Operation compliance intelligent monitoring method and system based on behavior evolution

Abstract

The invention discloses an operation compliance intelligent monitoring method and system based on behavior evolution, and relates to the technical field of operation monitoring. Comprising the following steps: in a target service system, obtaining operation bottom layer configuration data; analyzing the operation underlying configuration data to obtain an initial operation compliance baseline model; obtaining a real-time process operation sequence of the target operation object in the current time window; calculating a single microscopic deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model; recording all single microscopic deviation vectors of the target operation object in a plurality of continuous time windows; performing operation deviation evolution according to all the single microscopic deviation vectors to obtain a target operation deviation evolution result; according to the method, the operation compliance deviation can be efficiently identified and dynamically adjusted, the trend of the operation behavior can be accurately judged, the potential non-compliance risk is identified, and the system compliance is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of operation monitoring, in particular to an operation compliance intelligent monitoring method and system based on behavior evolution. BACKGROUND

[0002] At present, the existing operation compliance monitoring system mainly relies on historical operation logs to judge violations, but the existing technology has obvious defects: first, if there is a latent violation operation in the historical record, the existing technology will mistakenly think it is normal behavior, thus causing missed judgment of violations; second, the existing technology usually only looks at whether a single operation is out of line, and it is difficult to distinguish between normal business habit changes and long-term, low-frequency hidden exploratory attacks, and it is seriously insufficient in preventing long-term, slow penetration violations; at the same time, direct interception of abnormalities in the existing technology is easy to cause false positives and interrupt business, and is easy to cause alarm, and cannot find out the true purpose of the operator.

[0003] Therefore, an operation compliance intelligent monitoring method and system based on behavior evolution is needed to prevent historical data interference, accurately identify and amplify potential long-term exploratory behavior. SUMMARY

[0004] The present application aims to provide an operation compliance intelligent monitoring method and system based on behavior evolution, which constructs a pure initial baseline through bottom-layer configuration and historical log bidirectional verification, accurately identifies long-term hidden violations using the direction consistency amplification mechanism of micro deviation vectors, and creates a shadow operation compliance baseline model to isolate, induce and finally block suspicious behavior.

[0005] An operation compliance intelligent monitoring method based on behavior evolution, comprising the following steps: In the target business system, operation bottom-layer configuration data is obtained; the operation bottom-layer configuration data is parsed to obtain an initial operation compliance baseline model; The real-time process operation sequence of the target operation object in the current time window is obtained; the single micro deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model is calculated; in a plurality of continuous time windows, all single micro deviation vectors of the target operation object are recorded; operation deviation evolution is performed according to all single micro deviation vectors to obtain a target operation deviation evolution result; The differentiation judgment is performed based on the target operation deviation evolution result, if the target operation deviation evolution result meets the operation compliance safety range, it is judged as normal operation behavior drift, and the real-time process operation sequence is extracted to update the weight of the initial operation compliance baseline model, if the target operation deviation evolution result does not meet the operation compliance safety range, the shadow operation compliance baseline model is constructed based on the initial operation compliance baseline model, the operation non-compliance blocking operation is performed on the target operation object according to the shadow operation compliance baseline model, and the intelligent monitoring of the operation compliance of the target business system is completed.

[0006] As a preferred technical scheme of the present application, the specific steps of analyzing the operation bottom layer configuration data to obtain the initial operation compliance baseline model include: The operation compliance precedence dependency relationship in the operation bottom layer configuration data is extracted through the syntax tree, and the operation static rule topology graph is constructed according to the operation compliance precedence dependency relationship. The compliance behavior operation log of the target business system in a preset historical period is obtained, the historical compliance execution track of the compliance behavior operation log is extracted, the operation compliance execution link in the historical compliance execution track is extracted, the operation call probability and the operation transfer probability in different operation compliance execution links are counted, and the dynamic execution path graph is constructed based on the operation call probability and the operation transfer probability. The operation causal topology graph is obtained by performing the pruning operation on the dynamic execution path graph according to the operation static rule topology graph, the overlapping nodes and the overlapping effective edges are extracted according to the operation static rule topology graph and the dynamic execution path graph, the timing topology features of the operation causal topology graph are extracted, and the initial operation compliance baseline model is trained according to the overlapping nodes, the overlapping effective edges and the timing topology features.

[0007] As a preferred technical scheme of the present application, the specific steps of calculating the single micro deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model include: The real-time process operation sequence is mapped in the initial operation compliance baseline model to obtain a real-time process operation subgraph, and the process operation running features are obtained by performing feature extraction on the real-time process operation sequence. The topological structure difference between the real-time process operation subgraph and the operation causal topology graph is calculated, the structural deviation component is calculated based on the illegal edge or the unauthorized jump node existing in the real-time process operation subgraph but not existing in the operation causal topology graph, and the operation probability distribution divergence between the process operation running features and the initial operation compliance baseline model is calculated as the environmental deviation component. The structural deviation component and the environmental deviation component are orthogonally mapped and spliced in the feature representation space to obtain a single micro deviation vector; wherein, the length of the single micro deviation vector is used to represent the overall deviation amplitude of the real-time process operation sequence; and the pointing angle of the single micro deviation vector in the feature representation space represents the operation behavior deviation type of the real-time process operation sequence.

[0008] As a preferred technical solution of the present application, the specific steps of operation deviation evolution according to all single micro deviation vectors include: The pointing angle of the single micro deviation vector of the adjacent time window in the feature representation space is extracted and calculated to obtain the cosine similarity of the included angle between adjacent single micro deviation vectors; the dispersion of all cosine similarities of the included angle in the continuous time window is calculated to obtain a target behavior evolution operation coefficient; An operation nonlinear amplification function is constructed according to the target behavior evolution operation coefficient; the length of each single micro deviation vector is extracted as a single deviation penalty base on each time window; and all single deviation penalty bases are substituted into the operation nonlinear amplification function for sequence accumulation operation to obtain a target operation deviation evolution result.

[0009] As a preferred technical solution of the present application, the specific steps of operation non-compliance blocking operation of the target operation object according to the shadow operation compliance baseline model include: The subsequent real-time process operation sequence of the target operation object is redirected to the shadow operation compliance baseline model for operation compliance judgment: the target operation object returns a pseudo-compliant operation instruction generated based on the shadow operation compliance baseline model; and the graph topology structure variation trajectory of the subsequent real-time process operation sequence of the target operation object in the shadow operation compliance baseline model is recorded; In a preset continuous time period, the relative topological divergence of the graph structure between the shadow operation compliance baseline model and the initial operation compliance baseline model is continuously calculated; When the relative topological divergence of the graph structure reaches a preset high-risk operation compliance threshold, the operation complete variation trajectory corresponding to the target operation object in the shadow operation compliance baseline model is extracted; and the operation non-compliance blocking operation of the target operation object is performed according to the operation complete variation trajectory.

[0010] As a preferred technical solution of the present application, the specific steps of substituting all single deviation penalty bases into the operation nonlinear amplification function for sequence accumulation operation include: when the evolution synergy coefficient meets the preset direction consistency condition, the single deviation penalty base is subjected to exponential amplification gain before sequence accumulation operation; and when the evolution synergy coefficient meets the preset random fluctuation condition, the single deviation penalty base is subjected to linear gain before sequence accumulation operation.

[0011] An operation compliance intelligent monitoring system based on behavior evolution, comprising: An operation benchmark analysis module comprising a benchmark construction unit and a deviation analysis unit; the benchmark construction unit is configured to obtain operation underlying configuration data in a target business system; the operation underlying configuration data is parsed to obtain an initial operation compliance baseline model; The deviation analysis unit is configured to obtain a real-time process operation sequence of a target operation object within a current time window; calculate a single microscopic deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model; record all single microscopic deviation vectors of the target operation object within a plurality of continuous time windows; perform operation deviation evolution based on all single microscopic deviation vectors to obtain a target operation deviation evolution result; The operation compliance judgment module comprises a compliance judgment unit; the compliance judgment unit is configured to perform differentiation judgment based on the target operation deviation evolution result; if the target operation deviation evolution result meets an operation compliance safety range, it is determined that the operation behavior drift is normal, and the real-time process operation sequence is updated in weight relative to the initial operation compliance baseline model; if the target operation deviation evolution result does not meet the operation compliance safety range, a shadow operation compliance baseline model is constructed based on the initial operation compliance baseline model; operation non-compliance blocking operation is performed on the target operation object based on the shadow operation compliance baseline model, and the operation compliance intelligent monitoring of the target business system is completed.

[0012] The present application has the following advantages: 1. The present application constructs an initial operation compliance baseline model by analyzing the operation underlying configuration data in the target business system, and monitors the behavior deviation of the operation object in real time, which can efficiently identify the operation compliance deviation and dynamically adjust it; by calculating the single microscopic deviation vector in each time window and performing evolution analysis based on multiple deviations, the trend of operation behavior can be accurately judged, potential non-compliance risks can be identified, and system compliance can be ensured.

[0013] 2. The present application constructs a shadow operation compliance baseline model, which can automatically trigger the shadow operation compliance baseline model to block the operation when the operation behavior deviates from the compliance range, prevent the adverse effects of non-compliant operation on the system, and further improve the operation compliance guarantee; by calculating the relative topological divergence of the graph structure, potential high-risk operations can be accurately found and timely processed to ensure the safety of the system and reduce the security risks caused by operation deviation; according to different characteristics, behavior evolution path, environmental changes and other factors of the target operation object, the operation compliance is finely monitored, and personalized compliance analysis and intervention measures are provided. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1A structural schematic diagram of an operation compliance intelligent monitoring system based on behavior evolution for an embodiment of the present application. DETAILED DESCRIPTION

[0015] In order for those skilled in the art to better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.

[0016] Embodiment 1, an operation compliance intelligent monitoring method based on behavior evolution, comprising the following steps: In the target business system, operation underlying configuration data is acquired; the operation underlying configuration data is parsed to obtain an initial operation compliance baseline model; the operation underlying configuration data refers to the basic configuration materials that are pre-set in the development, construction and deployment stages of the target business system and are used to hard-constrain the business process flow transfer order and system access permission; the operation underlying configuration data specifically includes a calling contract file of a business system interface, that is, a specification file that specifies the function interface calling order and parameter passing limit in the business system, a role-based access control policy file, a configuration file that specifies the system menu browsing or data operation permission of users in different posts or levels, and a program source code file that carries the core business flow transfer judgment logic; these data are not dependent on actual operation logs of users and constitute an absolute physical and logical rule set that must be followed by the target business system in an ideal state.

[0017] The specific steps of parsing the operation underlying configuration data to obtain the initial operation compliance baseline model include: Operation compliance precedence dependency relationships in the operation underlying configuration data are extracted through a syntax tree; an operation static rule topology graph is constructed according to the operation compliance precedence dependency relationships. Specifically, the syntax tree is a form of converting complex program code statements into a tree-like hierarchical structure; by traversing each judgment node of the syntax tree, condition judgment statements representing permission verification and interface calling order are identified, so that operation compliance precedence dependency relationships are extracted; the operation compliance precedence dependency relationships refer to the forced precedence logical constraints that a specific operation in a business process must be released by the system after a preceding operation is successfully executed and a specific permission condition is met; each function interface in the target business system is abstracted as a node, and the extracted operation compliance precedence dependency relationships are used as directed edges connecting adjacent nodes to generate an operation static rule topology graph that represents the underlying constraint conditions of the system, which completely depicts all legal operation flow paths of the target business system in theory.

[0018] The operation log of the compliance behavior of the target business system in a preset historical period is acquired; a historical compliance execution track of the compliance behavior operation log is extracted; an operation compliance execution link in the historical compliance execution track is extracted; operation call probability and operation transfer probability in different operation compliance execution links are counted; and a dynamic execution path graph is constructed based on the operation call probability and the operation transfer probability. After the operation log of the compliance behavior of the target business system in a preset historical period is acquired, the original log data is cleaned according to the unique identity of the user, discrete operation actions of the same user in the same login period are concatenated in the order of timestamps, and continuous historical compliance execution tracks are extracted. From the long-period execution track, a short sequence for completing a specific business target, such as a complete order approval process, is further segmented and extracted, which is defined as an operation compliance execution link. In order to quantify the regular state of the operation compliance execution link, the frequency algorithm is used to calculate the frequency of each individual operation node being accessed by the user, that is, the operation call probability. At the same time, the transfer frequency of the operation from the previous node to the specific post-node, that is, the operation transfer probability, is calculated.

[0019] The operation actually occurred in the historical log is taken as a graph node, the real transfer direction is taken as an edge, and the calculated operation call probability and operation transfer probability are taken as the weight attribute values of the corresponding nodes and edges, so as to construct a dynamic execution path graph reflecting the actual operation habits of the user and the real operation state.

[0020] The operation compliance execution link is extracted according to the operation static rule topology graph and the dynamic execution path graph; the time sequence topology features of the operation compliance execution link are extracted; and an initial operation compliance baseline model is trained according to the coincident nodes, the coincident effective edges and the time sequence topology features. The pruning operation of the operation compliance execution link is performed according to the operation static rule topology graph, which is used to filter historical dirty data and immune historical poisoning. The immune historical poisoning refers to the ability of the monitoring system to effectively prevent the normal behavior judgment standard (baseline model) from being contaminated and biased by the malicious behavior or long-term existing irregular habits hidden in the historical log.

[0021] The specific steps are: isomorphic mapping and comparison and verification are performed between the graph structure of the dynamic execution path graph and the graph structure of the operation static rule topology graph; if it is found in the dynamic execution path graph that there is an execution link edge, but the corresponding legal constraint support of the edge cannot be found in the operation static rule topology graph, it is indicated that the link is a polluted path generated due to historical rule violation operations, system vulnerabilities or user illegal and unauthorized operations; at this time, the system will forcibly delete and remove the illegal and rule-violating link from the dynamic execution path graph, and the removal process is a pruning operation; after the pruning operation, the remaining network topology graph absolutely conforms to the permission rule constraints of the underlying system and contains the high-frequency calling habit characteristics of the actual business, so that the operation causal topology graph reflecting the pure and real business core logic is obtained.

[0022] After obtaining the operation causal topology graph, the coincident nodes and coincident effective edges commonly contained in the comparison process of the operation static rule topology graph and the dynamic execution path graph are extracted, which are used as the absolute boundary of the compliant operation in the spatial dimension; at the same time, the average flow time interval distribution and the order law between the operation nodes in the operation causal topology graph are extracted, which are used as the timing topology feature; the above coincident nodes, coincident effective edges and timing topology features are input into the graph neural network algorithm model as training samples for feature representation learning; the graph neural network converts the input discrete graph structure and time features into low-dimensional continuous numerical vectors, and continuously adjusts the parameter weights inside the network through an unsupervised learning mechanism, so that the model can fit and remember the probability distribution of these legal features; when the output feature vector distribution of the model reaches a stable convergence state after multiple iterations, an initial operation compliance baseline model is trained, and the initial operation compliance baseline model has the business causal recognition ability of immunity to known and unknown historical operation poisoning in zero state due to the early exclusion of the interference of illegal logs.

[0023] Obtaining a real-time process operation sequence of a target operation object in a current time window; calculating a single micro deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model; recording all single micro deviation vectors of the target operation object in continuous multiple time windows; performing operation deviation evolution according to all single micro deviation vectors to obtain a target operation deviation evolution result; The specific steps of calculating the single micro deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model include: Mapping the real-time process operation sequence in the initial operation compliance baseline model to obtain a real-time process operation subgraph; extracting features of the real-time process operation sequence to obtain process operation running features; The target operation object generally refers to a specific logged-in user in a business system, an automated operation script, or an external service entity that calls an interface; the current time window refers to a continuous and uninterrupted fixed time monitoring period set by the system (for example, the past five minutes or one hour); the system captures all cross-node access actions triggered by the object within the window through the stream data processing engine, and arranges them in chronological order to form a real-time process operation sequence.

[0024] Each operation node and flow direction in the real-time process operation sequence is projected and compared to the global causal topology space contained in the pre-trained initial operation compliance baseline model; the mapping process is essentially a subgraph isomorphism matching operation, and the system extracts the nodes and edges actually occurring in the sequence to generate a local network graph that only reflects the actual behavior trajectory of the object within the current monitoring period, i.e., a real-time process operation subgraph. The context attributes of the real-time process operation sequence are extracted to extract statistical data such as the login geographic location of the user, the hardware fingerprint of the access device, the frequency and time interval of the operation, and the network hop status. The above non-logical data reflecting operation habits and the network physical environment are collectively referred to as process operation running features.

[0025] The topological structure difference between the real-time process operation subgraph and the operation causal topology graph is calculated, and the structural deviation component is calculated based on the illegal edges or unauthorized jump nodes that exist in the real-time process operation subgraph but do not exist in the operation causal topology graph; the operation probability distribution divergence between the process operation running features and the initial operation compliance baseline model is calculated as the environmental deviation component. Specifically, the system traverses all nodes and edges in the real-time process operation subgraph and compares them one by one with the absolute rule boundaries in the operation causal topology graph; if the system finds a connection that does not exist in the operation causal topology graph (i.e., an illegal edge) in the real-time process operation subgraph during the comparison process, or finds that the user has unauthorized, skipped, or omitted a certain pre-approval node that must be executed and directly accessed the subsequent node (i.e., an unauthorized jump node), the system will trigger the rule punishment mechanism; according to the sensitivity level of the broken business node or the unauthorized span size, different structural penalty weight values are assigned, and these penalty weights are accumulated or nonlinearly fused to calculate a core value that represents the strength of the destruction, tampering, or unauthorized exploration of the underlying business logic. The core value is the structural deviation component.

[0026] The operation probability distribution divergence between the operation running feature and the historical normal operation probability distribution recorded in the initial operation compliance baseline model is calculated, which identifies the case that the user's operation habits or the environment where the user is located are abnormally deviated, although the user complies with the logic of the business process, for example, the user suddenly queries the regular business data at an unusual time and in an unusual place. The operation running feature including the operation frequency, device fingerprint and other unstructured attributes obtained previously is extracted, and the relative entropy algorithm (also known as the Kullback-Leibler divergence) and other mathematical statistical analysis methods are used to measure the coincidence degree and difference area between the real-time probability distribution curve of the running feature in the current time window and the normal historical feature probability distribution curve recorded in the baseline model. The statistical distance value representing the behavior habit drift, network physical environment fluctuation or time frequency change is defined as the environment deviation component.

[0027] The structure deviation component and the environment deviation component are orthogonally mapped and spliced in the feature representation space to obtain a single micro deviation vector. The length of the single micro deviation vector is used to represent the overall deviation amplitude of the real-time process operation sequence. The pointing angle of the single micro deviation vector in the feature representation space represents the operation behavior deviation type of the real-time process operation sequence. Specific data processing operations are that the system constructs a multi-dimensional orthogonal rectangular coordinate system, i.e., a feature representation space, in the memory space, takes the structure deviation component representing the degree of damage to the business logic as an independent coordinate value of one coordinate axis (for example, the horizontal X axis), and takes the environment deviation component representing the operation habits and external environment changes as the coordinate value of the orthogonal coordinate axis (for example, the vertical Y axis) perpendicular to the independent coordinate axis. Through the combination and space projection of the coordinate values, a directed line segment with clear geometric properties, i.e., a single micro deviation vector, is generated in the space. The technical effect of the above feature decoupling and vectorization design is to give the system two key mathematical and physical meanings of deviation degree: the absolute length (i.e., the length) of the single micro deviation vector in the space, which is obtained by the square root of the square sum of the deviation components of each dimension, is used to quantitatively represent the overall deviation amplitude and action intensity of the real-time process operation sequence compared with the normal baseline; and the angle (i.e., the pointing angle) formed by the single micro deviation vector in the multi-dimensional feature representation space and each orthogonal coordinate axis accurately reflects the proportion weight of each deviation component in the overall deviation, so that the specific operation behavior deviation type of the current real-time process operation sequence can be clearly and intuitively represented. For example, if the pointing angle of the vector mainly deviates from the structure deviation axis, it represents a strong logic overstepping attempt mainly aiming at the business rule vulnerability; and if the pointing angle of the vector mainly deviates from the environment deviation axis, it represents an account theft or abnormal login caused by the change of the environment habit.

[0028] The specific steps of operating the deviation evolution according to all single micro deviation vectors include: The pointing angle of the single micro deviation vector of the adjacent time window in the feature representation space is extracted and calculated to obtain the cosine similarity between the adjacent single micro deviation vectors; the dispersion of all the cosine similarities in the continuous time window is calculated to obtain the target behavior evolution operation coefficient; Specifically, the system constructs a feature sequence queue for a specific target operation object in the memory or time series database, and with the passage of time, the single micro deviation vector calculated in each independent time window (such as every ten minutes or every hour) of the object is sequentially pressed into the queue for saving; the pointing angle of the single micro deviation vector generated by the adjacent time windows in the multi-dimensional feature representation space is extracted, and the spatial geometric algebra algorithm is used for calculation, so as to obtain the cosine similarity between the adjacent single micro deviation vectors; the pointing angle represents the specific business type or vulnerability exploration direction of the operation behavior deviation from the baseline, for example, trying to transversely exceed authority or making parameter tampering; and the cosine similarity is calculated by calculating the cosine value of the angle between two adjacent vectors, so as to accurately measure the coincidence degree of the deviation directions of the two operations; if the cosine similarity value is closer to one, it means that the illegal exploration actions of the target operation object in the adjacent two time windows are extremely similar, indicating that it may be conducting repeated and continuous exploratory attacks on the same business system vulnerability.

[0029] The cosine similarity value sequence recorded in the past tens or even hundreds of time windows is analyzed for volatility by using the dispersion evaluation algorithm in statistics such as variance, standard deviation or information entropy; in the business security logic, if a user deviates from the normal baseline due to the change of the job position or the change of the business environment, the deviation direction of each operation is usually chaotic and random business drift, and the calculated dispersion is very large; on the contrary, if a hacker is implementing a hidden short-wave long-period latent penetration, in order to avoid triggering a security alarm, he will only perform extremely small and highly consistent exploration actions every day, and the calculated continuous cosine similarity sequence will be very stable, and the dispersion is very small; the dispersion is converted into the target behavior evolution operation coefficient through the inverse proportion mapping or normalization function, and the value of the coefficient directly represents the strength of the consistency of the long-term behavior exploration of the target operation object.

[0030] According to the target behavior evolution operation coefficient, an operation nonlinear amplification function is constructed; the length of each single micro deviation vector is extracted as the single deviation punishment base of each time window; all the single deviation punishment bases are substituted into the operation nonlinear amplification function for sequence accumulation operation to obtain the target operation deviation evolution result; The specific steps of substituting all single deviation penalty bases into the operation nonlinear amplification function for sequence accumulation operation include: when the evolution coordination coefficient meets the preset direction consistency condition, performing exponential amplification gain on the single deviation penalty base before performing sequence accumulation operation; when the evolution coordination coefficient meets the preset random fluctuation condition, performing linear gain on the single deviation penalty base before performing sequence accumulation operation. When the system determines that the target behavior evolution operation coefficient is extremely high, i.e., meets the preset direction high consistency condition, indicating that the system is suffering from extremely patient same-direction micro-exploration, the system configures the operation nonlinear amplification function as a mathematical function with exponential gain or high power gain characteristics; when the coefficient is extremely low, indicating that the behavior is only chaotic normal business random fluctuation, the system configures it as a normal linear gain or even attenuation filter function; after configuration, the system extracts the absolute length of each single micro-deviation vector of the object generated in each time window from the time sequence queue, i.e., the module length; since the module length represents the action amplitude of the operation deviation from the baseline in physical sense, the system defines it as the single deviation penalty base in each time window; the single deviation penalty base is usually extremely small in value and is often directly ignored or learned as normal noise in traditional security systems.

[0031] All single deviation penalty bases extracted from the continuous time sequence are substituted into the aforementioned configured operation nonlinear amplification function in sequence for sequence accumulation operation, so as to obtain the final target operation deviation evolution result; the specific data processing steps are as follows: using time sequence integration or accumulation summation algorithm, each seemingly insignificant single deviation penalty base in the historical sequence is used as the input variable (base number) of the function, and the single amplification gain value is calculated under the action of exponential or other nonlinear amplification, and then the gain values at all time nodes are accumulated; if the user's behavior is only normal random fluctuation, the small base grows extremely slowly under ordinary linear accumulation, and the evolution result is always below the safe water level; but if the target object performs continuous dozens of times of extremely small latent poisoning operation with high direction consistency, even if the penalty base of each time is only zero point zero one, under the action of the nonlinear exponential amplification mechanism triggered by the direction consistency, the evolution value will experience geometric series explosion after the sequence accumulation of dozens of time windows; the target operation deviation evolution result output by the system finally, which is the explosive growth, successfully amplifies and exposes the long-line hidden penetration attack originally hidden in the massive normal traffic at the numerical level, and provides an absolutely reliable quantitative decision basis for the system to trigger the shadow operation compliance baseline model isolation or violation blocking strategy.

[0032] The differentiation judgment is performed based on the target operation deviation evolution result. If the target operation deviation evolution result meets the operation compliance safety range, it is determined that it is normal operation behavior drift, and the real-time process operation sequence is extracted to update the weight of the initial operation compliance baseline model. If the target operation deviation evolution result does not meet the operation compliance safety range, a shadow operation compliance baseline model is constructed based on the initial operation compliance baseline model. The operation non-compliance blocking operation is performed on the target operation object according to the shadow operation compliance baseline model, and the intelligent monitoring of the operation compliance of the target business system is completed. Specifically, the target operation deviation evolution result obtained through nonlinear amplification and accumulation calculation is compared with the system preset operation compliance safety range threshold in value size. If the evolution result is within the safety range, the system determines that the behavior change of the target operation object is caused by normal operation behavior drift due to reasonable reasons such as business normal iteration and user business trip environment switching. At this time, in order to enable the system to have dynamic adaptive capability, the system extracts the feature data of the real-time process operation sequence, and uses the back propagation mechanism or the incremental learning algorithm to normally iteratively update the network node feature weight inside the initial operation compliance baseline model in the master control running state, so that the baseline model can learn and accept this legal new business habit. On the contrary, if the target operation deviation evolution result exceeds the operation compliance safety range, it indicates that the target object is probably implementing long-term latent poisoning or continuous unauthorized exploration. In order to protect the main model from being polluted by dirty data without directly cutting off the suspicious connection, a non-existing technology sandbox isolation mechanism is triggered at this time, that is, the learning and updating permission of the initial operation compliance baseline model of the master control to the target object is immediately frozen, and a virtual twin model identical to the current master baseline model is directly cloned in the memory and independently divided into a sandbox running environment specially for the suspicious object, that is, the shadow operation compliance baseline model is constructed.

[0033] The specific steps of performing operation non-compliance blocking operation on the target operation object according to the shadow operation compliance baseline model include: Redirecting the subsequent real-time process operation sequence of the target operation object to the shadow operation compliance baseline model for operation compliance judgment: returning the disguised compliance operation instruction generated based on the shadow operation compliance baseline model to the target operation object; recording the graph topology structure variation trajectory of the subsequent real-time process operation sequence of the target operation object inside the shadow operation compliance baseline model; In a preset continuous time period, the graph structure relative topological divergence between the shadow operation compliance baseline model and the initial operation compliance baseline model is continuously calculated; When the graph structure relative topological divergence reaches the preset high-risk operation compliance threshold, the operation complete variation trajectory corresponding to the target operation object in the shadow operation compliance baseline model is extracted; and the operation non-compliance blocking operation is performed on the target operation object according to the operation complete variation trajectory. First, the subsequent access traffic of the target object is intercepted and policy modified at the network application routing or proxy level, and the subsequent real-time flow operation sequence is redirected to the shadow operation compliance baseline model for independent feature matching and operation compliance judgment at the logical level; In order to prevent the suspect object from mistakenly thinking that its hidden overreach or poison detection operation has not been discovered by the defense party and has been successfully accepted by the system bottom logic, the system returns the disguised compliance operation instruction generated based on the shadow operation compliance baseline model to the target operation object; The disguised compliance operation instruction means that the system intercepts illegal cross-node requests, but does not return the real error code of insufficient authority, but simulates the return of operation success or response message containing part of the desensitization false data to the client; While the target object is induced to continue to probe, the system allows the target object's subsequent illegal sequence to continue to pollute and update the shadow operation compliance baseline model in the background, and uses graph node tracking and tracing technology to record in detail the node frequency abnormal surge, permission edge overreach generation and a series of topological form change processes triggered by these malicious traffic in the shadow operation compliance baseline model. The data link generated in this process is the graph topology structure variation trajectory.

[0034] In the preset continuous time period of inducing the target operation object to continuously operate in the shadow sandbox environment, the advanced analysis engine in the system background will continuously calculate the relative topological divergence of the dynamically updated shadow operation compliance baseline model and the initial operation compliance baseline model in the safe frozen state; The specific data processing and analysis steps are as follows: the system extracts the graph node probability distribution matrix and topological connection attribute in the master initial operation compliance baseline model and the current shadow operation compliance baseline model at each time slice, and then calculates the structural distribution probability difference value of the two originally identical digital twin models in the multi-dimensional feature space by using relative entropy algorithm (such as Kullback-Leibler divergence measurement technology) or graph edit distance algorithm; Since the initial operation compliance baseline model is absolutely frozen and remains pure, while the shadow operation compliance baseline model is constantly accepting the illegal evolution operation of the target object, the probability distribution and topological form difference between the two will become larger and larger as the penetration and probing depth of the target operation object increases. The difference value which is continuously integrated with time is the calculated relative topological divergence of the graph structure.

[0035] With the continuous advancement of parallel isolation evolution, the system background will monitor the numerical changes of the relative topological divergence of the graph structure in real time; when the relative topological divergence of the graph structure is continuously rising and finally reaches the system's preset high-risk operation compliance threshold, the system determines the final attack intention of the target operation object, such as trying to touch the core database node, trying to obtain the highest level of approval authority, etc. Long-term penetration purposes have been completely exposed and are beyond doubt; the system immediately terminates the interactive operation of the parallel camouflage trapping environment, and uses the internal data snapshot comparison engine to extract all node probes, permission jumps and illegal edge records generated by the target operation object since it was isolated and redirected from the shadow operation compliance baseline model, and packages and solidifies it into an irrefutable operation complete variation trajectory evidence chain. The system uses the operation complete variation trajectory as the direct basis for determining serious violations, according to the specific threat depth and damaged risk nodes exposed by the trajectory, and links the underlying zero-trust network access control component to execute substantive operation compliance blocking operations including but not limited to physical network connection forced disconnection, current business login session forced logout, user access permission comprehensive downgrade or joining the global blacklist, etc. Thus, under the premise of not interfering with the normal operation of the main business and obtaining complete attack evidence, the operation compliance intelligent monitoring closed loop of the target business system is completely completed.

[0036] In actual technical applications, before the system performs any topological structure comparison or vectorization deviation calculation, due to the heterogeneous data characteristics of the underlying configuration data and real-time log data generated by the target business system, including time stamps, IP address segments, access frequency, device fingerprints, etc. Physical units and dimensions are completely different, the system must first rely on the data preprocessing engine to perform standardized dimension unification and feature normalization algorithms.

[0037] The specific implementation is that for continuous numerical features such as operation execution time and interface call frequency, the system uses the Z-Score standardization algorithm based on Gaussian distribution, that is, first calculate the statistical mean and standard deviation of the feature in the historical compliance behavior operation log, then subtract the mean from the real-time collected feature value and divide by the standard deviation, thereby converting the absolute values with different physical units into dimensionless standardized values with a mean of zero and a variance of one. For discrete classification features such as device model and operation role type, the system uses one-hot encoding or entity embedding neural network layers to map these discrete text labels to a fixed-length continuous real vector space; After completing the dimensional unification, the training of the initial operation compliance baseline model and the deep representation of business features in this embodiment are simulated and implemented based on the graph neural network model architecture and its derived graph sampling and aggregation algorithms. The specific data processing steps are as follows: the system takes the pure operation causal topology graph obtained after the previous bidirectional verification and pruning operation as the initial input data structure of the graph neural network, wherein each legal business operation interface is defined as a node in the graph network, and the inescapable precedence relationship and flow probability between operations constitute a weighted directed edge; the graph neural network model uses the multi-layer perceptron and neighbor node aggregation function deployed internally to weight and fuse the attribute features of the current operation node itself with the timing features of the legal preceding and subsequent nodes within the multi-hop range around it in each forward propagation iteration; in the self-supervised learning training phase of the model, the system continuously fine-tunes the weight parameter matrix inside the graph neural network through the back propagation algorithm, so that the feature vectors of normal compliance links are highly clustered in the multi-dimensional space, thereby firmly fixing the absolute compliance causal logic in the mathematical parameter space distribution of the initial operation compliance baseline model.

[0038] For the calculation process of the single microscopic deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model, the system uses a hybrid calculation model that orthogonally combines the graph edit distance algorithm and the relative entropy algorithm; when calculating the structural deviation component representing logic violation, the system uses the graph edit distance algorithm to accurately measure the minimum structural modification cost required to deform the real-time process operation subgraph into the standard operation causal topology graph; the system internally configures an asymmetric cost penalty matrix, and for illegal edge operations that forcibly insert across the authority boundary in the real-time sequence, the algorithm assigns a very high exponential cost value, thereby calculating a numerical scalar that accurately reflects the strength of the underlying business rule violation.

[0039] At the same time, when calculating the environmental deviation component representing habit drift, the system uses the relative entropy algorithm to calculate the information divergence difference between the real-time feature probability distribution and the normal baseline probability distribution in the model, and the larger this value is, the more serious the deviation of the current operator's network environment or work time from the daily habit; after obtaining these two key numerical scalars, the system uses the spatial vector composition algebraic model in the Cartesian coordinate system to construct a virtual two-dimensional orthogonal feature representation space in the system memory; the system forces the structural deviation component representing the core business logic to be projected as the horizontal axis coordinate, and the environmental deviation component representing the skin behavior fluctuation to be projected as the vertical axis coordinate, and calculates a single microscopic deviation vector that contains both the deviation length (module length) and the deviation type physical direction (direction angle), thereby completely realizing the orthogonal decoupling of the core business overreach and the ordinary environmental fluctuation at the mathematical model level.

[0040] To address long-term, low-frequency, latent poisoning hidden within massive amounts of legitimate requests, the system utilizes a vector space geometric algebra model and a nonlinear dynamic time series amplification algorithm to achieve behavioral evolution and tracking exposure. The specific data analysis steps are as follows: First, the system uses the vector inner product formula to calculate the cosine similarity of the pointing angles of single micro-deviation vectors within two adjacent time windows in the historical queue. Then, it uses a statistical variance model to calculate the dispersion of this cosine similarity sequence over a continuous period. If the variance is extremely small and the cosine value continuously approaches one, the model determines that the target object is making highly regular, repeated, and minute probes in the same vulnerability direction. When the high consistency condition in this direction is met, the system activates the core operational nonlinear amplification function. This function is a nonlinear exponential surge model with a natural constant or a preset hyperparameter greater than one as the base and the continuous time period of the probe or the same-direction synergy coefficient as the exponent.

[0041] Regarding the parallel induction and the calculation of the relative topological divergence of the final graph structure in the shadow operation compliance baseline model, the system relies on digital twin isolation technology and symmetric distribution divergence measurement model in the field of artificial intelligence. Specifically, when the evolution result triggers a high-risk alarm, the system directly calls a deep copy instruction in the sandbox security domain of memory to completely copy all network topology, node characteristics, and weight matrix parameters of the master control initial operation compliance baseline model at the precise millisecond moment of alarm triggering, instantiating it into an independently running shadow operation compliance baseline model object. During subsequent disguised traffic redirection, the frozen and protected initial operation compliance baseline model maintains an absolutely static probability distribution, while the shadow operation compliance baseline model continuously absorbs illegal probing traffic and undergoes internal parameter weight variation shifts. The system analysis engine uses the symmetric distribution divergence measurement model to continuously collect the feature probability output distribution of the two parallel twin models for the same business node and calculates the Jensen-Shannon divergence value between the two distribution forms. Compared with the traditional relative entropy, this algorithm has symmetry and numerical smoothness, and is particularly suitable for evaluating the overall structural differences between two complex models that were originally from the same source but subsequently diverged in evolution path.

[0042] Example 2: An intelligent monitoring system for operational compliance based on behavioral evolution (see [link]). Figure 1 As shown, it includes: The operation benchmark analysis module includes a benchmark construction unit and a deviation analysis unit. The benchmark construction unit is used to obtain the underlying operation configuration data in the target business system and parse the underlying operation configuration data to obtain the initial operation compliance baseline model. The deviation analysis unit is configured to obtain a real-time process operation sequence of a target operation object in a current time window; calculate a single micro deviation vector of the real-time process operation sequence relative to an initial operation compliance baseline model; record all single micro deviation vectors of the target operation object in a plurality of continuous time windows; and perform operation deviation evolution based on the single micro deviation vectors to obtain a target operation deviation evolution result. The operation compliance judgment module includes a compliance judgment unit. The compliance judgment unit is configured to perform differentiation judgment based on the target operation deviation evolution result. If the target operation deviation evolution result meets an operation compliance safety range, it is determined that there is a normal operation behavior drift, and the real-time process operation sequence is used to update the weight of the initial operation compliance baseline model. If the target operation deviation evolution result does not meet the operation compliance safety range, a shadow operation compliance baseline model is constructed based on the initial operation compliance baseline model. An operation non-compliance blocking operation is performed on the target operation object based on the shadow operation compliance baseline model, and intelligent monitoring of operation compliance of the target business system is completed.

[0043] It should be understood that, for those skilled in the art, improvements or changes can be made according to the above description, and all these improvements and changes shall belong to the protection scope of the appended claims of the present application. The parts not described in detail in the specification belong to the prior art known to those skilled in the art.

Claims

1. A method for intelligent monitoring of operational compliance based on behavioral evolution, characterized in that, Includes the following steps: In the target business system, obtain the underlying operation configuration data; parse the underlying operation configuration data to obtain the initial operation compliance baseline model; Obtain the real-time process operation sequence of the target operation object within the current time window; calculate the single micro deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model; record all single micro deviation vectors of the target operation object within multiple consecutive time windows; perform operation deviation evolution based on all single micro deviation vectors to obtain the target operation deviation evolution result; Differentiation judgment is made based on the evolution results of the target operation deviation. If the evolution results of the target operation deviation meet the operational compliance and safety range, it is judged as normal operation behavior drift. The real-time process operation sequence is extracted and the weight of the initial operation compliance baseline model is updated. If the evolution result of the target operation deviation does not meet the operational compliance and safety range, a shadow operation compliance baseline model is constructed based on the initial operation compliance baseline model; and non-compliant operation blocking operations are performed on the target operation object according to the shadow operation compliance baseline model to complete the intelligent monitoring of the operation compliance of the target business system.

2. The intelligent monitoring method for operational compliance based on behavioral evolution according to claim 1, characterized in that, The specific steps for parsing the underlying operational configuration data to obtain the initial operational compliance baseline model include: Extract the operation compliance prerequisite dependencies from the underlying configuration data of the operation using a syntax tree; construct a static rule topology graph of the operation based on the operation compliance prerequisite dependencies; Obtain compliance behavior operation logs of the target business system within a preset historical period; extract historical compliance execution trajectories from the compliance behavior operation logs; extract operation compliance execution links from the historical compliance execution trajectories; calculate the operation invocation probability and operation transfer probability in different operation compliance execution links; construct a dynamic execution path graph based on the operation invocation probability and operation transfer probability. Pruning operations are performed on the dynamic execution path graph based on the static rule topology graph to obtain the causal topology graph of operations. Overlapping nodes and overlapping valid edges are extracted from the static rule topology graph and the dynamic execution path graph. Temporal topological features of the causal topology graph of operations are extracted. An initial operation compliance baseline model is trained based on the overlapping nodes, overlapping valid edges and temporal topological features.

3. The intelligent monitoring method for operational compliance based on behavioral evolution according to claim 2, characterized in that, The specific steps for calculating the single-step micro-deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model include: The real-time process operation sequence is mapped into the initial operation compliance baseline model to obtain the real-time process operation subgraph; features are extracted from the real-time process operation sequence to obtain the process operation operation features. The topological differences between the real-time process operation subgraph and the operation causal topology graph are calculated. The structural deviation component is calculated based on illegal edges or unauthorized jump nodes that exist in the real-time process operation subgraph but not in the operation causal topology graph. The operation probability distribution divergence between the process operation operation characteristics and the initial operation compliance baseline model is calculated as the environmental deviation component. The structural deviation component and the environmental deviation component are orthogonally mapped and concatenated in the feature representation space to obtain a single micro deviation vector. The magnitude of the single micro deviation vector is used to represent the overall deviation magnitude of the real-time process operation sequence. The pointing angle of the single micro deviation vector in the feature representation space represents the deviation type of the operation behavior of the real-time process operation sequence.

4. The intelligent monitoring method for operational compliance based on behavioral evolution according to claim 3, characterized in that, The specific steps for evolving operational bias based on all single micro-bias vectors include: Extract the pointing angle of the single micro deviation vector in the feature representation space of adjacent time windows and calculate it to obtain the cosine similarity of the angle between adjacent single micro deviation vectors; calculate the dispersion of all cosine similarities of the angle within a continuous time window to obtain the target behavior evolution operation coefficients. A nonlinear amplification function is constructed based on the operational coefficients of the target behavior evolution; the magnitude of each single micro deviation vector is extracted as the single deviation penalty base in each time window; all single deviation penalty bases are substituted into the operational nonlinear amplification function for sequential accumulation operation to obtain the target operational deviation evolution result.

5. The intelligent monitoring method for operational compliance based on behavioral evolution according to claim 4, characterized in that, The specific steps for blocking non-compliant operations of the target object based on the shadow operation compliance baseline model include: Redirect the subsequent real-time process operation sequence of the target operation object to the shadow operation compliance baseline model for operation compliance judgment: return the disguised compliant operation instruction generated based on the shadow operation compliance baseline model to the target operation object; record the graph topology variation trajectory of the subsequent real-time process operation sequence of the target operation object within the shadow operation compliance baseline model; Within a preset continuous time period, the relative topological divergence of the graph structure between the shadow operational compliance baseline model and the initial operational compliance baseline model is continuously calculated. When the relative topological divergence of the graph structure reaches the preset high-risk operation compliance threshold, the complete operation variation trajectory corresponding to the target operation object in the shadow operation compliance baseline model is extracted; and non-compliant operation blocking operation is performed on the target operation object according to the complete operation variation trajectory.

6. The intelligent monitoring method for operational compliance based on behavioral evolution according to claim 5, characterized in that, The specific steps for substituting all single deviation penalty bases into the operational nonlinear amplification function for sequence accumulation include: when the evolutionary coordination coefficients meet the preset directional consistency condition, applying an exponential amplification gain to the single deviation penalty bases before performing sequence accumulation; when the evolutionary coordination coefficients meet the preset random fluctuation condition, applying a linear gain to the single deviation penalty bases before performing sequence accumulation.

7. An intelligent monitoring system for operational compliance based on behavioral evolution, characterized in that, It is used to implement the intelligent monitoring method for operational compliance based on behavioral evolution as described in any one of claims 1-6, comprising: The benchmark analysis module includes a benchmark construction unit and a deviation analysis unit; The baseline construction unit is used to obtain the underlying operation configuration data in the target business system, parse the underlying operation configuration data, and obtain the initial operation compliance baseline model. The deviation analysis unit is used to obtain the real-time process operation sequence of the target operation object within the current time window, calculate the single micro deviation vector of the real-time process operation sequence relative to the initial operation compliance baseline model, record all single micro deviation vectors of the target operation object within multiple consecutive time windows, and perform operation deviation evolution based on all single micro deviation vectors to obtain the target operation deviation evolution result. The operation compliance judgment module includes a compliance judgment unit. The compliance judgment unit is used to differentiate and judge based on the evolution result of the target operation deviation. If the evolution result of the target operation deviation meets the operation compliance safety range, it is judged as normal operation behavior drift. The real-time process operation sequence is extracted and the weight of the initial operation compliance baseline model is updated. If the evolution result of the target operation deviation does not meet the operation compliance safety range, a shadow operation compliance baseline model is constructed based on the initial operation compliance baseline model. According to the shadow operation compliance baseline model, the non-compliant operation blocking operation is performed on the target operation object, thus completing the intelligent monitoring of the operation compliance of the target business system.

Images