Deep learning-based classified carrier trajectory tracking and anomaly detection method

Abstract

The invention discloses a secret-related carrier trajectory tracking and anomaly detection method based on deep learning, and belongs to the technical field of information security, and the detection method comprises the following steps: periodically obtaining a trajectory corresponding to each secret-related carrier, comparing the trajectory with a secrecy rule in a rule base, and determining an abnormal operation; calculating to obtain a comprehensive risk level corresponding to each track, determining whether the operation corresponding to the track is an abnormal operation, and marking an abnormal operation sample and a normal operation sample; performing statistical grouping on each abnormal operation sample and each normal operation sample according to the type of the confidential carrier, and updating the confidentiality rule in the rule base based on a comparison result; according to the method, a novel attack track is automatically identified by analyzing the similarity between the abnormal operation sample and the confidentiality rule, and the rule base is dynamically evolved based on the output target expansion or newly added rule, so that the protection coverage range and adaptability of the system are continuously improved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically, it relates to a method for tracking and detecting anomalies in classified carriers based on deep learning. Background Technology

[0002] In the security protection of classified information systems (such as those in the military, aerospace, and core government departments), abnormal operation detection and risk warning are core aspects of preventing data leakage. Currently, the widely adopted technical solution in this field is the traditional system of "static rule base + manual auditing + single-dimensional behavior analysis". Its typical architecture includes: a rule engine module that stores hundreds of fixed detection rules, a log collection module that only collects user operation logs, and a manual auditing terminal that relies on security administrators to manually review and handle anomalies.

[0003] However, after in-depth analysis, the existing technical solutions have the following four core flaws: Anomaly detection relies on static rule bases, resulting in extremely high false negative rates for unknown attacks and gradual anomalies. Rule bases can only identify known attack patterns and cannot handle zero-day exploits, AI-generated spoofing commands, or gradual anomalies that steal data through multiple minor compliance operations. Statistics show that traditional systems have a false negative rate of up to 43.2% for unknown attacks.

[0004] Risk assessment is limited to a single dimension, making it prone to misjudgments and omissions. Traditional systems rely solely on user behavior for judgment, neglecting crucial dimensions such as device status (e.g., whether malicious firmware has been implanted), physical environment (e.g., unauthorized personnel approaching), and data flow. This leads to complete failure in complex risk scenarios such as "device hijacked but user behavior is normal."

[0005] The early warning response is delayed and isolated, requiring manual closure from detection to completion, which takes an average of several hours. Due to the lack of an automated linkage mechanism, the detection module and the terminal control module are physically isolated, making real-time blocking impossible, which leads to data theft during manual review.

[0006] Lacking adaptive learning capabilities and with long rule base update cycles (typically ≥3 months), the system is unable to cope with rapidly evolving new attack methods. The coverage of static rule bases has fallen below 37%, making it difficult to defend against AI-driven dynamic threats. In summary, the existing technology, based on an architecture of "deterministic rules + single-dimensional data + manual closed-loop," can no longer meet the core requirements of classified scenarios for "dynamic detection, correlated assessment, and real-time response." Summary of the Invention

[0007] The present application aims to provide a deep learning-based secret-involved carrier track tracking and anomaly detection method, which solves the problem that the existing technology based on the architecture of "deterministic rules + single-dimensional data + artificial closed loop" cannot meet the core needs of "dynamic detection, correlation evaluation and real-time response" in the secret-involved scene.

[0008] The object of the present application can be achieved by the following technical solutions: The deep learning-based secret-involved carrier track tracking and anomaly detection method comprises the following steps: S1: periodically acquiring operation logs of each secret-involved carrier to obtain the corresponding track of each secret-involved carrier, and comparing the track with the security rules in the rule library, when the track does not conform to the security rules, considering that the corresponding operation is an abnormal operation; S2: calculating the comprehensive risk level corresponding to each track, and determining whether the track corresponding operation is an abnormal operation, and marking the abnormal operation sample and the normal operation sample; S3: according to the type of the secret-involved carrier, statistically grouping each abnormal operation sample and normal operation sample, and updating the security rules in the rule library based on the comparison result; The method for updating the security rules in the rule library is: Comparing a group of abnormal operation samples corresponding to a type of secret-involved carrier with each security rule in the rule library to calculate the similarity; When the similarity between the abnormal operation sample and any security rule is greater than a preset threshold, it is marked as an analyzable sample, and the corresponding contrast security rule is obtained, if the similarity with all security rules is not greater than the threshold, the sample is marked as an unanalyzable sample; Pick up the different parts of the analyzable sample from the contrast security rule as the different segments, and count the types and quantities of the different segments; Analyze the output target of each type of different segment, if there is a part of the output target same as the contrast security rule, expand the corresponding part in the contrast security rule, if not, take the analyzable sample as a new security rule, and after statistical and deduplication of the unanalyzable sample, take it as a new security rule in the rule library.

[0009] As a further scheme of the present application, the expansion of the corresponding part in the contrast security rule comprises at least one of the following ways: Adding one or more replaceable track paths with the same output target but different specific operation process in the corresponding track part of the contrast security rule; Using a general output target description to directly replace the specific operation process track part in the contrast security rule.

[0010] As a further scheme of the present application, step S3 further comprises: performing semantic recognition analysis on the unanalyzable sample to identify the key stages in the operation process and the output targets thereof; Using the identified output targets, the partial trajectories in the sample operation process are replaced in a summarized manner; The unanalyzable sample after the replacement processing is de-duplicated, and the de-duplicated result is added to the rule library as a new security rule.

[0011] As a further scheme of the present application, the method for calculating the comprehensive risk level corresponding to each trajectory is: Synchronously collecting four types of heterogeneous data of user behavior, device state, physical environment and data flow through a multi-source data acquisition terminal; Aligning the four types of heterogeneous data in time and space using a timestamp, and extracting a fusion feature vector; Inputting the fusion feature vector into a deep learning model to perform anomaly detection and output an anomaly probability; Based on D-S evidence theory, fusing risk indicators in four dimensions of user behavior, device state, physical environment and data flow, calculating and outputting a comprehensive risk level of 0-10 points.

[0012] As a further scheme of the present application, the method further comprises: triggering a hierarchical response strategy according to the comprehensive risk level, automatically performing a hardware-level physical blocking when the risk level is ≥ 6 points; and storing the anomaly detection log, risk assessment report and disposal record through a consortium chain in a non-tamperable manner.

[0013] As a further scheme of the present application, the hardware-level physical blocking comprises: performing a power-off operation through a USB port controller; Performing a laser shutdown operation through a network optical module to cut off the physical network link; Freezing the keyboard, mouse and screen by sending an instruction to the terminal mainboard BIOS.

[0014] As a further scheme of the present application, the method is implemented through a deep learning-based secret-related carrier trajectory tracking and anomaly detection system, which comprises: A multi-source data acquisition terminal deployed on a secret-related terminal for collecting raw data; A multi-source data preprocessing module for cleaning, feature extraction and spatio-temporal alignment of the collected raw data; An AI anomaly detection module using an improved hybrid model of Transformer and graph neural network for detecting anomalies in user operation sequences; A multi-dimensional risk assessment module based on D-S evidence theory to fuse multi-dimensional indicators and quantitatively output a comprehensive risk level; A dynamic early warning response module executes a hierarchical response strategy according to the comprehensive risk level; A blockchain storage module is configured to store all abnormal logs, evaluation reports and disposal records.

[0015] As a further scheme of the application, the blockchain storage module is composed of a plurality of supervision nodes and execution nodes to form a consortium chain, and adopts a PBFT consensus algorithm.

[0016] The application has the following beneficial effects: The application automatically identifies new attack trajectories by analyzing the similarity between abnormal operation samples and security rules, and dynamically evolves the rule library based on the output target expansion or new rules, so as to continuously improve the system protection coverage and adaptability. The system is suitable for various types of classified information carriers, and realizes full-process security monitoring from data collection to response storage through closed-loop management, thereby meeting the needs of high-security-level classified information environments.

[0017] The application integrates behavior, environment and device state sensors through a multi-source data collection terminal, and combines a daisy chain topology and optical fiber transmission to ensure the comprehensiveness, real-time performance and reliability of data collection. The preprocessing module adopts advanced technologies such as LSTM automatic encoder and Fourier transform to realize efficient feature extraction and nanosecond-level time and space alignment, thereby providing a high-quality data basis for subsequent analysis. The self-attention mechanism is also used to capture long-term temporal dependencies, and the graph neural network is used to model entity associations, thereby effectively identifying complex attack patterns. In combination with contrast learning and dynamic threshold adjustment, the detection sensitivity to gradual abnormalities is significantly improved, and the false positive rate is reduced.

[0018] Based on the D-S evidence theory and AHP weight distribution, the application quantifies the output comprehensive risk level, and the evaluation result is more objective and comprehensive. The dynamic early warning response module executes a hierarchical response strategy, from log recording to physical blocking, with a short response time to ensure fast disposal of security incidents. The blockchain storage module adopts a consortium chain and an improved PBFT consensus to ensure that all logs, reports and records are tamper-proof, thereby enhancing the system audit and traceability capabilities. BRIEF DESCRIPTION OF DRAWINGS

[0019] The application will be further described below with reference to the accompanying drawings.

[0020] Figure 1 FIG. 1 is a flowchart of a classified information carrier trajectory tracking and abnormality detection method based on deep learning according to the application; Figure 2 FIG. 2 is a schematic diagram of the framework structure of a classified information carrier trajectory tracking and abnormality detection system based on deep learning according to the application. DETAILED DESCRIPTION

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Example 1 A deep learning-based system for tracking the trajectory and detecting anomalies of classified carriers, such as... Figure 2 As shown, it includes: Multi-source data acquisition terminals, deployed in classified terminals, are used to collect raw data; The multi-source data acquisition terminal includes behavioral acquisition sensors such as a keyboard logger, a mouse trajectory capture device, and a screen operation recording unit. Infrared intrusion detectors, temperature and humidity sensors, electromagnetic radiation monitors, and other environmental sensing sensors; and Device status monitoring sensors such as BIOS log acquisition chips, hard drive SMART readers, and memory abnormal access detectors; After each sensor is connected to the local data aggregation unit via a daisy-chain topology, the data is transmitted to the AI ​​anomaly detection module via optical fiber.

[0023] The multi-source data preprocessing module is used to clean, extract features, and spatiotemporally align the collected raw data. It utilizes an LSTM autoencoder to convert the keyboard input sequence into a 128-dimensional behavioral feature vector, employs Fourier transform to extract mouse trajectory features, and precisely aligns the user operation, environmental parameters, and device status data based on BeiDou timestamps with an accuracy ≤10ns.

[0024] AI anomaly detection module: Employs an improved hybrid model combining Transformer and Graph Neural Network (GNN); This improved Transformer+GNN hybrid deep learning model adopts the architecture described in the software copyright registration number 2025SR0376482. It captures long-range dependencies in user operation sequences through a self-attention masking mechanism and constructs a device-user-environment relationship graph using a graph neural network. The model input layer receives preprocessed behavioral feature vectors, environmental feature vectors, and device state vectors. After multi-head attention layers calculate feature correlations, cross-dimensional feature fusion is achieved through graph convolutional layers. During the training phase, a contrastive learning strategy is adopted to forcibly separate normal behavior samples from abnormal samples in the latent space, thereby improving the model's sensitivity to detecting gradual anomalies. During the inference phase, a dynamic threshold adjustment mechanism is used to automatically adapt the detection strictness according to the confidentiality level, thereby improving the anomaly detection rate and reducing the false alarm rate.

[0025] Specifically: Among them: the Transformer layer captures the long-term dependence of user operations through the self-attention mask mechanism (supports more than 100 steps of sequence); GNN layer: model users, devices, and documents as graph nodes, dynamically represent the interaction frequency between entities through edge weights, and identify abnormal associations such as "low-privilege users frequently access high-security-level documents".

[0026] Dynamic threshold adjuster: based on reinforcement learning (DQN algorithm), dynamically optimize the classification threshold every 24 hours according to the real-time false positive rate.

[0027] Multi-dimensional risk assessment module: based on D-S evidence theory, integrating 8 indicators in four categories: user dimension (behavior deviation, qualification matching degree), device dimension (firmware integrity, process anomaly degree), environment dimension (space intrusion, electromagnetic anomaly), and data dimension (flow compliance, encryption status), quantifying the output of comprehensive risk level 0-10 points, and the weight of each dimension indicator is determined by AHP hierarchical analysis method.

[0028] Specifically: the specific steps of calculating the comprehensive risk level include: calculating the behavior deviation of the user dimension, which is the cosine distance between the current behavior feature vector and the historical behavior baseline; Calculating the firmware integrity of the device dimension, which is the comparison result of the current BIOS hash value of the terminal and the reference hash library; Calculate the space intrusion risk of the environment dimension, which is the number of infrared intrusion detector triggers within a set time; Calculate the flow compliance of the data dimension, which is whether the data export target address is located in the preset whitelist; Then use D-S evidence theory to fuse the risk values of the above indicators through the belief function to output the comprehensive risk value.

[0029] Dynamic early warning response module: execute hierarchical response strategy according to the comprehensive risk level: Low risk (0-3 points): only generate normal operation logs and chain storage.

[0030] Medium risk (3-6 points): push the alarm work order to the administrator, and start the sound and light alarm.

[0031] High risk (6-10 points): automatically execute physical blocking, and record the disposal in real time; The physical blocking is performed by the USB port controller to perform power-off operation, with a response time <0.5 seconds; Through the network optical module to perform laser shutdown operation to cut off the physical network link; Send instructions to the terminal motherboard BIOS to freeze the keyboard, mouse, and screen.

[0032] The trajectory tracking and anomaly detection algorithm further comprises a blockchain storage module, which is composed of a plurality of supervision nodes and execution nodes to form a consortium chain, adopts a PBFT consensus algorithm, and stores all abnormal logs, evaluation reports and disposal records.

[0033] Embodiment 2 A deep learning-based secret-involved carrier trajectory tracking and anomaly detection method, as shown in Figure 1 The method comprises the following steps: S1, periodically acquiring operation logs of each secret-involved carrier to obtain trajectories corresponding to each secret-involved carrier; The trajectory refers to a complete operation data of an account for a secret-involved carrier, such as login-copy-transmission, which is a complete trajectory; Compare each trajectory with each security rule in the rule library. When a trajectory does not meet the requirements of each security rule in the rule library, it is considered that the corresponding operation of the trajectory is an abnormal operation; S2, obtaining the comprehensive risk level of each secret-involved carrier through the trajectory tracking and anomaly detection system described above; The specific acquisition method is: Synchronize the collection of four types of heterogeneous data of user behavior, device status, physical environment and data flow through a multi-source data collection terminal; Align the four types of heterogeneous data in space and time using a Beidou timestamp, and extract a 128-dimensional fusion feature vector; Input the fusion feature vector into a hybrid deep learning model of an improved Transformer and GNN for anomaly detection, and output an anomaly probability; Based on D-S evidence theory, fuse the risk indicators of four dimensions of users, devices, environments and data, calculate and output a comprehensive risk level of 0-10 points; Trigger the hierarchical response strategy according to the comprehensive risk level. When the risk level is ≥6 points, automatically execute the hardware-level physical blocking; Store the anomaly detection logs, risk evaluation reports and disposal records through the consortium chain in a non-tamperable manner.

[0034] Then, the dynamic early warning response module executes the hierarchical response strategy according to the comprehensive risk level of each trajectory, and finally determines whether the corresponding operation of each trajectory is an abnormal operation. Mark the trajectories whose corresponding operations are determined to be abnormal operations as abnormal operation samples, and mark the trajectories whose corresponding operations are determined to be normal operations as normal operation samples. S3, according to the type of the corresponding secret-involved carrier, statistically grouping each abnormal operation sample and normal operation sample; That is, each type of classified carrier corresponds to a set of abnormal operation samples and a set of normal operation samples; The type of the classified carrier refers to the file format type of the classified carrier, including pictures, documents, videos, audio, etc. Take one type of classified carrier as an example, compare its corresponding set of abnormal operation samples with each security rule in the rule base, and the comparison method is: Compare each abnormal operation sample with each security rule in the rule base in turn, and calculate the similarity between them. When the similarity between the abnormal operation sample and any security rule is greater than the preset threshold, the abnormal operation sample is marked as an analyzable sample; When the similarity between the abnormal operation sample and any security rule is not greater than the preset threshold, the abnormal operation sample is marked as an unanalyzable sample; Get all security rules corresponding to the analyzable sample whose similarity is greater than the preset threshold, and mark these security rules as the control security rules corresponding to the analyzable sample; Compare the analyzable sample with its control security rules, and pick up the different part of the analyzable sample from its control security rules. In order to facilitate description, the different part is recorded as a different section. Then, according to this method, get all different sections corresponding to one type of classified carrier, and count the types of different sections corresponding to one type of classified carrier and the number of different sections of each type; Analyze the output target of each type of different section, then get the part of the control security rule that has the output target, and if a type of different section has the same part as the control security rule, expand the corresponding part of the control security rule. For example: The security rule is: login→copy→external transmission=abnormal; A new type of attack process is found: login→view→screenshot→OCR recognition→fragmented external transmission; Therefore, the security rule can be modified as: login→(copy / view→screenshot→OCR recognition)→external transmission=abnormal; For example, replace one track part in the security rule with the output target, for example: The security rule is: login→copy→external transmission=abnormal; A new type of attack process is found: login→view→screenshot→OCR recognition→fragmented external transmission; Therefore, the security rule can be modified as: login→text information acquisition→external transmission=abnormal; That is, the specific operation process is replaced by using the output target "acquisition of text information", thereby expanding the coverage of a security rule.

[0035] If a category distinguishing section does not have the same part as the output target of the control security rule, the security rule in the rule library is expanded, and the analyzable sample corresponding to the category distinguishing section is taken as a new security rule in the rule library.

[0036] Embodiment 3 On the basis of Embodiment 1 and Embodiment 2, the unanalyzable samples corresponding to one type of classified carrier are counted, and after deduplication, the unanalyzable samples are taken as new security rules in the rule library, or according to the analysis mode of the analyzable samples, through semantic recognition, the output target is used to replace part of the track in each analyzable sample, then deduplication processing is performed, and then the processed unanalyzable samples are taken as new security rules in the rule library.

[0037] The above is only an example and description of the present application, and those skilled in the art can make various modifications or supplements to the described specific embodiments or use similar ways to replace, as long as the modifications or supplements do not deviate from the invention or exceed the scope defined by the present claims, and should belong to the protection scope of the present application.

Claims

1. A method for tracking and detecting abnormality of a secret-containing carrier trajectory based on deep learning, characterized in that, Comprise the following steps: S1: periodically acquire the operation log of each secret-related carrier, obtain the corresponding trajectory of each secret-related carrier, and compare the trajectory with the security rules in the rule library. When the trajectory does not comply with the security rules, the corresponding operation is considered to be an abnormal operation; S2: calculate the comprehensive risk level corresponding to each trajectory, and determine whether the operation corresponding to the trajectory is an abnormal operation, and mark the abnormal operation samples and normal operation samples; S3: according to the type of the secret-related carrier, statistically group each abnormal operation sample and normal operation sample, and update the security rules in the rule library based on the comparison result; The method for updating the security rules in the rule library is: Compare a group of abnormal operation samples corresponding to a type of secret-related carrier with each security rule in the rule library, and calculate the similarity; When the similarity between the abnormal operation sample and any security rule is greater than a preset threshold, it is marked as an analyzable sample, and the corresponding control security rule is obtained. If the similarity with all security rules is not less than the threshold, the sample is marked as an unanalyzable sample; Pick up the different parts of the analyzable sample from the control security rule as the different segments, and count the types and quantities of the different segments; Analyze the output target of each type of different segment. If there is a part that is the same as the output target of the control security rule, the corresponding part in the control security rule is expanded. If not, the analyzable sample is used as a new security rule. After the unanalyzable sample is counted and de-duplicated, it is used as a new security rule in the rule library.

2. The deep learning-based method for tracking and detecting abnormality of a secret-carrying carrier according to claim 1, wherein, The expansion of the corresponding part in the control security rule includes at least one of the following ways: Add one or more replaceable trajectory paths with the same output target but different specific operation processes to the corresponding trajectory part of the control security rule; Use a general output target description to directly replace the specific operation process trajectory part in the control security rule.

3. The deep learning-based method for tracking and detecting abnormality of a secret-carrying carrier according to claim 2, characterized in that, In step S3, the unanalyzable sample is also subjected to semantic recognition analysis to identify the key stages in the operation process and their output targets; Use the identified output target to replace part of the trajectory in the sample operation process; The unanalyzable sample after replacement processing is de-duplicated, and the de-duplicated result is added to the rule library as a new security rule.

4. The deep learning-based method for tracking and detecting abnormality of a secret-carrying carrier according to claim 1, wherein, The method for calculating the comprehensive risk level corresponding to each trajectory is: Synchronize the collection of four types of heterogeneous data including user behavior, device state, physical environment and data flow through a multi-source data collection terminal; Align the four types of heterogeneous data in time and space using timestamps, and extract and generate a fusion feature vector; Input the fusion feature vector into a deep learning model for anomaly detection, and output an anomaly probability; Based on D-S evidence theory, fuse the risk indicators in four dimensions of user behavior, device state, physical environment and data flow, calculate and output a comprehensive risk level of 0-10 points.

5. The deep learning-based secret-carrying carrier track tracking and anomaly detection method according to claim 4, characterized in that, Further comprising: Trigger a hierarchical response strategy according to the comprehensive risk level. When the risk level is greater than or equal to 6 points, automatically execute a hardware-level physical block; Store the anomaly detection log, risk assessment report and disposal record through a consortium chain to make it tamper-proof.

6. The deep learning-based method for tracking and detecting abnormality of a secret-carrying carrier according to claim 5, wherein, The hardware-level physical blocking includes: performing a power-off operation through a USB port controller; Performing a laser shutdown operation through a network optical module to cut off the physical network link; By sending instructions to the terminal motherboard BIOS, freeze the keyboard, mouse and screen.

7. The deep learning-based method for tracking and anomaly detection of secret-carrying carrier trajectories according to any one of claims 4-6, characterized in that, The method is realized by a deep learning-based secret-involved carrier trajectory tracking and anomaly detection system, which includes: A multi-source data acquisition terminal is deployed on a secret-involved terminal to collect raw data; A multi-source data preprocessing module is used to clean, feature extract and spatio-temporal align the collected raw data; An AI anomaly detection module uses an improved hybrid model of Transformer and graph neural network to detect anomalies in user operation sequences; A multi-dimensional risk assessment module fuses multi-dimensional indicators based on D-S evidence theory to quantitatively output a comprehensive risk level; A dynamic early warning response module executes a graded response strategy according to the comprehensive risk level; A blockchain storage module is used to store all anomaly logs, assessment reports and disposal records.

8. The deep learning-based secret-involved carrier trajectory tracking and anomaly detection method according to claim 7, wherein the blockchain storage module constitutes a consortium chain by a plurality of supervision nodes and execution nodes, and adopts a PBFT consensus algorithm.

Images