Computer abnormal operation behavior monitoring method

Abstract

The invention discloses a computer abnormal operation behavior monitoring method which comprises the following steps: monitoring a user operation behavior of a computer system, and generating an operation behavior log; extracting characteristic parameters from the operation behavior log; the feature parameters are input into a pre-trained anomaly detection model, the anomaly detection model is constructed based on a support vector machine algorithm, a historical normal operation behavior data set is used for training, and the training process comprises a feature selection step and a model parameter optimization step; calculating a deviation value between the characteristic parameters and the normal behavior mode through an anomaly detection model; when the deviation value is larger than a preset threshold value, an abnormal operation behavior is judged, and abnormal grades are divided according to the deviation value; and when the abnormal operation behavior is determined, triggering an alarm operation, including generating an alarm message and sending the alarm message to the system administrator terminal, and executing a predefined response action. According to the invention, the accuracy of abnormal behavior identification can be improved, and the false alarm rate and the missing report rate are significantly reduced.

Description

Technical Field

[0001] This invention relates to the field of computer-related technologies. More specifically, this invention relates to a method for monitoring abnormal computer operation behavior. Background Technology

[0002] With the increasing application of computer systems in government, finance, and enterprise offices, massive amounts of sensitive data and core business processes heavily rely on the stable operation of these systems. Abnormal user actions have become a major source of risk, leading to data breaches, system crashes, and malicious attacks. These abnormal actions encompass various forms, including unauthorized access, unauthorized data tampering, and abnormal resource consumption, which can cause not only direct economic losses but also business interruptions and compliance risks.

[0003] Existing computer operation monitoring technologies mostly rely on preset rule bases or single behavioral features for judgment, which has obvious limitations: the rule base is difficult to cover new abnormal behaviors and has poor adaptability; feature extraction is not comprehensive enough and it is easy to ignore the correlation between operation sequences and resource usage features; the detection model has insufficient generalization ability, resulting in a high rate of false negatives and false alarms, and it is difficult to achieve real-time monitoring and hierarchical response, which cannot meet the security protection needs of complex systems.

[0004] Therefore, it is necessary to design a technical solution that can overcome the above-mentioned defects. Summary of the Invention

[0005] One objective of this invention is to provide a method for monitoring abnormal computer operation behavior, which can improve the accuracy of abnormal behavior identification and significantly reduce false alarm and false negative rates.

[0006] To achieve these objectives and other advantages of the present invention, according to one aspect of the present invention, a method for monitoring abnormal computer operation behavior is provided, comprising: S1: monitoring user operation behavior of a computer system, including keyboard input operations, mouse click operations, file access operations, network access operations, process startup operations, and system call operations, and generating an operation behavior log, the operation behavior log recording the timestamp, operation content, operation context information, and associated system events of each user operation behavior; S2: extracting feature parameters from the operation behavior log, the feature parameters including operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormality. Operation counting; S3: Input the feature parameters into the pre-trained anomaly detection model. The anomaly detection model is built based on the support vector machine algorithm and trained using a historical normal operation behavior dataset. The training process includes feature selection steps and model parameter optimization steps; S4: Calculate the deviation value between the feature parameters and the normal behavior pattern through the anomaly detection model. The deviation value is based on the Euclidean distance between the feature vectors on the support vector machine hyperplane; S5: When the deviation value is greater than a preset threshold, it is judged as an abnormal operation behavior, and the anomaly level is divided according to the magnitude of the deviation value; S6: When an abnormal operation behavior is judged, an alarm operation is triggered, including generating an alarm message and sending the alarm message to the system administrator terminal, and executing a predefined response action.

[0007] Furthermore, user actions are intercepted in real time using operating system hooks, including keyboard hooks, mouse hooks, file system hooks, network hooks, process hooks, and system call hooks, to capture keyboard input, mouse clicks, file access, network access, process startup, and system call operations. When generating operation behavior logs, the system records the user identifier, application identifier, operation result status, and process context information for each user action. The operation context information includes application status, system resource status, and user session status. Real-time data cleaning and formatting are performed on the operation behavior logs to remove redundant information and ensure log structure consistency.

[0008] Furthermore, in S2, the operation type features include keyboard input operation types, mouse click operation types, file access operation types, network access operation types, process start operation types, and system call operation types, and a unique identifier is assigned to each operation type; the operation frequency features calculate the number of operations per second, per minute, and per hour based on the timestamps of the operation behavior logs, and calculate the operation frequency separately for each operation type; the operation time interval features include the average time interval, minimum time interval, and maximum time interval between consecutive operations, as well as the time interval distribution of the same operation type; the operation sequence pattern features identify frequent operation sequences by analyzing operation sequences through a sliding window, and calculate the occurrence frequency and transition probability of each operation sequence; the resource usage features include CPU utilization, memory usage, disk I / O, and network bandwidth usage, and record the peak and average resource usage associated with each user operation behavior; the behavior pattern consistency features compare the similarity between the current operation behavior sequence and the historical normal operation behavior sequence, and the similarity calculation is based on the operation type matching rate, operation frequency deviation, and operation sequence pattern overlap; the abnormal operation count features include the cumulative number of abnormal operation types in the current user session, the recent abnormal operation frequency, and the ratio of abnormal operations to normal operations.

[0009] Furthermore, in S3, the anomaly detection model is trained using a historical normal operation behavior dataset. The training process first performs a feature selection step, employing a recursive feature elimination method to select a predetermined number of key features with the highest importance scores from the extracted feature parameters. These key features include at least one or more of the following: operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and anomaly operation count. Next, a model parameter optimization step is performed, using a grid search method to optimize the kernel function parameters and penalty factor of the support vector machine algorithm within a predetermined parameter space. The kernel function parameters include linear kernel function parameters, multinomial kernel function parameters, and radial kernel function parameters. Kernel function parameters; After feature selection and model parameter optimization, a support vector machine (SVM) classification model is trained based on a historical normal operation behavior dataset using the selected key features and optimized model parameters. The historical normal operation behavior dataset contains normal operation behavior logs generated by multiple users at different time periods and their corresponding feature parameters. During training, k-fold cross-validation is used to evaluate the performance of the trained SVM classification model, and the model parameters are adjusted according to accuracy, recall, and F1 score until the model performance meets the preset requirements. Finally, the trained SVM classification model is used as an anomaly detection model to calculate the deviation between the feature parameters and the normal behavior pattern.

[0010] Furthermore, the method of using recursive feature elimination to select a preset number of key features with the highest importance scores from the extracted feature parameters includes: initializing a feature set containing all feature parameters extracted from operation behavior logs, including operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormal operation count; training a base learner using a historical normal operation behavior dataset, the base learner employing a support vector machine algorithm, and calculating a feature importance score for each feature parameter in the feature set during training; sorting all feature parameters in the feature set according to the calculated feature importance scores, removing the feature parameters with the lowest preset proportion of feature importance scores, and updating the feature set; retraining the support vector machine algorithm based on the updated feature set, and repeating the steps of feature importance score calculation, feature sorting, and feature removal until the number of features in the feature set reaches a preset number; and finally retaining the feature parameters as the selected key features, which are used for subsequent model parameter optimization steps and training of the support vector machine classification model.

[0011] Furthermore, the method for optimizing the kernel function parameters and penalty factors of the support vector machine (SVM) algorithm within a predefined parameter space using a grid search approach includes: constructing a predefined parameter space, which includes multiple kernel function types and their corresponding parameter value ranges. The kernel function types include linear kernel functions, polynomial kernel functions, and radial basis function kernel functions, and the penalty factor value range is also included. Combinations of kernel function types and penalty factors are sequentially selected from the predefined parameter space. For each parameter combination, the SVM algorithm is trained using selected key features and a historical normal operating behavior dataset, and the performance of the trained SVM classification model is evaluated using k-fold cross-validation. The performance evaluation results of the SVM classification model corresponding to each parameter combination in k-fold cross-validation are recorded, including accuracy, recall, and F1 score. The performance evaluation results for all parameter combinations are compared, and the combination of kernel function type and penalty factor that optimizes the performance of the SVM classification model is selected as the optimized model parameters. The optimized model parameters are then used to train the final anomaly detection model.

[0012] Furthermore, in S4, the extracted feature parameters are combined into a feature vector, and the feature vector is input into the trained anomaly detection model. The Euclidean distance between the position of the feature vector in the support vector machine feature space and the optimal hyperplane is calculated to obtain the deviation value between the feature parameters and the normal behavior pattern. The optimal hyperplane is the classification boundary determined by the kernel function parameters and penalty factor optimized by the grid search method during the model training process.

[0013] Furthermore, during the training process of the support vector machine algorithm, an initial separating hyperplane is first constructed in the feature space; the distance from all historical normal operation behavior data sample points to the initial separating hyperplane is calculated, and the closest data sample point is identified; the position and orientation of the separating hyperplane are adjusted so that the minimum distance from all data sample points to the separating hyperplane reaches the maximum value; the distance calculation and hyperplane adjustment process is repeated until the final separating hyperplane that maximizes the minimum distance is found, and the final separating hyperplane is determined as the optimal hyperplane.

[0014] Furthermore, the deviation value calculated by the anomaly detection model is compared with a preset threshold, which is determined based on the distribution of deviation values ​​in the feature vectors of historical normal operation behavior datasets. When the deviation value exceeds the preset threshold, the anomaly level is classified according to the multiple preset threshold intervals in which the deviation value falls. The anomaly levels include low-risk, medium-risk, and high-risk levels. The low-risk level corresponds to the deviation value exceeding the first threshold but not exceeding the second threshold, the medium-risk level corresponds to the deviation value exceeding the second threshold but not exceeding the third threshold, and the high-risk level corresponds to the deviation value exceeding the third threshold. Different anomaly levels trigger different levels of response actions. Abnormal operation behaviors at the low-risk level only generate log records, abnormal operation behaviors at the medium-risk level trigger internal system alarms, and abnormal operation behaviors at the high-risk level trigger both internal system alarms and send alarm messages to the system administrator terminal.

[0015] Furthermore, the deviation values ​​of all feature vectors in the historical normal operation behavior dataset to the optimal hyperplane are calculated to form a historical deviation value dataset; statistical analysis is performed on the historical deviation value dataset to calculate its mean, standard deviation, and specified percentile; based on the results of the statistical analysis, multiple preset thresholds are set to verify the effectiveness of the multiple preset thresholds and ensure that the deviation values ​​of feature vectors of a preset proportion in the historical normal operation behavior dataset are lower than the first threshold.

[0016] The present invention has at least the following beneficial effects: This invention achieves comprehensive monitoring of computer operation behavior across all scenarios by comprehensively capturing various user actions such as keyboard input and network access, combined with multi-dimensional log recordings including timestamps and contextual information. This effectively avoids the missed detection problems caused by monitoring only a single behavior. The extraction of multi-dimensional feature parameters takes into account key dimensions such as operation type, sequence pattern, and resource usage. Combined with the precise calculations of the support vector machine model, this significantly improves the accuracy of abnormal behavior identification and significantly reduces false positives and false negatives. The model, trained and optimized with historical normal behavior data, possesses strong generalization ability and can adapt to different user operating habits and system operating scenarios. An anomaly level classification mechanism based on deviation values ​​enables tiered responses, preventing low-risk anomalies from excessively consuming system resources while providing rapid early warning and handling of high-risk behaviors, thus improving the targeting and efficiency of security protection. Real-time monitoring and alarm push functions can promptly alert administrators to intervene, minimizing losses such as data leaks and system failures caused by abnormal operations, providing comprehensive and efficient security for computer systems.

[0017] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Attached Figure Description

[0018] Figure 1 This is a flowchart of one embodiment of this application. Detailed Implementation

[0019] The present invention will now be described in further detail so that those skilled in the art can implement it based on the description.

[0020] It should be understood that terms such as "having," "comprising," and "including" used in the embodiments of this application do not exclude the presence or addition of one or more other elements or combinations thereof. All directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of this application are only used to explain the relative positional relationship and movement of components in a specific posture. If the specific posture changes, the directional indication will also change accordingly. When an element is referred to as "fixed to" or "set on" another element, it can be directly on the other element or may have an intervening element present. When an element is referred to as "connected to" another element, it can be directly connected to the other element or indirectly connected to the other element through an intervening element. Descriptions involving "first," "second," etc., in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features.

[0021] It should be noted that the technical solutions of the various embodiments of this application can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by this application.

[0022] like Figure 1 As shown, embodiments of this application provide a method for monitoring abnormal computer operation behavior, including: S1: monitoring user operation behavior of a computer system, including keyboard input operations, mouse click operations, file access operations, network access operations, process startup operations, and system call operations, and generating an operation behavior log, which records the timestamp, operation content, operation context information, and associated system events for each user operation behavior; S2: extracting feature parameters from the operation behavior log, including operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormal operation count; S3: processing the features... The parameters are input into a pre-trained anomaly detection model, which is built based on the support vector machine algorithm and trained using a historical normal operation behavior dataset. The training process includes feature selection and model parameter optimization steps; S4: The anomaly detection model calculates the deviation between the feature parameters and the normal behavior pattern. The deviation is based on the Euclidean distance between the feature vectors on the support vector machine hyperplane; S5: When the deviation exceeds a preset threshold, it is determined to be an abnormal operation behavior, and the anomaly level is classified according to the magnitude of the deviation; S6: When an abnormal operation behavior is determined, an alarm operation is triggered, including generating an alarm message and sending the alarm message to the system administrator terminal, and executing a predefined response action.

[0023] For example, when monitoring user operation behavior on a computer system, a wide range of operation types are comprehensively covered. Keyboard input operations include pressing and releasing individual keys, triggering shortcut keys (such as Ctrl+C, Alt+F4), and continuous character input; mouse click operations cover left-click, right-click, and double-click, as well as the screen coordinates of the click location and the information of the window to which it belongs; file access operations involve opening, closing, reading, modifying, deleting, and moving files; network access operations include the accessed IP address, domain name, port number, data transmission direction, and traffic volume; process startup operations include the name, path, PID (process identifier), and parent process information of the started process; and system call operations involve the name, parameters, and return value of the called function. The generated operation log uses Unix timestamps accurate to milliseconds, such as 1717234567890 or 1717234568901; the operation content records the specific operation object in detail, such as the file access operation record as "open D:\Work\Report.docx" or "delete E:\Backup\202405.zip"; the operation context information includes the currently logged-in user account, the running application (such as Microsoft Word 2021), the current system memory usage (such as 30% or 60%), etc.; associated system events, such as process startup operations, will be associated with the "Process Creation" event (Event ID 4688) or "Service Startup" event (Event ID 7036) in the system log.

[0024] When extracting feature parameters from operation behavior logs, the operation type feature assigns a unique identifier to each operation, such as 001 for keyboard input, 002 for mouse clicks, and 003 for file access. The operation frequency feature is calculated based on timestamps; the number of operations per second may be 3 or 8, the number of operations per minute may be 180 or 480, and the number of operations per hour may be 10,800 or 28,800. It is calculated separately for each operation type, such as separately counting the frequency of keyboard input per minute. In the operation time interval feature, the average time interval for consecutive operations may be 0.8 or 2.5 seconds, the minimum time interval may be 0.2 or 0.5 seconds, and the maximum time interval may be 10 or 30 seconds. The distribution of time intervals for the same operation type is statistically analyzed, such as for mouse clicks. Double-click intervals are mostly between 0.3-0.5 seconds or 0.2-0.4 seconds; operation sequence pattern characteristics are analyzed using a sliding window (window size set to 5 or 8) to identify frequent sequences such as "mouse click icon - open file - keyboard input - save file - close window", with a frequency of 25% or 40%, and a transition probability, such as from "open file" to "keyboard input", is 70% or 85%; in terms of resource usage characteristics, peak CPU usage may be 75% or 90%, average memory usage may be 1.5GB or 3GB, disk I / O may be 50MB / s or 150MB / s, and network bandwidth usage may be 2Mbps or 10Mbps; behavioral pattern consistency characteristics are determined by comparing the similarity between the current and historical normal sequences, calculated as (operation type matching rate × 0.4). + Operation frequency deviation × 0.3 + Operation sequence pattern overlap × 0.3), the similarity result may be 85% or 65%; In the abnormal operation count feature, the cumulative number of abnormal operations in the current session may be 3 or 7 times, the frequency of abnormal operations in the recent period (e.g., within 1 hour) may be 2 times / hour or 5 times / hour, and the ratio of abnormal to normal operations may be 1:20 or 1:10.

[0025] The feature parameters are input into a pre-trained anomaly detection model, which is built based on the Support Vector Machine (SVM) algorithm. The historical normal operation behavior dataset used for training contains normal operation logs of 500 users within 6 months or normal operation logs of 1000 users within 3 months, with each log corresponding to extracted feature parameters. The feature selection step during training employs a recursive feature elimination method to select the 6 or 9 most important key features from all features. The model parameter optimization step uses grid search to select the optimal parameters in a preset parameter space. For the kernel function parameters, the linear kernel function parameter may be 0.2 or 0.6, the polynomial kernel function order may be 2 or 3, the radial basis function gamma value may be 0.3 or 1.2, and the penalty factor may be 2 or 8.

[0026] When calculating the bias value using the anomaly detection model, the feature parameters are first combined into a feature vector, such as [001, 5 times / second, 1.2 seconds, 30%, 2GB, 70%, 4 times]. Then, the Euclidean distance between this vector and the optimal hyperplane in the SVM feature space is calculated as |w·x + b| / ||w|| (where w is the hyperplane normal vector, x is the feature vector, and b is the bias term). The resulting bias value may be 2.8 or 6.5.

[0027] When the deviation value is greater than the preset threshold (such as 4 or 7), it is judged as an abnormal operation behavior and classified into levels according to the deviation value. For example, a deviation value between 4 and 6 is a low-risk level, between 6 and 8 is a medium-risk level, and greater than 8 is a high-risk level.

[0028] When an abnormal operation is detected, an alarm is triggered. The generated alarm message includes the timestamp of the abnormal operation, the operation type, the deviation value, and the associated user information. It is sent to the system administrator's terminal (such as the administrator's office computer or mobile APP) through an internal communication protocol. The predefined response actions include recording only detailed logs for low-risk levels, temporarily restricting some operation permissions for medium-risk levels, and immediately terminating the current abnormal operation process for high-risk levels.

[0029] In existing technologies, common anomaly detection methods often focus only on a single type of operation, such as monitoring only the frequency of keyboard input, setting a threshold of 20 times / minute, and judging it as abnormal when this value is exceeded. This approach may misjudge normal, rapid text input as abnormal, and miss unmonitored abnormal mouse clicks or unauthorized file access, resulting in low accuracy. This embodiment, by covering multiple operation types, extracting multi-dimensional features, and combining them with an optimized SVM model to calculate deviation values, can more comprehensively characterize operational behavior, reduce false positives and false negatives caused by judging based on a single feature, and improve the comprehensiveness and accuracy of the response through a hierarchical response mechanism, making the handling more in line with actual risks.

[0030] In another embodiment, user actions are intercepted in real time using operating system hooks, including keyboard hooks, mouse hooks, file system hooks, network hooks, process hooks, and system call hooks, to capture keyboard input operations, mouse click operations, file access operations, network access operations, process start operations, and system call operations. When generating operation behavior logs, the user identifier, application identifier, operation result status, and process context information corresponding to each user operation are recorded, where the operation context information includes application status, system resource status, and user session status. The operation behavior logs are then cleaned and formatted in real time to remove redundant information and ensure log structure consistency.

[0031] For example, when intercepting user actions in real time using operating system hooks, the operating system hook is a message processing mechanism provided by the operating system that can prioritize receiving notifications when specific events are triggered. Specifically, keyboard hooks can use WH_KEYBOARD (monitoring keyboard messages) or WH_KEYBOARD_LL (a low-level keyboard hook that can capture keyboard input from all threads) to capture the scan codes and virtual key codes of key presses / releases; mouse hooks can use WH_MOUSE (monitoring mouse messages) or WH_MOUSE_LL (a low-level mouse hook) to record click types (left / right / middle click) and corresponding screen coordinates (e.g., (1200, 800) or (300, 500)); file system hooks can be based on the FileSystemWatcher component in Windows systems and on the inotify mechanism in Linux systems, used to monitor file creation and modification paths (e.g., moving from C:\temp to D:\archive); network hooks can intercept Winsock... Function call implementations record the accessed IP (e.g., 192.168.1.100 or 203.0.113.5), port (e.g., 80 or 443), and data transfer volume; process hooks can monitor the CreateProcess function call and capture the process startup path (e.g., C:\Program Files\Browser\browser.exe); system call hooks in Linux can be based on the ptrace mechanism to capture syscall numbers (e.g., 5 for open or 3 for read). When generating operation behavior logs, the user identifier is the system login account (such as user01 or admin) or UUID (such as f47ac10b-58cc-4372-a567-0e02b2c3d479); the application identifier includes the process name (such as notepad.exe) and version number (such as 10.0.19041.1); the operation result status is divided into success (return code 0) or failure (such as file access failure returns 0x80070002, which means the file does not exist); in the operation context information, the application status is "active" or "running in the background", the system resource status includes the remaining memory (such as 4GB or 1.5GB), and the user session status is "local login" or "remote desktop login". When performing real-time data cleaning on operation behavior logs, it removes duplicate mouse click logs within 1 second, fills in missing timestamps (using the current system time, accurate to milliseconds), and uniformly formats the logs into a JSON structure (such as {"timestamp":1717234567890, "user":"user01","operation":"file_open"...}) to ensure field consistency.

[0032] In existing technologies, some monitoring methods use only a single type of hook (such as keyboard hooks only), and the logs only record the operation type and time without cleaning. This often leads to errors in subsequent analysis due to duplicate logs or missing fields. This embodiment comprehensively captures operations through multiple types of hooks, records multi-dimensional information in detail, and performs rigorous cleaning, making the logs more complete and accurate. This provides a reliable data foundation for subsequent feature extraction and reduces detection bias caused by data quality. In another embodiment, in S2, the operation type features include keyboard input operation types, mouse click operation types, file access operation types, network access operation types, process start operation types, and system call operation types, and a unique identifier is assigned to each operation type; the operation frequency features calculate the number of operations per second, the number of operations per minute, and the number of operations per hour based on the timestamps of the operation behavior logs, and calculate the operation frequency separately for each operation type; the operation time interval features include the average time interval, minimum time interval, and maximum time interval between consecutive operations, as well as the time interval distribution of the same operation type; the operation sequence pattern features identify frequent operation sequences by analyzing operation sequences through a sliding window, and calculate the occurrence frequency and transition probability of each operation sequence; the resource usage features include CPU utilization, memory usage, disk I / O usage, and network bandwidth usage, and record the peak and average resource usage associated with each user operation behavior; the behavior pattern consistency features compare the similarity between the current operation behavior sequence and the historical normal operation behavior sequence, and the similarity calculation is based on the operation type matching rate, operation frequency deviation, and operation sequence pattern overlap; the abnormal operation count features include the cumulative number of abnormal operation types in the current user session, the recent abnormal operation frequency, and the ratio of abnormal operations to normal operations.

[0033] For example, when extracting feature parameters, the operation type feature is further subdivided into keyboard input (such as the letter "A") and combination key input (such as Ctrl+S), which are assigned unique identifiers 001-1 and 001-2 respectively; mouse click operation type is subdivided into left click and right click, which are assigned 002-1 and 002-2; file access operation type is subdivided into read and delete, which are assigned 003-1 and 003-2; and so on, to ensure that each subdivided operation has a unique identifier.

[0034] When calculating the operation frequency characteristics, timestamp statistics are used. For example, if 30 keyboard inputs are recorded within 10 seconds, the number of operations per second is 3; if 240 mouse clicks are recorded within 5 minutes, the number of operations per minute is 48. Each operation type is counted separately. For example, if a file access operation occurs 60 times in 1 hour, its frequency per hour is 60 times.

[0035] In the operation time interval characteristics, the timestamp differences of 10 consecutive operations are 0.5, 0.8, 1.2... seconds, and the average time interval is (0.5+0.8+...) / 10=1.0 or 1.5 seconds; the minimum time interval is the minimum value of 0.3 or 0.4 seconds; the maximum time interval is the maximum value of 15 or 20 seconds; the time interval distribution statistics of the same operation type (such as continuous file reading) show that 80% of the intervals are between 2-5 seconds or 1-3 seconds.

[0036] The operation sequence pattern features are analyzed using a sliding window with a window size of 5, meaning that each sequence consists of 5 consecutive operations, such as [mouse click - file open - keyboard input - save - close]. If this sequence appears 200 times in 1000 operation records, the frequency is 20%. When calculating the transition probability, if "file open" is followed by "keyboard input" 140 times, and the total number of subsequent operations is 200, the transition probability is 70% or 80%.

[0037] Among the resource usage characteristics obtained through the system interface, the peak CPU usage reached 60% or 85% during operation; the average memory usage was 2GB or 3.5GB; disk I / O reached 80MB / s or 120MB / s during file copying; and network bandwidth usage reached 5Mbps or 15Mbps during downloading.

[0038] When calculating the consistency feature of behavioral patterns, if the matching rate of the operation type between the current operation sequence and the historical normal sequence is 80% (8 out of 10 operations are of the same type), the operation frequency deviation is 10% (the ratio of the difference between the current frequency and the historical average), and the operation sequence pattern overlap is 75%, then the similarity is 80%×0.4 + 10%×0.3 + 75%×0.3 = 65.5% or 72%.

[0039] In the abnormal operation counting characteristics, within the current user session (lasting 2 hours), the abnormal operation type occurs a total of 4 or 6 times; the frequency of abnormal operations in the recent 1 hour is 3 times / hour or 5 times / hour; if there are 3 abnormal operations and 60 normal operations, the ratio is 1:20 or 1:15. In existing technologies, some methods only focus on operation frequency when extracting features, such as setting keyboard input exceeding 5 times / second as abnormal, ignoring the correlation between operation sequence and resource usage, which can easily lead to misjudging normal operations entered quickly. This embodiment extracts multi-dimensional features, covering dimensions such as type, sequence, and resources, which can more comprehensively characterize behavioral patterns and improve the accuracy of anomaly identification.

[0040] In another embodiment, in S3, the anomaly detection model is trained using a historical normal operation behavior dataset. The training process first performs a feature selection step, employing a recursive feature elimination method to select a predetermined number of key features with the highest importance scores from the extracted feature parameters. These key features include at least one or more of operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and anomaly operation count. Next, a model parameter optimization step is performed, using a grid search method to optimize the kernel function parameters and penalty factor of the support vector machine algorithm within a predetermined parameter space. The kernel function parameters include linear kernel function parameters, polynomial kernel function parameters, and... Radial basis function kernel parameters; after feature selection and model parameter optimization, a support vector machine (SVM) classification model is trained based on a historical normal operation behavior dataset using the selected key features and optimized model parameters. The historical normal operation behavior dataset contains normal operation behavior logs generated by multiple users at different time periods and their corresponding feature parameters. During training, the k-fold cross-validation method is used to evaluate the performance of the trained SVM classification model, and the model parameters are adjusted according to the accuracy, recall, and F1 score until the model performance meets the preset requirements. Finally, the trained SVM classification model is used as an anomaly detection model to calculate the deviation between the feature parameters and the normal behavior pattern.

[0041] For example, when training an anomaly detection model using a historical normal operation behavior dataset, the dataset contains normal operation logs of 800 users over 12 months (approximately 5 million logs) or logs of 1200 users over 6 months (approximately 8 million logs), with each log corresponding to extracted feature parameters. The training process first performs feature selection, employing a recursive feature elimination method to select the 7 or 9 key features with the highest importance scores from all features, such as operation frequency, operation sequence patterns, resource usage, etc.

[0042] When performing the model parameter optimization step, the optimal parameters are selected from the preset parameter space through grid search. In the preset parameter space, the kernel function types include linear kernel function (parameter c takes values ​​of 1, 2, and 3), polynomial kernel function (order 2 and 3, parameter c takes values ​​of 1 and 5), and radial basis function (gamma values ​​of 0.1, 1, and 2, parameter c takes values ​​of 1 and 10); the penalty factor ranges from 1 to 10, with a step size of 2.

[0043] After feature selection and parameter optimization, a support vector machine (SVM) classification model is trained using the selected key features and optimized parameters. K-fold cross-validation is used during training, with k = 5 or 10. This means the dataset is divided into 5 or 10 parts, and 4 or 9 parts are used for training and 1 part for validation alternately. When evaluating model performance, accuracy = number of correctly identified normal samples / total number of samples, recall = number of correctly identified normal samples / actual number of normal samples, and F1 score = 2 × accuracy × recall / (accuracy + recall). Parameters are adjusted based on these metrics until the F1 score stabilizes above 0.85 or 0.9. The finally trained model is used to calculate the bias value.

[0044] In existing technologies, some models directly use all features during training, and parameters are set empirically (e.g., a fixed penalty factor of 1), resulting in model redundancy and poor generalization ability. This embodiment simplifies dimensionality through feature selection, optimizes parameters through grid search, and combines cross-validation for evaluation, making the model more efficient and stable with superior detection performance. In another embodiment, the method for selecting a preset number of key features with the highest importance scores from the extracted feature parameters using a recursive feature elimination method includes: initializing a feature set containing all feature parameters extracted from operation behavior logs, including operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormal operation count; training a base learner using a historical normal operation behavior dataset, the base learner employing a support vector machine algorithm, and calculating a feature importance score for each feature parameter in the feature set during training; sorting all feature parameters in the feature set according to the calculated feature importance scores, removing the feature parameters with the lowest preset proportion of feature importance scores, and updating the feature set; retraining the support vector machine algorithm based on the updated feature set, and repeating the steps of calculating feature importance scores, sorting features, and removing features until the number of features in the feature set reaches a preset number; and using the finally retained feature parameters as the selected key features, which are used for subsequent model parameter optimization steps and training of the support vector machine classification model.

[0045] For example, when using the recursive feature elimination method to filter key features, the feature set is first initialized, containing seven categories of features: operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormal operation count. Each feature category contains 3-5 sub-features (e.g., operation frequency includes frequencies per second, per minute, and per hour). The base learner is trained using a historical normal operation behavior dataset. The base learner uses the support vector machine algorithm, and a linear kernel is selected as the kernel function. During training, the feature importance score is calculated by the absolute value of the coefficients (the larger the absolute value of the coefficient, the higher the importance). For example, the absolute value of the coefficient for operation frequency is 0.8, for operation type it is 0.6, and for resource usage it is 0.5, etc.

[0046] After sorting by score, remove the lowest 20% or 30% of features (e.g., initially removing "recent frequency" from abnormal operation counts and "sequence overlap" from behavior pattern consistency), and update the feature set. Retrain the support vector machine based on the new set, and repeat the scoring, sorting, and removal steps, keeping the removal ratio constant each time, until 6 or 8 features remain in the feature set (e.g., ultimately retaining operation frequency, operation sequence pattern, resource usage, etc.). These will be used as key features in subsequent steps. In existing technologies, some methods subjectively select features (such as retaining only operation type and frequency), ignoring differences in feature importance, leading to redundant model inputs. This embodiment automatically filters key features through recursive elimination, retaining important features based on data-driven approaches, reducing redundancy, and improving model training efficiency and detection accuracy.

[0047] In another embodiment, the method for optimizing the kernel function parameters and penalty factors of the support vector machine algorithm in a preset parameter space using a grid search method includes: constructing a preset parameter space, which includes multiple kernel function types and their corresponding parameter value ranges; the kernel function types include linear kernel functions, polynomial kernel functions, and radial basis function kernel functions; and the value range of the penalty factor; sequentially selecting combinations of kernel function types and penalty factors from the preset parameter space; for each parameter combination, training the support vector machine algorithm using selected key features and historical normal operation behavior datasets, and evaluating the performance of the trained support vector machine classification model using k-fold cross-validation; recording the performance evaluation results of the support vector machine classification model corresponding to each parameter combination in k-fold cross-validation, the performance evaluation results including accuracy, recall, and F1 score; comparing the performance evaluation results corresponding to all parameter combinations, and selecting the combination of kernel function type and penalty factor that optimizes the performance of the support vector machine classification model as the optimized model parameters; and using the obtained optimized model parameters for training the final anomaly detection model.

[0048] For example, when optimizing support vector machine parameters through grid search, a preset parameter space is first constructed: the kernel function types include linear kernel function (parameter c takes values ​​of 1, 2, 4), polynomial kernel function (order 2, 3, parameter c takes values ​​of 1, 3, 5), and radial basis kernel function (gamma values ​​of 0.1, 0.5, 1, parameter c takes values ​​of 2, 4, 8); the penalty factor takes values ​​from 1 to 8 and is set with a step size of 1.

[0049] Combinations are selected sequentially from the parameter space, such as "linear kernel + c=2", "polynomial kernel (order 2) + c=3", "radial basis kernel (gamma=0.5) + c=4", etc. For each combination, the model is trained using the selected key features and historical datasets, and 5-fold cross-validation is used, that is, the dataset is divided into 5 parts, 4 parts are used for training and 1 part for validation each time, and the average performance is taken after 5 repetitions.

[0050] Record the performance evaluation results for each combination. For example, the accuracy of "radial basis kernel (gamma=0.5) + c=4" is 0.88, the recall is 0.86, and the F1 score is 0.87; the F1 score of "linear kernel + c=2" is 0.82. After comparison, select the combination with the highest F1 score (such as radial basis kernel gamma=0.5, c=4) as the optimization parameters for the final model training. In existing technologies, some model parameter settings rely on experience (such as using a fixed linear kernel and c=1), without systematically searching for the optimal combination, resulting in performance limitations. This embodiment traverses the parameter space through grid search and combines it with cross-validation to select the optimal combination, enabling the model to adapt to data characteristics and improving detection performance. In another embodiment, in S4, the extracted feature parameters are combined into a feature vector, and the feature vector is input into the trained anomaly detection model. The Euclidean distance between the position of the feature vector in the support vector machine feature space and the optimal hyperplane is calculated to obtain the deviation value between the feature parameters and the normal behavior pattern. The optimal hyperplane is the classification boundary determined by the kernel function parameters and penalty factor optimized by the grid search method during the model training process.

[0051] For example, when calculating the deviation value, the extracted feature parameters are first combined into a feature vector, such as [Operation type ID=001, Operation frequency=5 times / second, Average time interval=1.2 seconds, Sequence occurrence frequency=30%, Memory usage=2GB, Behavior similarity=70%, Anomaly count=3 times], and the vector dimension is consistent with the number of key features (e.g., 7 dimensions).

[0052] The feature vector is input into the trained anomaly detection model. The model, based on the Support Vector Machine (SVM) algorithm, calculates the Euclidean distance between the vector and the optimal hyperplane in the feature space. The calculation is as follows: Let the hyperplane equation be w·x + b = 0 (where w is a 7-dimensional weight vector, such as [0.2, 0.3, 0.1, 0.15, 0.1, 0.05, 0.1]; b is the bias term, such as -0.5). Then the distance is |w·x + b| / ||w|| (where ||w|| is the L2 norm of w), and the resulting bias value may be 3.2 or 5.8. The optimal hyperplane is calculated from the kernel function parameters (e.g., radial basis function gamma = 0.5) and penalty factor (c = 4) determined by grid search during training, and serves as the classification boundary distinguishing normal from abnormal behavior.

[0053] In existing technologies, some methods judge anomalies based on a single feature threshold (such as an operation frequency exceeding 8 times / second), ignoring the correlation between features. This embodiment combines multi-dimensional features into a vector, calculates the distance to the optimal hyperplane, and comprehensively evaluates the deviation of behavior, which is more in line with the characteristics of complex operation behavior and makes the judgment more accurate. In another embodiment, during the training process of the support vector machine algorithm, an initial separating hyperplane is first constructed in the feature space; the distance from all historical normal operation behavior data sample points to the initial separating hyperplane is calculated, and the closest data sample point is identified; the position and orientation of the separating hyperplane are adjusted so that the minimum distance from all data sample points to the separating hyperplane reaches the maximum value; the distance calculation and hyperplane adjustment process is repeated until the final separating hyperplane that maximizes the minimum distance is found, and the final separating hyperplane is determined as the optimal hyperplane.

[0054] For example, during the training process of the support vector machine algorithm, an initial separating hyperplane is first constructed in the feature space. Assuming that the feature space is 3-dimensional (with 3 key features), and a normal vector w (e.g., [0.1, 0.2, 0.3]) and a bias term b (e.g., -0.4) are randomly generated, the equation of the initial hyperplane is 0.1x1 + 0.2x2 + 0.3x3 - 0.4 = 0.

[0055] Calculate the distance from all historical normal operation data sample points to the hyperplane using the formula |w·x+b| / ||w||. For example, for a sample point x=(2,3,4), the distance is 4.28. Identify the closest sample point (e.g., a point with a distance of 1.5 or 2.0). Adjust w and b of the hyperplane to maximize the minimum distance from all sample points to the hyperplane. For example, optimize the objective function (maximize the margin) using gradient descent, iteratively adjusting the components of w (e.g., from 0.1 to 0.12, 0.2 to 0.18) and b (e.g., from -0.4 to -0.35), recalculating the distance until the minimum distance increases from 1.5 to 2.5 or from 2.0 to 3.0. The hyperplane at this point is the optimal hyperplane.

[0056] In existing technologies, some classification models simply separate samples using hyperplanes without maximizing the minimum distance, leading to unstable judgments of edge samples. This embodiment optimizes the hyperplane to maintain the maximum and minimum distance between it and the samples, enhancing the model's tolerance to noise and edge behavior, and improving the stability of anomaly detection. In another embodiment, the deviation value calculated by the anomaly detection model is compared with a preset threshold, which is determined based on the distribution of deviation values ​​in the feature vectors of historical normal operation behavior datasets. When the deviation value is greater than the preset threshold, the anomaly level is divided according to the multiple preset threshold intervals in which the deviation value is located. The anomaly levels include low-risk, medium-risk, and high-risk levels. The low-risk level corresponds to the case where the deviation value exceeds the first threshold but does not exceed the second threshold; the medium-risk level corresponds to the case where the deviation value exceeds the second threshold but does not exceed the third threshold; and the high-risk level corresponds to the case where the deviation value exceeds the third threshold. Different anomaly levels trigger different levels of response actions. Abnormal operation behavior at the low-risk level only generates a log record; abnormal operation behavior at the medium-risk level triggers an internal system alarm; and abnormal operation behavior at the high-risk level triggers both an internal system alarm and sends an alarm message to the system administrator terminal.

[0057] For example, the deviation value calculated by the anomaly detection model is compared with a preset threshold. The preset threshold is determined based on the distribution of deviation values ​​from historical normal operating behavior data. For example, the first threshold is 3.5, the second threshold is 5.5, and the third threshold is 7.5. When the deviation value is 4.0, it is greater than the first threshold of 3.5 but less than the second threshold of 5.5, and is judged as a low-risk level; when the deviation value is 6.0, it is greater than the second threshold of 5.5 but less than the third threshold of 7.5, and is judged as a medium-risk level; when the deviation value is 8.0, it is greater than the third threshold of 7.5, and is judged as a high-risk level.

[0058] Different risk levels trigger different response actions: low-risk levels only generate logs, recording in detail the time, type, and deviation value of the abnormal operation (e.g., "2024-8-09 10:00:00, file access operation, deviation value 4.0"); medium-risk levels trigger internal system alarms, such as displaying a yellow warning icon on the server management interface; high-risk levels, in addition to internal system alarms, also send alarm messages to the administrator terminal via email or SMS. In existing technologies, some methods trigger the same alarm for all anomalies (such as only pop-ups), which may lead to the neglect of high-risk behaviors and the waste of resources for low-risk behaviors. This embodiment responds in a tiered manner based on deviation values, allowing resources to be focused on high-risk behaviors while recording low-risk behaviors for analysis, thereby improving the efficiency and targeting of security responses. In another embodiment, the deviation values ​​of all feature vectors in the historical normal operation behavior dataset to the optimal hyperplane are calculated to form a historical deviation value dataset; statistical analysis is performed on the historical deviation value dataset to calculate its mean, standard deviation and specified percentile; based on the results of the statistical analysis, multiple preset thresholds are set to verify the effectiveness of the multiple preset thresholds and ensure that the deviation values ​​of feature vectors of a preset proportion in the historical normal operation behavior dataset are lower than the first threshold.

[0059] For example, the deviation values ​​of all feature vectors in the historical normal operating behavior dataset to the optimal hyperplane are calculated, forming a historical deviation value dataset containing 10,000 values. Statistical analysis is performed on this dataset, and the mean is calculated to be 2.8 and the standard deviation is 1.2; among the specified percentiles, the 90th percentile is 4.0 (i.e., 90% of the deviation values ​​are ≤4.0), the 95th percentile is 5.2, and the 99th percentile is 6.8.

[0060] Based on statistical results, multiple preset thresholds are set. For example, the first threshold is set to 4.0 (corresponding to the 90th percentile), the second threshold is set to 5.2 (corresponding to the 95th percentile), and the third threshold is set to 6.8 (corresponding to the 99th percentile). When verifying the effectiveness of the thresholds, it is checked that in historical normal data, 90% of the deviation values ​​are lower than the first threshold of 4.0, and 95% are lower than the second threshold of 5.2, which meets the preset ratio requirements and ensures that the probability of normal operation being misjudged as abnormal is at a low level (e.g., ≤10%).

[0061] In existing technologies, some methods set thresholds based on experience (e.g., a fixed value of 5), without considering historical data distribution. This can easily lead to excessively high false alarm rates (normal operations are misjudged) or excessively high false negative rates (abnormal operations are not identified). This embodiment sets and verifies thresholds based on historical data statistics, making the thresholds more closely match the actual behavior distribution, balancing false alarms and false negatives, and improving detection reliability.

[0062] Although embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details and embodiments shown and described herein.

Claims

1. A method for monitoring abnormal computer operation behavior, characterized in that, include: S1: Monitor user operation behavior of the computer system, including keyboard input, mouse click, file access, network access, process start, and system call operations, and generate operation behavior logs. The operation behavior logs record the timestamp, operation content, operation context information, and associated system events for each user operation. S2: Extract feature parameters from the operation behavior log. Feature parameters include operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormal operation count. S3: Input the feature parameters into the pre-trained anomaly detection model. The anomaly detection model is built based on the support vector machine algorithm and trained using a historical normal operation behavior dataset. The training process includes feature selection steps and model parameter optimization steps. S4: Calculate the deviation between the feature parameters and the normal behavior pattern through the anomaly detection model. The deviation is based on the Euclidean distance between the feature vectors on the support vector machine hyperplane. S5: When the deviation value is greater than the preset threshold, it is judged as an abnormal operation behavior, and the abnormality level is divided according to the size of the deviation value; S6: When an abnormal operation is detected, trigger an alarm operation, including generating an alarm message and sending the alarm message to the system administrator terminal, and executing a predefined response action.

2. The computer abnormal operation behavior monitoring method as described in claim 1, characterized in that, User actions are intercepted in real time using operating system hooks, which include keyboard hooks, mouse hooks, file system hooks, network hooks, process hooks, and system call hooks to capture keyboard input operations, mouse click operations, file access operations, network access operations, process start operations, and system call operations. When generating operation behavior logs, the user identifier, application identifier, operation result status, and process context information of each user operation behavior are recorded. The operation context information includes application status, system resource status, and user session status. Perform real-time data cleaning and formatting on operation logs to remove redundant information and ensure log structure consistency.

3. The computer abnormal operation behavior monitoring method as described in claim 1, characterized in that, In S2, operation type characteristics include keyboard input operation type, mouse click operation type, file access operation type, network access operation type, process start operation type, and system call operation type, and a unique identifier is assigned to each operation type. The operation frequency feature calculates the number of operations per second, per minute, and per hour based on the timestamps of the operation behavior logs, and calculates the operation frequency separately for each operation type; Operation time interval characteristics include the average time interval, minimum time interval, and maximum time interval between consecutive operations, as well as the time interval distribution of the same operation type; Operation sequence pattern features identify frequent operation sequences by analyzing operation sequences through a sliding window, and calculate the occurrence frequency and transition probability of each operation sequence; Resource usage characteristics include CPU utilization, memory usage, disk I / O, and network bandwidth usage, and record the peak and average resource usage associated with each user's operation. Behavioral pattern consistency features are achieved by comparing the similarity between the current operational behavior sequence and the historical normal operational behavior sequence. The similarity is calculated based on the operation type matching rate, operation frequency deviation, and operation sequence pattern overlap. The abnormal operation count features include the cumulative number of abnormal operation types in the current user session, the frequency of recent abnormal operations, and the ratio of abnormal operations to normal operations.

4. The computer abnormal operation behavior monitoring method as described in claim 1, characterized in that, In S3, the anomaly detection model is trained using a historical normal operation behavior dataset. The training process first performs a feature selection step, using a recursive feature elimination method to select a predetermined number of key features with the highest importance scores from the extracted feature parameters. Key features include at least one or more of operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and anomaly operation count. Next, a model parameter optimization step is performed, using a grid search method to optimize and select the kernel function parameters and penalty factor of the support vector machine algorithm in a predetermined parameter space. The kernel function parameters include linear kernel function parameters, polynomial kernel function parameters, and radial basis function kernel function parameters. After completing feature selection and model parameter optimization, the selected key features and optimized model parameters are used to train a support vector machine classification model based on the historical normal operation behavior dataset. The historical normal operation behavior dataset contains normal operation behavior logs generated by multiple users at different time periods and their corresponding feature parameters. During training, the k-fold cross-validation method is used to evaluate the performance of the trained support vector machine classification model, and the model parameters are adjusted according to the accuracy, recall and F1 score indicators until the model performance meets the preset requirements. Finally, the trained support vector machine classification model is used as an anomaly detection model to calculate the deviation between the feature parameters and the normal behavior pattern.

5. The computer abnormal operation behavior monitoring method as described in claim 4, characterized in that, Methods for selecting a predetermined number of key features with the highest importance scores from extracted feature parameters using recursive feature elimination include: Initialize the feature set, which contains all feature parameters extracted from the operation behavior log. The feature parameters include operation type, operation frequency, operation time interval, operation sequence pattern, resource usage, behavior pattern consistency, and abnormal operation count. The base learner is trained using a historical normal operating behavior dataset. The base learner employs the support vector machine algorithm, and a feature importance score is calculated for each feature parameter in the feature set during the training process. Sort all feature parameters in the feature set according to the calculated feature importance scores, remove the feature parameters with the lowest feature importance scores according to a preset ratio, and update the feature set. The support vector machine algorithm is retrained based on the updated feature set, and the steps of feature importance score calculation, feature sorting and feature removal are repeated until the number of features in the feature set reaches the preset number. The retained feature parameters are used as the key features selected, which are then used in subsequent model parameter optimization steps and training of the support vector machine classification model.

6. The computer abnormal operation behavior monitoring method as described in claim 4, characterized in that, Methods for optimizing the kernel function parameters and penalty factors of the support vector machine algorithm in a predefined parameter space using grid search include: Construct a preset parameter space, which includes multiple kernel function types and their corresponding parameter value ranges. The kernel function types include linear kernel functions, polynomial kernel functions, and radial basis kernel functions, as well as the value range of the penalty factor. From the preset parameter space, combinations of kernel function types and penalty factors are selected sequentially. For each parameter combination, the support vector machine algorithm is trained using the selected key features and historical normal operation behavior dataset. The performance of the trained support vector machine classification model is evaluated using the k-fold cross-validation method. Record the performance evaluation results of the support vector machine classification model corresponding to each parameter combination in k-fold cross-validation. The performance evaluation results include accuracy, recall and F1 score. Compare the performance evaluation results for all parameter combinations, and select the combination of kernel function type and penalty factor that optimizes the performance of the support vector machine classification model as the optimized model parameters; The optimized model parameters obtained are used to train the final anomaly detection model.

7. The computer abnormal operation behavior monitoring method as described in claim 1, characterized in that, In S4, the extracted feature parameters are combined into a feature vector, and the feature vector is input into the trained anomaly detection model. The Euclidean distance between the position of the feature vector in the support vector machine feature space and the optimal hyperplane is calculated to obtain the deviation value between the feature parameters and the normal behavior pattern. The optimal hyperplane is the classification boundary determined by the kernel function parameters and penalty factor optimized through a grid search method during model training.

8. The computer abnormal operation behavior monitoring method as described in claim 7, characterized in that, In the training process of the support vector machine algorithm, an initial separating hyperplane is first constructed in the feature space; Calculate the distance from all historical normal operation behavior data sample points to the initial separating hyperplane, and identify the closest data sample point; Adjust the position and orientation of the separating hyperplane so that the minimum distance from all data sample points to the separating hyperplane reaches the maximum value; Repeat the distance calculation and hyperplane adjustment process until the final separating hyperplane that maximizes the minimum distance is found, and then determine the final separating hyperplane as the optimal hyperplane.

9. The computer abnormal operation behavior monitoring method as described in claim 8, characterized in that, The deviation value calculated by the anomaly detection model is compared with a preset threshold, which is determined based on the distribution of deviation values ​​of feature vectors in the historical normal operation behavior dataset. When the deviation value is greater than the preset threshold, the abnormality level is divided according to the multiple preset threshold intervals in which the deviation value is located. The abnormality level includes low risk level, medium risk level and high risk level. Among them, the low-risk level corresponds to the case where the deviation value exceeds the first threshold but does not exceed the second threshold, the medium-risk level corresponds to the case where the deviation value exceeds the second threshold but does not exceed the third threshold, and the high-risk level corresponds to the case where the deviation value exceeds the third threshold. Different levels of anomalies trigger different levels of response actions. Low-risk anomalies only generate logs, medium-risk anomalies trigger internal system alarms, and high-risk anomalies trigger both internal system alarms and send alarm messages to the system administrator's terminal.

10. The computer abnormal operation behavior monitoring method as described in claim 9, characterized in that, Calculate the deviation values ​​of all feature vectors in the historical normal operation behavior dataset from the optimal hyperplane to form a historical deviation value dataset; Perform statistical analysis on the historical deviation value dataset to calculate its mean, standard deviation, and specified percentiles; Based on the results of statistical analysis, multiple preset thresholds are set, and the effectiveness of the multiple preset thresholds is verified to ensure that the deviation value of the feature vector of a preset proportion in the historical normal operation behavior dataset is lower than the first threshold.

Images