Method and device for detecting abnormal operation behavior of software system and medium

Abstract

The invention discloses a method and equipment for detecting an abnormal operation behavior of a software system and a medium, and relates to the technical field of data processing. The method comprises the following steps: collecting a historical operation log from a target software system, and preprocessing the historical operation log; semantic features, time sequence features and statistical features are extracted from the preprocessed historical operation logs to be spliced, and training feature samples are obtained; inputting the samples with normal operation behaviors and no labels into a pre-training large language model to execute self-supervised training, and executing supervised fine tuning on the pre-training large language model through the samples with normal operation behavior labels and the samples with abnormal operation behavior labels to obtain a trained large language model; and detecting whether an operation behavior is normal or not on an operation log generated by the target software system in real time based on the trained large language model to obtain a target detection result. Therefore, accurate abnormal operation behavior detection of the target software system is realized.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, device and medium for detecting abnormal operating behavior of a software system. Background Technology

[0002] With the acceleration of enterprise digital transformation, software systems, as core business carriers, are experiencing an exponential increase in their attack surface, facing increasingly severe security threats. The main forms of security threats to software systems include account theft, data scraping, fraudulent transactions, and internal privilege escalation. Current methods for detecting abnormal user behavior in software systems using user operation logs include: Rule-based methods rely on predefined strategies based on expert experience. While intuitive, they are rigid and outdated, struggling to adapt to novel, complex, low-frequency, slow, or combined attack patterns. Furthermore, the rule base is cumbersome to maintain, resulting in high false negative and false positive rates. To address these issues, a traditional machine learning-based approach is proposed. While partially automated, its effectiveness heavily depends on manual feature engineering. Feature extraction is not only labor-intensive but also fails to deeply capture implicit information such as temporal relationships, behavioral intent, and contextual semantics within log data, leading to limited model generalization capabilities.

[0003] Therefore, providing a method for detecting abnormal operating behaviors of software systems and achieving relatively accurate detection of abnormal operating behaviors of software systems is an urgent problem to be solved. Summary of the Invention

[0004] This application provides a method, device, and medium for detecting abnormal operation behavior of a software system, with the main purpose of achieving relatively accurate detection of abnormal operation behavior of a software system.

[0005] In a first aspect, embodiments of this application provide a method for detecting abnormal operation behavior of a software system, the method comprising: collecting historical operation logs from a target software system and preprocessing the historical operation logs; Semantic features, temporal features, and statistical features are extracted from the preprocessed historical operation logs, and the semantic features, temporal features, and statistical features are concatenated to obtain training feature samples. Samples with normal but unlabeled operation behavior are input into a pre-trained large language model for self-supervised training. The pre-trained large language model is then fine-tuned using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model. The samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples. Based on the trained large language model, the operation logs generated in real time by the target software system are used to detect whether the operation behavior is normal or not, and the target detection result is obtained.

[0006] In one implementation of this application, the extraction of semantic features, temporal features, and statistical features from the preprocessed historical operation log includes: Each historical operation log in the preprocessed historical operation log is input into the preset model to obtain semantic features represented by dense vectors; Arrange the historical operation logs belonging to the same user session in the preprocessed historical operation logs in chronological order to obtain the temporal features corresponding to the user operation behavior sequence. Calculate the statistical characteristics of each user session in the preprocessed historical operation log. The statistical characteristics include the frequency of occurrence of the target-specific operation, the failure rate of the target-specific operation, and the number of target resources accessed.

[0007] In one implementation of this application, the preprocessing of the historical operation log includes: Extract the key fields of each historical operation log, including timestamp, user ID, operation category, operation object, result status, IP address, device fingerprint, and session ID; Each historical operation log is aggregated based on the user ID or the session ID to obtain the user operation behavior sequence corresponding to each user session; The text-type key fields of each historical operation log in each of the user operation behavior sequences are converted into numerical vectors to obtain the preprocessed historical operation logs.

[0008] In one implementation of this application, the self-supervised training includes: a masked language model training task and a next sentence prediction task.

[0009] In one implementation of this application, when the trained large language model generates anomaly judgment results, the target detection results include the judgment results of whether the operation behavior is abnormal and the judgment analysis process.

[0010] In one implementation of this application, when the trained large language model generates anomaly scores, the anomaly score is calculated based on the target detection result using a classifier or anomaly detection algorithm to obtain the target anomaly score, wherein the target detection result includes a sequence representation vector.

[0011] In one implementation of this application, after obtaining the target anomaly score, the method includes: Determine whether the target anomaly score exceeds the anomaly threshold; If the limit is exceeded, a security alert will be generated and the security operations and maintenance personnel will be notified.

[0012] In one implementation of this application, the method includes: Obtain feedback data from the security operations and maintenance personnel regarding the handling of the security alarms; The training feature samples are updated based on the feedback data, and the trained large language model is continuously iterated and optimized based on the updated training feature samples to dynamically improve performance.

[0013] Secondly, embodiments of this application also provide a detection device for abnormal operation behavior of a software system. The device includes: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed, enable the at least one processor to: collect historical operation logs from the target software system and preprocess the historical operation logs; extract semantic features, temporal features, and statistical features from the preprocessed historical operation logs, and concatenate the semantic features, temporal features, and statistical features to obtain training feature samples; input samples with normal but unlabeled operation behavior into a pre-trained large language model for self-supervised training, and perform supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model. The samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples; and detect whether the operation behavior is normal or not based on the real-time operation logs generated by the target software system using the trained large language model to obtain a target detection result.

[0014] Thirdly, embodiments of this application also provide a non-volatile computer storage medium for detecting abnormal operation behavior of a software system, storing computer-executable instructions. These computer-executable instructions are configured to: collect historical operation logs from the target software system and preprocess the historical operation logs; extract semantic features, temporal features, and statistical features from the preprocessed historical operation logs, and concatenate the semantic features, temporal features, and statistical features to obtain training feature samples; input samples with normal but unlabeled operation behavior into a pre-trained large language model for self-supervised training, and perform supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model. The samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples; and detect whether the operation behavior is normal or not based on the real-time operation logs generated by the target software system using the trained large language model to obtain a target detection result.

[0015] This application provides a method, device, and medium for detecting abnormal operation behavior in a software system, comprising: collecting historical operation logs from a target software system and preprocessing the historical operation logs; extracting semantic features, temporal features, and statistical features from the preprocessed historical operation logs, and concatenating the semantic features, temporal features, and statistical features to obtain training feature samples; inputting samples with normal but unlabeled operation behavior into a pre-trained large language model for self-supervised training, and performing supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model, wherein the samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples; and detecting whether the operation behavior is normal or not based on the operation logs generated in real time by the target software system using the trained large language model to obtain a target detection result. It has the following beneficial effects: After splicing multiple features into training feature samples, the training samples are divided. The pre-trained large language model is then trained and fine-tuned using the divided training samples. This enables deep capture of implicit information such as temporal correlation, behavioral intent, and contextual semantics hidden in log data. Based on the trained large language model, it detects whether the operation behavior is abnormal, thereby achieving relatively accurate detection of abnormal operation behavior of the target software system. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating a method for detecting abnormal operational behavior of a software system, provided in an embodiment of this application; Figure 2 This is a schematic diagram of the internal structure of a software system abnormal operation detection device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] To facilitate understanding of the following embodiments of this application, the embodiments of this application provide some conceptual explanations and definitions, including: Historical operation logs refer to semi-structured data records that are automatically recorded by user behavior during the operation of the software system and are arranged in chronological order. Each record typically includes, but is not limited to, fields such as timestamp, user identifier, operation type, operation object, source IP address, device information, and operation result status. These logs are the original data sources for analysis and model training in this invention. Behavioral baselines refer to a reference model or data distribution that represents the normal behavioral patterns of a specific user or user group, constructed by learning from historical or real-time user operation logs using a large model. Any behavioral sequence that significantly deviates from this baseline will be identified as an anomaly. This baseline is dynamically updated to adapt to changes in behavioral patterns. Numerical vectors are a type of semantic vector representation, referring to the process and result of transforming textual information (such as operation type, operation object) or the entire log sequence in historical user operation logs into high-dimensional, dense numerical vectors through a large model. This vector contains deep semantic information about the operation and its contextual relationships, and is the core feature for pattern calculation and anomaly determination in this invention.

[0019] This application provides a method, device, and medium for detecting abnormal operation behavior of a software system, in order to solve the following technical problem: how to achieve relatively accurate detection of abnormal operation behavior of a software system.

[0020] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0021] Figure 1 This is a flowchart illustrating a method for detecting abnormal operational behavior in a software system, as provided in an embodiment of this application. Figure 1 As shown in the figure, the method for detecting abnormal operation behavior of a software system provided in this application embodiment specifically includes the following steps: Step 101: Collect historical operation logs from the target software system and preprocess the historical operation logs.

[0022] As a refinement of the above embodiments, the target software system includes, but is not limited to, web applications, apps, servers, etc., and the collection method of the historical operation logs includes, but is not limited to, real-time collection or offline collection.

[0023] Step 102: Extract semantic features, temporal features, and statistical features from the preprocessed historical operation log, and concatenate the semantic features, temporal features, and statistical features to obtain training feature samples.

[0024] Step 103: Input samples with normal but unlabeled operation behavior into the pre-trained large language model to perform self-supervised training, and perform supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain the trained large language model. The samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples.

[0025] As a refinement of the above embodiments, the pre-trained large language model is a large language model that has already been trained for basic abnormal operation behavior recognition. The pre-trained large language model is then subjected to self-supervised training and fine-tuning using training feature samples generated by the target software system. This makes the trained large language model more adaptable to detecting abnormal operation behaviors of the target software system and more capable of capturing implicit information such as temporal correlations, behavioral intent, and contextual semantics hidden in log data. Fine-tuning the pre-trained large language model requires only a small number of samples labeled with normal operation behaviors and a small number of samples labeled with abnormal operation behaviors, reducing the amount of data labeling and improving training efficiency.

[0026] Step 104: Based on the trained large language model, detect whether the operation behavior of the operation log generated in real time by the target software system is normal or not, and obtain the target detection result.

[0027] This application provides a method for detecting abnormal operation behavior in a software system, comprising: collecting historical operation logs from a target software system and preprocessing the historical operation logs; extracting semantic features, temporal features, and statistical features from the preprocessed historical operation logs, and concatenating the semantic features, temporal features, and statistical features to obtain training feature samples; inputting samples with normal but unlabeled operation behavior into a pre-trained large language model for self-supervised training, and performing supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model, wherein the samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples; and detecting whether the operation behavior is normal or not based on the operation logs generated in real time by the target software system using the trained large language model to obtain a target detection result. It has the following beneficial effects: After splicing multiple features into training feature samples, the training samples are divided. The pre-trained large language model is then trained and fine-tuned using the divided training samples. This enables deep capture of implicit information such as temporal correlation, behavioral intent, and contextual semantics hidden in log data. Based on the trained large language model, it detects whether the operation behavior is abnormal, thereby achieving relatively accurate detection of abnormal operation behavior of the target software system.

[0028] As a refinement of the embodiments of this application, when performing step 102 to extract semantic features, temporal features, and statistical features from the preprocessed historical operation logs, the following implementation methods may also be adopted, but are not limited to: inputting each historical operation log in the preprocessed historical operation log into a preset model to obtain semantic features represented by dense vectors; arranging each historical operation log belonging to the same user session in the preprocessed historical operation log in chronological order to obtain temporal features corresponding to the user operation behavior sequence; calculating the statistical features of each user session in the preprocessed historical operation log, wherein the statistical features include the frequency of occurrence of a target-specific operation, the failure rate of the target-specific operation, and the number of target resources accessed.

[0029] In some embodiments, the semantic features can be obtained by inputting a short log sequence into the preset model, which is a type of large language model, including but not limited to BERT, LogBERT, etc. The preset model and the pre-trained large language model can be the same model or separately configured models, and the types of models used may be the same or different.

[0030] As a refinement of the above embodiments, when performing the preprocessing of the historical operation logs in step 101, the following implementation methods may also be adopted, but are not limited to: extracting key fields of each historical operation log, the key fields including timestamp, user ID, operation category, operation object, result status, IP address, device fingerprint, and session ID; aggregating each historical operation log based on the user ID or the session ID to obtain the user operation behavior sequence corresponding to each user session; converting the text-type key fields of each historical operation log in each user operation behavior sequence into numerical vectors to obtain the preprocessed historical operation logs.

[0031] In some embodiments, the text-type key fields include, for example, operation category, operation object, etc.

[0032] As a refinement of the above embodiments, the self-supervised training includes: a masked language model training task and a next-sentence prediction task. The masked language model training task is implemented by randomly masking a portion of the words in the input text (e.g., 15% of the tokens), requiring the model to predict the masked words based on the context. The next-sentence prediction task is implemented by determining whether two given sentences (Sentence A and Sentence B) have a continuous contextual relationship.

[0033] As a refinement of the above embodiments, when the trained large language model generates anomaly judgment results, the target detection results include the judgment results of whether the operation behavior is abnormal and the judgment analysis process. (e.g., "The user logged in from three different IPs within one minute, which is abnormal behavior").

[0034] As a refinement of the above embodiments, if the trained large language model generates anomaly scores, then the anomaly score is calculated based on the classifier or anomaly detection algorithm on the target detection result to obtain the target anomaly score, wherein the target detection result includes a sequence representation vector.

[0035] As a refinement of the above embodiments, after obtaining the target anomaly score, the method may also adopt, but is not limited to, the following implementation methods, for example: determining whether the target anomaly score exceeds an anomaly threshold; if it exceeds, generating a security alarm and notifying security operations personnel.

[0036] As a refinement of the above embodiments, the method may also adopt, but is not limited to, the following implementation methods, for example: obtaining feedback data from the security operations and maintenance personnel on the security alarm processing; updating the training feature samples based on the feedback data; and continuously iteratively optimizing the trained large language model based on the updated training feature samples to dynamically improve performance.

[0037] In summary, the embodiments of this application can achieve the following effects, including: 1. After concatenating multiple features into training feature samples, the training samples are divided. The pre-trained large language model is then trained under self-supervised supervision and under-supervised fine-tuning using the divided training samples. This enables deep capture of implicit information such as temporal correlations, behavioral intentions, and contextual semantics hidden in log data. Based on the trained large language model, abnormal operation behavior is detected, thereby achieving relatively accurate detection of abnormal operation behavior in the target software system.

[0038] 2. By performing self-supervised training on the pre-trained language model using normal but unlabeled samples, the model can learn general patterns in traffic data (such as the temporal regularity of normal operational behavior and the dependencies between protocol fields). These features are also sensitive to unknown abnormal operations. Using normal but unlabeled samples reduces the dependence on known threats, making it suitable for zero-shot scenarios. Subsequently, fine-tuning with a small amount of labeled data allows it to adapt to the detection of novel abnormal operational behaviors. This enables the trained large language model to recognize unknown and never-before-seen attack methods and abnormal patterns.

[0039] The above are embodiments of the method proposed in this application. Based on the same inventive concept, embodiments of this application also provide a detection device for abnormal operation behavior of a software system, the structure of which is as follows: Figure 2 As shown.

[0040] Figure 2 This is a schematic diagram of the internal structure of a software system abnormal operation detection device provided in an embodiment of this application. Figure 2 As shown, the device includes: At least one processor 201; And a memory 202 that is communicatively connected to at least one processor; The memory 202 stores instructions executable by at least one processor. These instructions are executed by at least one processor 201 to enable the processor 201 to: collect historical operation logs from the target software system and preprocess the historical operation logs; extract semantic features, temporal features, and statistical features from the preprocessed historical operation logs, and concatenate the semantic features, temporal features, and statistical features to obtain training feature samples; input samples with normal but unlabeled operation behavior into a pre-trained large language model for self-supervised training, and perform supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model, wherein the samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples; and detect whether the operation behavior is normal or not based on the operation logs generated in real time by the target software system using the trained large language model to obtain target detection results.

[0041] Some embodiments of this application provide corresponding to Figure 1 A non-volatile computer storage medium stores computer-executable instructions, which are configured to: collect historical operation logs from a target software system and preprocess the historical operation logs; extract semantic features, temporal features, and statistical features from the preprocessed historical operation logs, and concatenate the semantic features, temporal features, and statistical features to obtain training feature samples; input samples with normal but unlabeled operation behavior into a pre-trained large language model for self-supervised training, and perform supervised fine-tuning on the pre-trained large language model using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model, wherein the samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples; and detect whether the operation behavior is normal or not based on the operation logs generated in real time by the target software system based on the trained large language model to obtain a target detection result.

[0042] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for IoT devices and media are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0043] The systems, media, and methods provided in this application are one-to-one correspondences. Therefore, the systems and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the systems and media will not be repeated here.

[0044] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0045] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0046] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0047] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0048] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0049] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0050] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0051] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0052] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting abnormal operational behavior in a software system, characterized in that, The method includes: Historical operation logs are collected from the target software system, and the historical operation logs are preprocessed. Semantic features, temporal features, and statistical features are extracted from the preprocessed historical operation logs, and the semantic features, temporal features, and statistical features are concatenated to obtain training feature samples. Samples with normal but unlabeled operation behavior are input into a pre-trained large language model for self-supervised training. The pre-trained large language model is then fine-tuned using samples with normal operation behavior labels and samples with abnormal operation behavior labels to obtain a trained large language model. The samples with normal but unlabeled operation behavior, the samples with normal operation behavior labels, and the samples with abnormal operation behavior labels are obtained by dividing the training samples. Based on the trained large language model, the operation logs generated in real time by the target software system are used to detect whether the operation behavior is normal or not, and the target detection result is obtained.

2. The method for detecting abnormal operation behavior of a software system according to claim 1, characterized in that, The extraction of semantic features, temporal features, and statistical features from the preprocessed historical operation logs includes: Each historical operation log in the preprocessed historical operation log is input into the preset model to obtain semantic features represented by dense vectors; Arrange the historical operation logs belonging to the same user session in the preprocessed historical operation logs in chronological order to obtain the temporal features corresponding to the user operation behavior sequence. Calculate the statistical characteristics of each user session in the preprocessed historical operation log. The statistical characteristics include the frequency of occurrence of the target-specific operation, the failure rate of the target-specific operation, and the number of target resources accessed.

3. The method for detecting abnormal operation behavior of a software system according to claim 2, characterized in that, The preprocessing of the historical operation logs includes: Extract the key fields of each historical operation log, including timestamp, user ID, operation category, operation object, result status, IP address, device fingerprint, and session ID; Each historical operation log is aggregated based on the user ID or the session ID to obtain the user operation behavior sequence corresponding to each user session; The text-type key fields of each historical operation log in each of the user operation behavior sequences are converted into numerical vectors to obtain the preprocessed historical operation logs.

4. The method for detecting abnormal operation behavior of a software system according to claim 3, characterized in that, The self-supervised training includes: a masked language model training task and a next sentence prediction task.

5. A method for detecting abnormal operational behavior of a software system according to any one of claims 1-4, characterized in that, When the trained large language model generates anomaly judgment results, the target detection results include the judgment results of whether the operation behavior is abnormal and the judgment analysis process.

6. The method for detecting abnormal operation behavior of a software system according to claim 5, characterized in that, When the trained large language model generates anomaly scores, the anomaly score is calculated based on the target detection result using a classifier or anomaly detection algorithm to obtain the target anomaly score. The target detection result includes a sequence representation vector.

7. The method for detecting abnormal operation behavior of a software system according to claim 6, characterized in that, After obtaining the target anomaly score, the method includes: Determine whether the target anomaly score exceeds the anomaly threshold; If the limit is exceeded, a security alert will be generated and the security operations and maintenance personnel will be notified.

8. The method for detecting abnormal operation behavior of a software system according to claim 7, characterized in that, The method includes: Obtain feedback data from the security operations and maintenance personnel regarding the handling of the security alarms; The training feature samples are updated based on the feedback data, and the trained large language model is continuously iterated and optimized based on the updated training feature samples to dynamically improve performance.

9. A detection device for abnormal operational behavior of a software system, characterized in that, The device includes: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform a method for detecting abnormal operating behavior of a software system as described in any one of claims 1-8.

10. A computer storage medium storing computer-executable instructions, characterized in that, When the computer-executable instructions are executed, a method for detecting abnormal operating behavior of a software system as described in any one of claims 1-8 is implemented.

Images