Network action time sequence causal anomaly detection method, system and device and medium

Abstract

The invention provides a network action time sequence causal anomaly detection method, system and device and a medium, and effectively solves the problems that dependence on predefined features cannot be effectively solved in a network environment, calculation is complex, hidden attack detection is difficult and the like in the prior art. The method comprises the following steps: extracting an action sequence from a weblog in a network to be detected; generating a cross-network segment inevitable path list based on the topological structure of the network to be detected and the dynamic flow data, and screening the action sequence based on the cross-network segment inevitable path list to obtain a key path action sequence; according to the key path action sequence, generating an optimal causal diagram based on the Locade principle, and extracting a plurality of features; and through a pre-trained anomaly detection model, in combination with a pre-captured normal behavior time sequence mode and a normally distributed rolling window mechanism, carrying out anomaly detection on the extracted multiple features to obtain an anomaly detection result so as to complete anomaly detection on the to-be-detected network.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, system, device, and medium for detecting network action timing and causal anomalies. Background Technology

[0002] The cybersecurity field has long faced severe challenges in detecting network attacks, especially the accurate identification of unknown threats and covert attacks, which has become a core problem in ensuring network security. Traditional network anomaly detection methods are based on signature databases or rule engines, with typical examples such as intrusion detection systems like Snort. Their core logic is to identify threats by matching predefined known attack characteristics or behavioral patterns. However, with the continuous evolution and diversification of network attack methods, the limitations of such methods have become increasingly apparent.

[0003] Existing network anomaly detection technologies can be mainly divided into five categories: feature-based detection technologies, machine learning-based detection technologies, network behavior analysis-based technologies, graph neural network-based detection technologies, and isolated forest-based detection technologies. While these technologies each have their own focus, they generally suffer from significant drawbacks: First, they are highly feature-dependent; neither traditional feature-based methods nor machine learning methods relying on feature engineering can effectively address novel and unknown attacks, and deep detection of encrypted traffic is difficult. Second, they have high computational complexity, requiring the processing of a large amount of specific information such as protocols, ports, and IP addresses, resulting in a large number of model parameters and a heavy computational burden, making them unsuitable for edge computing node deployment requirements. Third, they have weak capabilities in identifying covert attacks; covert attacks such as APTs employ seemingly normal behavioral patterns, making them difficult to detect through predefined features or simple behavioral analysis. Fourth, they lack real-time performance, experiencing response delays when processing large-scale network data, failing to meet the needs of real-time threat prevention and control.

[0004] In recent years, the application of machine learning methods such as deep learning in the field of cybersecurity has enabled the learning of potential patterns in data, but it has not yet escaped the constraints of specific feature extraction and cannot fundamentally solve the problem of feature dependence. At the same time, existing methods often focus on the content or behavioral patterns of network traffic, ignoring the temporal causal relationships of network actions themselves, making it difficult to capture the "inevitable traces" of attacks emphasized by the Locard commutation principle.

[0005] In summary, existing technologies cannot effectively solve problems such as reliance on predefined features, computational complexity, and difficulty in detecting covert attacks. There is an urgent need for a new network anomaly detection technology to improve the universality, real-time performance, and accuracy of detection, and to achieve effective identification of unknown threats and covert attacks. Summary of the Invention

[0006] In view of this, the purpose of this application is to provide a method, system, device and medium for detecting network action timing causal anomalies, which effectively solves the problems of existing technologies being unable to effectively solve problems in network environments such as reliance on predefined features, computational complexity and difficulty in detecting covert attacks.

[0007] In a first aspect, embodiments of this application provide a method for detecting causal anomalies in network action sequences, the method comprising: The action type and timestamp information are extracted from the network logs of the network to be detected. The action type is mapped, and the event vectors obtained by the mapping are arranged according to the timestamp information to generate an action sequence. Based on the topology and dynamic traffic data of the network to be detected, a list of necessary cross-network segments is generated. Based on the list of necessary cross-network segments, the action sequence is filtered to obtain the critical path action sequence. An optimal causal graph based on the Locard principle is generated according to the critical path action sequence, and multi-dimensional features are extracted from the temporal causal chain on the optimal causal graph to extract a variety of features. By using a pre-trained anomaly detection model, combined with pre-captured normal behavior time-series patterns and a normal distribution rolling window mechanism, anomaly detection results are obtained by performing anomaly detection on various extracted features, thereby completing the anomaly detection of the network to be detected.

[0008] In conjunction with the first aspect, embodiments of this application provide a first possible implementation of the first aspect, wherein generating an optimal causal graph based on the Locard principle according to the critical path action sequence includes: The actions in the critical path action sequence are used as nodes in the cause-effect graph, and the temporal sequence of the actions is used as the initial edges. The structure of the initial causal graph is iteratively adjusted using a greedy search algorithm until the target score of the initial causal graph reaches the minimum value, thus obtaining the optimal causal graph.

[0009] In conjunction with the first aspect, this application provides a second possible implementation of the first aspect, wherein the structure of the constructed initial causal graph is iteratively adjusted using a greedy search algorithm, including: A bivariate VAR model is established for the critical path action sequence, and the temporal dependencies between actions are determined by Granger causality test; Based on the temporal dependencies, a greedy algorithm is executed to adjust the edges of the initial causal graph, and the target score of the adjusted initial causal graph is calculated for iteration.

[0010] In conjunction with the first aspect, this application provides a third possible implementation of the first aspect, wherein an anomaly detection result is obtained by using a pre-trained anomaly detection model, combined with pre-captured normal behavior time-series patterns and a normally distributed rolling window mechanism, to perform anomaly detection on multiple extracted features, including: The normal behavior time sequence pattern is invoked by the anomaly detection model to reconstruct multiple input features and obtain the reconstruction result; The reconstruction error between the reconstruction result and the input features is calculated, and the reconstruction error is judged by combining the normal distribution rolling window mechanism to obtain the anomaly detection result.

[0011] In conjunction with the first aspect, this application provides a fourth possible implementation of the first aspect, wherein the reconstruction error is determined by combining a normal distribution rolling window mechanism to obtain anomaly detection results, including: The reconstruction error condition is updated in real time using a normal distribution rolling window mechanism, and it is determined whether the reconstruction error meets the reconstruction error condition. If so, an anomaly is detected in the temporal causal chain, and the anomaly type is marked on the temporal causal chain.

[0012] In conjunction with the first aspect, this application provides a fifth possible implementation of the first aspect, wherein multi-dimensional feature extraction is performed from the temporal causal chain on the optimal causal graph to extract multiple features, including: Traverse all temporal causal chains on the optimal causal graph, divide them into segments according to a preset time window, and extract features of multiple dimensions on the optimal causal graph segment by segment; The features of the multiple dimensions are preprocessed to conclude feature extraction based on the preprocessed features of the multiple dimensions.

[0013] In conjunction with the first aspect, this application provides a sixth possible implementation of the first aspect, wherein generating a list of necessary cross-network segment paths based on the topology and dynamic traffic data of the network to be detected includes: Based on the aforementioned topology and dynamic traffic data, the weighted traffic betweenness centrality of each node in the network to be detected is calculated. Based on the weighted traffic betweenness centrality, key nodes are selected from each node to generate a list of necessary paths across network segments.

[0014] Secondly, embodiments of this application provide a network action timing causal anomaly detection system, the system comprising: The mapping module is used to extract action type and timestamp information from the network logs of the network to be detected, map the action type, arrange the mapped event vectors according to the timestamp information, and generate an action sequence. The generation module is used to generate a list of necessary cross-network segments based on the topology and dynamic traffic data of the network to be detected, and to filter the action sequence based on the list of necessary cross-network segments to obtain the critical path action sequence. The extraction module is used to generate an optimal causal graph based on the Locard principle according to the key path action sequence, and to extract multiple features from the temporal causal chain on the optimal causal graph. The detection module is used to perform anomaly detection on various extracted features by combining a pre-trained anomaly detection model with pre-captured normal behavior time sequence patterns and a normal distribution rolling window mechanism to obtain anomaly detection results, thereby completing the anomaly detection of the network to be detected.

[0015] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of any of the network action timing causal anomaly detection methods described above are performed.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of any of the network action timing causal anomaly detection methods described in the present application.

[0017] This application provides a method for detecting network action temporal causal anomalies. The method first extracts action types and timestamp information from network logs in the network to be detected, maps the action types, and arranges the mapped event vectors according to the timestamp information to generate an action sequence. Second, it generates a list of necessary cross-network segment paths based on the topology and dynamic traffic data of the network to be detected, and filters the action sequences based on this list to obtain critical path action sequences. Then, it generates an optimal causal graph based on the Locard principle according to the critical path action sequences, and extracts multiple features from the temporal causal chains on the optimal causal graph. Finally, it uses a pre-trained anomaly detection model, combined with pre-captured normal behavior temporal patterns and a normally distributed rolling window mechanism, to perform anomaly detection on the extracted features to obtain anomaly detection results, thus completing the anomaly detection of the network to be detected. Based on the above methods, this application combines the Locard switching principle with temporal causal analysis to achieve network anomaly detection. This not only solves the feature dependency problem—eliminating the need to rely on specific content features such as protocols, ports, and IPs, but also focuses solely on the temporal existence of network actions—effectively identifying unknown threats and new attacks, overcoming the limitations of lagging feature database updates; it also reduces computational complexity, eliminating the need to process large amounts of redundant traffic information, reducing the number of model parameters, and adapting to edge computing node deployments; it also improves the ability to identify covert attacks, capturing the temporal causal relationships of network actions and accurately identifying seemingly normal covert attacks such as APTs; it enhances real-time performance, simplifies data processing, quickly responds to network anomalies, and reduces threat response latency; and it further improves encrypted traffic processing capabilities, achieving effective detection without deep analysis of encrypted traffic content, adapting to the current network environment with an increasing proportion of encrypted traffic. Therefore, this application has strong versatility, adapting to networks with different topologies, without requiring model adjustments for specific network scenarios, thus expanding its application scope. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a network action timing causal anomaly detection method provided in an embodiment of this application is shown. Figure 2 A schematic diagram of the process for generating a critical path action sequence provided in an embodiment of this application is shown; Figure 3A flowchart illustrating the optimal cause-effect graph provided in an embodiment of this application is shown; Figure 4 This paper shows a structural diagram of a network action timing causal anomaly detection device provided in an embodiment of this application; Figure 5 A structural diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0021] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0023] In the current network environment, the proportion of encrypted traffic continues to increase, further exacerbating the difficulty of detection. Many shortcomings of existing technologies have resulted in obvious vulnerabilities in network security protection, which cannot meet the security and control needs in complex scenarios and cannot effectively solve problems such as reliance on predefined features, computational complexity, and difficulty in detecting covert attacks. Therefore, it is urgent to develop new and efficient network anomaly detection solutions.

[0024] Based on this, embodiments of this application provide a method, system, device, and medium for detecting network action timing causal anomalies, which are described below through embodiments.

[0025] Example 1 To facilitate understanding of this embodiment, a method for detecting network action temporal causal anomalies disclosed in this application will first be described in detail. For example... Figure 1 The diagram shows a flowchart of a method for detecting temporal causal anomalies in network actions. This application provides a method for detecting temporal causal anomalies in network actions, the method comprising: S101. Extract action type and timestamp information from the network logs of the network to be detected, map the action type, arrange the mapped event vectors according to the timestamp information, and generate an action sequence. S102. Generate a list of necessary cross-network segments based on the topology and dynamic traffic data of the network to be detected, and filter the action sequence based on the list of necessary cross-network segments to obtain the critical path action sequence. S103. Generate an optimal causal graph based on the Locard principle according to the critical path action sequence, and extract multiple features from the temporal causal chain on the optimal causal graph. S104. By using a pre-trained anomaly detection model, combined with pre-captured normal behavior time-series patterns and a normal distribution rolling window mechanism, anomaly detection results are obtained by performing anomaly detection on the extracted features to complete the anomaly detection of the network to be detected.

[0026] In step S101, based on the Locard switching principle, the generation or termination of any network action (such as connection establishment or disconnection) inevitably leaves a time-series trace. These traces manifest as a lack of completeness in the action chain (e.g., no disconnection after connect) or abnormal additions (e.g., connect occurring outside of working hours), rather than the action content itself. Therefore, by focusing on the temporal existence of actions (e.g., connect occurs, disconnection does not occur), the inevitable traces of abnormal behavior can be captured without relying on specific content features such as protocols, ports, or IPs. Thus, this application obtains network logs from the network to be detected. These network logs contain various operation records during network communication, covering relevant information such as action execution, time nodes, and communication associations. There is no need for deep analysis of the logs (e.g., protocol analysis, IP analysis, etc.), avoiding the introduction of redundant calculations. Secondly, the collected raw network logs are filtered to remove redundant fields unrelated to the temporal characteristics of network actions, such as protocol type, port number, IP address, and packet size. Only the core information is extracted, namely the network action type and the corresponding timestamp information. The action type includes, but is not limited to, specific content features such as protocol type, port number, IP address, and packet size. For core network operations such as network connection establishment (connect), connection disconnection (disconnect), path addition (new_path), and path deletion (delete), the action types are then mapped, i.e., vectorized, to obtain points in the vector space corresponding to the action types. These points are the event vectors. For example, one-hot mapping is used to convert the action types into binary vectors, such as network connection establishment connect → [1,0,0,0], connection disconnection disconnect → [0,1,0,0]. This ensures that the action types can be recognized and processed by subsequent models, while avoiding computational redundancy caused by textual representations of action types. Finally, the event vectors are arranged according to time windows to form a Hankel matrix, i.e., a snapshot matrix X, forming the mathematical representation of the network action sequence. ; in, Here, m is the event vector, m is the time window length, and N is the total number of events. The network action sequence only retains the temporal existence characteristics of network actions and does not contain any specific content related to protocols or ports. This provides standardized input data for subsequent critical path filtering and temporal causal chain construction, while reducing computational complexity from the source. Furthermore, it captures the dynamic patterns of the network action sequence by constructing a state matrix A. ; in, =[ , , , ], =[ , , , ], , , yes The singular value decomposition (SVD) results, and also the snapshot matrix Perform SVD decomposition to extract dominant modes: ; Preservation of the first r-order principal components This results in a dimensionality-reduced representation of the action sequence: ; Where, r N is the number of principal components retained, which is determined by the energy contribution rate.

[0027] In step S102, after obtaining the network action sequence, this application collects complete topology data and real-time dynamic traffic data of the network to be detected. The topology data includes the distribution of all nodes and network segments in the network to be detected, as well as the connection relationships between nodes, clarifying the location attributes and connectivity paths of each node. The dynamic traffic data includes real-time operational data such as communication traffic and path occupancy of each node within a preset time window, such as 5 minutes, used to characterize the actual activity level of each node. Then, based on the topology and dynamic traffic data of the network to be detected, a list of necessary cross-network segment paths is generated. Finally, the action sequence is filtered based on the list of necessary cross-network segment paths to obtain a critical path action sequence. Specifically, the critical path action sequence is obtained based on the following steps: Figure 2 As shown, the association between the network action sequence and the nodes on the network to be detected is first established, clarifying the network node corresponding to each action in the action sequence. Then, the entire network action sequence is traversed, and the event vectors corresponding to actions occurring on nodes outside the list of necessary paths across network segments are removed. Only the event vectors corresponding to actions occurring on nodes in the list of necessary paths are retained, while keeping the timestamp order of the remaining event vectors unchanged, forming a filtered critical path action sequence. This critical path action sequence focuses on the core critical nodes of the network to be detected, eliminating redundant non-critical node action information. This not only preserves the temporal causal characteristics of network actions but also further reduces the computational complexity of subsequent temporal causal chain construction and anomaly detection. At the same time, it ensures that subsequent analysis focuses on the necessary paths of attack behavior, improving the accuracy of anomaly detection.

[0028] In a specific implementation of step S102, one embodiment is as follows: A list of necessary cross-network segment paths is generated based on the topology and dynamic traffic data of the network to be detected, including: S1021. Based on the topology and dynamic traffic data, calculate the weighted traffic betweenness centrality of each node in the network to be detected; S1022. Based on the weighted traffic betweenness centrality, filter from each node to obtain key nodes to generate a list of necessary paths across network segments.

[0029] In steps S1021-S1022, this application first calculates the betweenness centrality of each node in the network to be detected based on the following formula: ; in, It is the total number of shortest paths from s to t. It is the number of paths passing through node v, which is normalized as follows: ; or ; Where N is the total number of nodes in the network to be detected; The traffic weight of each node is also calculated based on the following formula: ; in, Where I is the time window length (e.g., 5 minutes), and I is the indicator function. The weighted flow betweenness centrality of each node is calculated by combining the betweenness centrality of each node and the flow weight. ; in, It is the total flow, which is filtered from each node based on the weighted flow betweenness centrality, that is: ; in, The threshold (e.g., 0.8) determines whether a node is a critical node if its weighted traffic betweenness centrality is greater than the threshold. Multiple critical nodes are then integrated to generate a list of necessary cross-network segment paths. This list is calculated hourly to adapt to network topology changes. This mechanism identifies critical paths in the network through betweenness centrality and dynamic traffic weight analysis, serving as anchor points for time-series analysis. These necessary cross-network segment paths are critical nodes in the network topology, and attacks inevitably pass through them. By identifying these necessary paths, time-series causal analysis can focus on the inevitable paths of attacks, improving detection accuracy. Betweenness centrality quantifies a node's control capability in the network, while dynamic traffic weight analysis captures actual active communication chains.

[0030] In step S103, after obtaining the critical path action sequence, this application generates an optimal causal graph based on the Locard principle. Specifically, it constructs a temporal causal chain corresponding to the network action sequence based on the Granger causality test and the F-GES model, thereby identifying abnormal interruptions and additions in network actions. The temporal causal relationship of network actions is the manifestation of the Locard principle in cyberspace. For example, under normal circumstances, a disconnect event will inevitably occur after a connect event, forming a complete causal chain. Under abnormal circumstances, this causal chain may be interrupted, such as no disconnect event occurring after a connect event, or abnormal additions may occur, such as a connect event occurring outside of working hours. By constructing a temporal causal chain... The chain can quantify these abnormal traces without relying on the action content, and extract multiple features from the temporal causal chain on the optimal causal graph. The extracted features include the causal gap (causal_gap) corresponding to the causal association dimension: the time difference (in seconds) between the current connect event and the most recent disconnect event; the event frequency ratio (event_freq_ratio) corresponding to the temporal distribution dimension: the ratio of the frequency of connect events in the current window to the historical baseline frequency; and the causal chain violation rate (causal_chain_violation) corresponding to the structural feature dimension: the proportion of connect events in the current window that have no disconnect.

[0031] In the specific implementation of step S103, one embodiment is as follows: Figure 3 As shown, generating an optimal causal graph based on the Locard principle according to the critical path action sequence includes: A1. Use the actions in the critical path action sequence as nodes in the cause-effect graph, and use the temporal sequence relationship between actions as the initial edge; A2. The structure of the initial causal graph is iteratively adjusted using a greedy search algorithm until the target score of the initial causal graph reaches the minimum value, thus obtaining the optimal causal graph.

[0032] In steps A1-A2, this application preprocesses the obtained critical path action sequence to remove outliers and noise data. Specifically, it removes event vectors with abnormal timestamps (such as incorrect timestamps or timestamps outside the normal time range) and abnormal action types (such as undefined action types). At the same time, it supplements the missing temporal correlation information in the critical path action sequence to ensure the integrity and temporal coherence of the sequence, laying the data foundation for the generation of the optimal cause-effect graph. After preprocessing, the retained critical path action sequence only contains the effective network actions and corresponding temporal information on the key nodes. Focusing on the core analysis object, each action in the critical path action sequence is used as a node of the cause-effect graph, and the temporal relationship between actions is used as the initial edge. That is, if action 1 is earlier than action 2 in timestamp and there is a potential logical relationship between the two (such as the connect action is likely to be followed by the disconnect action), then an initial causal edge is established between action 1 and action 2 to form the initial cause-effect graph structure. The initial causal graph initially reflects the temporal correlation of network actions on the critical path, providing a basic framework for subsequent optimization. The greedy search algorithm of F-GES combined with BIC scoring is used to optimize the initial causal graph. The structure of the constructed initial causal graph is iteratively adjusted, such as deleting redundant causal edges, i.e., removing edges that do not contribute to the representation of causal relationships and lead to an increase in BIC score, and adding missing effective causal edges, i.e., adding edges that can improve the accuracy of causal relationship representation and reduce BIC score, until the target score of the initial causal graph reaches the minimum value, generating the optimal causal graph.

[0033] In the specific implementation of step A2, one embodiment is as follows: the structure of the initial causal graph constructed is iteratively adjusted using a greedy search algorithm, including: A21. Establish a bivariate VAR model for the critical path action sequence and determine the temporal dependency between actions through Granger causality test; A22. Based on the temporal dependency, execute a greedy algorithm to adjust the edges of the initial causal graph, and calculate the target score of the adjusted initial causal graph for iteration.

[0034] In steps A21-A22, this application establishes a bivariate VAR model for the critical path action sequence, that is, for the critical path action sequence Establish a vector autoregressive model: ; Where L is the lag order, This is the error term. The F-value between actions is calculated using the Granger causality test to verify and determine the causal relationship between actions. ; in, and These are the sum of squared residuals for the simplified model and the full model, respectively. p is the number of new parameters (lag order L × number of variables), q is the total number of parameters, and n is the sample size. Then we reject the null hypothesis. The reason why connect is determined to be a Granger of disconnect is that connect is disconnect.

[0035] The BIC value of the initial causal graph is calculated based on the Bayesian Information Criterion (BIC) scoring method to evaluate the structure of the initial causal graph: ; Where k is the number of model parameters (number of edges × number of conditional probability parameters), L is the maximum likelihood value, and n is the sample size. For example, the number of conditional probability parameters for a bivariate variable is... .

[0036] The initial causal graph is then modified by adding or removing edges using a greedy search algorithm. The BIC value is calculated again, and the directed acyclic graph (DAG) with the minimum BIC value is selected as the optimal causal graph.

[0037] In the specific implementation of step S103, another embodiment is as follows: multi-dimensional feature extraction is performed from the temporal causal chain on the optimal causal graph to extract various features, including: B1. Traverse all temporal causal chains on the optimal causal graph, divide them into segments according to the preset time window, and extract the features of multiple dimensions on the optimal causal graph segment by segment. B2. Preprocess the features of the multiple dimensions to end feature extraction based on the preprocessed features of the multiple dimensions.

[0038] In steps B1-B2, this application sets up a causal association dimension, a temporal distribution dimension, and a structural feature dimension for all temporal causal chains on the most causal graph. The causal association dimension extracts the association strength of the causal edges in each causal chain, that is, the tightness of the causal relationship between two actions, which is obtained by calculating the temporal correlation coefficient between actions. The higher the association strength, the more significant the causal dependence between the two actions. The temporal distribution dimension extracts the time interval of causal events (i.e., the time difference between two adjacent actions with a causal relationship) and the occurrence frequency (i.e., the number of times a certain causal chain is triggered per unit time), which is used to characterize the temporal pattern of normal network behavior. The structural feature dimension extracts the length of each causal chain (i.e., the number of action nodes contained in the causal chain) and the number of branches (i.e., the number of causal edges extended from a certain action node), reflecting the complexity of the causal chain. The fourth dimension is the anomaly tendency dimension, which extracts the causal chain breakage rate (i.e., the ratio of the number of times the causal chain is not triggered according to normal logic within a preset time window to the total number of triggers) and the causal edge validity (i.e., the proportion of causal edges that pass the Granger causality test), which is directly related to the subsequent anomaly detection requirements. This application also normalizes the extracted multi-dimensional features, mapping each feature to the same numerical range to eliminate the dimensional differences between different features and avoid subsequent model detection bias due to differences in feature values. At the same time, redundant and invalid features are removed through feature selection algorithms, retaining the core features that can best distinguish between normal and abnormal behavior, resulting in a variety of extracted features. These extracted features must be able to comprehensively reflect the temporal causal rules of network actions, providing standardized and high-quality feature inputs for subsequent anomaly judgment based on anomaly detection models.

[0039] In step S104, this application utilizes a pre-trained anomaly detection model, which is an LSTM-GRU hybrid architecture model, combined with attention mechanisms and weight sharing techniques, to achieve efficient analysis of temporal causal features. The LSTM-GRU hybrid architecture combines the long-term memory capability of LSTM with the lightweight characteristics of GRU, balancing detection accuracy and real-time performance. The model is pre-trained using the critical path action sequences, multi-dimensional features, and corresponding normal behavior labels of the network under normal operating conditions. During training, the temporal patterns of normal network behavior are captured and saved simultaneously. These pre-captured temporal patterns are essentially the temporal causal rules of network actions on the critical path under normal network conditions, including the normal distribution range of features such as causal gaps, event frequency ratios, and causal chain break rates, as well as the normal causal relationship logic between actions. These serve as the benchmark for subsequent anomaly detection. When an anomaly is identified, the pre-captured temporal patterns of normal behavior and the normal distribution rolling window mechanism are combined to perform anomaly detection on the extracted features to obtain anomaly detection results. This detects whether there are abnormal interruptions or additions in the causal chain. The abnormal behavior of the network under test manifests as a specific pattern in the temporal causal chain. For example, the causal chain of connect→disconnect during normal operating time has a stable periodicity, while abnormal behavior will cause this periodicity to be broken. By capturing these temporal patterns using an RNN model, abnormal behavior can be detected. For example, if no disconnect event occurs within 5 minutes after a connect event, it is marked as a temporal causal anomaly, thus completing the anomaly detection of the network under test.

[0040] In the specific implementation of step S104, one embodiment is as follows: using a pre-trained anomaly detection model, combined with pre-captured normal behavior time-series patterns and a normally distributed rolling window mechanism, anomaly detection results are obtained by performing anomaly detection on multiple extracted features, including: S1041. The normal behavior time sequence pattern is called through the anomaly detection model to reconstruct the multiple input features and obtain the reconstruction result; S1042. Calculate the reconstruction error between the reconstruction result and the input features, and use the normal distribution rolling window mechanism to determine the reconstruction error to obtain the anomaly detection result.

[0041] In steps S1041-S1042, this application uses the anomaly detection model to call the normal behavior time sequence pattern and reconstructs multiple input features to obtain the reconstruction result. The first layer (GRU) of the anomaly detection model processes short-term causal dependencies (such as a single connection timeout without disconnection). ; ; ; ; in, It is the input weight matrix. , , It is the hidden state weight matrix. It is the Hadamard product. It is the sigmoid activation function. To reset the door, To update the door, In the candidate hidden state, The hidden state at the current time step. The input features are for the current time step. The hidden state of the previous time step is represented by tanh, which is the hyperbolic tangent activation function; the second layer (LSTM) of the anomaly detection model captures long-term causal dependencies (such as multiple consecutive connections that have not been broken). ; ; ; ; ; in, , , , It is the input weight matrix. , , , It is the hidden state weight matrix. , , It is a bias vector. For input gate, For the Gate of Oblivion In cellular state, This represents the cell transition at the previous time step. For output gate, The hidden state at the current time step; the third layer (GRU) of the anomaly detection model: integrates contextual information to enhance sensitivity to causal breaks: ; in, It is a shared hidden layer weight matrix, which enables parameter sharing to reduce model complexity. This represents the final hidden state of the third-layer GRU at the current time step. This represents the hidden state output by the second LSTM layer. This is the hidden state of the third-layer GRU at the previous time step. The ) indicates a call to the GRU unit; the anomaly detection model is also based on a causal attention mechanism and a lower triangular mask matrix (M) to ensure that the attention weights only focus on past time steps: ; ; ; Where (H) is the hidden state matrix, , , It is a learnable weight matrix, and d is the hidden layer dimension. This represents the attention weight matrix in the attention mechanism; Q, K, and V are the Query, Key, and Value in the attention mechanism, respectively.

[0042] The anomaly detection model uses pre-captured normal behavior time-series patterns as a benchmark to reconstruct various input features, obtaining a reconstruction result. The reconstructed result is then compared and analyzed with the normal behavior time-series patterns to calculate the degree of deviation between the input features and the normal pattern, thus obtaining the reconstruction error. The anomaly detection model outputs the reconstruction error (MSE) at the current time step. t The larger the reconstruction error, the greater the deviation between the current network behavior and normal behavior, and the higher the probability of an anomaly. A rolling window mechanism based on a normal distribution is introduced to perform real-time statistics and anomaly threshold determination on the reconstruction error output by the model, compensating for the poor adaptability of fixed thresholds. When the reconstruction error value exceeds the dynamic threshold, it is determined to be an anomaly, as shown below: ; That is, the reconstruction error MSE at the current time step. t Compared with the dynamic anomaly detection threshold τ, if MSE t If ≤ τ, the current network behavior is determined to be normal, and a "normal" detection result is output; if MSE t >τ determines that the current network behavior is abnormal and outputs the "abnormal" detection result.

[0043] In the specific implementation of step S1042, another embodiment is as follows: The reconstruction error is determined by combining a normal distribution rolling window mechanism to obtain anomaly detection results, including: S10421. The reconstruction error condition is updated in real time through a normal distribution rolling window mechanism, and it is determined whether the reconstruction error meets the reconstruction error condition. S10422. If so, then an anomaly is detected on the temporal causal chain, and the anomaly type is marked on the temporal causal chain.

[0044] In steps S10421-S10422, the reconstruction error condition preset in this application is updated in real time through a normal distribution rolling window mechanism. The reconstruction error condition is based on a dynamic threshold mechanism to avoid manual setting. This application sets a preset rolling window length, such as 10 minutes. The historical data of reconstruction error is maintained in real time through this window, and the historical mean of reconstruction error within the rolling window is calculated step by step. ) and historical standard deviation ( The calculation formulas are as follows: ; ; Where γ is the smoothing coefficient (e.g., 0.9) used to balance the weights of historical and current data, MSE t The reconstruction error at the current time step, based on the normal distribution assumption, is calculated using the formula... The system automatically calculates the dynamic anomaly detection threshold τ (where z is a multiple of the standard deviation, such as 3, which can be adjusted according to the required detection accuracy). This threshold is dynamically adjusted in real time as the scrolling window updates, adapting to changes in the operating status of the network under test and avoiding misjudgments or missed judgments caused by fluctuations in the network environment. It also incorporates the reconstruction error MSE of the current time step. t The anomaly detection result is obtained by comparing it with the dynamic anomaly detection threshold τ: if MSE t If ≤ τ, the current network behavior is determined to be normal, and a "normal" detection result is output; if MSE t >τ determines that the current network behavior is abnormal, outputs an "abnormal" detection result, and annotates the abnormal features, such as an excessive causal chain break rate, abnormal causal gaps, and corresponding critical path nodes, providing accurate guidance for subsequent threat investigation. The above process is repeated to continuously detect multiple features extracted at each time step, achieving real-time, dynamic anomaly detection of the network under investigation, comprehensively covering the identification needs of unknown threats and covert attacks.

[0045] Example 2 This application also provides a network action timing causal anomaly detection system, such as... Figure 4 The diagram shows a block diagram of a network action temporal causality anomaly detection system. The system implements functions corresponding to the steps described above in executing a network action temporal causality anomaly detection method on a terminal device. This device can be understood as a server component including a processor. The network action temporal causality anomaly detection system described in this application includes: The mapping module 401 is used to extract action type and timestamp information from the network logs in the network to be detected, map the action type, arrange the mapped event vectors according to the timestamp information, and generate an action sequence. The generation module 402 is used to generate a list of necessary cross-network segments based on the topology and dynamic traffic data of the network to be detected, and to filter the action sequence based on the list of necessary cross-network segments to obtain a critical path action sequence. The extraction module 403 is used to generate an optimal causal graph based on the Locard principle according to the key path action sequence, and to extract multiple features from the temporal causal chain on the optimal causal graph. The detection module 404 is used to perform anomaly detection on the extracted features by combining a pre-trained anomaly detection model with pre-captured normal behavior time sequence patterns and a normal distribution rolling window mechanism to obtain anomaly detection results, thereby completing the anomaly detection of the network to be detected.

[0046] In one feasible implementation, the extraction module includes: The actions in the critical path action sequence are used as nodes in the cause-effect graph, and the temporal sequence of the actions is used as the initial edges. The structure of the initial causal graph is iteratively adjusted using a greedy search algorithm until the target score of the initial causal graph reaches the minimum value, thus obtaining the optimal causal graph.

[0047] In one feasible implementation, the extraction module further includes: A bivariate VAR model is established for the critical path action sequence, and the temporal dependencies between actions are determined by Granger causality test; Based on the temporal dependencies, a greedy algorithm is executed to adjust the edges of the initial causal graph, and the target score of the adjusted initial causal graph is calculated for iteration.

[0048] In one feasible implementation, the detection module includes: The normal behavior time sequence pattern is invoked by the anomaly detection model to reconstruct multiple input features and obtain the reconstruction result; The reconstruction error between the reconstruction result and the input features is calculated, and the reconstruction error is judged by combining the normal distribution rolling window mechanism to obtain the anomaly detection result.

[0049] In one feasible implementation, the detection module further includes: The reconstruction error condition is updated in real time using a normal distribution rolling window mechanism, and it is determined whether the reconstruction error meets the reconstruction error condition. If so, an anomaly is detected in the temporal causal chain, and the anomaly type is marked on the temporal causal chain.

[0050] In one feasible implementation, the extraction module also includes: Traverse all temporal causal chains on the optimal causal graph, divide them into segments according to a preset time window, and extract features of multiple dimensions on the optimal causal graph segment by segment; The features of the multiple dimensions are preprocessed to conclude feature extraction based on the preprocessed features of the multiple dimensions.

[0051] In one feasible implementation, the generation module includes: Based on the aforementioned topology and dynamic traffic data, the weighted traffic betweenness centrality of each node in the network to be detected is calculated. Based on the weighted traffic betweenness centrality, key nodes are selected from each node to generate a list of necessary paths across network segments.

[0052] Example 3 This application also provides an electronic device, such as Figure 5 As shown, it includes: a processor 501, a memory 502, and a bus 503. The memory 502 stores machine-readable instructions that can be executed by the processor 501. When the electronic device is running, the processor 501 and the memory 502 communicate through the bus 503. When the machine-readable instructions are executed by the processor 501, the steps of any one of the network action timing causal anomaly detection methods are performed.

[0053] Example 4 This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of any one of the network action timing causal anomaly detection methods.

[0054] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0055] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0056] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0057] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a platform server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0058] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting causal anomalies in network action sequences, characterized in that, The method includes: The action type and timestamp information are extracted from the network logs of the network to be detected. The action type is mapped, and the event vectors obtained by the mapping are arranged according to the timestamp information to generate an action sequence. Based on the topology and dynamic traffic data of the network to be detected, a list of necessary cross-network segments is generated. Based on the list of necessary cross-network segments, the action sequence is filtered to obtain the critical path action sequence. An optimal causal graph based on the Locard principle is generated according to the critical path action sequence, and multi-dimensional features are extracted from the temporal causal chain on the optimal causal graph to extract a variety of features. By using a pre-trained anomaly detection model, combined with pre-captured normal behavior time-series patterns and a normal distribution rolling window mechanism, anomaly detection results are obtained by performing anomaly detection on various extracted features, thereby completing the anomaly detection of the network to be detected.

2. The method according to claim 1, characterized in that, Generate an optimal causal graph based on the Locard principle from the critical path action sequence, including: The actions in the critical path action sequence are used as nodes in the cause-effect graph, and the temporal sequence of the actions is used as the initial edges. The structure of the initial causal graph is iteratively adjusted using a greedy search algorithm until the target score of the initial causal graph reaches the minimum value, thus obtaining the optimal causal graph.

3. The method according to claim 2, characterized in that, The structure of the initial causal graph is iteratively adjusted using a greedy search algorithm, including: A bivariate VAR model is established for the critical path action sequence, and the temporal dependencies between actions are determined by Granger causality test; Based on the temporal dependencies, a greedy algorithm is executed to adjust the edges of the initial causal graph, and the target score of the adjusted initial causal graph is calculated for iteration.

4. The method according to claim 1, characterized in that, By using a pre-trained anomaly detection model, combined with pre-captured temporal patterns of normal behavior and a normally distributed rolling window mechanism, anomaly detection results are obtained by performing anomaly detection on various extracted features, including: The normal behavior time sequence pattern is invoked by the anomaly detection model to reconstruct multiple input features and obtain the reconstruction result; The reconstruction error between the reconstruction result and the input features is calculated, and the reconstruction error is judged by combining the normal distribution rolling window mechanism to obtain the anomaly detection result.

5. The method according to claim 4, characterized in that, The reconstruction error is determined by combining a normal distribution rolling window mechanism to obtain anomaly detection results, including: The reconstruction error condition is updated in real time using a normal distribution rolling window mechanism, and it is determined whether the reconstruction error meets the reconstruction error condition. If so, an anomaly is detected in the temporal causal chain, and the anomaly type is marked on the temporal causal chain.

6. The method according to claim 1, characterized in that, Multi-dimensional feature extraction is performed from the temporal causal chain on the optimal causal graph to extract various features, including: Traverse all temporal causal chains on the optimal causal graph, divide them into segments according to a preset time window, and extract features of multiple dimensions on the optimal causal graph segment by segment; The features of the multiple dimensions are preprocessed to conclude feature extraction based on the preprocessed features of the multiple dimensions.

7. The method according to claim 1, characterized in that, Based on the topology and dynamic traffic data of the network to be detected, a list of necessary cross-network segment paths is generated, including: Based on the aforementioned topology and dynamic traffic data, the weighted traffic betweenness centrality of each node in the network to be detected is calculated. Based on the weighted traffic betweenness centrality, key nodes are selected from each node to generate a list of necessary paths across network segments.

8. A network action temporal causal anomaly detection system, characterized in that, The system includes: The mapping module is used to extract action type and timestamp information from the network logs of the network to be detected, map the action type, arrange the mapped event vectors according to the timestamp information, and generate an action sequence. The generation module is used to generate a list of necessary cross-network segments based on the topology and dynamic traffic data of the network to be detected, and to filter the action sequence based on the list of necessary cross-network segments to obtain the critical path action sequence. The extraction module is used to generate an optimal causal graph based on the Locard principle according to the key path action sequence, and to extract multiple features from the temporal causal chain on the optimal causal graph. The detection module is used to perform anomaly detection on various extracted features by combining a pre-trained anomaly detection model with pre-captured normal behavior time sequence patterns and a normal distribution rolling window mechanism to obtain anomaly detection results, thereby completing the anomaly detection of the network to be detected.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of a network action timing causal anomaly detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of a network action timing causal anomaly detection method as described in any one of claims 1 to 7.

Images