Information security risk detection method and system based on data feature analysis

Abstract

The invention provides an information security risk detection method and system based on data feature analysis, and the method comprises the steps: obtaining traffic data of each node of a network, extracting communication protocol state transition and load information entropy features, and constructing a node feature vector through combining port and protocol information; clustering the nodes by adopting a density peak clustering algorithm to obtain a plurality of initial clusters; an initial cluster is regarded as a super node, a communication stability coefficient is determined according to communication flow jitter and periodicity between the super nodes, a cluster graph is constructed, and node feature vector dispersion in the super nodes is calculated to serve as an internal stability index; calculating super-node structure centrality based on the cluster graph, fusing the node feature vector and the subordinate super-node structure centrality to obtain a node context risk value, and aggregating node risk values in the super-nodes to generate a cluster risk value; and determining a global risk baseline according to statistical distribution of all cluster risk values, adjusting the baseline in combination with a super-node internal stability index to obtain a threshold value, and determining that the cluster is a high-risk cluster if the cluster risk value exceeds the threshold value.

Description

Technical Field

[0001] This application belongs to the field of risk detection, and in particular relates to an information security risk detection method and system based on data feature analysis. Background Technology

[0002] Network behavior analysis-based anomaly detection technology learns the behavioral patterns of a network during normal operation to identify abnormal behaviors that deviate from the normal pattern. Clustering algorithms, as an unsupervised learning method, can group network nodes or communication flows with similar behavioral characteristics into the same clusters without pre-labeled data, and then discover potential security risks by analyzing cluster characteristics or identifying outliers. However, clustering-based network security detection methods, based on basic traffic statistics, only superficially explore behavioral features that reflect the inherent patterns of communication. Furthermore, clustering all network nodes in a flat space ignores the "service clusters" formed by nodes with similar functions and the interactions between these clusters. Using thresholds to judge anomalies fails to consider the differences in behavioral patterns within different service clusters. For example, a server cluster with highly consistent internal behavior and a user terminal cluster with diverse behavior have different normal fluctuation ranges; a uniform threshold standard can easily lead to high false positives. Summary of the Invention

[0003] This invention proposes an information security risk detection method based on data feature analysis to address the problem that existing methods lack context-aware analysis modes and cannot distinguish the differences in behavioral patterns within different business clusters. The method includes: Traffic data of each node in the network is acquired, communication protocol state transition features and payload information entropy features are extracted, and node feature vectors are constructed by combining the port and protocol information of the nodes. Based on the feature vectors of all nodes, density peak clustering algorithm is used to cluster the nodes to obtain multiple initial clusters. Each initial cluster is regarded as a super node; the communication stability coefficient is determined based on the communication flow jitter and periodicity between super nodes; a cluster graph is constructed with super nodes as vertices and the coefficient as edge weights; and the dispersion of the node feature vector within each super node is calculated as an internal stability index. The structural centrality of each supernode is calculated based on the cluster graph; for any node, the node's feature vector and the structural centrality of its supernode are fused to calculate the node's context risk value, and then the context risk values ​​of all nodes within the supernode are aggregated to obtain the cluster risk value of the supernode; A global risk baseline is determined based on the statistical distribution of cluster risk values ​​of all supernodes; for each supernode, the global risk baseline is adjusted using the internal stability index of the supernode to obtain a judgment threshold; the cluster risk value of the supernode is compared with the judgment threshold, and when it exceeds the threshold, the supernode is judged as a high-risk cluster.

[0004] Furthermore, this invention also relates to an information security risk detection system based on data feature analysis, comprising the following modules: The clustering module is used to acquire traffic data of each node in the network, extract communication protocol state transition features and payload information entropy features, and construct node feature vectors by combining the port and protocol information of the nodes. Based on the feature vectors of all nodes, the density peak clustering algorithm is used to cluster the nodes to obtain multiple initial clusters. The calculation module is used to treat each initial cluster as a super node; determine the communication stability coefficient based on the communication flow jitter and periodicity between super nodes; construct a cluster graph with super nodes as vertices and the coefficient as edge weights; and calculate the dispersion of the node feature vectors within each super node as an internal stability index. An aggregation module is used to calculate the structural centrality of each supernode based on the cluster graph; for any node, the node's feature vector is fused with the structural centrality of its supernode to calculate the node's context risk value, and then the context risk values ​​of all nodes within the supernode are aggregated to obtain the cluster risk value of the supernode; The determination module is used to determine the global risk baseline based on the statistical distribution of the cluster risk values ​​of all supernodes; for each supernode, the global risk baseline is adjusted using the internal stability index of the supernode to obtain a determination threshold; the cluster risk value of the supernode is compared with the determination threshold, and when it exceeds the threshold, the supernode is determined to be a high-risk cluster.

[0005] This invention represents the operational modes of nodes by mining the inherent behavioral characteristics of communication protocol state transitions and payload information entropy. By clustering nodes into supernodes and constructing a cluster graph, it not only considers the behavior of individual nodes but also uses structural centrality to represent the importance of their respective service groups within the entire network, thereby achieving context-aware risk assessment of nodes. In the risk determination phase, a risk determination benchmark is set for each cluster based on the different levels of behavioral stability within that cluster. By combining deep feature analysis, macro-topology analysis, and analysis of group intrinsic characteristics, the reliability of network security risk detection is improved, and false positives and false negatives caused by a single evaluation standard in the network environment are reduced. Attached Figure Description

[0006] Figure 1 A flowchart of the first embodiment; Figure 2Construct a schematic diagram for node features; Figure 3 This is the initial clustering decision graph; Figure 4 This is a schematic diagram illustrating the communication stability coefficients. Figure 5 A schematic diagram for determining the global risk baseline. Detailed Implementation

[0007] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0008] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0009] In the first embodiment, the present invention proposes an information security risk detection method based on data feature analysis, such as... Figure 1 ,include: S1. Obtain traffic data from each node in the network, extract communication protocol state transition features and payload information entropy features, and construct node feature vectors by combining the port and protocol information of the nodes; based on the feature vectors of all nodes, use the density peak clustering algorithm to cluster the nodes to obtain multiple initial clusters; By mirroring ports on network switches or optical splitters, traffic acquisition tools are used to detect network traffic data packets over a period of time. Based on the five-tuple (source IP address, destination IP address, source port, destination port, and protocol type), the data packets are organized into bidirectional communication flows belonging to each node. For the state transition characteristics of communication protocols, taking TCP as an example, a finite state machine model of the TCP protocol is established. The frequency of all TCP sessions transitioning from one state to another within the observation period is counted. The transition frequencies between all states are then normalized to form a... The probability vector; for the load information entropy feature, the Shannon entropy of the application layer load of each data packet is calculated, and the mean value of the load entropy of all data packets of a node within the observation period is obtained; for port and protocol information, one-hot encoding is used for vectorization. For example, ports are divided into 5 groups: Web group: 80 / 443, Database group: 3306 / 1433, Remote access group: 22 / 3389, Mail group: 25 / 110, and other groups, encoded as a 5-dimensional vector, such as port 80 corresponding to [1,0,0,0,0]; protocol information is one-hot encoded for the three core protocols TCP / UDP / ICMP, encoded as a 3-dimensional vector, such as TCP corresponding to [1,0,0], and the port encoding vector and protocol encoding vector are concatenated to form an 8-dimensional port protocol feature vector; the protocol state transition probability vector, the mean load entropy, and the port and protocol encoding vectors of a node are concatenated, and after standardization, the feature vector of the node is formed, such as Figure 2 .

[0010] Calculate the Euclidean distance between the feature vectors of any two nodes; for each node, calculate the distance between the node's local density and high-density points; the local density is a cutoff distance. The number of neighboring nodes within the range; the high-density point distance is the distance from that node to the nearest node among all nodes with higher density; a decision graph is drawn with local density as the x-axis and high-density point distance as the y-axis, such as... Figure 3 The nodes with relatively large distances to both local and high-density points in the graph are selected manually or through algorithms as the initial cluster centers; the remaining nodes are assigned to the clusters containing the nodes with higher density and the closest distance, thus completing the initial clustering of all nodes.

[0011] In an optional embodiment, the step of acquiring traffic data from each node in the network and extracting communication protocol state transition features and payload information entropy features includes: A state transition probability matrix is ​​constructed as the state transition feature of the communication protocol by statistically analyzing the frequency of TCP protocol state transitions from state i to state j in a communication session per unit time. The probability of occurrence of each byte in the communication payload is then calculated. And according to the formula Calculate the load information entropy characteristics.

[0012] Specifically, within a defined time window, such as 1 minute, all TCP sessions initiated by a node in the network are monitored. The TCP protocol has 11 standard states, such as ESTABLISHED and FIN_WAIT_1. An 11×11 frequency matrix is ​​constructed to record the number of transitions from one state to another. For example, if the ESTABLISHED state transitions to FIN_WAIT_1 10 times within 1 minute, the corresponding count in the matrix is ​​10. After the statistics are completed, the frequency matrix is ​​row-normalized, that is, each element in each row is divided by the sum of all elements in that row to obtain the state transition probability matrix. This matrix is ​​the node's communication protocol state transition feature vector.

[0013] Collect the payload portion of all communication data packets from this node within the same time window. The payload consists of bytes, with each byte ranging from 0 to 255. Count the frequency of each of the 256 different byte values ​​and calculate the probability of each byte value. The information entropy is calculated by dividing the number of times the byte appears by the total number of bytes in the payload. For example, if the total payload is 1000 bytes, and the character 'A' (byte value 65) appears 50 times, the probability is 0.05. Substituting the probability values ​​of all bytes into the information entropy formula, a single value is calculated as the payload information entropy feature.

[0014] In an optional embodiment, the nodes are clustered using a density peak clustering algorithm based on the feature vectors of all nodes to obtain multiple initial clusters, including: Calculate the local density of the node for any node i. and the minimum distance from the node to the high-density point Select Value and Nodes whose values ​​are all greater than a preset threshold are designated as cluster centers, and the remaining nodes are assigned to the clusters containing the cluster centers closest to the selected nodes to complete the initial clustering.

[0015] For each node in the network, calculate two core parameters. The first parameter is the local density. The distance between the feature vector of node i and node i is less than the preset cutoff distance. The number of other nodes is determined. For example, if the cutoff distance is... Let the value be 0.5. If the feature vectors of 15 surrounding nodes are less than 0.5 away from node i, then the local density of node i is... The cutoff distance is 15. The following method was used to determine the distances: First, the Euclidean distances between the feature vectors of all nodes were calculated, forming a distance set D; then, D was sorted in ascending order, and the distance value at the 2nd percentile of the sorted values ​​was taken as the distance set. If the total number of network nodes is less than 100, We directly use an empirical value of 0.5; the second parameter is the minimum distance. , where represents the distance between node i and the nearest node among all nodes with a higher local density. If there is no node with a higher density than node i, then Take the maximum distance from all other nodes.

[0016] After calculating all nodes and After setting the value, cluster centers are identified and nodes are assigned. All nodes are then plotted on a graph. The horizontal axis is... On the decision graph with the vertical axis as the ordinate. Simultaneously possessing high... Value and High Nodes with high density values ​​are identified as cluster centers because they represent both local density peaks and are relatively far from other high-density regions. For example, setting a density threshold of 10 and a distance threshold of 2, then all... Greater than 10 and Nodes with a value greater than 2 are selected as initial cluster centers. For all non-cluster centers, they are assigned to the cluster represented by the cluster center closest to the selected node, thus completing the initial clustering of the entire network and forming multiple supernodes.

[0017] S2, each initial cluster is regarded as a super node; the communication stability coefficient is determined based on the communication flow jitter and periodicity between super nodes, a cluster graph is constructed with super nodes as vertices and the coefficient as edge weights, and the dispersion of the node feature vector within each super node is calculated as an internal stability index. For any two supernodes, the arrival time intervals of data packets in all communication flows between them are statistically analyzed, and the standard deviation of the time intervals is calculated as the communication flow jitter. Simultaneously, the flow rates between the two supernodes are expanded as a time series, and the spectrum of the supernodes is analyzed using Fourier transform. The amplitude of the dominant frequency is taken as the periodicity intensity. The communication stability coefficient is obtained by dividing the normalized periodicity intensity by (normalized jitter + 1). In the cluster graph, each supernode is a vertex, and the communication stability coefficient between supernodes is the weight of the edge connecting the corresponding vertex. For the internal stability index, the centroid of the eigenvectors of all nodes within a supernode is calculated, and then the average Euclidean distance from each node vector to the centroid is calculated. This average distance is the dispersion of the supernode.

[0018] In an optional embodiment, determining the communication stability coefficient based on communication flow jitter and periodicity between supernodes includes: The jitter J of the communication flow is obtained by calculating the standard deviation of the arrival time interval of data packets in the communication flow between two supernodes. A Fourier transform is performed on the time series of the communication flow, and the energy of the dominant frequency component is extracted as the periodicity P. After normalizing the communication flow jitter J and the periodicity P, the result is obtained using the formula... The communication stability coefficient is calculated, where and These are the preset weighting coefficients.

[0019] Specifically, to calculate the communication flow jitter J, the arrival timestamps of a series of data packets transmitted between two supernodes over a period of time are collected, for example... Calculate the time interval sequence between adjacent data packets. For example, if the arrival time intervals of the first four data packets are 10ms, 12ms, 9ms, and 11ms respectively, the standard deviation is calculated based on this interval sequence. The value of the standard deviation is the communication flow jitter J. A smaller J value indicates that the data packet arrival time intervals are stable, and the communication is smooth.

[0020] To calculate the periodicity P, the arrival time series of data packets is converted into a time signal, for example, on a fixed time grid with a granularity of 1 ms. The arrival time of a data packet is marked as 1, and the time before arrival is marked as 0. A Fast Fourier Transform (FFT) is applied to this time signal to transform it from the time domain to the frequency domain, resulting in a spectrum. Peaks in the spectrum correspond to periodic patterns in the communication flow. The frequency component with the highest energy, i.e., the dominant frequency component, is identified, and its energy value is extracted as the periodicity index P. A higher P value indicates a strong periodicity in the communication behavior. The communication flow jitter J and periodicity P are normalized and then calculated using a weighted formula to obtain the communication stability coefficient. For example, weights are set... , The calculated C value is the communication stability coefficient between the two supernodes. A higher value indicates more stable communication. Figure 4 .

[0021] In an optional embodiment, calculating the dispersion of the feature vectors of each supernode as an internal stability index includes: The centroid vector of the supernode is obtained by calculating the mean of the feature vectors of all nodes within the supernode. The Euclidean distance between the feature vector of each node within the supernode and the centroid vector is calculated, and the average of all calculated Euclidean distances is used as the internal stability index of the supernode.

[0022] For each supernode, a centroid vector is determined, representing the overall behavioral characteristics of the supernode. Assume a supernode contains N nodes, each with a D-dimensional feature vector. Centroid vector The calculation method is to take the value of each dimension as the arithmetic mean of the feature vectors of all nodes in the corresponding dimension. For example, if a supernode has three two-dimensional feature vectors (1,5), (2,3), and (3,7), then the centroid vector is (2,5).

[0023] After obtaining the centroid vector, the consistency of behavior among nodes within the supernode is measured. For each node within the supernode, the Euclidean distance between the node's feature vector and the supernode's centroid vector is calculated. Euclidean distance is the straight-line distance between two points in multidimensional space. Taking the previous example, the distance from node (1,5) to the centroid (2,5) is 1. This calculation is repeated for all nodes, resulting in a set of distance values. All the calculated Euclidean distance values ​​are summed and averaged; this average distance is defined as the internal stability index of the supernode. The smaller this index value, the more similar and concentrated the node behaviors within the supernode are, and the higher the internal stability.

[0024] S3. Calculate the structural centrality of each supernode based on the cluster graph; for any node, fuse the node's feature vector with the structural centrality of its supernode to calculate the node's context risk value, and then aggregate the context risk values ​​of all nodes within the supernode to obtain the supernode's cluster risk value. On the constructed weighted cluster graph, the PageRank algorithm is used to calculate the structural centrality score of each supernode. The higher the score, the more important the supernode is in the network structure. For any node within a supernode, the degree of anomalousness of the node itself is obtained by dividing the Euclidean distance from the node's feature vector to the centroid of its supernode cluster by the maximum Euclidean distance from all nodes within the supernode to the centroid. The larger the distance, the higher the degree of anomalousness. The context risk value of the node is equal to the node's own anomalousness multiplied by the structural centrality score of its supernode. The total cluster risk value of a supernode is obtained by summing the context risk values ​​of all nodes within a supernode.

[0025] In an optional embodiment, calculating the structural centrality of each supernode based on the cluster graph includes: The cluster graph is treated as a directed weighted graph. The PageRank algorithm is applied, and the communication stability coefficient between supernodes is normalized and used as the weight of the edge. The calculation is carried out iteratively until the PageRank value of each supernode converges. The converged PageRank value is used as the structural centrality of the supernode.

[0026] Specifically, each supernode is considered a vertex in the graph, and the communication flow between supernodes is considered a directed edge connecting the vertices. The weight of the edge is not fixed at 1, but is defined by a previously calculated communication stability coefficient. For example, if the communication stability coefficient from supernode A to supernode B is 50, then there is a directed edge with a weight of 50 pointing from A to B. The entire network is constructed as a directed weighted graph, where the edge weights reflect the importance and reliability of the communication links.

[0027] In the graph structure, after normalizing the original weights, an improved PageRank algorithm is applied to evaluate the importance of each supernode. Initially, each supernode is assigned the same initial PageRank value, such as the reciprocal of the total number of nodes. The PageRank value of each supernode is continuously updated iteratively. In each iteration, a supernode's PageRank value is updated based on the PageRank values ​​of other supernodes pointing to it and the weights of the corresponding connecting edges. Specifically, a supernode with a high PageRank value and high-weight inbound connections will have its importance increased accordingly. This iterative process continues until the change in the PageRank values ​​of all supernodes is below a very small preset threshold, at which point the algorithm is considered to have converged. The obtained stable and converged PageRank value is the structural centrality index of that supernode.

[0028] In an optional embodiment, the aggregation of the context risk values ​​of all nodes within the supernode to obtain the cluster risk value of the supernode includes: Calculate the arithmetic mean of the context risk values ​​of all nodes within the supernode, and use the average value as the cluster risk value of the supernode.

[0029] A context risk value has been calculated for each node within a supernode. This risk value combines the node's individual behavior with its role in the network structure. The aggregation process integrates these discrete node risk values ​​into a single index that represents the collective risk level of the entire supernode. For example, assuming a supernode C1 consists of four nodes N1, N2, N3, and N4, their context risk values ​​calculated above are 0.5, 0.8, 0.4, and 0.7, respectively.

[0030] To obtain the cluster risk value of supernode C1, the context risk values ​​of the four nodes are summed and divided by the number of nodes, 4. The result is 0.6. 0.6 is then determined as the cluster risk value of supernode C1. The method of using the arithmetic mean can smooth out the extreme risk values ​​of individual nodes, thereby providing a stable assessment of the overall security status of the functional cluster and reflecting the average risk level of the nodes within the supernode.

[0031] S4. Determine the global risk baseline based on the statistical distribution of cluster risk values ​​of all supernodes; for each supernode, adjust the global risk baseline using the internal stability index of the supernode to obtain a judgment threshold; compare the cluster risk value of the supernode with the judgment threshold, and when it exceeds the threshold, determine the supernode as a high-risk cluster.

[0032] Calculate the mean and standard deviation of the risk values ​​for all supernode clusters, setting the global risk baseline as the mean plus three times the standard deviation. For a specific supernode, obtain its internal stability index, i.e., dispersion, calculated above. Optionally, the decision threshold for a supernode is determined using the formula... Received, among which B is the preset adjustment coefficient, S is the global risk baseline, and S is the internal stability index of the supernode. The judgment threshold of supernodes with highly consistent internal behavior (i.e., low dispersion) will be close to the global baseline, while the judgment threshold of supernodes with diverse internal behavior (i.e., high dispersion) will be lowered accordingly. If the cluster risk value of a supernode is greater than the judgment threshold corresponding to the supernode, then the supernode and all nodes inside the supernode are marked as high risk.

[0033] In an optional embodiment, determining the global risk baseline based on the statistical distribution of cluster risk values ​​across all supernodes includes: Calculate the arithmetic mean of the cluster risk values ​​of all supernodes. and standard deviation And through the formula The global risk baseline B is calculated, where k is a preset coefficient.

[0034] Specifically, assume there are 5 supernodes in the network, and the cluster risks of these supernodes are 0.6, 0.4, 0.5, 0.65, and 0.45, respectively. Calculate the arithmetic mean of this dataset. That is, the sum of all risk values ​​divided by the number of supernodes: The average value represents the central trend of risk under the current network conditions.

[0035] The standard deviation is calculated by taking the square root of the sum of the squares of the differences between each risk value and the mean. The result is, for example,... . Obtain the average value and standard deviation Then, a global risk baseline is set using a formula. The coefficient k is a parameter that can be adjusted according to the security policy, for example, set to 2. Then the global risk baseline B = 0.7. The baseline B represents the statistical upper limit of the acceptable risk level in the current network environment, such as... Figure 5 .

[0036] To set a personalized risk assessment threshold for each supernode, in an optional embodiment, adjusting the global risk baseline using the supernode's internal stability index to obtain the assessment threshold includes: Based on the global risk baseline B and the internal stability index S of the supernode, the formula is used... Calculate the decision threshold T, where This is the preset adjustment coefficient.

[0037] The threshold is adjusted based on the internal stability index S of the supernode. This index represents the consistency of behavior among nodes within the supernode; a smaller S value indicates higher stability. In the adjustment formula, B is the global risk baseline. This is an adjustment coefficient used to control the degree of influence of the stability index S on the threshold adjustment; for example, it can be set to 0.5. (Exponential function) Partially, it is a regulatory factor between 0 and 1.

[0038] Assume a global risk baseline B = 0.7. For a highly consistent supernode A, the internal stability index of the supernode is... If it's low, for example, 0.2, then the threshold is determined. For another supernode B, whose internal node behavior is quite varied and chaotic, the stability index... High, for example, 1.8. Judgment threshold. Therefore, it can be seen that the more unstable the internal behavior of a supernode, the lower the risk assessment threshold is set, the more stringent the monitoring of such supernodes, and the easier it is to trigger alarms even with a slight increase in risk.

[0039] In the second embodiment, the present invention also proposes an information security risk detection system based on data feature analysis, comprising the following modules: The clustering module is used to acquire traffic data of each node in the network, extract communication protocol state transition features and payload information entropy features, and construct node feature vectors by combining the port and protocol information of the nodes. Based on the feature vectors of all nodes, the density peak clustering algorithm is used to cluster the nodes to obtain multiple initial clusters. The calculation module is used to treat each initial cluster as a super node; determine the communication stability coefficient based on the communication flow jitter and periodicity between super nodes; construct a cluster graph with super nodes as vertices and the coefficient as edge weights; and calculate the dispersion of the node feature vectors within each super node as an internal stability index. An aggregation module is used to calculate the structural centrality of each supernode based on the cluster graph; for any node, the node's feature vector is fused with the structural centrality of its supernode to calculate the node's context risk value, and then the context risk values ​​of all nodes within the supernode are aggregated to obtain the cluster risk value of the supernode; The determination module is used to determine the global risk baseline based on the statistical distribution of the cluster risk values ​​of all supernodes; for each supernode, the global risk baseline is adjusted using the internal stability index of the supernode to obtain a determination threshold; the cluster risk value of the supernode is compared with the determination threshold, and when it exceeds the threshold, the supernode is determined to be a high-risk cluster.

[0040] In an optional embodiment, the step of acquiring traffic data from each node in the network and extracting communication protocol state transition features and payload information entropy features includes: A state transition probability matrix is ​​constructed as a state transition feature of the communication protocol by statistically analyzing the frequency of TCP protocol state transitions from state i to state j in a communication session per unit time. The occurrence probability of each byte in the communication payload is calculated, and the payload information entropy feature is calculated based on the occurrence probability.

[0041] In an optional embodiment, the nodes are clustered using a density peak clustering algorithm based on the feature vectors of all nodes to obtain multiple initial clusters, including: Calculate the local density of the node for any node i. and the minimum distance from the node to the high-density point Select Value and Nodes whose values ​​are all greater than a preset threshold are designated as cluster centers, and the remaining nodes are assigned to the clusters containing the cluster centers closest to the selected nodes to complete the initial clustering.

[0042] In an optional embodiment, determining the communication stability coefficient based on communication flow jitter and periodicity between supernodes includes: The jitter J of the communication flow is obtained by calculating the standard deviation of the arrival time interval of data packets in the communication flow between two supernodes. A Fourier transform is performed on the time series of the communication flow, and the energy of the dominant frequency component is extracted as the periodicity P. After normalizing the communication flow jitter J and the periodicity P, the result is obtained using the formula... The communication stability coefficient is calculated, where and These are the preset weighting coefficients.

[0043] In an optional embodiment, calculating the dispersion of the feature vectors of each supernode as an internal stability index includes: The centroid vector of the supernode is obtained by calculating the mean of the feature vectors of all nodes within the supernode. The Euclidean distance between the feature vector of each node within the supernode and the centroid vector is calculated, and the average of all calculated Euclidean distances is used as the internal stability index of the supernode.

[0044] In an optional embodiment, calculating the structural centrality of each supernode based on the cluster graph includes: The cluster graph is treated as a directed weighted graph. The PageRank algorithm is applied, and the communication stability coefficient between supernodes is normalized and used as the weight of the edge. The calculation is carried out iteratively until the PageRank value of each supernode converges. The converged PageRank value is used as the structural centrality of the supernode.

[0045] In an optional embodiment, the aggregation of the context risk values ​​of all nodes within the supernode to obtain the cluster risk value of the supernode includes: Calculate the arithmetic mean of the context risk values ​​of all nodes within the supernode, and use the average value as the cluster risk value of the supernode.

[0046] In an optional embodiment, determining the global risk baseline based on the statistical distribution of cluster risk values ​​across all supernodes includes: Calculate the arithmetic mean of the cluster risk values ​​of all supernodes. and standard deviation And through the formula The global risk baseline B is calculated, where k is a preset coefficient.

[0047] In an optional embodiment, adjusting the global risk baseline using the supernode's internal stability index to obtain a judgment threshold includes: Based on the global risk baseline B and the internal stability index S of the supernode, the formula is used... Calculate the decision threshold T, where This is the preset adjustment coefficient.

[0048] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0049] The functional modules shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0050] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0051] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0052] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting information security risks based on data feature analysis, characterized in that, Includes the following steps: Traffic data of each node in the network is acquired, communication protocol state transition features and payload information entropy features are extracted, and node feature vectors are constructed by combining the port and protocol information of the nodes. Based on the feature vectors of all nodes, density peak clustering algorithm is used to cluster the nodes to obtain multiple initial clusters. Each initial cluster is considered a supernode; Based on the communication flow jitter and periodicity between supernodes, a communication stability coefficient is determined. A cluster graph is constructed with supernodes as vertices and the coefficients as edge weights. The dispersion of the feature vectors of nodes within each supernode is calculated as an internal stability index. Calculate the structural centrality of each supernode based on the cluster graph; For any node, the node's feature vector and the structural centrality of its supernode are fused to calculate the node's context risk value. Then, the context risk values ​​of all nodes within the supernode are aggregated to obtain the supernode's cluster risk value. The global risk baseline is determined based on the statistical distribution of cluster risk values ​​of all supernodes; For each supernode, the global risk baseline is adjusted using the internal stability index of the supernode to obtain the judgment threshold; The cluster risk value of the supernode is compared with a judgment threshold. When the risk value exceeds the threshold, the supernode is determined to be a high-risk cluster.

2. The method according to claim 1, characterized in that, The acquisition of traffic data from each node in the network, and the extraction of communication protocol state transition features and payload information entropy features, include: A state transition probability matrix is ​​constructed as a state transition feature of the communication protocol by statistically analyzing the frequency of TCP protocol state transitions from state i to state j in a communication session per unit time. The occurrence probability of each byte in the communication payload is calculated, and the payload information entropy feature is calculated based on the occurrence probability.

3. The method according to claim 1 or 2, characterized in that, Based on the feature vectors of all nodes, the density peak clustering algorithm is used to cluster the nodes, resulting in multiple initial clusters, including: Calculate the local density of the node for any node i. and the minimum distance from the node to the high-density point Select Value and Nodes whose values ​​are all greater than a preset threshold are designated as cluster centers, and the remaining nodes are assigned to the clusters containing the cluster centers closest to the selected nodes to complete the initial clustering.

4. The method according to claim 1, characterized in that, The method for determining the communication stability coefficient based on communication flow jitter and periodicity between supernodes includes: The standard deviation of the arrival time interval of data packets in the communication flow between two supernodes is calculated to obtain the communication flow jitter J. A Fourier transform is performed on the time series of the communication flow, and the energy of the dominant frequency component is extracted as the periodicity P. After normalizing the communication flow jitter J and the periodicity P, the result is obtained using the formula... The communication stability coefficient is calculated, where and These are the preset weighting coefficients.

5. The method according to claim 1, characterized in that, The calculation of the dispersion of the feature vectors of each supernode as an internal stability index includes: The centroid vector of the supernode is obtained by calculating the mean of the feature vectors of all nodes within the supernode. The Euclidean distance between the feature vector of each node within the supernode and the centroid vector is calculated, and the average of all calculated Euclidean distances is used as the internal stability index of the supernode.

6. The method according to claim 1, characterized in that, The calculation of the structural centrality of each supernode based on the cluster graph includes: The cluster graph is treated as a directed weighted graph. The PageRank algorithm is applied, and the communication stability coefficient between supernodes is normalized and used as the weight of the edge. The calculation is carried out iteratively until the PageRank value of each supernode converges. The converged PageRank value is used as the structural centrality of the supernode.

7. The method according to claim 1, characterized in that, The aggregation of the context risk values ​​of all nodes within the supernode to obtain the cluster risk value of the supernode includes: Calculate the arithmetic mean of the context risk values ​​of all nodes within the supernode, and use the average value as the cluster risk value of the supernode.

8. The method according to claim 1, characterized in that, The determination of the global risk baseline based on the statistical distribution of cluster risk values ​​of all supernodes includes: Calculate the arithmetic mean of the cluster risk values ​​of all supernodes. and standard deviation And through the formula The global risk baseline B is calculated, where k is a preset coefficient.

9. The method according to claim 1, characterized in that, The step of adjusting the global risk baseline using the internal stability index of the supernode to obtain the judgment threshold includes: Based on the global risk baseline B and the internal stability index S of the supernode, the formula is used... Calculate the decision threshold T, where This is the preset adjustment coefficient.

10. An information security risk detection system based on data feature analysis, characterized in that, Includes the following modules: The clustering module is used to acquire traffic data of each node in the network, extract communication protocol state transition features and payload information entropy features, and construct node feature vectors by combining the port and protocol information of the nodes. Based on the feature vectors of all nodes, the density peak clustering algorithm is used to cluster the nodes to obtain multiple initial clusters. The computation module is used to treat each initial cluster as a supernode; Based on the communication flow jitter and periodicity between supernodes, a communication stability coefficient is determined. A cluster graph is constructed with supernodes as vertices and the coefficients as edge weights. The dispersion of the feature vectors of nodes within each supernode is calculated as an internal stability index. The aggregation module is used to calculate the structural centrality of each supernode based on the cluster graph; For any node, the node's feature vector and the structural centrality of its supernode are fused to calculate the node's context risk value. Then, the context risk values ​​of all nodes within the supernode are aggregated to obtain the supernode's cluster risk value. The determination module is used to determine the global risk baseline based on the statistical distribution of cluster risk values ​​of all supernodes; For each supernode, the global risk baseline is adjusted using the internal stability index of the supernode to obtain the judgment threshold; The cluster risk value of the supernode is compared with a judgment threshold. When the risk value exceeds the threshold, the supernode is determined to be a high-risk cluster.

Images