learning neural network models.

[0066] According to embodiments of this application, a detection result is generated based on the local and global feature similarities between a preset network topology graph and the network topology graph. This includes: determining a first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph, wherein the features of the network topology graph include first local features and first global features; generating a second similarity between the network topology graph and the preset network topology graph based on a graph similarity calculation model and the network topology graph, wherein the graph similarity calculation model is trained based on the features of the preset network topology graph; and performing a weighted sum of the first and second similarities to obtain a target similarity. Wherein, if the target similarity is greater than a preset similarity threshold, the detection result is determined to characterize abnormal network behavior within the target system.

[0067] Euclidean distance is used to characterize the similarity and difference between features. The smaller the Euclidean distance between two features, the higher the similarity between the two features.

[0068] The graph similarity calculation model can be a neural network model that has been trained in advance using positive sample data including a preset network topology graph. The input of the graph similarity calculation model can include images, and the output is a representation of the similarity between the input image and the positive sample data.

[0069] It should be understood that different similarity determination methods may focus on different local and global features in the network topology graph. That is, the first local feature and the second local feature may be different; the first global feature and the second global feature may be different.

[0070] By using Euclidean distance and a graph similarity calculation model, the similarity of local and global features of the network topology graph is determined. This enables similarity calculation for different local and global features in the network topology graph. By combining the similarity obtained from Euclidean distance and the graph similarity calculation model, the similarity between the network topology graph and the preset network topology graph is determined. Based on the similarity, it is determined whether there is abnormal network behavior in the network topology graph, thus improving the accuracy of abnormal network behavior judgment.

[0071] The process of determining the first similarity between a network topology graph and a preset network topology graph using Euclidean distance is explained below.

[0072] When there are multiple preset network topologies, in the process of calculating the similarity of local features between the preset network topologies and the network topologies based on Euclidean distance, i.e., local similarity, the preset network topologies can be pre-classified according to the Euclidean distance of local features to obtain multiple sets. The local features of the preset network topologies included in the sets are then combined to determine the local features corresponding to each set.

[0073] According to embodiments of this application, the features of the preset network topology graph further include local features of the preset network topology graph. Determining a first similarity between the network topology graph and the features of the network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph includes: determining the similarity between the first local feature and each of the multiple sets of local feature features based on the Euclidean distance between the first local feature and the features of multiple sets of local feature features, wherein the local feature sets are obtained by classifying them according to the Euclidean distance between the local features of the preset network topology graph; performing a weighted summation of the similarities between the first local feature and each set of local feature features to obtain a first local similarity, wherein the weights corresponding to the similarities between the first local feature and each set of local feature features are based on the proportion of elements in the local feature sets among all elements of the preset network topology graph; and obtaining a first similarity based on the first local similarity.

[0074] Local features of a preset network topology can be classified according to their Euclidean distance, resulting in multiple sets of local features and their corresponding local feature sets. For example, preset network topologies whose local features have an Euclidean distance less than a preset distance value can be aggregated to form a set of local features. Furthermore, at least one preset network topology can be randomly selected from the set of local features, and these sets can be combined or superimposed to obtain the local feature set corresponding to that set.

[0075] By classifying the preset network topology and using the features of each set of local features obtained from the classification to determine the local similarity with the network topology, the amount of data required for local similarity determination is reduced, thus avoiding the pressure of detecting the similarity of local features of the network topology due to the existence of a large number of preset network topologies.

[0076] Furthermore, a weighted summation is performed on the similarity between the network topology graph and each set of local features to achieve similarity detection between the comprehensive network topology graph and all types of preset network topology graphs, resulting in high-precision local similarity.

[0077] The features of the preset network topology graph also include its global features. The similarity of global features between the preset network topology graph and the network topology graph can be determined by classifying the preset network topology graph according to the Euclidean distance of its global features, obtaining a global feature set, and then determining the global similarity between the network topology graph determined by the Euclidean distance and the preset network topology graph based on the first global feature of the network topology graph and the global feature set.

[0078] According to embodiments of this application, the features of a preset network topology graph include global features of the preset network topology graph, which are obtained based on a feature vector construction method. A first similarity is obtained based on a first local similarity, including: classifying the global features of the preset network topology graph according to the Euclidean distance between them to obtain multiple global feature sets; determining the similarity between the first global feature and each of the multiple global feature sets based on the Euclidean distance between the first global feature and the multiple global feature sets, where the global feature sets are obtained by classifying them according to the Euclidean distance between the global features of the preset network topology graph; performing a weighted summation of the similarities between the first global feature and each global feature set to obtain a first global similarity, where the weights corresponding to the similarities between the first global feature and each global feature set are based on the proportion of elements in the global feature sets among all elements in the preset network topology graph; and determining the first similarity based on the first local similarity, the first global similarity, the preset weights of the first local similarity and the first global similarity.

[0079] The weights corresponding to the first local similarity and the first global similarity can be predetermined, and the first local similarity and the first global similarity can be weighted and summed to obtain the first similarity between the network topology graph calculated based on Euclidean distance and the preset network topology graph.

[0080] By classifying the preset network topology and using the features of each global feature set obtained from the classification to determine the global similarity between the network topology and the network topology, the amount of data required for global similarity determination is reduced, avoiding the pressure of detecting the similarity of global features of the network topology due to the existence of a large number of preset network topologies. Furthermore, by weighted summing the obtained first local similarity and first global similarity to obtain the first similarity, the detection of both local and global features of the network topology is achieved, improving the accuracy of the obtained first similarity.

[0081] The following describes the process of determining the second similarity between a network topology graph and a preset network topology graph using a graph similarity calculation model.

[0082] According to an embodiment of this application, the graph similarity calculation model includes a convolutional layer, which is used to capture at least one of the following: node type information of the network topology graph, network node traffic transmission direction, amount of data sent by network nodes per unit time, and average response time per unit time.

[0083] Based on a graph similarity calculation model and a network topology graph, a second similarity between the network topology graph and a preset network topology graph is generated, including: processing the second global features in the network topology graph using a graph similarity calculation model to obtain a second global similarity; processing the second local features in the network topology graph using a graph similarity calculation model to obtain a second local similarity; and determining the second similarity based on the preset weights of the second local similarity, the second global similarity, the second local similarity, and the second global similarity.

[0084] Attention parameters can be set in the graph similarity model to adjust the model's focus weights on local and global features of the input image. Furthermore, during the training process of the graph similarity model, the second similarity obtained by processing the network topology graph in the test set based on the graph similarity model is compared with the similarity of the corresponding network topology graph in the test set, and the attention parameters are adjusted to ensure that the second similarity output by the graph similarity model has the highest fit with the similarity in the test set.

[0085] The second global feature includes information about all network nodes in the network topology graph. For example, the input network topology graph can be used as the second global feature.

[0086] The second local feature includes information about some network nodes in the network topology diagram, such as an image of the network topology diagram that includes some network nodes and traffic behavior information connected to those network nodes.

[0087] The convolutional layer of the graph similarity model is used to process at least one of the following in the network topology graph: node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time. This enhances the graph similarity model's perception of at least one of these factors and generates a second similarity between the network topology graph and a preset network topology graph.

[0088] By setting up a graph similarity model that can perceive at least one of node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time, and generating a second similarity based on local and global features in the network topology graph, the accuracy of similarity determination is improved.

[0089] Based on the above behavior detection method, this application also provides a behavior detection device. The following will be combined with... Figure 3 The device is described in detail.

[0090] Figure 3 A schematic block diagram of a behavior detection device according to an embodiment of this application is shown.

[0091] like Figure 3 As shown, the behavior detection device 300 of this embodiment includes an acquisition module 310, a construction module 320 and a detection module 330.

[0092] The acquisition module 310 is used to acquire network nodes within the target system and the traffic interaction behavior between network nodes during the target time period.

[0093] Module 320 is used to construct a network topology map based on network nodes within the target system. The network topology map includes information about the network nodes.

[0094] The detection module 330 is used to generate detection results based on the local feature similarity and global feature similarity of the preset network topology map and the network topology map. The local feature similarity is determined based on the local features of the preset network topology map and the local features of the network topology map. The global feature similarity is determined based on the global features of the preset network topology map and the global features of the network topology map. There is no abnormal network behavior in the target system in the preset network topology map. The detection results characterize the existence of abnormal network behavior in the target system.

[0095] According to embodiments of this application, any multiple modules among the acquisition module 310, construction module 320, and detection module 330 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the acquisition module 310, construction module 320, and detection module 330 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these. Alternatively, at least one of the acquisition module 310, construction module 320, and detection module 330 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0096] According to an embodiment of this application, the information of a network node includes at least one of node type information, network node traffic transmission direction, network node data transmission volume per unit time, and network node average response time per unit time; the first local feature is obtained in the following manner: based on the node type information, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time, vector feature information of the network node is constructed respectively; the vector feature information of the network node is combined to obtain the first local feature of the network topology graph.

[0097] According to an embodiment of this application, the detection module 330 further includes an Euclidean distance detection submodule and a model detection submodule. The Euclidean distance detection submodule is used to determine a first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph. The features of the network topology graph include a first local feature and a first global feature of the network topology graph. The model detection submodule is used to generate a second similarity between the network topology graph and the preset network topology graph based on a graph similarity calculation model and the network topology graph. The graph similarity calculation model is trained based on the features of the preset network topology graph. The first similarity and the second similarity are weighted and summed to obtain a target similarity. Wherein, if the target similarity is greater than a preset similarity threshold, the detection result is determined to represent the existence of abnormal network behavior in the target system.

[0098] According to an embodiment of this application, the features of the preset network topology graph include local features of the preset network topology graph; the Euclidean distance detection submodule determines the first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph in the following manner: based on the Euclidean distance between the first local feature and the features of multiple local feature sets, the similarity between the first local feature and the features of multiple local feature sets is determined respectively, and the features of the local feature sets are obtained by classifying them according to the Euclidean distance between the local features of the preset network topology graph; the first local similarity is obtained by weighted summation of the similarity between the first local feature and each local feature set, and the weight corresponding to the similarity between the first local feature and each local feature set is based on the proportion of the elements in the local feature sets in all elements of the preset network topology graph; the first similarity is obtained based on the first local similarity.

[0099] According to an embodiment of this application, the features of the preset network topology graph further include global features of the preset network topology graph, which are obtained based on the feature vector construction method. The Euclidean distance detection submodule obtains the first similarity based on the first local similarity in the following manner: determining the similarity between the first global feature and the features of the multiple global feature sets based on the Euclidean distance between the first global feature and the multiple global feature sets, wherein the features of the global feature sets are obtained by classifying them according to the Euclidean distance between the global features of the preset network topology graph; performing a weighted summation of the similarities between the first global feature and each global feature set to obtain the first global similarity, wherein the weights corresponding to the similarities between the first global feature and each global feature set are based on the proportion of elements in the global feature sets in all elements of the preset network topology graph; and determining the first similarity based on the first local similarity, the first global similarity, the preset weights of the first local similarity and the preset weights of the first global similarity.

[0100] According to an embodiment of this application, the graph similarity calculation model includes a convolutional layer, which is used to capture at least one of the following: node type information of the network topology graph, traffic transmission direction of network nodes, amount of data sent by network nodes per unit time, and average response time per unit time. The model detection submodule generates a second similarity between the network topology graph and a preset network topology graph based on the graph similarity calculation model and the network topology graph in the following manner: the graph similarity calculation model is used to process the second global features in the network topology graph to obtain a second global similarity, wherein the second global features include information of all network nodes in the network topology graph; the graph similarity calculation model is used to process the second local features in the network topology graph to obtain a second local similarity, wherein the second local features include information of some network nodes in the network topology graph; and the second similarity is determined based on the second local similarity, the second global similarity, the preset weights of the second local similarity and the second global similarity.

[0101] Figure 4 A block diagram schematically illustrates an electronic device suitable for implementing a behavior detection method according to an embodiment of this application.

[0102] like Figure 4As shown, an electronic device 400 according to an embodiment of this application includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage portion 408 into a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0103] RAM 403 stores various programs and data required for the operation of electronic device 400. Processor 401, ROM 402, and RAM 403 are interconnected via bus 404. Processor 401 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 402 and / or RAM 403. It should be noted that the programs may also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0104] According to embodiments of this application, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to a bus 404. The electronic device 400 may also include one or more of the following components connected to the input / output (I / O) interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 410 as needed so that computer programs read from it can be installed into the storage section 408 as needed.

[0105] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0106] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 402 and / or RAM 403 and / or one or more memories other than ROM 402 and RAM 403 described above.

[0107] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the behavior detection method provided in the embodiments of this application.

[0108] When the computer program is executed by the processor 401, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0109] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via communication section 409, and / or installed from removable medium 411. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0110] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by processor 401, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0111] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0112] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0113] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A behavior detection method, characterized in that, The method includes: Obtain network nodes within the target system, and identify traffic interaction behaviors between these network nodes during the target time period; Based on the network nodes within the target system, a network topology map is constructed, and the network topology map includes information about the network nodes. A detection result is generated based on the local feature similarity and global feature similarity between a preset network topology and the network topology. The local feature similarity is determined based on the local features of the preset network topology and the local features of the network topology. The global feature similarity is determined based on the global features of the preset network topology and the global features of the network topology. There is no abnormal network behavior in the target system within the preset network topology. The detection result characterizes the presence of abnormal network behavior within the target system.

2. The method according to claim 1, characterized in that, The generation of detection results based on the local feature similarity and global feature similarity between the preset network topology graph and the network topology graph includes: Based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph, a first similarity between the network topology graph and the preset network topology graph is determined. The features of the network topology graph include the first local features and the first global features of the network topology graph. Based on the graph similarity calculation model and the network topology graph, a second similarity between the network topology graph and the preset network topology graph is generated. The graph similarity calculation model is trained based on the features of the preset network topology graph. The first similarity and the second similarity are weighted and summed to obtain the target similarity. Wherein, if the target similarity is greater than a preset similarity threshold, the detection result is determined to indicate that there is abnormal network behavior in the target system.

3. The method according to claim 2, characterized in that, The information of the network node includes at least one of the following: node type information, network node traffic transmission direction, network node data transmission volume per unit time, and network node average response time per unit time. The first local feature is obtained in the following way: Based on the node type information, the network node traffic transmission direction, the amount of data sent by the network node per unit time, and the average response time per unit time, vector feature information of the network node is constructed respectively. The vector feature information of the network nodes is combined to obtain the first local feature of the network topology graph.

4. The method according to claim 2 or 3, characterized in that, The features of the preset network topology diagram include local features of the preset network topology diagram; The step of determining the first similarity between the network topology graph and the preset network topology graph based on the Euclidean distance between the features of the preset network topology graph and the features of the network topology graph includes: Based on the Euclidean distance between the first local feature and the features of multiple local feature sets, the similarity between the first local feature and the features of multiple local feature sets is determined respectively. The features of the local feature sets are obtained by classifying them according to the Euclidean distance between the local features of the preset network topology. The first local similarity is obtained by weighted summation of the similarities between the first local feature and each local feature set. The weights corresponding to the similarities between the first local feature and each local feature set are based on the proportion of the elements in the local feature set among all elements in the preset network topology. The first similarity is obtained based on the first local similarity.

5. The method according to claim 4, characterized in that, The features of the preset network topology graph also include the global features of the preset network topology graph, which are obtained based on the feature vector construction method; The process of obtaining the first similarity based on the first local similarity includes: Based on the Euclidean distance between the first global feature and multiple global feature sets, the similarity between the first global feature and the features of the multiple global feature sets is determined respectively. The features of the global feature sets are obtained by classifying them according to the Euclidean distance between the global features of the preset network topology. The first global similarity is obtained by weighted summation of the similarities between the first global feature and each global feature set. The weights corresponding to the similarities between the first global feature and each global feature set are based on the proportion of the elements in the global feature set among all elements in the preset network topology. The first similarity is determined based on the first local similarity, the first global similarity, the preset weight of the first local similarity, and the preset weight of the first global similarity.

6. The method according to claim 3, characterized in that, The graph similarity calculation model includes a convolutional layer, which is used to capture at least one of the following: node type information of the network topology graph, network node traffic transmission direction, network node data transmission volume per unit time, and average response time per unit time. The generation of a second similarity between the network topology graph and the preset network topology graph based on the graph similarity calculation model and the network topology graph includes: The second global feature in the network topology graph is processed using the graph similarity calculation model to obtain the second global similarity. The second global feature includes information about all network nodes in the network topology graph. The graph similarity calculation model is used to process the second local features in the network topology graph to obtain the second local similarity. The second local features include information about some network nodes in the network topology graph. The second similarity is determined based on the second local similarity, the second global similarity, the preset weight of the second local similarity, and the preset weight of the second global similarity.

7. A behavior detection device, characterized in that, The device includes: The acquisition module is used to acquire network nodes within the target system, wherein there is traffic interaction behavior between the network nodes during the target time period; A construction module is used to construct a network topology map based on network nodes within the target system, wherein the network topology map includes information about the network nodes; The detection module is used to generate detection results based on the local feature similarity and global feature similarity between the preset network topology map and the network topology map. The detection results characterize the existence of abnormal network behavior in the target system.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1-6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1-6.

Images