Simulation sequence generation method, system and equipment based on double genetic transfer matrixes

Abstract

The invention discloses a simulation sequence generation method, system and equipment based on double genetic transfer matrixes. The method comprises the following steps: step 1, converting sequence data into state relation data; step 2, constructing a double transfer matrix; step 3, genetic algorithm optimization; 4, simulation data are generated based on the double matrixes; 5, outputting and applying data; according to the method, the object transfer matrix and the operation transfer matrix are constructed to realize separated modeling of the object and the operation, the genetic algorithm is combined to optimize the double matrixes generation by generation, and the object-operation legality mapping table is matched, so that the flexibility and controllability of the simulation data generation process are greatly enhanced; the generated simulation data effectively keeps the statistical characteristics and sequence structure details of the original data, the diversity of the generated data is improved, the consistency of object-operation combinational logic is guaranteed, the generated simulation data is ensured to be reasonable, large-scale real data does not need to be depended on, and the computing resource requirement is reduced.

Description

Technical Field

[0001] This invention relates to the field of data generation and modeling technology, specifically to a method, system, and device for generating simulated sequences based on a dual genetic transfer matrix. Background Technology

[0002] In applications such as information security, behavioral modeling, and sequence analysis, researchers and system developers often require large, representative datasets for model training and testing. However, in complex sequence data scenarios such as process trees, behavior trees, and attack chains, existing datasets are generally limited in size and type due to factors such as the difficulty of actual data collection, privacy compliance restrictions, and insufficient scenario diversity, making it difficult to meet the actual needs of research and validation.

[0003] In existing technologies, data generation methods mainly include random generation methods based on statistical distributions, transition matrix methods based on Markov chains, and generative models based on deep learning. Statistical distribution-based methods generate samples by modeling the statistical characteristics of existing data. While they can reflect the overall distribution, they struggle to maintain the detailed features of sequence structure and state transitions. Markov chain-based transition matrix methods generate sequence data using the transition probabilities between states. Although they can maintain behavioral patterns to some extent, the generated data is mostly driven by static probabilities, lacking a fine-grained expression of the correlation between objects and operations, resulting in limited data diversity. Deep learning models such as GANs, RNNs, and Transformers can generate complex sequences, but they require large amounts of training data and computational resources, and lack intuitive control over probability structure and interpretability. Therefore, existing methods struggle to simultaneously consider the rationality of object transitions, the diversity of operational behaviors, and dynamic controllability, failing to meet the practical needs of generating complex sequence data. Summary of the Invention

[0004] The purpose of this invention is to provide a method, system, and device for generating simulated sequences based on a dual genetic transfer matrix, in order to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a simulated sequence generation method based on a dual genetic transfer matrix, comprising the following steps: Step 1, converting sequence data into state relationship data; Step 2, constructing a dual transfer matrix; Step 3, optimizing the genetic algorithm; Step 4, generating simulated data based on the dual matrix; Step 5, data output and application.

[0006] In step one above, the input log and behavior sequence data arranged in chronological order are transformed into object-operation state relationship data containing source object, operation type, and target object.

[0007] In step two above, based on the object-operation state relationship data obtained in step one, object transition counting matrices are constructed respectively. The values ​​are then normalized to object transition probability matrices, and operation transition counting matrices are constructed. The values ​​are then normalized to an operation transition probability matrix, and an object-operation legality mapping table is established. ;

[0008] In step three above, the optimal double transition matrix is ​​obtained by generational optimization of the object transition probability matrix and operation transition probability matrix obtained in step two through a genetic algorithm.

[0009] In step four above, the optimal bimatrix obtained in step three and the legality mapping table from step two are used. Generate a simulated sequence dataset;

[0010] In step five above, the simulated sequence dataset generated in step four is output.

[0011] Preferably, in step one, the log needs to be divided into multiple event sequences, each event sequence being in the following form:

[0012]

[0013] in For the source object, For operation type, For the target object.

[0014] Preferably, in step two, the object transition counting matrix elements Representative object Transfer to object The number of times it appears, Used to count the transition frequency between the source and target objects in all event sequences; manipulates the transition counting matrix. elements , representing operation Transfer to operation The number of times it appears, Used to count the adjacency relationships of operation types in a sequence.

[0015] Preferably, in step two, the formula for calculating the normalized probability matrix is:

[0016] Object transition probability matrix:

[0017] Operation transition probability matrix:

[0018] in and All are smoothing coefficients.

[0019] Preferably, in step two, the object-operation validity mapping table elements If the operation meets the following conditions: Legal action on object transfer ,but If operation Illegal action on object transfer ,but .

[0020] Preferably, in step three, the fitness function of the genetic algorithm is:

[0021]

[0022]

[0023] in, Let KL divergence be the distance between the real data and the generated data on the edge distribution. For real datasets With generating datasets Statistical differences in structure in terms of depth and branching degree To generate dataset Internal variability measurement To generate dataset Coverage of rare state transitions; for The weight parameters, for The weight parameters, for The weight parameters, for The weight parameters, and satisfying .

[0024] Preferably, in step four, when generating the simulated sequence dataset, the number of generations and weight parameters of the genetic algorithm can be adjusted to generate simulated sequence datasets with different feature distributions.

[0025] Preferably, in step four, the method for generating simulated data specifically involves: first selecting a starting object and randomly determining the first operation, then performing object transfer, based on... Sample the next object, then perform the operation selection, based on... Sample the next operation and base it on the validity mapping table. Verify the validity; if invalid, return to the object transfer operation to select a new object, and finally perform event composition to generate an event sequence. This data is then added to the simulated sequence dataset, and the process of object transfer, operation selection, and event combination described above is repeated until a termination condition is met, resulting in the simulated sequence dataset. The termination condition is any of the following: a sequence termination marker appears in the generated sequence, or the depth of the generated sequence reaches a preset maximum depth. Trigger a preset stop probability threshold.

[0026] The simulated sequence generation system based on dual genetic transfer matrices includes a data preprocessing module, a dual transfer matrix construction module, a genetic algorithm optimization module, a simulated sequence generation module, and a data output module. The data preprocessing module is used to convert sequence data into state relationship data. The dual transfer matrix construction module is used to construct an initial object transfer probability matrix and an initial operation transfer probability matrix based on the object-operation state relationship data output by the data preprocessing module. The genetic algorithm optimization module is used to optimize the dual transfer matrix construction using a genetic algorithm to obtain the optimal object transfer probability matrix and the optimal operation transfer probability matrix. The simulated sequence generation module is used to generate simulated sequences based on the optimal object transfer probability matrix and the optimal operation transfer probability matrix. The data output module is used to output the simulated sequence dataset to the application layer.

[0027] The simulated sequence generation device based on a dual genetic transfer matrix includes a memory body, a computer program, and a processor body. The memory body stores a computer program that can run on the processor body, and the processor body executes the computer program to implement the above-mentioned generation method.

[0028] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention achieves separate modeling of objects and operations by constructing object transition matrices and operation transition matrices, and combines the generational optimization of the two matrices by genetic algorithms with an object-operation legality mapping table, which greatly enhances the flexibility and controllability of the simulation data generation process. The generated simulation data effectively maintains the statistical characteristics and sequence structure details of the original data, which not only improves the diversity of generated data, but also ensures the consistency of object-operation combination logic, ensuring that the generated simulation data is reasonable, and does not need to rely on large-scale real data, thus reducing the demand for computing resources. Attached Figure Description

[0029] Figure 1 This is a flowchart of the steps of the present invention;

[0030] Figure 2 This is a flowchart of the method of the present invention.

[0031] Figure 3 This is a system structure block diagram of the present invention;

[0032] Figure 4 This is a block diagram of the device structure of the present invention.

[0033] In the diagram: 1. Data preprocessing module; 2. Dual transition matrix construction module; 3. Genetic algorithm optimization module; 4. Simulated sequence generation module; 5. Data output module; 6. Memory unit; 7. Computer program; 8. Processor unit. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] Please see the appendix Figure 1 -Appendix Figure 2 The present invention provides an embodiment of a simulated sequence generation method based on a dual genetic transfer matrix, comprising the following steps: Step 1, converting sequence data into state relationship data; Step 2, constructing a dual transfer matrix; Step 3, optimizing the genetic algorithm; Step 4, generating simulated data based on the dual matrix; and Step 5, data output and application.

[0036] In step one above, the input log and behavior sequence data, arranged in chronological order, are transformed into object-operation state relationship data containing source object, operation type, and target object. The logs need to be divided into multiple event sequences, each in the following format:

[0037]

[0038] in For the source object, For operation type, For the target object;

[0039] In step two above, based on the object-operation state relationship data obtained in step one, object transition counting matrices are constructed respectively. The values ​​are then normalized to object transition probability matrices, and operation transition counting matrices are constructed. The values ​​are then normalized to an operation transition probability matrix, and an object-operation legality mapping table is established. Among them, the object transition counting matrix elements Representative object Transfer to object The number of times it appears, Used to count the transition frequency between the source and target objects in all event sequences; manipulates the transition counting matrix. elements , representing operation Transfer to operation The number of times it appears, The formula for calculating the normalized probability matrix, used to statistically determine the adjacency relationship of operation types in a sequence, is as follows:

[0040] Object transition probability matrix:

[0041] Operation transition probability matrix:

[0042] in and All are smoothing coefficients;

[0043] Object-Operation Validity Mapping Table elements If the operation meets the following conditions: Legal action on object transfer ,but If operation Illegal action on object transfer ,but ;

[0044] In step three above, based on the object transition probability matrix and operation transition probability matrix obtained in step two, the optimal double transition matrix is ​​obtained through generational optimization using a genetic algorithm. The fitness function of the genetic algorithm is:

[0045]

[0046]

[0047] in, Let KL divergence be the distance between the real data and the generated data on the edge distribution. For real datasets With generating datasets Statistical differences in structure in terms of depth and branching degree To generate dataset Internal variability measurement To generate dataset Coverage of rare state transitions; for The weight parameters, for The weight parameters, for The weight parameters, for The weight parameters, and satisfying ;

[0048] In step four above, the optimal bimatrix obtained in step three and the legality mapping table from step two are used. To generate a simulated sequence dataset, the number of generations and weight parameters of the genetic algorithm can be adjusted to generate simulated sequence datasets with different feature distributions. The specific method for generating simulated data is as follows: first, select a starting object and randomly determine the first operation; then, perform object transfer according to... Sample the next object, then perform the operation selection, based on... Sample the next operation and base it on the validity mapping table. Verify the validity; if invalid, return to the object transfer operation to select a new object, and finally perform event composition to generate an event sequence. This data is then added to the simulated sequence dataset, and the process of object transfer, operation selection, and event combination described above is repeated until a termination condition is met, resulting in the simulated sequence dataset. The termination condition is any of the following: a sequence termination marker appears in the generated sequence, or the depth of the generated sequence reaches a preset maximum depth. Triggering a preset stop probability threshold;

[0049] In step five above, the simulated sequence dataset generated in step four is output.

[0050] Please see the appendix Figure 3This invention provides an embodiment of a simulated sequence generation system based on a dual genetic transfer matrix, comprising a data preprocessing module 1, a dual transfer matrix construction module 2, a genetic algorithm optimization module 3, a simulated sequence generation module 4, and a data output module 5. The data preprocessing module 1 converts sequence data into state relation data. When converting sequence data into state relation data, it also maps event types in logs to corresponding objects and operations. If an event contains additional attributes, these attributes are saved as additional attributes of nodes and edges. These additional attributes include process path, user permissions, and file type. The objects and operations are defined according to the application scenario: in a process behavior tree field... In the context of object modeling, objects are INIT, PROC, FILE, REG, IP, and EXIT, and operations are CREATE, READ, WRITE, CONNECT, and KILL. In the context of security event modeling, objects are USER, HOST, SERVICE, and DATABASE, and operations are AUTH_SUCCESS, AUTH_FAIL, PRIV_ESC, MALWARE_DROP, and DATA_EXFIL. These objects and operations can be expanded or refined; for example, FILE can be further refined into CONFIG_FILE, SENSITIVE_FILE, etc. WRITE can be further subdivided into APPEND, OVERWRITE, etc.; the dual transition matrix construction module 2 is used to construct the initial object transition probability matrix and the initial operation transition probability matrix based on the object-operation state relationship data output by the data preprocessing module 1; the genetic algorithm optimization module 3 is used to optimize the dual transition matrix structure through a genetic algorithm, using the object transition probability matrix and the operation transition probability matrix as two segments of chromosome genes, and through selection, crossover, and mutation genetic operations, combined with a fitness function that uses the statistical difference, diversity, and coverage rate between the generated data and the real data as indicators, the optimal dual matrix is ​​obtained generation by generation, thus obtaining the optimal object transition probability matrix and the optimal operation transition probability matrix. The genetic operations are as follows: the selection operation uses tournament selection or roulette wheel selection to select individuals with higher fitness from the current population to enter the next generation; the crossover operation generates new individuals by exchanging the object transition probability matrix and the operation transition probability matrix at the row level; the mutation operation adds random perturbation to some transition probability values ​​and then normalizes them; the simulated sequence generation module 4 is used to generate simulated sequences based on the optimal object transition probability matrix and the optimal operation transition probability matrix; the data output module 5 is used to output the simulated sequence dataset to the application layer, such as for model training and evaluation, algorithm testing, and evaluation of security defense systems.

[0051] Please see the appendix Figure 4The present invention provides an embodiment of an attack detection device based on multi-stage snapshot comparison, comprising a memory body 6, a computer program 7, and a processor body 8. The memory body 6 stores the computer program 7, which can run on the processor body 8. When the processor body 8 executes the computer program 7, it implements the above-mentioned generation method. The memory body 6 may adopt a non-transitory computer-readable storage medium, such as a solid-state drive, a mechanical hard drive, a read-only memory, a random access memory, a smart memory card, a secure digital card, a flash memory card, etc. The computer program 7 is a set of codes that implement the above-mentioned generation method. The processor body 8 may adopt a central processing unit, a microprocessor, a digital signal processor, or other hardware unit with data processing and program execution capabilities.

[0052] Based on the above, the advantages of this invention are as follows: When used, it achieves separate modeling of objects and operations by constructing object transition matrices and operation transition matrices, significantly enhancing the flexibility and controllability of the simulation data generation process; it introduces an object-operation legality mapping table to effectively avoid generating object-operation combinations that do not conform to real logic, ensuring the logical consistency of the generated data; it uses a genetic algorithm to optimize the dual matrices generation by generation, enabling the generated results to maintain the statistical characteristics of the original data while possessing rich diversity; this method can flexibly adapt to various scenarios such as process behavior trees, security event modeling, and user behavior analysis, demonstrating strong adaptability; and it can generate high-quality test data without relying on large-scale real data, significantly reducing data acquisition costs and improving data generation efficiency.

[0053] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A simulated sequence generation method based on a dual genetic transfer matrix, comprising the following steps: Step 1: Transform sequence data into state relationship data; Step 2: Construct a dual transition matrix; Step 3: Optimize using a genetic algorithm; Step 4: Generate simulated data based on the dual matrix; Step 5: Data output and application; Its key features are: In step one above, the input log and behavior sequence data arranged in chronological order are transformed into object-operation state relationship data containing source object, operation type, and target object. In step two above, based on the object-operation state relationship data obtained in step one, object transition counting matrices are constructed respectively. The values ​​are then normalized to object transition probability matrices, and operation transition counting matrices are constructed. The values ​​are then normalized to an operation transition probability matrix, and an object-operation legality mapping table is established. ; In step three above, the optimal double transition matrix is ​​obtained by generational optimization of the object transition probability matrix and operation transition probability matrix obtained in step two through a genetic algorithm. In step four above, the optimal bimatrix obtained in step three and the legality mapping table from step two are used. Generate a simulated sequence dataset; In step five above, the simulated sequence dataset generated in step four is output.

2. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step one, the log needs to be divided into multiple event sequences, each event sequence being as follows: in For the source object, For operation type, For the target object.

3. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step two, the object transition counting matrix elements Representative object Transfer to object The number of times it appears, Used to count the transition frequency between the source and target objects in all event sequences; manipulates the transition counting matrix. elements , representing operation Transfer to operation The number of times it appears, Used to count the adjacency relationships of operation types in a sequence.

4. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step two, the formula for calculating the normalized probability matrix is: Object transition probability matrix: Operation transition probability matrix: in and All are smoothing coefficients.

5. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step two, the object-operation validity mapping table elements If the operation meets the following conditions: Legal action on object transfer ,but If operation Illegal action on object transfer ,but .

6. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step three, the fitness function of the genetic algorithm is: in, Let KL divergence be the distance between the real data and the generated data on the edge distribution. For real datasets With generating datasets Statistical differences in structure in terms of depth and branching degree To generate dataset Internal variability measurement To generate dataset Coverage of rare state transitions; for The weight parameters, for The weight parameters, for The weight parameters, for The weight parameters, and satisfying .

7. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step four, when generating the simulated sequence dataset, the number of generations and weight parameters of the genetic algorithm can be adjusted to generate simulated sequence datasets with different feature distributions.

8. The simulated sequence generation method based on a dual genetic transfer matrix according to claim 1, characterized in that: In step four, the method for generating simulated data is as follows: first, select a starting object and randomly determine the first operation; then, perform object transfer according to... Sample the next object, then perform the operation selection, based on... Sample the next operation and base it on the validity mapping table. Verify the validity; if invalid, return to the object transfer operation to select a new object, and finally perform event composition to generate an event sequence. This data is then added to the simulated sequence dataset, and the process of object transfer, operation selection, and event combination described above is repeated until a termination condition is met, resulting in the simulated sequence dataset. The termination condition is any of the following: a sequence termination marker appears in the generated sequence, or the depth of the generated sequence reaches a preset maximum depth. Trigger a preset stop probability threshold.

9. A simulated sequence generation system based on a dual genetic transfer matrix, comprising a data preprocessing module (1), a dual transfer matrix construction module (2), a genetic algorithm optimization module (3), a simulated sequence generation module (4), and a data output module (5), characterized in that: The data preprocessing module (1) is used to convert sequence data into state relationship data. The dual transition matrix construction module (2) is used to construct the initial object transition probability matrix and the initial operation transition probability matrix based on the object-operation state relationship data output by the data preprocessing module (1). The genetic algorithm optimization module (3) is used to optimize the dual transition matrix structure through a genetic algorithm to obtain the optimal object transition probability matrix and the optimal operation transition probability matrix. The simulated sequence generation module (4) is used to generate a simulated sequence based on the optimal object transition probability matrix and the optimal operation transition probability matrix. The data output module (5) is used to output the simulated sequence dataset to the application layer.

10. A simulated sequence generation device based on a dual genetic transfer matrix, comprising a memory body (6), a computer program (7), and a processor body (8), characterized in that: The memory body (6) stores a computer program (7) that can run on the processor body (8), and the processor body (8) executes the computer program (7) to implement the above-described generation method.

Images