A big data-based information security risk behavior identification method and system

Abstract

This invention discloses a method and system for identifying information security risk behaviors based on big data, relating to the technical fields of information security and big data analysis. The method involves collecting and preprocessing user multimodal behavior data to obtain a structured behavior dataset. Based on this dataset, behavior sequences are constructed, and behavior sequence images are generated through visualization transformation. Behavioral features are extracted using a ResNet18 model, and these features are processed to obtain behavioral entity representations. A graph attention network is used to mine the relationships between entities, constructing a behavior relationship graph and establishing a multi-dimensional behavior knowledge base. Based on a prototype-enhanced graph convolutional network model and the multi-dimensional behavior knowledge base, the deviation degree between the behavioral features and the prototype centers of each category is calculated. Abnormal behavior patterns are identified, and abnormal behavior identification results are output. The deviation degree is normalized to obtain an anomaly score. The anomaly score is compared with a preset risk indicator threshold to trigger a security warning.

Description

Technical Field

[0001] This invention relates to the technical field of information security and big data analysis, and in particular to a method and system for identifying information security risk behaviors based on big data. Background Technology

[0002] With the rapid development of information technology, enterprises and organizations face increasingly complex and diverse information security threats. Traditional security detection methods based on rules or signature matching are no longer sufficient to cope with new and covert cyberattacks. Existing technologies often rely on static feature matching or single-behavior analysis, lacking in-depth analysis of multi-dimensional and dynamic correlations in user behavior, resulting in limited ability to identify unknown threats and internal risk behaviors.

[0003] Currently, Chinese invention patent application CN120046195A discloses a method and system for identifying computer big data information security risks. This method automatically identifies details such as the environment, location, text content, associated people, and clothing / items in an image when a user sends it to a target contact. It then generates a list of sensitive information prompts for the user to view. The user can choose to cancel sending, perform de-identification processing, or confirm sending based on the prompts, effectively preventing the leakage of sensitive information. This method enhances user security awareness and reduces the risk of sensitive information leakage by automatically identifying and prompting users about sensitive information in images, while also providing flexible de-identification options. While balancing user privacy and personalization needs, this solution has a relatively limited application scenario, primarily targeting the content security of static images. It cannot address the complex risks arising from dynamic operations such as user login, file access, network communication, and system configuration modifications. Its analytical methods rely on visual content analysis of single images, failing to address the serialization modeling, association graph construction, and dynamic anomaly pattern recognition of continuous, multimodal user behavior data. Furthermore, its core is a passive defense model dependent on user self-decision, lacking the ability to proactively and in real-time identify and automatically intervene in potential attack chains. Consequently, it struggles to achieve large-scale, automated risk management within enterprise-level security systems. Summary of the Invention

[0004] The technical problem addressed by this invention is that existing information security risk behavior identification methods, based on a single data source, struggle to comprehensively capture users' multimodal behavioral characteristics; methods based on static rules or traditional machine learning cannot effectively model the complex relationships between behavioral entities; and early warning mechanisms relying on fixed thresholds lack the ability to dynamically identify and adapt to unknown abnormal behaviors. This invention aims to comprehensively solve the above problems by providing an intelligent information security risk identification method that can deeply integrate multi-source behavioral data, accurately model behavioral relationships, and achieve dynamic risk assessment by calculating the deviation of behavioral features from the prototype centers of each category.

[0005] To address the aforementioned technical problems, the present invention provides the following technical solution: Firstly, a method for identifying information security risk behaviors based on big data, comprising the following steps:

[0006] Step S1: Obtain user multimodal behavior data and preprocess the user multimodal behavior data to obtain a structured behavior dataset;

[0007] Step S2: Construct a behavior sequence based on the structured behavior dataset, perform a visualization transformation on the behavior sequence to generate a behavior sequence image, and extract the behavior features from the behavior sequence image using the ResNet18 model;

[0008] Step S3: Perform entity recognition and semantic alignment on the behavioral features to obtain behavioral entity representations. Use graph attention network to mine the relationships between entities and construct a behavioral relationship graph. Based on the behavioral relationship graph and a predefined semantic tag library, establish a multi-dimensional behavioral knowledge base.

[0009] Step S4: Based on the prototype-enhanced graph convolutional network model and multi-dimensional behavior knowledge base, calculate the degree of deviation between the behavior features and the prototype centers of each category, identify abnormal behavior patterns and output abnormal behavior identification results, and normalize the degree of deviation to obtain an anomaly score;

[0010] Step S5: Compare the anomaly score with the preset risk indicator threshold to trigger a security alert.

[0011] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, step S1 specifically includes:

[0012] Step S11: Obtain user multimodal behavior data, which includes network traffic, device operation logs, and application behavior sequences;

[0013] Step S12: Clean, filter and standardize the multimodal behavior data, remove noisy data and fill in missing values ​​to obtain a structured behavior dataset;

[0014] The structured behavior dataset includes timestamp, user identifier, user operation behavior, operation object, and context feature fields;

[0015] The user actions include login actions, file access actions, network communication actions, system configuration modification actions, application operation actions, data transmission actions, and account operation actions;

[0016] The objects of operation include file resources, system resources, network resources, account resources, and application resources;

[0017] The context feature fields include device status, system session, and security policy.

[0018] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, step S2 specifically includes:

[0019] Step S21: Construct a behavior sequence based on the structured behavior dataset;

[0020] Step S22: Perform a visualization transformation on the behavior sequence to obtain a behavior sequence image;

[0021] Step S23: Extract behavioral features from the behavioral sequence images using a pre-trained ResNet18 model.

[0022] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, step S21, the processing logic for constructing the behavior sequence includes:

[0023] Based on the structured behavior dataset, the structured behavior dataset is grouped by user identifier and sorted in ascending order by timestamp to form the original behavior trajectory;

[0024] The original behavioral trajectory is segmented using a sliding time window mechanism. The time window size is set to T minutes, and the sliding step size is minutes. The structured behavioral dataset within each time window is treated as a behavioral sequence unit.

[0025] Feature enhancement processing is performed on each behavioral sequence unit, and the processing logic includes:

[0026] The frequency of each user action is counted within the time window, and the frequency of each user action is normalized to obtain a frequency vector of user actions.

[0027] Calculate the timestamp difference between two consecutive user actions, and use the moving average and standard deviation to obtain the time interval feature vector;

[0028] The operation objects within the time window are counted according to the categories of file resources, system resources, network resources, account resources, and application resources, and the category probability distribution vector is obtained by softmax normalization.

[0029] The context feature fields are embedded and encoded to obtain behavioral sequence units;

[0030] In this process, embedding encoding maps context feature fields into low-dimensional continuous vectors using a pre-trained embedding matrix.

[0031] Organize the behavioral sequence units into a standard sequence data structure to form a behavioral sequence.

[0032] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, the visualization conversion processing logic in step S22 includes:

[0033] Each user operation behavior in each behavior sequence unit is converted into a corresponding numerical code through a predefined mapping table to form a one-dimensional numerical sequence.

[0034] The one-dimensional numerical sequence is normalized to compress the numerical range to the interval [0, 255] and converted into grayscale pixel values.

[0035] Based on the preset image size M×N, calculate the total number of pixels required P=M×N. If the length of the one-dimensional numerical sequence is less than P, fill it with zero values ​​to the length P. If the length of the one-dimensional sequence exceeds P, truncate it to the length P.

[0036] The space-filling curve algorithm is used to map the one-dimensional pixel value sequence to the two-dimensional image space. The Hilbert curve traversal method is used to fill the pixel values ​​into the M×N two-dimensional grid according to the curve path.

[0037] The filled 2D grid is converted into a standard image format to generate a behavior sequence image, which is a single-channel grayscale image with a uniform size of 256×256 pixels.

[0038] In a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, the feature extraction processing logic in step S23 includes:

[0039] We used a ResNet18 model that was pre-trained on the large ImageNet image dataset to obtain the network weight parameters;

[0040] The structural adjustment of the ResNet18 model involves the following processing logic:

[0041] Remove the fully connected classification layer at the end and use the convolutional and pooling layers as the backbone network for feature extraction;

[0042] The 256×256 pixel behavior sequence image generated in step S22 is input into the feature extraction backbone network, and the intermediate feature representation of the behavior sequence image is obtained through the forward propagation process.

[0043] The 512-dimensional feature vector extracted from the output of the last pooling layer of the ResNet18 model is used as the final feature representation of the corresponding action sequence image.

[0044] The feature extraction process is optimized using a contrastive learning strategy, and its processing logic includes:

[0045] Apply enhancement transformations to images of the same action sequence to generate enhanced views;

[0046] The enhancement transformation includes rotation, translation, flipping, and brightness adjustment;

[0047] Input the enhanced view into the ResNet18 model to obtain the corresponding feature vector representation;

[0048] Using the contrastive loss function, the cosine similarity between the 512-dimensional feature vectors corresponding to the augmented views generated from the same action sequence images is increased in the feature space.

[0049] All behavioral sequence images are collected and processed by the ResNet18 model to extract 512-dimensional feature vectors, forming behavioral features.

[0050] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, step S3 specifically includes:

[0051] Step S31: Perform entity recognition and semantic alignment on the behavioral features. The processing logic includes:

[0052] The behavioral features output in step S23 are used as the initial features of the nodes in the graph attention network.

[0053] By using the learnable transformation matrix in the graph attention network, the 512-dimensional feature vector is mapped to the action semantic space to form a representation of the action entity.

[0054] The behavioral entity representation includes user identity, operation type, accessed resources, and network protocol;

[0055] Step S32: Utilize graph attention networks to mine the relationships between behavioral entities and construct a behavioral relationship graph. The processing logic includes:

[0056] Edge connections of the graph are established based on the co-occurrence relationship, temporal adjacency relationship and feature similarity of behavioral entities in the behavioral sequence;

[0057] The co-occurrence relationship is when two behavioral entities appear simultaneously within the same behavioral sequence unit and a co-occurrence edge is established. The weight of the co-occurrence edge can be determined based on the number of co-occurrences.

[0058] The temporal adjacency relationship refers to the occurrence of two behavioral entities in adjacent time steps, and the establishment of a temporal edge. The weight of the temporal edge can be calculated based on the inverse ratio of the time interval.

[0059] The feature similarity is calculated by the cosine similarity between each vector in the behavioral features. When the similarity exceeds a preset threshold, a similarity edge is established, and the weight of the similarity edge is equal to the similarity value.

[0060] The attention coefficient between nodes is calculated using a multi-head graph attention mechanism, and the formula is as follows:

[0061] ;

[0062] in, Indicates the attention coefficient. Represents a node The 512-dimensional feature vector, The transformation matrix represents the mapping from visual features to the semantic space. Indicates attention weights, Represents a node. Represents nodes Different nodes, This represents the total number of heads of attention. Represents nodes The set of all connected neighboring nodes. This indicates that the attention span starts from the first attention and proceeds to the second attention. One point of attention, Represents a nonlinear activation function;

[0063] Step S33: Integrate the predefined semantic tag library to form a multi-dimensional behavioral knowledge base. The processing logic includes:

[0064] Based on a predefined semantic tag library, behavioral features are matched with the predefined semantic tag library to obtain a corresponding semantic tag for each node;

[0065] The predefined semantic tag library includes behavior categories, risk levels, and contextual tags;

[0066] The behavior categories include login and file modification;

[0067] The context labels include working time periods and external network environment;

[0068] Integrate behavioral features with corresponding semantic tags to generate fused behavioral features;

[0069] Construct a multi-dimensional behavioral knowledge base to store behavioral entities, behavioral relationship graphs, and semantic tags.

[0070] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, step S4 specifically includes:

[0071] Step S41: Calculate the prototype center for each category using the prototype enhancement graph convolutional network model. The calculation formula is as follows:

[0072] ;

[0073] in, Indicate category The prototype center, Indicate category The sample set, Represents the feature extraction function. Represents the sample feature vector. Indicates category, Indicate category The number of elements in the sample set;

[0074] Each category includes user operation behavior, operation object, and context feature fields;

[0075] Step S42: Calculate the deviation of behavioral features from the prototype centers of each category using a distance metric. The distance calculation formula is:

[0076] ;

[0077] in, Indicates the behavioral characteristics to be detected. Indicates distance;

[0078] The prototype-enhanced graph convolutional network model includes a feature extraction module, a prototype calculation module, and a graph convolutional class module;

[0079] Step S43: Use historical risk data to determine the volatility benchmark of the prototype center for each category through quantile analysis, and set the deviation threshold for each category. The calculation formula is as follows:

[0080] ;

[0081] in, Indicate category The deviation threshold, Indicate category The sample set, Indicate category The number of elements in the sample set, Indicate category The first sample in the sample set One sample, Indicates the sample The feature vector obtained after feature extraction. Indicate category The prototype center, Represents the L2 norm;

[0082] Step S44: Classify behavioral features using the graph convolutional integration module. The processing logic includes:

[0083] When the distance between a behavioral feature and the center of all known class prototypes exceeds the corresponding deviation threshold, it is determined to be an abnormal behavioral pattern. The hierarchical propagation rule of the graph convolutional network is as follows:

[0084] ;

[0085] in, This represents the adjacency matrix with added self-loops. Represents the adjacency matrix. Represents the identity matrix. express The degree matrix, Indicates the first The feature matrix of the layer, This represents a trainable weight matrix. This represents the activation function. Indicates the first The node feature matrix of the layer;

[0086] Step S45: Output the abnormal behavior identification results. When an unknown malicious behavior is detected, dynamically update the prototype center and recalculate the threshold.

[0087] The unknown malicious behaviors include zero-day attack exploitation, new malware variant communication, advanced persistent threat activities, anomalous insider threat behaviors, new distributed denial-of-service attack variants, and unknown network protocol abuse behaviors.

[0088] The deviation is normalized to obtain the anomaly score S.

[0089] As a preferred embodiment of the information security risk behavior identification method based on big data described in this invention, step S5 specifically includes:

[0090] Step S51: Obtain the anomaly score S and compare the anomaly score S with the preset risk indicator threshold.

[0091] The preset risk indicator thresholds are respectively denoted as the first threshold θ1, the second threshold θ2, and the third threshold θ3;

[0092] Step S52: Compare the anomaly score S with the first threshold θ1 to perform the first-level evaluation:

[0093] If the anomaly score S is less than the first threshold θ1, the evaluation result is safe and the system is operating normally.

[0094] If the anomaly score S is greater than or equal to the first threshold θ1, a preliminary warning is triggered, the security log is recorded, and the security administrator is notified.

[0095] Step S53: Compare the anomaly score S with the second threshold θ2 to perform the second-level evaluation:

[0096] If the anomaly score S is greater than or equal to the first threshold θ1 and less than the second threshold θ2, the assessment result is low risk, and a risk assessment report is automatically generated.

[0097] If the abnormal score S is greater than or equal to the second threshold θ2, a medium-level alarm is triggered, automatically blocking the current session connection and restricting the user's operation permissions.

[0098] Step S54: Compare the anomaly score S with the third threshold θ3 to perform a third-level evaluation:

[0099] If the anomaly score S is greater than or equal to the second threshold θ2 and less than the third threshold θ3, the assessment result is medium risk;

[0100] If the anomaly score S is greater than or equal to the third threshold θ3, the assessment result is high risk.

[0101] Secondly, a big data-based information security risk behavior identification system includes a data acquisition module, a feature extraction module, a behavior knowledge base module, a risk identification module, and an early warning and intervention module.

[0102] The data acquisition module is used to acquire user multimodal behavior data and preprocess the user multimodal behavior data to obtain a structured behavior dataset;

[0103] The feature extraction module is used to construct behavior sequences based on structured behavior datasets, perform visualization transformation on the behavior sequences to generate behavior sequence images, and extract behavior features from the behavior sequence images using the ResNet18 model.

[0104] The behavior knowledge base module is used to perform entity recognition and semantic alignment on behavior features to obtain behavior entity representations, use graph attention networks to mine the relationships between entities and construct a behavior relationship graph, and establish a multi-dimensional behavior knowledge base based on the behavior relationship graph and a predefined semantic tag library.

[0105] The risk identification module is used to calculate the degree of deviation between behavioral features and the prototype centers of each category based on the prototype enhanced graph convolutional network model and multi-dimensional behavioral knowledge base, identify abnormal behavior patterns and output abnormal behavior identification results, and normalize the degree of deviation to obtain an abnormal score.

[0106] The early warning intervention module is used to trigger a safety warning by comparing the anomaly score with a preset risk indicator threshold.

[0107] The beneficial effects of this invention are as follows: analysis methods based on a single data source are difficult to fully capture the multimodal behavioral characteristics of users; methods based on static rules or traditional machine learning cannot effectively model the complex relationships between behavioral entities; and early warning mechanisms that rely on fixed thresholds lack the ability to dynamically identify and adapt to unknown abnormal behaviors. This invention aims to comprehensively solve the above problems and provide an intelligent information security risk identification method that can deeply integrate multi-source behavioral data, accurately model behavioral relationships, and achieve dynamic risk assessment by calculating the degree of deviation between behavioral features and the prototype centers of each category. Attached Figure Description

[0108] Figure 1 A basic flowchart of a big data-based information security risk behavior identification method is provided as an embodiment of the present invention.

[0109] Figure 2 This is a schematic diagram of the basic process for anomaly identification provided in one embodiment of the present invention. Detailed Implementation

[0110] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0111] Example, refer to Figure 1-2 As an embodiment of the present invention, a method for identifying information security risk behaviors based on big data is provided, comprising the following steps:

[0112] Step S1: Obtain user multimodal behavior data and preprocess the user multimodal behavior data to obtain a structured behavior dataset;

[0113] Step S2: Construct a behavior sequence based on the structured behavior dataset, perform a visualization transformation on the behavior sequence to generate a behavior sequence image, and extract the behavior features from the behavior sequence image using the ResNet18 model;

[0114] Step S3: Perform entity recognition and semantic alignment on the behavioral features to obtain behavioral entity representations. Use graph attention network to mine the relationships between entities and construct a behavioral relationship graph. Based on the behavioral relationship graph and a predefined semantic tag library, establish a multi-dimensional behavioral knowledge base.

[0115] Step S4: Based on the prototype-enhanced graph convolutional network model and multi-dimensional behavior knowledge base, calculate the degree of deviation between the behavior features and the prototype centers of each category, identify abnormal behavior patterns and output abnormal behavior identification results, and normalize the degree of deviation to obtain an anomaly score;

[0116] Step S5: Compare the anomaly score with the preset risk indicator threshold to trigger a security alert.

[0117] Step S1 specifically includes:

[0118] Step S11: Obtain user multimodal behavior data, which includes network traffic, device operation logs, and application behavior sequences;

[0119] Step S12: Clean, filter, and standardize the multimodal behavior data, remove noisy data, and fill in missing values ​​to obtain a structured behavior dataset;

[0120] The structured behavioral dataset includes timestamp, user identifier, user action behavior, action object, and contextual feature fields;

[0121] User actions include login actions, file access actions, network communication actions, system configuration modification actions, application actions, data transmission actions, and account actions;

[0122] The objects of operation include file resources, system resources, network resources, account resources, and application resources;

[0123] Contextual feature fields include device status, system session, and security policy.

[0124] In practice, network traffic is analyzed in real time by Zeek network monitoring sensors (10Gbps throughput, ET Open Rules rule base) deployed next to the core switch, processing an average of 120 million flow records per day and extracting 28 key fields such as 5-tuples, payload size, and TLS SNI; device operation logs are collected from more than 5,000 terminals and servers through the Fluentd log collector (256MB cache, 5s batch submission interval), collecting an average of 45 million logs such as Windows event IDs 4624 / 4625 / 4688 per day; application behavior sequences are tracked by business applications embedded with Jaeger probes, tracing API call paths and database sessions, generating an average of 800GB of Span data per day.

[0125] Data cleaning and filtering employed the DBSCAN clustering statistical outlier detection method, with eps=0.5 and min_samples=10. It automatically filtered network scanning noise (such as ICMP Flood), false security events (such as legitimate logins triggered by scheduled tasks), and application heartbeat packets, achieving a noise data filtering efficiency of 95.2%. Missing value imputation is performed on numerical fields (such as session duration) using an exponentially weighted moving average (EWMA, α=0.3) within a time window (T=10min). For categorical fields (such as operation type), the most frequent value is recommended using collaborative filtering based on user profiles, improving data integrity. Standardization processes unify heterogeneous timestamps (such as Unix millisecond stamps, CIM_DateTime) into the ISO 8601 extended format. User identifiers and resource paths are mapped to 64-bit fixed-length anonymous strings using the SHA-256 hash algorithm. Operation names are normalized into seven categories using a pre-built thesaurus (containing 1200 standard terms), for example, "ssh_connect" and "rdp_logon" are uniformly mapped to "login behavior".

[0126] The resulting structured behavior dataset is stored in HDFS in Apache Parquet columnar format, using Snappy compression (compression ratio 1:2.1). The average size of a single record is 1.5KB, with approximately 580 million records generated daily. This dataset serves as the benchmark for subsequent behavior sequence construction and feature extraction. In a test environment, its data consistency reached 99.95%, and the field completion error rate was less than 0.01%, providing a highly reliable data foundation for end-to-end analysis. Based on this high-quality dataset, the false positive rate of the subsequent abnormal behavior recognition model was reduced compared to the original data, improving overall analysis efficiency.

[0127] Step S2 specifically includes:

[0128] Step S21: Construct a behavior sequence based on the structured behavior dataset;

[0129] Step S22: Perform a visualization transformation on the behavior sequence to obtain a behavior sequence image;

[0130] Step S23: Extract behavioral features from the behavioral sequence images using a pre-trained ResNet18 model.

[0131] In specific implementation, step S21 uses the Apache Spark Streaming engine to group users by ID and sort them by millisecond-level timestamps to form the original behavior trajectory stream. A sliding time window (time window size T = 30 minutes, sliding step S = 5 minutes) is used for session segmentation, generating a behavior sequence unit within each time window. This unit undergoes multi-dimensional feature enhancement: the frequency of occurrence of 7 types of user operations is counted and normalized using the L2 norm to obtain a 7-dimensional frequency vector; the timestamp difference between adjacent behaviors is calculated, and its mean and standard deviation are calculated using a sliding time window with a width of 5 to obtain a 2-dimensional time interval feature; 5 types of operation objects are counted according to resource type, and normalized using the Softmax function to obtain a 5-dimensional category probability distribution; contextual features are mapped to a 128-dimensional embedding vector using a pre-trained Word2Vec model (vector dimension = 128, time window size = 5). Finally, the enhanced features are organized into a JSON sequence to form a behavior sequence, with an average of 45 behavior events per sequence and a feature dimension of 142 dimensions.

[0132] In step S22, the seven types of user operation behaviors are first converted into integer codes through a mapping table (e.g., login behavior → 1, file access behavior → 2, network communication behavior → 3, system configuration modification behavior → 4, application operation behavior → 5, data transmission behavior → 6, account operation behavior → 7), forming a one-dimensional numerical sequence. This sequence is then subjected to Min-Max normalization, compressing the numerical range to [0, 255] and rounding to obtain a grayscale pixel value sequence. The standard image size is set to 256×256 pixels (total number of pixels P = 65536). If the sequence length is less than P, zero values ​​are padded to P at the end; if the one-dimensional sequence length exceeds P, it is truncated from the beginning to P. The Hilbert space-filling curve algorithm (curve order = 8) is used for mapping, filling the pixel values ​​sequentially into a 256×256 two-dimensional grid according to the curve traversal path, ultimately generating a single-channel grayscale behavior sequence image in PNG format with an average file size of approximately 48KB.

[0133] Step S23 uses the PyTorch framework and loads a ResNet18 model pre-trained on ImageNet-1k (Top-1 accuracy 69.76%). The network structure is adaptively adjusted: the last fully connected layer (classification head) of the original model is removed, and the convolutional layers (Conv1-4) and the global average pooling layer (GAP) are retained as the backbone for feature extraction. The 256×256 pixel action sequence image generated in step S22 is input into the adjusted network. Through forward propagation, a 512-dimensional feature vector is output from the GAP layer as the final feature representation of the action sequence. To improve feature discriminative power, contrastive learning optimization is introduced: random combination transformations (including ±15° rotation, maximum 10% translation, horizontal flip, and ±25% brightness adjustment) are applied to the same action sequence image to generate two enhanced views, forming a positive sample pair. The NT-Xent (Normalized Temperature-scaled CrossEntropy) loss function is used to shorten the distance between positive sample pairs and widen the distance between negative sample pairs generated from different original images in the feature space. After optimization, the cosine similarity of similar behavioral features was effectively improved, while the similarity of different behavioral features decreased, resulting in a significant improvement in feature discrimination. Finally, the 512-dimensional feature vectors extracted from all behavioral sequence images through this process were aggregated to form the behavioral feature set for subsequent map construction and anomaly recognition.

[0134] In step S21, the processing logic for constructing the behavior sequence includes:

[0135] Based on the structured behavior dataset, the structured behavior dataset is grouped by user identifier and sorted in ascending order by timestamp to form the original behavior trajectory;

[0136] The original behavioral trajectory is segmented using a sliding time window mechanism, with the time window size set to T minutes and the sliding step size as follows. Minutes are used to treat the structured behavior dataset within each time window as a behavior sequence unit;

[0137] Feature enhancement processing is performed on each behavioral sequence unit, and the processing logic includes:

[0138] The frequency of each user action is counted within the time window, and the frequency of each user action is normalized to obtain a frequency vector of user actions.

[0139] Calculate the timestamp difference between two consecutive user actions, and use the moving average and standard deviation to obtain the time interval feature vector;

[0140] The operation objects within the time window are counted according to the categories of file resources, system resources, network resources, account resources, and application resources, and the category probability distribution vector is obtained by softmax normalization.

[0141] The context feature fields are embedded and encoded to obtain behavioral sequence units;

[0142] In this process, embedding encoding maps context feature fields into low-dimensional continuous vectors using a pre-trained embedding matrix.

[0143] Organize the behavioral sequence units into a standard sequence data structure to form a behavioral sequence.

[0144] In practice, based on the structured behavior dataset (Parquet format, 580 million records per day) stored in HDFS, Apache Spark SQL (version 3.2.1, 8GB executor memory configuration) performs hash partitioning by the user identifier field (number of partitions = 200), and within each partition, sorts the data in ascending order by the timestamp field (using the Timsort sorting algorithm) to form the original behavior trajectory by user dimension. Subsequently, a sliding time window mechanism (time window size T = 30 minutes, sliding step S = 5 minutes) is used to segment the trajectory. This is implemented using Spark Streaming's window function, aggregating all user behavior records within each 30-minute window into a behavior sequence unit, generating approximately 12 million sequence units per day.

[0145] For each action sequence unit, perform the following multidimensional feature enhancement processing:

[0146] User operation frequency vector: The frequency of seven types of user operations (login, file access, network communication, system configuration modification, application operation, data transmission, and account operation) within a time window is counted to form a 7-dimensional frequency vector. The vector is then normalized using the L2 norm (L2-Norm) to make the vector magnitude 1, so as to eliminate the magnitude impact caused by the difference in activity levels among different users.

[0147] Time interval feature vector: Calculate the timestamp difference (in seconds) between two adjacent actions within a time window to obtain a time interval sequence. Apply a sliding time window with a width of 5 to this sequence, and calculate the arithmetic mean and standard deviation of the time intervals within each sliding time window. Finally, average the mean and standard deviation of all sliding time windows to obtain a 2D feature vector (mean, standard deviation), which is used to characterize the rhythmic regularity and suddenness of user behavior.

[0148] Operation Object Category Probability Distribution Vector: For all operation objects involved within the time window, counts are performed according to five predefined categories (files, system, network, account, and application resources), forming a 5-dimensional count vector. Subsequently, the count vector is normalized using the Softmax function, transforming it into a category probability distribution vector with a sum of 1, intuitively reflecting the user's preference for resource types during that time period.

[0149] Contextual Feature Embedding Encoding: For categorical contextual feature fields such as device status, system session, and security policy, a pre-trained Word2Vec model (Skip-gram architecture, vector dimension = 64, training corpus consists of 3 months of historical behavioral data) is used for embedding encoding. The embedding matrix generated by this model maps each discrete feature value to a 64-dimensional continuous vector, effectively capturing the semantic correlation between contextual features.

[0150] In step S22, the processing logic for the visualization transformation includes:

[0151] Each user operation behavior in each behavior sequence unit is converted into a corresponding numerical code through a predefined mapping table to form a one-dimensional numerical sequence.

[0152] The one-dimensional numerical sequence is normalized to compress the numerical range to the interval [0, 255] and converted into grayscale pixel values.

[0153] Based on the preset image size M×N, calculate the total number of pixels required P=M×N. If the length of the one-dimensional numerical sequence is less than P, fill it with zero values ​​to the length P. If the length of the one-dimensional sequence exceeds P, truncate it to the length P.

[0154] The space-filling curve algorithm is used to map the one-dimensional pixel value sequence to the two-dimensional image space. The Hilbert curve traversal method is used to fill the pixel values ​​into the M×N two-dimensional grid according to the curve path.

[0155] The filled 2D grid is converted into a standard image format to generate a behavior sequence image. The behavior sequence image is a single-channel grayscale image with a uniform size of 256×256 pixels.

[0156] In specific implementation, the visualization conversion process is implemented through a dedicated Python image generation service, which reads the behavior sequence generated in step S21 from HBase. First, the service loads a predefined mapping table (stored in Redis in the form of a Python dictionary structure, with a read latency < 1ms), which maps seven types of user operation behaviors to unique integer encodings: login behavior → 1, file access behavior → 2, network communication behavior → 3, system configuration modification behavior → 4, application operation behavior → 5, data transmission behavior → 6, account operation behavior → 7. Traverse each operation behavior in the behavior sequence unit and replace it with the corresponding integer encoding, thus forming a one-dimensional numerical sequence.

[0157] Perform normalization processing on this one-dimensional numerical sequence. Using the Min-Max scaling algorithm, linearly transform the original numerical range in the sequence (theoretically [1,7]) to the interval [0, 255]. The transformation formula is:

[0158] ;

[0159] where, represents the output grayscale pixel value corresponding to the th position in the sequence, represents the input behavior encoding corresponding to the th position in the sequence, represents the behavior encoding;

[0160] Round the calculation result to the nearest integer, thus converting the sequence into a standard 8-bit grayscale pixel value sequence.

[0161] According to the preset image size M×N = 256×256, calculate the total number of required pixels P = 65536. The system counts the length L of the current pixel value sequence. The length adaptation logic is: if L < P, fill zeros (i.e., pure black pixels) at the end of the sequence until the length reaches P; if L > P, truncate from the beginning of the sequence and retain the first P pixel values.

[0162] The key spatial mapping process is implemented using the Hilbert curve algorithm (curve order = 8, recursion depth = 8). Through its unique space-filling path, this algorithm maps each value in the one-dimensional pixel value sequence to a specific coordinate on the two-dimensional 256×256 grid in the order of its position in the sequence. This process uses the optimized C++ extension library hilbertcurve for calculation, and the average mapping time for a single sequence is 12ms. This mapping method can maximize the preservation of the proximity of adjacent points in the one-dimensional sequence in the two-dimensional space.

[0163] The filled 2D grid (NumPy array, data type uint8) is encoded into a lossless PNG standard image format using the cv2.imwrite function of the OpenCV library (version 4.5.5), generating the final behavioral sequence image. This image is a single-channel grayscale image with a resolution of 256x256 pixels and an average file size of 48.5KB. All images are stored in a distributed file system (such as HDFS), with an average of approximately 12 million images generated daily, providing standardized visual input for subsequent ResNet18 feature extraction.

[0164] In step S23, the feature extraction processing logic includes:

[0165] We used a ResNet18 model that was pre-trained on the large ImageNet image dataset to obtain the network weight parameters;

[0166] The structural adjustment of the ResNet18 model involves the following processing logic:

[0167] Remove the fully connected classification layer at the end and use the convolutional and pooling layers as the backbone network for feature extraction;

[0168] The 256×256 pixel behavior sequence image generated in step S22 is input into the feature extraction backbone network, and the intermediate feature representation of the behavior sequence image is obtained through the forward propagation process.

[0169] The 512-dimensional feature vector extracted from the output of the last pooling layer of the ResNet18 model is used as the final feature representation of the corresponding action sequence image.

[0170] The feature extraction process is optimized using a contrastive learning strategy, and its processing logic includes:

[0171] Apply enhancement transformations to images of the same action sequence to generate enhanced views;

[0172] Enhanced transformations include rotation, translation, flipping, and brightness adjustment;

[0173] Input the enhanced view into the ResNet18 model to obtain the corresponding feature vector representation;

[0174] Using the contrastive loss function, the cosine similarity between the 512-dimensional feature vectors corresponding to the augmented views generated from the same action sequence images is increased in the feature space.

[0175] All behavioral sequence images are collected and processed by the ResNet18 model to extract 512-dimensional feature vectors, forming behavioral features.

[0176] In practice, the feature extraction task was performed on a server equipped with four NVIDIA Tesla V100 GPUs. First, the weights of a ResNet18 model pre-trained on the ImageNet-1K dataset (provided by PyTorch) were loaded. Then, a crucial adaptive structural adjustment was made to the model: the fully connected classification layer at the end of the original model (which originally output 1000 dimensions, corresponding to the 1000 classes in ImageNet) was removed, and all preceding convolutional layers (Conv1 to Conv4_x) and the immediately following global average pooling layer were retained and utilized as the backbone network for feature extraction. This adjustment transformed the network from a classifier into a powerful, general-purpose feature extractor.

[0177] The 256×256 pixel single-channel action sequence image generated in step S22 is adapted to the RGB input requirements of ResNet18 by copying the single-channel data into a three-channel format and then input into the backbone network. The data passes through convolution, batch normalization (BatchNorm), and ReLU activation functions during the network's forward propagation process, finally yielding a 512-dimensional feature vector in the global average pooling layer. This vector is the final feature representation of the corresponding action sequence, and its mathematical representation is as follows:

[0178] ;

[0179] in, This represents an input sequence of images. This represents the adjusted ResNet18 backbone network;

[0180] To improve the quality of feature representation (i.e., for different images of the same user behavior pattern, their features should be as similar as possible; for images of different behavior patterns, their features should be discriminative), a contrastive learning strategy is introduced to optimize the feature extraction process.

[0181] When performing enhancement transformation to generate enhanced views, the present invention processes the following: for each behavioral sequence image in the training set, apply two controllable enhancements consisting of random combination transformations to generate a pair of enhanced views.

[0182] The specific parameter range for random transformation is as follows:

[0183] Rotation: Angle range [-15°, +15°]

[0184] Translation: Horizontal and vertical translation ratio range [-10%, +10%]

[0185] Horizontal flip: Performed with a probability of 0.5

[0186] Brightness adjustment: Adjustment factor range [0.75, 1.25]

[0187] Feature extraction and projection: The generated enhanced view pairs are input into the ResNet18 backbone network to obtain the corresponding feature vectors. A small projection head (usually a two-layer multilayer perceptron MLP) is introduced to map the 512-dimensional features to a 128-dimensional projection space z=g(h), and the contrastive loss is calculated in this space.

[0188] Contrastive Loss Optimization: The NT-Xent loss function is used, the core idea of ​​which is to bring positive sample pairs (enhanced views from the same original image) closer together and push away negative sample pairs (views from different original images). For a batch containing N samples, the loss function is defined as follows:

[0189] For positive sample pairs, the loss contribution is:

[0190] ;

[0191] in, Indicates the positive sample pairs The calculated loss value, , Represents the feature vector in the projection space. Representing vectors and Cosine similarity between them Indicates the temperature coefficient. This represents the total number of samples in a training batch. Indicates the index of the sample in the batch. Indicates an indicator function;

[0192] By minimizing this contrastive loss, the features learned by the model are effectively resistant to minor perturbations at the image level and focus on the essential patterns of behavioral sequences. After this optimization, the average cosine similarity of similar behavioral features is effectively improved, while the average similarity of different behavioral features decreases.

[0193] Collect all behavioral sequence images and extract 512-dimensional feature vectors h using the optimized ResNet18 model (excluding the projection head) to form the behavioral feature set required for subsequent map construction and anomaly recognition.

[0194] Step S3 specifically includes:

[0195] Step S31: Perform entity recognition and semantic alignment on the behavioral features. The processing logic includes:

[0196] The behavioral features output in step S23 are used as the initial features of the nodes in the graph attention network.

[0197] By using the learnable transformation matrix in the graph attention network, the 512-dimensional feature vector is mapped to the action semantic space to form a representation of the action entity.

[0198] Behavioral entity representation includes user identity, operation type, accessed resources, and network protocol;

[0199] Step S32: Utilize graph attention networks to mine the relationships between behavioral entities and construct a behavioral relationship graph. The processing logic includes:

[0200] Edge connections of the graph are established based on the co-occurrence relationship, temporal adjacency relationship and feature similarity of behavioral entities in the behavioral sequence;

[0201] Co-occurrence is a relationship in which two behavioral entities appear simultaneously within the same behavioral sequence unit and establish a co-occurrence edge. The weight of the co-occurrence edge can be determined based on the number of times they co-occur.

[0202] Temporal adjacency is when two behavioral entities appear in adjacent time steps and establish a temporal edge. The weight of the temporal edge can be calculated inversely based on the time interval.

[0203] Feature similarity is calculated by measuring the cosine similarity between each vector in the behavioral features. When the similarity exceeds a preset threshold, a similarity edge is established, and the weight of the similarity edge is equal to the similarity value.

[0204] The attention coefficient between nodes is calculated using a multi-head graph attention mechanism, and the formula is as follows:

[0205] ;

[0206] in, Indicates the attention coefficient. Represents a node The 512-dimensional feature vector, The transformation matrix represents the mapping from visual features to the semantic space. Indicates attention weights, Represents a node. Represents nodes Different nodes, This represents the total number of heads of attention. Represents nodes The set of all connected neighboring nodes. This indicates that the attention span starts from the first attention and proceeds to the second attention. One point of attention, Represents a nonlinear activation function;

[0207] Step S33: Integrate the predefined semantic tag library to form a multi-dimensional behavioral knowledge base. The processing logic includes:

[0208] Based on a predefined semantic tag library, behavioral features are matched with the predefined semantic tag library to obtain a corresponding semantic tag for each node;

[0209] The predefined semantic tag library includes behavior categories, risk levels, and contextual tags;

[0210] Behavior categories include login and file modification;

[0211] Contextual tags include working time periods and external network environment;

[0212] Integrate behavioral features with corresponding semantic tags to generate fused behavioral features;

[0213] Construct a multi-dimensional behavioral knowledge base to store behavioral entities, behavioral relationship graphs, and semantic tags.

[0214] In specific implementation, all 512-dimensional behavioral feature vectors output in step S23 are used as the initial features of the nodes in the graph. A learnable linear transformation matrix maps the high-dimensional visual features to a lower-dimensional, more semantic 256-dimensional behavioral space, forming a new representation of the nodes in the behavioral semantic space. The system defines four core behavioral entities: user identity, operation type, accessed resources, and network protocol.

[0215] The edge connections in constructing the behavioral relationship graph are based on three types of strong associations:

[0216] If two behavioral entities appear within the same 30-minute behavioral sequence unit, a co-occurrence edge is established. The edge weight is calculated based on the logarithm of the number of co-occurrences; an edge is established only if the number of co-occurrences exceeds 3, effectively filtering out accidental co-occurrences.

[0217] If two behavioral entities have adjacent timestamps in the original log and the interval is less than 5 seconds, a time-series edge is established. The edge weight is calculated inversely proportional to the time interval; the shorter the interval, the higher the weight.

[0218] Calculate the cosine similarity between the initial feature vectors of any two nodes. When the similarity exceeds a preset threshold of 0.85, establish a similarity edge with the edge weight equal to the similarity value.

[0219] An 8-head graph attention mechanism is employed to aggregate and update node features. This mechanism dynamically measures the importance of information from different neighboring nodes by calculating the attention coefficients between a node and its neighboring nodes, and updates the feature representation of the central node accordingly. The features output from the eight attention heads are concatenated in the final layer to obtain a 1024-dimensional updated feature representation for each node.

[0220] A LightGBM-based matching algorithm is used to match node features with a tag library, assigning the most relevant semantic tag to each node. Finally, the node features output by the graph attention network are integrated with the corresponding semantic tags to generate fused behavioral features. All behavioral entities, behavioral relationship graphs, and semantic tags are persistently stored in the Neo4j graph database, forming a multi-dimensional behavioral knowledge base. This knowledge base supports complex relational queries, providing powerful semantic retrieval and relational analysis capabilities for security analysis.

[0221] Step S4 specifically includes:

[0222] Step S41: Calculate the prototype center for each category using the prototype enhancement graph convolutional network model. The calculation formula is as follows:

[0223] ;

[0224] in, Indicate category The prototype center, Indicate category The sample set, Represents the feature extraction function. Represents the sample feature vector. Indicates category, Indicate category The number of elements in the sample set;

[0225] Each category includes user action behavior, action object, and contextual feature fields;

[0226] Step S42: Calculate the deviation of behavioral features from the prototype centers of each category using a distance metric. The distance calculation formula is:

[0227] ;

[0228] in, Indicates the behavioral characteristics to be detected. Indicates distance;

[0229] The prototype-enhanced graph convolutional network model includes a feature extraction module, a prototype computation module, and a graph convolutional classification module.

[0230] Step S43: Use historical risk data to determine the volatility benchmark of the prototype center for each category through quantile analysis, and set the deviation threshold for each category. The calculation formula is as follows:

[0231] ;

[0232] in, Indicate category The deviation threshold, Indicate category The sample set, Indicate category The number of elements in the sample set, Indicate category The first sample in the sample set One sample, Indicates the sample The feature vector obtained after feature extraction. Indicate category The prototype center, Represents the L2 norm;

[0233] Step S44: Classify behavioral features using the graph convolutional integration module. The processing logic includes:

[0234] When the distance between a behavioral feature and the center of all known class prototypes exceeds the corresponding deviation threshold, it is determined to be an abnormal behavioral pattern. The hierarchical propagation rule of the graph convolutional network is as follows:

[0235] ;

[0236] in, This represents the adjacency matrix with added self-loops. Represents the adjacency matrix. Represents the identity matrix. express The degree matrix, Indicates the first The feature matrix of the layer, This represents a trainable weight matrix. This represents the activation function. Indicates the first The node feature matrix of the layer;

[0237] Step S45: Output the abnormal behavior identification results. When an unknown malicious behavior is detected, dynamically update the prototype center and recalculate the threshold.

[0238] Unknown malicious behaviors include zero-day exploitation, new malware variant communications, advanced persistent threat activities, anomalous insider threat behaviors, new distributed denial-of-service attack variants, and unknown network protocol abuses.

[0239] The deviation is normalized to obtain the anomaly score S.

[0240] In the specific implementation, a prototype-enhanced graph convolutional network model is implemented based on the PyTorch framework. This model is trained on an NVIDIA Tesla V100 GPU server with a batch size of 32, using the Adam optimizer and an initial learning rate of 0.001. The prototype calculation module calculates the prototype center for each category based on samples from the support set. The support set contains 2000 labeled samples, covering three basic behavioral categories: normal, suspicious, and malicious. For each category k, its prototype center is obtained by calculating the mean of the feature vectors of all samples in that category. Specifically, a set of samples belonging to category k is selected from the multi-dimensional behavioral knowledge base, and the corresponding 512-dimensional feature vectors are obtained through the feature extraction module. Then, the arithmetic mean of these feature vectors is calculated to form a 256-dimensional prototype center representation for that category.

[0241] Euclidean distance is used as the distance metric. For each behavioral feature vector to be detected, its Euclidean distance to the center of each known category prototype is calculated. During the distance calculation, the feature vector is L2 normalized to eliminate the influence of dimensions. In actual deployment, a maximum detection distance threshold of 5.0 is set; samples exceeding this value are directly identified as anomalies.

[0242] For each class k, calculate the distance distribution from all training samples to the prototype center of that class. Take the 95th quantile of the distance distribution as the base threshold, and then multiply it by a safety factor of 1.5 to obtain the final threshold. The threshold update cycle is set to 24 hours to ensure that the system can adapt to dynamic changes in behavioral patterns.

[0243] The graph convolutional model module employs a two-layer graph convolutional network structure. The first layer maps node features from 512 dimensions to 256 dimensions using the ReLU activation function. The second layer further maps the features to three output dimensions, corresponding to three basic behavior categories. During the graph convolution operation, the adjacency matrix is ​​normalized, self-loops are added to ensure the preservation of node features, and symmetric normalization is used to balance the impact of node degree. Each category, including user action behavior, action object, and context feature fields, represents the labels for these three fields in the structured behavior dataset.

[0244] The system outputs abnormal behavior identification results in real time. When a behavioral pattern is detected whose distance from the prototype center of all known categories exceeds the corresponding threshold, it is determined to be abnormal behavior. For detected unknown malicious behavior, the system initiates an online learning mechanism: first, newly detected abnormal samples are added to the support set; then, the prototype centers of the affected categories are recalculated; and finally, the thresholds are recalculated based on the updated support set. The entire update process is completed within 5 seconds, ensuring the system can quickly adapt to new threats.

[0245] The system calculates the distance between behavioral characteristics and the prototype centers of each category. If the distance is greater than the deviation threshold and does not belong to any known normal or malicious category, the system classifies it as an unknown malicious behavior. Zero-day attack exploitation, new malware variant communication, advanced persistent threat activities, anomalous insider threat behavior, new distributed denial-of-service attack variants, and unknown network protocol abuse are potential risk categories that this invention can capture through the above-mentioned judgment logic. When the system first captures this type of unknown behavior, its feature vector is temporarily stored in a buffer, and an anomaly alarm is triggered. By acquiring external security intelligence or manual audit annotation information, the system initiates a dynamic update procedure: defining the feature set of the specific unknown behavior as a new sample set, calculating and generating a new prototype center according to the formula in step S41, and setting its corresponding deviation threshold according to the formula in step S43. This dynamic evolution mechanism based on prototype centers enables the system to quickly transform newly discovered unknown threats into identifiable known models, achieving adaptive enhancement of identification capabilities.

[0246] This system can effectively identify emerging security risks such as zero-day attacks and advanced persistent threats. Its dynamic update mechanism ensures stable performance improvement during continuous operation; after 30 days of online learning, the accuracy of detecting unknown threats has been greatly improved.

[0247] Step S5 specifically includes:

[0248] Step S51: Obtain the anomaly score S and compare the anomaly score S with the preset risk indicator threshold.

[0249] The preset risk indicator thresholds are respectively denoted as the first threshold θ1, the second threshold θ2, and the third threshold θ3;

[0250] Step S52: Compare the anomaly score S with the first threshold θ1 to perform the first-level evaluation:

[0251] If the anomaly score S is less than the first threshold θ1, the evaluation result is safe and the system is operating normally.

[0252] If the abnormal score S is greater than or equal to the first threshold θ1, a preliminary warning is triggered, the security log is recorded, and the security administrator is notified.

[0253] Step S53: Compare the anomaly score S with the second threshold θ2 to perform the second-level evaluation:

[0254] If the anomaly score S is greater than or equal to the first threshold θ1 and less than the second threshold θ2, the assessment result is low risk, and a risk assessment report is automatically generated.

[0255] If the abnormal score S is greater than or equal to the second threshold θ2, a medium-level alarm is triggered, automatically blocking the current session connection and restricting the user's operation permissions.

[0256] Step S54: Compare the anomaly score S with the third threshold θ3 and perform the third-level evaluation:

[0257] If the anomaly score S is greater than or equal to the second threshold θ2 and less than the third threshold θ3, the assessment result is medium risk;

[0258] If the anomaly score S is greater than or equal to the third threshold θ3, the assessment result is high risk.

[0259] In practice, this is achieved through an early warning and intervention module that integrates a rules engine and a workflow engine. This module receives an anomaly score S in real time from the risk identification module (step S4). This score S is a normalized comprehensive risk value, fixed between 0 and 100, with higher values ​​indicating a greater degree of behavioral abnormality and potential risk.

[0260] The system's preset risk indicator thresholds are determined based on statistical quantile analysis of millions of normal and abnormal behavior data points over a historical three-month period, and are specifically set as follows:

[0261] The first threshold θ1 is 30. This threshold is used to filter out most normal fluctuations and identify suspicious behaviors that require attention.

[0262] The second threshold θ2: 60. This threshold is used to identify anomalous behavior with a moderate level of confidence, typically accompanied by clear indicators of malice.

[0263] The third threshold θ3: 85. This threshold is used to detect high-confidence malicious attacks or serious insider threat behaviors.

[0264] Level 1 Assessment (Initial Warning): When 30 ≤ S < 60, the system is assessed as low risk. The initial warning is triggered by recording the anomaly (including user ID, time, score, trigger characteristics, etc.) in a structured format to the Elasticsearch security log cluster and immediately sending a notification message to the security administrator via WeChat Work bot.

[0265] Level 2 Assessment (Intermediate Alert and Automatic Intervention): When 60 ≤ S < 85, the system assesses it as medium risk. Triggering an intermediate alert involves the following actions: In addition to logging and notification, the system automatically performs two intervention measures: First, it calls the network device management interface via API to block the user's current session connection; second, it restricts the user's operational permissions via the LDAP protocol interface (e.g., adding them to the "Restricted User Group" to prohibit access to core data resources). Simultaneously, the system calls the report generation service to automatically generate a risk assessment report containing behavioral sequences, correlation graph fragments, and risk analysis.

[0266] Level 3 Assessment (High-Risk Incident Response): When S≥85, the system assesses it as high-risk. In addition to executing all actions of a medium-level alert, the incident response plan will be immediately activated: a highest-priority incident ticket will be created through the SIEM system, and all on-duty security engineers will be forcibly notified through multiple channels such as telephone and SMS. The system will also coordinate with the endpoint detection and response system to perform a deep scan and memory forensics on the user endpoint. This helps in responding to various advanced threats, including zero-day vulnerabilities and lateral movement attacks.

[0267] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0268] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A method for identifying information security risk behaviors based on big data, characterized in that, Includes the following steps: Step S1: Obtain user multimodal behavior data and preprocess the user multimodal behavior data to obtain a structured behavior dataset; Step S2: Construct a behavior sequence based on the structured behavior dataset, perform a visualization transformation on the behavior sequence to generate a behavior sequence image, and extract the behavior features from the behavior sequence image using the ResNet18 model; Step S3: Perform entity recognition and semantic alignment on the behavioral features to obtain behavioral entity representations. Use graph attention network to mine the relationships between entities and construct a behavioral relationship graph. Based on the behavioral relationship graph and a predefined semantic tag library, establish a multi-dimensional behavioral knowledge base. Step S3 specifically includes: Step S31: Perform entity recognition and semantic alignment on the behavioral features. The processing logic includes: Use behavioral features as the initial features of nodes in the graph attention network; By using the learnable transformation matrix in the graph attention network, the 512-dimensional feature vector is mapped to the action semantic space to form a representation of the action entity. The behavioral entity representation includes user identity, operation type, accessed resources, and network protocol; Step S32: Utilize graph attention networks to mine the relationships between behavioral entities and construct a behavioral relationship graph. The processing logic includes: Edge connections of the graph are established based on the co-occurrence relationship, temporal adjacency relationship and feature similarity of behavioral entities in the behavioral sequence; The co-occurrence relationship is when two behavioral entities appear simultaneously within the same behavioral sequence unit and a co-occurrence edge is established. The weight of the co-occurrence edge can be determined based on the number of co-occurrences. The temporal adjacency relationship refers to the occurrence of two behavioral entities in adjacent time steps, and the establishment of a temporal edge. The weight of the temporal edge can be calculated based on the inverse ratio of the time interval. The feature similarity is calculated by the cosine similarity between each vector in the behavioral features. When the similarity exceeds a preset threshold, a similarity edge is established, and the weight of the similarity edge is equal to the similarity value. The attention coefficient between nodes is calculated using a multi-head graph attention mechanism, and the formula is as follows: ； in, Indicates the attention coefficient. Represents a node The 512-dimensional feature vector, The transformation matrix represents the mapping from visual features to the semantic space. Indicates attention weights. Represents a node. Represents nodes Different nodes, This represents the total number of heads of attention. Represents nodes The set of all connected neighboring nodes. This indicates that the attention span starts from the first attention and proceeds to the second attention. One point of attention, Represents a nonlinear activation function; Step S33: Integrate the predefined semantic tag library to form a multi-dimensional behavioral knowledge base. The processing logic includes: Based on a predefined semantic tag library, behavioral features are matched with the predefined semantic tag library to obtain a corresponding semantic tag for each node; The predefined semantic tag library includes behavior categories, risk levels, and contextual tags; The behavior categories include login and file modification; The context labels include working time periods and external network environment; Integrate behavioral features with corresponding semantic tags to generate fused behavioral features; Construct a multi-dimensional behavioral knowledge base to store behavioral entities, behavioral relationship graphs, and semantic tags; Step S4: Based on the prototype-enhanced graph convolutional network model and the multi-dimensional behavior knowledge base, calculate the degree of deviation between the behavior features and the prototype centers of each category, identify abnormal behavior patterns and output the abnormal behavior identification results, and normalize the degree of deviation to obtain the abnormal score. Step S5: Compare the anomaly score with the preset risk indicator threshold to trigger a security alert.

2. The method for identifying information security risk behaviors based on big data as described in claim 1, characterized in that, Step S1 specifically includes: Step S11: Obtain user multimodal behavior data, which includes network traffic, device operation logs, and application behavior sequences; Step S12: Clean, filter and standardize the multimodal behavior data, remove noisy data and fill in missing values ​​to obtain a structured behavior dataset; The structured behavior dataset includes timestamps, user identifiers, user actions, action objects, and contextual feature fields. The user actions include login actions, file access actions, network communication actions, system configuration modification actions, application operation actions, data transmission actions, and account operation actions; The objects of operation include file resources, system resources, network resources, account resources, and application resources; The contextual feature fields include device status, system session, and security policy.

3. The information security risk behavior identification method based on big data as described in claim 1, characterized in that, Step S2 specifically includes: Step S21: Construct a behavior sequence based on the structured behavior dataset; Step S22: Perform a visualization transformation on the behavior sequence to obtain a behavior sequence image; Step S23: Extract behavioral features from the behavioral sequence images using a pre-trained ResNet18 model.

4. The method for identifying information security risk behaviors based on big data as described in claim 3, characterized in that, In step S21, the processing logic for constructing the behavior sequence includes: Based on the structured behavior dataset, the structured behavior dataset is grouped by user identifier and sorted in ascending order by timestamp to form the original behavior trajectory; The original behavioral trajectory is segmented using a sliding time window mechanism, with the time window size set to T minutes and the sliding step size as follows. Minutes are used to treat the structured behavior dataset within each time window as a behavior sequence unit; Feature enhancement processing is performed on each behavioral sequence unit, and the processing logic includes: The frequency of each user action is counted within the time window, and the frequency of each user action is normalized to obtain a frequency vector of user actions. Calculate the timestamp difference between two consecutive user actions, and use the moving average and standard deviation to obtain the time interval feature vector; The operation objects within the time window are counted according to the categories of file resources, system resources, network resources, account resources, and application resources, and the category probability distribution vector is obtained by softmax normalization. The context feature fields are embedded and encoded to obtain behavioral sequence units; In this process, embedding encoding maps context feature fields into low-dimensional continuous vectors using a pre-trained embedding matrix. Organize the behavioral sequence units into a standard sequence data structure to form a behavioral sequence.

5. The method for identifying information security risk behaviors based on big data as described in claim 3, characterized in that, In step S22, the processing logic for the visualization transformation includes: Each user operation behavior in each behavior sequence unit is converted into a corresponding numerical code through a predefined mapping table to form a one-dimensional numerical sequence. The one-dimensional numerical sequence is normalized to compress the numerical range to the interval [0, 255] and converted into grayscale pixel values. Based on the preset image size M×N, calculate the total number of pixels required P=M×N. If the length of the one-dimensional numerical sequence is less than P, fill it with zero values ​​to the length P. If the length of the one-dimensional sequence exceeds P, truncate it to the length P. The space-filling curve algorithm is used to map the one-dimensional pixel value sequence to the two-dimensional image space. The Hilbert curve traversal method is used to fill the pixel values ​​into the M×N two-dimensional grid according to the curve path. The filled 2D grid is converted into a standard image format to generate a behavior sequence image, which is a single-channel grayscale image with a uniform size of 256×256 pixels.

6. The method for identifying information security risk behaviors based on big data as described in claim 3, characterized in that, In step S23, the feature extraction processing logic includes: We used a ResNet18 model that was pre-trained on the large ImageNet image dataset to obtain the network weight parameters; The structural adjustment of the ResNet18 model involves the following processing logic: Remove the fully connected classification layer at the end and use the convolutional and pooling layers as the backbone network for feature extraction; The 256×256 pixel behavior sequence image generated in step S22 is input into the feature extraction backbone network, and the intermediate feature representation of the behavior sequence image is obtained through the forward propagation process. The 512-dimensional feature vector extracted from the output of the last pooling layer of the ResNet18 model is used as the final feature representation of the corresponding action sequence image. The feature extraction process is optimized using a contrastive learning strategy, and its processing logic includes: Apply enhancement transformations to images of the same action sequence to generate enhanced views; The enhancement transformation includes rotation, translation, flipping, and brightness adjustment; Input the enhanced view into the ResNet18 model to obtain the corresponding feature vector representation; Using the contrastive loss function, the cosine similarity between the 512-dimensional feature vectors corresponding to the augmented views generated from the same action sequence images is increased in the feature space. All behavioral sequence images are collected and processed by the ResNet18 model to extract 512-dimensional feature vectors, forming behavioral features.

7. The information security risk behavior identification method based on big data as described in claim 1, characterized in that, Step S4 specifically includes: Step S41: Calculate the prototype center for each category using the prototype enhancement graph convolutional network model. The calculation formula is as follows: ； in, Indicates category The prototype center, Indicates category The sample set, Represents the feature extraction function. Represents the sample feature vector. Indicates category, Indicates category The number of elements in the sample set; Each category includes user operation behavior, operation object, and context feature fields; Step S42: Calculate the deviation of behavioral features from the prototype centers of each category using a distance metric. The distance calculation formula is: ； in, Indicates the behavioral characteristics to be detected. Indicates distance; in, Indicates category The deviation threshold, Indicates category The sample set, Indicates category The number of elements in the sample set, Indicates category The first sample in the sample set One sample, Indicates the sample The feature vector obtained after feature extraction Indicates category The prototype center, Represents the L2 norm; Step S44: Classify behavioral features using the graph convolutional integration module. The processing logic includes: When the distance between a behavioral feature and the center of all known class prototypes exceeds the corresponding deviation threshold, it is determined to be an abnormal behavioral pattern. The hierarchical propagation rule of the graph convolutional network is as follows: ； in, This represents the adjacency matrix with added self-loops. Represents the adjacency matrix. Represents the identity matrix. express The degree matrix, Indicates the first The feature matrix of the layer, This represents a trainable weight matrix. This represents the activation function. Indicates the first The node feature matrix of the layer; Step S45: Output the abnormal behavior identification results. When an unknown malicious behavior is detected, dynamically update the prototype center and recalculate the threshold. The unknown malicious behaviors include zero-day attack exploitation, new malware variant communication, advanced persistent threat activities, anomalous insider threat behaviors, new distributed denial-of-service attack variants, and unknown network protocol abuse behaviors. The deviation is normalized to obtain the anomaly score S.

8. The method for identifying information security risk behaviors based on big data as described in claim 1, characterized in that, Step S5 specifically includes: Step S51: Obtain the anomaly score S and compare the anomaly score S with the preset risk indicator threshold. The preset risk indicator thresholds are respectively denoted as the first threshold θ1, the second threshold θ2, and the third threshold θ3; Step S52: Compare the anomaly score S with the first threshold θ1 to perform the first-level evaluation: If the anomaly score S is less than the first threshold θ1, the evaluation result is safe and the system is operating normally. If the anomaly score S is greater than or equal to the first threshold θ1, a preliminary warning is triggered, the security log is recorded, and the security administrator is notified. Step S53: Compare the anomaly score S with the second threshold θ2 to perform the second-level evaluation: If the anomaly score S is greater than or equal to the first threshold θ1 and less than the second threshold θ2, the assessment result is low risk, and a risk assessment report is automatically generated. If the abnormal score S is greater than or equal to the second threshold θ2, a medium-level alarm is triggered, automatically blocking the current session connection and restricting the user's operation permissions; Step S54: Compare the anomaly score S with the third threshold θ3 to perform a third-level evaluation: If the anomaly score S is greater than or equal to the second threshold θ2 and less than the third threshold θ3, the assessment result is medium risk; If the anomaly score S is greater than or equal to the third threshold θ3, the assessment result is high risk.

9. A big data-based information security risk behavior identification system, used to implement the big data-based information security risk behavior identification method as described in any one of claims 1-8, characterized in that, It includes a data acquisition module, a feature extraction module, a behavioral knowledge base module, a risk identification module, and an early warning and intervention module; The data acquisition module is used to acquire user multimodal behavior data and preprocess the user multimodal behavior data to obtain a structured behavior dataset; The feature extraction module is used to construct behavior sequences based on structured behavior datasets, perform visualization transformation on the behavior sequences to generate behavior sequence images, and extract behavior features from the behavior sequence images using the ResNet18 model. The behavior knowledge base module is used to perform entity recognition and semantic alignment on behavior features to obtain behavior entity representations, use graph attention networks to mine the relationships between entities and construct a behavior relationship graph, and establish a multi-dimensional behavior knowledge base based on the behavior relationship graph and a predefined semantic tag library. The risk identification module is used to calculate the degree of deviation between behavioral features and the prototype centers of each category based on the prototype enhanced graph convolutional network model and multi-dimensional behavioral knowledge base, identify abnormal behavior patterns and output abnormal behavior identification results, and normalize the degree of deviation to obtain an abnormal score. The early warning intervention module is used to trigger a safety warning by comparing the anomaly score with a preset risk indicator threshold.

Images