Network security investigation method based on behavior sequence

Abstract

The invention discloses a network security investigation method based on a behavior sequence, and relates to the technical field of network security, which comprises the following steps: performing normalization processing on massive heterogeneous original logs to construct a uniform event stream basis, introducing a double attention coding mechanism, performing local context focusing on a normalized event stream on an event level, and obtaining a uniform event stream; according to the method, the short-term intention of the threatening threatening system is analyzed to construct a tactical fragment sequence capable of representing the short-term intention, then long-time-sequence context focusing is carried out again on the tactical level, the discrete tactical fragment sequences are aggregated into global context representation capable of describing a complete attack chain, and finally accurate threatening scoring is carried out based on the global context. Therefore, by performing automatic and deep construction and cognition on the context scene of the attack behavior, accurate and efficient investigation on complex attacks can be realized, so that the automatic analysis level and response capability of network security threats are effectively improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and more specifically, to a cybersecurity reconnaissance method based on behavior sequences. Background Technology

[0002] With the deep integration and development of network information technology, network attack methods are increasingly exhibiting highly organized, persistent, and complex characteristics. Traditional network security defense systems, such as firewalls and intrusion detection systems, often rely on fixed rules or known attack signature databases for single-point, isolated threat identification. This defense model often proves inadequate when dealing with new, multi-stage, and complex attacks such as Advanced Persistent Threats (APTs). Attackers gradually infiltrate and damage target systems through a series of meticulously planned, seemingly harmless, continuous actions. Single behavioral events are unlikely to trigger alerts, causing the full picture of the attack activity to be submerged in massive amounts of log data. Therefore, the focus of security analysis has shifted from detecting isolated events to a deep understanding and investigation of attacker behavior sequences. By correlating and analyzing context, reconstructing the attack chain has become a crucial prerequisite for effectively identifying and defending against advanced threats.

[0003] Against this backdrop, the industry has begun exploring the use of massive amounts of raw log data for attack behavior tracing and analysis. However, this log data, originating from different systems and devices, is essentially machine-generated, highly discrete, and with extremely low semantic levels, such as single login attempts, file access, or process creation. In contrast, attack activities understood and analyzed by security experts are based on high-level tactical intentions, such as "initial access," "credential theft," or "lateral movement." A significant cognitive and analytical gap exists between the massive, fragmented low-level event data and the abstract, coherent high-level attack tactics. Existing automated analysis tools mostly rely on simple association rules or statistical models, making it difficult to effectively capture long-term, cross-host complex behavioral patterns, and unable to truly understand the tactical implications behind behavioral sequences. This results in insufficient awareness of the contextual background of attack activities, hindering accurate and efficient threat assessment.

[0004] Therefore, there is an urgent need for an optimized network security reconnaissance method based on behavioral sequences. Summary of the Invention

[0005] This application is made in order to solve the above-mentioned technical problems.

[0006] According to one aspect of this application, a network security reconnaissance method based on behavioral sequences is provided, comprising: Normalize the events in the original log to obtain a normalized event stream; Event-level encoding and attention focusing are performed on the normalized event stream to obtain a sequence of tactical fragment vectors; Tactical layer encoding and attention focusing are performed on the sequence of tactical fragment vectors to obtain the attack activity context vector; Threat assessment is performed on the context vector of the attack activity to obtain a threat score.

[0007] Compared to existing technologies, this application provides a behavior sequence-based network security reconnaissance method. It normalizes massive amounts of heterogeneous raw logs to construct a unified event stream foundation and introduces a dual attention encoding mechanism. At the event level, it performs local contextual focusing on the normalized event stream to construct tactical fragment sequences representing short-term intentions. Then, at the tactical level, it performs long-term contextual focusing again, aggregating these discrete tactical fragment sequences into a global contextual representation that depicts the complete attack chain. Finally, it performs accurate threat scoring based on this global context. In this way, by automating and deeply constructing and recognizing the contextual scenario of attack behavior, it can achieve accurate and efficient reconnaissance of complex attacks, thereby effectively improving the level of automated analysis and response capabilities for network security threats. Attached Figure Description

[0008] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0009] Figure 1 This is a flowchart of a network security reconnaissance method based on behavior sequence according to an embodiment of this application.

[0010] Figure 2 This is a data flow diagram of a behavior sequence-based network security reconnaissance method according to an embodiment of this application.

[0011] Figure 3 This is a flowchart of sub-step S2 of the behavior sequence-based network security reconnaissance method according to an embodiment of this application.

[0012] Figure 4 This is a flowchart of sub-step S25 of the behavior sequence-based network security reconnaissance method according to an embodiment of this application.

[0013] Figure 5 This is a flowchart of sub-step S3 of the behavior sequence-based network security reconnaissance method according to an embodiment of this application. Detailed Implementation

[0014] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While some embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this application. It should be understood that the drawings and embodiments of this application are for illustrative purposes only and are not intended to limit the scope of protection of this application.

[0015] To address the problems mentioned above in the background technology, this application proposes a network security reconnaissance method based on behavior sequence. Figure 1 This is a flowchart of a network security reconnaissance method based on behavior sequence according to an embodiment of this application. Figure 2 This is a data flow diagram of a behavior sequence-based network security reconnaissance method according to an embodiment of this application. Figure 1 and Figure 2 As shown, the network security reconnaissance method based on behavior sequence includes the following steps: S1, normalizing the original logs to obtain a normalized event stream; S2, performing event-level encoding and attention focusing on the normalized event stream to obtain a sequence of tactical fragment vectors; S3, performing tactical-level encoding and attention focusing on the sequence of tactical fragment vectors to obtain an attack activity context vector; S4, performing threat assessment on the attack activity context vector to obtain a threat score.

[0016] In the aforementioned network security reconnaissance method based on behavior sequences, step S1 involves normalizing the events in the original logs to obtain a normalized event stream. It should be understood that because the original logs originate from various data sources such as EDR, network devices, operating systems, and cloud platforms, their formats exhibit significant heterogeneity, and field definitions are inconsistent. For example, a single user may have multiple identifiers such as username and SID. Behavioral descriptions also differ significantly, and timestamp formats vary, making these discrete logs unsuitable for direct use in subsequent behavior sequence analysis. Therefore, this application further performs systematic processing on the original logs, including parsing, entity unification, event standardization, and timestamp alignment, to transform heterogeneous logs into a structurally consistent and semantically unified set of events. This completely eliminates the heterogeneity barrier of multi-source logs, ensuring the consistency and comparability of event data during subsequent encoding, providing core support for building an accurate behavior sequence foundation, avoiding analytical biases caused by chaotic data formats, and laying a data foundation for cross-data source event correlation.

[0017] Specifically, in one possible embodiment, step S1 is implemented as follows: First, a customized parser is used to process logs from different sources, extracting source IP, destination IP, port, and access actions from firewall logs, and process ID, process name, user identifier, and operation type from operating system logs to ensure no critical information is omitted. Next, an entity mapping table is established to associate different identifiers of the same entity (such as user accounts and their corresponding security identifiers) with unique identifiers, avoiding duplicate counting of the same entity. Then, based on a preset event classification system, similar events with different descriptions (such as process creation and ProcessCreate) are unified into standard event names and codes. Finally, the timestamps of all events are converted to a unified UTC time format and sorted chronologically to generate a normalized event stream.

[0018] In the aforementioned network security reconnaissance method based on behavior sequences, step S2 involves performing event-level encoding and attention focusing on the normalized event stream to obtain a sequence of tactical fragment vectors. It should be understood that although the normalized event stream has a uniform format, it is still an isolated collection of low-level events. Individual events cannot reflect short-term correlations and tactical intentions between behaviors, and it contains a large number of non-threatening routine operational events, which can interfere with the identification of attack tactical fragments, making it impossible to extract tactically significant behavioral units from the event stream. Therefore, this application further performs event-level encoding and attention focusing on the normalized event stream to transform discrete low-level events into fragment vectors that can represent short-term tactical intentions. This establishes local contextual dependencies between events, highlights key events that contribute significantly to tactical intentions through an attention mechanism, filters out some unrelated benign noise events, and forms a structured and semantic sequence of tactical fragment vectors. This lays a semantic foundation for subsequent long-term global correlation analysis at the tactical level, while reducing the data dimensionality and computational complexity of subsequent processing.

[0019] In particular, in one specific embodiment, Figure 3 This is a flowchart of sub-step S2 of the behavior sequence-based network security reconnaissance method according to an embodiment of this application. Figure 3 As shown, step S2 includes: S21, obtaining a sequence of normalized events from the normalized event stream; S22, performing event embedding on the sequence of normalized events to obtain a sequence of event vectors; S23, segmenting the sequence of event vectors to obtain multiple event subsequences; S24, performing sub-event context semantic association encoding on the multiple event subsequences to obtain multiple event layer hidden states; S25, performing event layer attention aggregation on the multiple event layer hidden states to obtain a tactical fragment vector, and repeating this process to obtain a sequence of the tactical fragment vectors.

[0020] Specifically, step S21 involves obtaining a normalized event sequence from the normalized event stream. It should be understood that since the normalized event stream is a continuous and potentially infinitely growing data set, directly processing the entire stream is computationally infeasible and lacks a clear analytical boundary. Therefore, this application needs to extract a finite-length event sequence with contextual relevance as an analysis unit, rather than processing isolated single events. Obtaining such a bounded sequence is a prerequisite for subsequent sequence segmentation and capturing local contextual relationships. In this way, by defining a clear analysis window (i.e., an event sequence), subsequent embedding and encoding steps can focus on a temporally or logically related set of events, laying the foundation for effectively identifying short-term behavioral patterns and tactical intentions, and avoiding analysis failure caused by an unbounded processing scope.

[0021] Specifically, in one possible embodiment, step S21 is implemented as follows: First, the extraction rules for the sequence are determined, such as based on a fixed time window (e.g., extracting all events within 5 minutes), based on a logical session (e.g., extracting all events from the same user's login to logout), or based on associated entities (e.g., extracting all events triggered by the same process ID). Then, the system traverses the normalized event stream, collecting a set of consecutive events that satisfy the preset rules and are ordered by time to form a normalized event sequence. This sequence, as a whole, is used in subsequent event embedding steps.

[0022] Specifically, step S22 involves embedding the sequence of normalized events into event vectors to obtain a sequence of event vectors. It should be understood that since normalized events are presented in text or discrete symbol form, containing non-numerical information such as event type and operation description, they cannot be directly identified and calculated by subsequent modeling steps such as sequence segmentation and semantic encoding. This leads to the model's inability to capture the semantic relationships and feature differences of the events. Therefore, this application further transforms the non-numerical information of normalized events into numerical vectors with semantic representation capabilities. In a specific example of this application, the sequence of normalized events is input into an embedding layer based on the Word2Vec model to obtain the sequence of event vectors. The Word2Vec model's embedding layer maps the semantic information and feature attributes of the events into a computable numerical form. This allows the semantic relationships of normalized events (such as the relationship between process creation and malicious code execution) to be quantitatively represented, ensuring that subsequent steps can perform logical relationship analysis based on numerical vectors, thus improving the model's ability to understand the semantics of events.

[0023] Specifically, in one possible embodiment, step S22 is implemented as follows: First, the normalized event is preprocessed to extract key semantic elements, including event type, operational behavior, and associated entities, and these elements are organized into a structured text sequence. Then, a pre-trained Word2Vec model is invoked. This model has been trained on massive amounts of cybersecurity event text data and possesses event semantic mapping capabilities. The preprocessed structured text sequence is input into the embedding layer of the Word2Vec model, which maps the text sequence into a fixed-dimensional numerical vector according to semantic association rules. Finally, the output numerical vector is determined as the event vector, ensuring that it carries the complete semantic features of the normalized event.

[0024] Specifically, step S23 involves segmenting the event vector sequence to obtain multiple event subsequences. It should be understood that since the event vectors are a continuous set of vectors arranged in chronological order, directly semantically encoding the entire vector sequence would make it difficult for the model to capture the short-term logical connections between local events due to the excessive length of the sequence. This would prevent the identification of short-term behavioral fragments with tactical significance, thus affecting the perception of short-term attack intentions. Therefore, this application further divides the continuous event vector sequence into multiple event subsequences to identify event vector units with short-term logical connections. This allows subsequent semantic encoding steps to focus on local event vector sets, accurately capturing the short-term logical connections between events within the same subsequence, creating conditions for extracting fragment vectors representing short-term tactical intentions, and avoiding the loss of local connection information due to the excessive length of the overall sequence.

[0025] Specifically, in one possible embodiment, step S23 is implemented as follows: First, a segmentation rule is determined. Considering the short-term characteristics of network attack behavior, a fixed time window (e.g., 5 minutes) or logical correlation (such as events triggered by the same process) is selected as the segmentation basis. Then, the continuous event vector sequence is traversed, and sub-sets are truncated segment by segment according to the segmentation rule, ensuring that the event vectors within each subset are temporally or logically correlated. Simultaneously, the integrity of the truncated vector subsets is verified to confirm that each subset contains a sufficient number of event vectors to support subsequent semantic encoding. Finally, the verified vector subsets are marked as event subsequences, forming multiple independent sets of local vector sequences.

[0026] Specifically, in step S24, sub-event contextual semantic association encoding is performed on multiple event sub-sequences to obtain multiple event-layer hidden states. It should be understood that, to avoid the temporal dependencies and semantic association logic between events within an event sub-sequence failing to reflect the behavioral intent behind the short-term event sequence and hindering the construction of subsequent tactical segments, this application further performs deep processing on each event sub-sequence, learning the contextual association relationships of event vectors within the sub-sequence and transforming them into feature states containing association information. This obtains feature representations that carry the semantic associations and temporal logic of events within the sub-sequence. In this way, isolated event vectors can be transformed into feature states with contextual information, enabling each feature state to reflect the overall association logic of events within the sub-sequence, providing a basis for the subsequent attention aggregation step to filter key information.

[0027] Specifically, in one possible embodiment, step S24 is implemented as follows: First, an encoding model with temporal correlation learning capabilities is selected, such as a bidirectional recurrent neural network. This model can simultaneously traverse subsequences in both forward and backward directions to capture the bidirectional correlation between event vectors. Then, each event subsequence is successively input into the encoding model. The model iteratively processes the input vector sequence, fusing the semantic information of the current event vector with the preceding and following event vectors at each time step. After processing, the model outputs the feature state corresponding to each time step, which contains the correlation information between the current event vector and other event vectors within the subsequence. Finally, these feature states are marked as event-layer hidden states, ensuring that a set of event-layer hidden states is generated for each event subsequence.

[0028] Specifically, in step S25, event-level attention aggregation is performed on the multiple event-level hidden states to obtain a tactical fragment vector, and this process is repeated to obtain a sequence of the tactical fragment vectors. It should be understood that although the multiple event-level hidden states carry the contextual semantic relationships within the event subsequence, each hidden state has equal weight in representing tactical intent, making it impossible to distinguish between information that has a key impact on short-term tactical intent (such as hidden states reflecting abnormal process creation or access to sensitive resources) and irrelevant redundant information, resulting in difficulty in forming fragment representations that focus on the core tactical logic. Therefore, this application further performs attention weight allocation and information fusion processing on the multiple event-level hidden states, assigning differentiated weights based on the contribution of each hidden state to the tactical intent and aggregating them into a single vector to extract key tactical association information within the subsequence. This enables the generated vector to accurately carry the core logic of short-term attack tactics, filter out redundant information corresponding to benign operations, provide a local representation with clear tactical direction for the construction of the complete attack chain in subsequent tactical layer encoding, improve the accuracy of identifying short-term attack intent, and avoid misjudgment of tactical intent due to information mixing.

[0029] In particular, in one specific embodiment, Figure 4 This is a flowchart of sub-step S25 of the network security reconnaissance method based on behavior sequence according to an embodiment of this application. Figure 4 As shown, step S25 includes: S251, calculating the event attention weights of each event layer hidden state to obtain multiple event attention weights; S252, using the multiple event attention weights as weight coefficients, calculating the weighted sum of multiple event layer hidden states to obtain the tactical fragment vector.

[0030] More specifically, in step S251, the event attention weights of the hidden states of each event layer are calculated using the following formula to obtain multiple event attention weights:

[0031]

[0032] in, Hide the state for each event layer. For event attention weights, , and For learnable parameters, For the tanh function, To hide intermediate feature vectors for the event layer, This is the transpose of the vector. This is an exponential function with base e. Specifically, this application further quantifies the attention weight of each event-layer hidden state by first performing a nonlinear transformation on the event-layer hidden states, and then performing Softmax normalization on the inner product of the intermediate hidden feature vectors obtained after the nonlinear transformation and the learnable parameters. This ensures that the obtained attention weights accurately reflect the importance of each hidden state to the tactical intent, guaranteeing that hidden states related to key attack behaviors receive higher weights during subsequent weighted aggregation. This strengthens the representation of core tactical information, filters out irrelevant and redundant interference, provides a reliable weighting basis for generating tactical fragment vectors, and effectively improves the accuracy of identifying short-term attack tactical intent.

[0033] More specifically, in step S252, a weighted sum of multiple event-layer hidden states is calculated using multiple event attention weights as weight coefficients to obtain the tactical fragment vector. It should be understood that since each event-layer hidden state is an independent semantic carrier, a unified tactical information aggregate has not yet been formed, making it impossible to directly represent short-term attack tactical intentions and support the subsequent tactical layer's construction of the attack chain. Therefore, this application further uses event attention weights as the adjustment basis, fusing and calculating the hidden states of each event layer according to their weight contribution. A single vector is generated by combining weights and hidden states, thereby integrating key semantic information and forming a unified short-term tactical fragment representation. This allows the dispersed key hidden state information to be aggregated into a vector with a clear tactical orientation, strengthening the semantic contribution of high-weight hidden states, filtering out low-weight benign redundant information, and enabling the vector to accurately carry the core attack logic within the subsequence, laying a reliable local tactical foundation for the subsequent tactical layer encoding to construct a complete attack chain.

[0034] In the aforementioned network security reconnaissance method based on behavioral sequences, step S3 involves performing tactical-level encoding and attention focusing on the sequence of tactical fragment vectors to obtain an attack activity context vector. It should be understood that, since the sequence of tactical fragment vectors can only represent short-term tactical intentions within an attack activity, and lacks long-term logical connections and global integration between the tactical fragments, it cannot fully present the entire chain of attack activity from initial penetration and lateral movement to target achievement. Furthermore, it cannot distinguish the degree of contribution of different tactical fragments to the overall attack intention, making it difficult to form an understanding of the overall attack situation. Therefore, this application further performs tactical-level encoding and attention focusing on the sequence of tactical fragment vectors to establish long-term temporal connections between tactical fragments and highlight core tactical information, forming a global representation capable of depicting a complete attack scenario. In this way, scattered short-term tactical intentions can be effectively integrated to construct an attack activity context vector that includes the logic of the entire attack chain. This accurately captures the core tactical links that play a key role in threat assessment, providing a comprehensive and focused global attack situation basis for subsequent accurate threat scoring. It avoids the breakage of the attack chain or the omission of key information due to the dispersion of tactical fragments, and significantly improves the overall cognitive ability to deal with complex attacks such as advanced persistent threats.

[0035] In particular, in one specific embodiment, Figure 5 This is a flowchart of sub-step S3 of the behavior sequence-based network security reconnaissance method according to an embodiment of this application. Figure 5As shown, step S3 includes: S31, inputting the sequence of tactical fragment vectors into a tactical layer encoder based on a bidirectional LSTM model to obtain a sequence of tactical layer hidden states; S32, calculating the tactical attention weights of each tactical layer hidden state in the sequence of tactical layer hidden states to obtain a sequence of tactical attention weights; S33, calculating the weighted sum of the sequences of tactical layer hidden states based on the sequence of tactical attention weights to obtain the attack activity context vector.

[0036] Specifically, in step S31, the sequence of tactical fragment vectors is input into a tactical layer encoder based on a bidirectional LSTM model to obtain the sequence of tactical layer hidden states. It should be understood that while the sequence of tactical fragment vectors can represent short-term tactical intentions, the vectors are discrete and lack long-term logical connections, failing to reflect the progressive relationships of tactical stages in an attack, such as the connection from initial access to lateral movement. Furthermore, traditional encoding methods can only capture temporal information unidirectionally, making it difficult to fully present the bidirectional impact between tactics. Therefore, this application further inputs the sequence into a tactical layer encoder based on a bidirectional LSTM model to learn the long-term temporal connections and bidirectional logical relationships between tactical fragments. This allows the output sequence of tactical layer hidden states to not only contain the semantic information of individual tactical fragments but also integrate the relational features of preceding and following tactical fragments, fully preserving the progressive logic and bidirectional impact of the attack tactics. This lays the foundation for accurate identification of core tactical stages and avoids problems such as broken attack chains and misjudgments of tactical connections caused by missing temporal information or unidirectional encoding.

[0037] Specifically, in one possible embodiment, step S31 is implemented as follows: First, the tactical layer encoder of the bidirectional LSTM model is pre-trained to construct a labeled dataset, where each sample is a sequence of tactical fragment vectors of a known attack activity, and each tactical fragment in the sequence is labeled with its corresponding attack tactic by a security expert. Subsequently, based on this dataset, the encoder's pre-training task can be set as a supervised learning or self-supervised learning task. For example, it can be set as a supervised task of classifying tactical categories at each time step. Through this pre-training process, the encoder can deeply learn and internalize typical sequence patterns and logical dependencies between attack tactics. Then, the sequence of tactical fragment vectors is input into the encoder sequentially according to the time order of the attack events. The encoder initiates a bidirectional traversal mechanism, forward traversing to learn the progressive relationship of tactical fragments from the early to the late stages, and backward traversing to capture the retrospective association between later tactics and earlier tactics, such as the dependence of data theft on credential acquisition. After the traversal is complete, the encoder outputs the corresponding hidden state at each time step. All hidden states are arranged in the order of input to form a sequence of tactical layer hidden states. Each hidden state in this sequence carries the complete temporal and semantic information of the corresponding tactical segment and its preceding and following relationships.

[0038] Specifically, step S32 involves calculating the tactical attention weights of each tactical layer hidden state in the sequence of tactical layer hidden states to obtain a sequence of tactical attention weights. In a specific example of this application, step S32 includes: calculating the tactical attention weights of each tactical layer hidden state in the sequence of tactical layer hidden states using the following formula:

[0039]

[0040] in, To hide the state for each tactical layer, For tactical attention weight, , and For learnable parameters, The tactical layer hides intermediate feature vectors. This involves performing a non-linear transformation on the tactical layer hidden states. First, linear operations are performed on each tactical layer hidden state using learnable parameters. Then, the non-linear expression of the enhanced features is processed through a tanh activation function, resulting in intermediate feature vectors that more accurately characterize the semantic features of the tactical layer hidden states. Subsequently, the similarity between the intermediate feature vectors and the learnable parameters is measured using inner product operations, and all inner product results are normalized using the Softmax function to obtain the tactical attention weights. The Softmax normalization operation ensures that the tactical attention weights are within the [0,1] interval and that the sum of all tactical attention weights is 1. This allows the tactical attention weights to accurately reflect the contribution of the corresponding tactical layer hidden state in constructing the global context of the attack activity, providing a reliable weight basis for subsequent weighted aggregation to generate the attack activity context vector, and ensuring that core tactical information is highlighted in the global representation.

[0041] Specifically, in step S33, a weighted sum of the sequences of tactical layer hidden states is calculated based on the sequence of tactical attention weights to obtain the attack activity context vector. It should be understood that since the sequence of tactical attention weights only quantifies the importance of each hidden state, and the sequence of tactical layer hidden states remains in a scattered feature space, it is not integrated into a unified vector that can comprehensively represent the entire attack chain. This fails to provide a global and structured basis for threat assessment, resulting in a lack of complete contextual support for subsequent threat scoring. Therefore, this application further uses the sequence of tactical attention weights as coefficients to calculate the weighted sum of the sequences of tactical layer hidden states, thereby integrating scattered tactical features with different importance into a single global representation vector. This allows the integrated attack activity context vector to highly focus on core tactical elements, while also integrating the progressive and relational logic between various tactics, fully presenting the entire chain of attack activity from initial penetration, intermediate breakthrough to final destruction. This provides comprehensive and focused input information for subsequent accurate threat scoring, significantly improving the accuracy and efficiency of threat assessment and avoiding misjudgments or omissions due to feature dispersion.

[0042] In particular, in another possible preferred embodiment, step S3 includes: inputting the sequence of the tactical fragment vectors into a bidirectional sequence encoder to obtain a sequence of tactical layer hidden states corresponding to each tactical fragment vector; performing positional encoding on the sequence of the tactical layer hidden states to incorporate temporal positional information; generating a dynamic query vector based on a global information digest of the sequence of the tactical layer hidden states, wherein the global information digest is composed of the final forward hidden state and the initial backward hidden state of the bidirectional sequence encoder, so that the dynamic query vector can adapt to the current sequence of tactical fragment vectors; calculating the tactical attention weight of each tactical layer hidden state based on the dynamic query vector; and performing weighted aggregation on the position-encoded sequence of tactical layer hidden states based on the tactical attention weight to obtain the attack activity context vector.

[0043] Specifically, parameter vector It is a static globally shared context vector learned throughout the training process. It can be understood as an abstract representation of the ideal and most important tactical segments. When calculating the tactical attention weights, it measures the tactical layer hidden state corresponding to each tactical segment in the sequence. With this ideal template The similarity.

[0044] However, tactical fragment sequences differ in nature from lower-level event sequences. Tactical fragments are highly abstract and logical; for example, initial access → execution → persistence → lateral movement exhibits a more pronounced logical progression. Therefore, tactical fragment sequences are context-dependent. For instance, a lateral movement tactical fragment might be benign, such as during normal administrator maintenance. However, if it occurs after credential theft, its maliciousness increases dramatically. Thus, the importance of tactical fragments is dynamic, depending on their position and context within the attack chain. Therefore, static query vectors... The inability to capture this dynamic, context-dependent logic, and the use of the same standard to measure all segments, may lead to an overemphasis on segments that seem dubious in themselves, while ignoring those that reveal their crucial role only in a specific context.

[0045] Therefore, the expected query vector It is not globally static, but dynamically generated from the global information of the sequence itself. That is, for each different tactical sequence, a unique adaptive query vector is generated to examine the various components of the sequence itself. First, the sequence of tactical fragment vectors is input into a bidirectional sequence encoder to obtain the sequence of tactical layer hidden states corresponding to each tactical fragment vector. Specifically, for the sequence of tactical fragment vectors (let the length be K), the tactical layer encoder based on a bidirectional LSTM model is used to input the context representation of each tactical fragment. ,in It is the hidden state of the forward LSTM at position i. It is the hidden state of the backward LSTM at position i. It involves splicing the sequences and introducing positional encoding, that is, encoding the sequence of the tactical layer hidden states positionally so that the sequence of the tactical layer hidden states incorporates temporal positional information, in the hidden state. Based on position encoding , For example, positional encoding is generated using the sin / cos functions in the Transformer. That is, because attack chains have explicit syntax and temporal structures—for example, "initial access" always comes first, and "data leakage" always comes later—attention mechanisms need to be able to perceive the positional information of tactical fragments within the sequence.

[0046] Then, a dynamic query vector is generated based on the global information digest of the sequence of the tactical layer hidden states. The global information digest is composed of the final forward hidden state and the initial backward hidden state of the bidirectional sequence encoder; that is, the final state of the bidirectional LSTM is the last hidden state of the forward LSTM. and the first hidden state of the backward LSTM The concatenation of the sequences, which contains a high-level information summary of the entire sequence, allows the dynamic query vector to adapt to the current sequence of tactical fragment vectors. Therefore:

[0047] in, Represents a dynamic query vector. and These are learnable parameters used to map a global summary of a sequence to the query space. This represents the hyperbolic tangent function. In other words, since the final semantics of a tactical sequence is determined by its overall structure, the best criterion for evaluating the importance of a particular part (a tactical segment) of the sequence is the overall summary of the sequence.

[0048] In this way, the tactical attention weights of each tactical layer hidden state can be calculated based on the dynamic query vector, for example, by using a generalized associative dot product attention mechanism:

[0049]

[0050]

[0051] in, Represents the transpose of a vector. Represents matrix multiplication. This represents an exponential function with base e. Represents the intermediate correlation matrix. Represents the hidden state of each tactical layer Attention score Represents the hidden state of each tactical layer The tactical attention weights are all row vectors. That is, attention scores are obtained by generalizing the association between dynamic queries and the hidden states of the tactical layer through correlation, and further by analyzing query clicks. This allows attention allocation to become more context-aware. For example, instead of asking whether a fragment resembles a known bad fragment, the model asks how much this fragment contributes to the context of the current attack story, thus better identifying key steps that connect different parts of the story.

[0052] Therefore, the improved tactical attention mechanism can understand the logical relationships and positional importance between tactical segments, thus better distinguishing between real, structurally complete attack chains and isolated, benign anomalous behaviors. For example, if an administrator executes a remote command (which looks like "lateral movement") but there is no context such as "credential theft" or "persistence" before or after it, adaptive attention will give it lower weight due to the overall incoherence, thereby avoiding false positives. Furthermore, through the above mechanism, the grammatical structure of attacks can be learned, rather than specific words (individual tactics). This allows the model to correctly identify this key step, for example, when an attacker uses a new technique to achieve persistence, as long as its position and role in the attack chain are similar to known persistence techniques, thanks to its structure-aware capabilities.

[0053] Finally, based on the tactical attention weights, the sequence of position-encoded tactical-layer hidden states is weighted and aggregated to obtain the attack activity context vector. Specifically, firstly, the weighted aggregation is calculated as element-wise weighted summation, where each position-encoded tactical-layer hidden state is multiplied element-wise by its corresponding tactical attention weight to obtain a weighted feature vector for that hidden state. Secondly, the sequence of position-encoded hidden states is traversed, and the above weighting operation is performed on each hidden state to generate a set of weighted feature vectors. Subsequently, all weighted feature vectors are summed according to their dimensions, and the summation result is used as the integrated global feature vector. Finally, the global feature vector is dimension-validated to ensure that its dimension is consistent with the dimension of the tactical-layer hidden states and that the vector element values ​​are within a reasonable range, such as through activation function constraints, to generate an attack activity context vector that can completely represent the global context of the attack activity.

[0054] In the aforementioned network security reconnaissance method based on behavior sequences, step S4 involves performing threat assessment on the attack activity context vector to obtain a threat score. In a specific example of this application, step S4 includes: inputting the attack activity context vector into a fully connected layer, followed by a Sigmoid activation function to obtain the threat score. It should be understood that although the attack activity context vector fully carries the global situational characteristics of the entire attack chain, it remains in a high-dimensional feature space and has not been transformed into a quantitative indicator that can directly support security decisions. It cannot intuitively reflect the risk level of the attack activity, and the lack of a unified numerical standard makes it difficult for security personnel to quickly distinguish the urgency of threats, nor can it provide a clear triggering basis for automated response mechanisms. Therefore, this application further inputs the attack activity context vector into a fully connected layer for feature mapping and dimensionality compression, and then processes it through a Sigmoid activation function to transform the high-dimensional features into a normalized threat score. This allows the threat level to be presented as a quantitative value in the range of 0 to 1. The scoring is intuitive and standardized, and security personnel can quickly identify high-risk attacks. If the score is close to 1, the automated system can set alarm priorities or trigger handling procedures based on the score, avoiding low judgment efficiency and delayed decision-making caused by high feature dimensions and lack of quantitative basis, and effectively improving the accuracy and timeliness of threat response.

[0055] Specifically, in one possible embodiment, step S4 is implemented as follows: First, the fully connected layer is initialized and configured. The input dimension of this fully connected layer strictly matches the feature dimension of the attack activity context vector, and the output dimension is set to 1 to ensure a single score output. The weight matrix and bias terms within the layer are trained and optimized using massive labeled samples (containing attack activity data and normal behavior data of different threat levels) to ensure accurate establishment of the correlation between features and threat levels. Next, the attack activity context vector is input into the fully connected layer according to a preset data format. The fully connected layer performs linear transformation and nonlinear feature fusion on the vector, compressing the high-dimensional global situation features into a low-dimensional risk feature vector. Subsequently, the low-dimensional risk feature vector is input into the Sigmoid activation function, which performs a nonlinear mapping on the input value so that the output result strictly falls within the range of 0 to 1, where the closer the value is to 1, the higher the threat level of the attack activity, and the closer it is to 0, the lower the threat level. Finally, the output value of the Sigmoid activation function is extracted and determined as the final threat score. This score is directly used for security decisions. For example, when the score is greater than 0.8, a high-level alarm is triggered and emergency response suggestions are pushed. When the score is less than 0.2, it is marked as a low-risk activity that does not require emergency intervention.

[0056] In summary, the behavior sequence-based network security reconnaissance method based on the embodiments of this application is explained. It normalizes massive amounts of heterogeneous raw logs to construct a unified event stream foundation and introduces a dual attention encoding mechanism. At the event level, it performs local contextual focusing on the normalized event stream to construct a sequence of tactical fragments representing short-term intentions. Then, at the tactical level, it performs long-term contextual focusing again, aggregating these discrete tactical fragment sequences into a global contextual representation that depicts the complete attack chain. Finally, it performs accurate threat scoring based on this global context. Thus, by automatically and deeply constructing and recognizing the contextual scenario of attack behavior, it can achieve accurate and efficient reconnaissance of complex attacks, thereby effectively improving the level of automated analysis and response capabilities for network security threats.

[0057] As described above, the behavior sequence-based network security reconnaissance method according to the embodiments of this application can be implemented in various wireless terminals, such as servers with behavior sequence-based network security reconnaissance algorithms. In one possible implementation, the behavior sequence-based network security reconnaissance method according to the embodiments of this application can be integrated into the wireless terminal as a software module and / or hardware module. For example, the behavior sequence-based network security reconnaissance method can be a software module in the operation method of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the behavior sequence-based network security reconnaissance method can also be one of many hardware modules of the wireless terminal.

[0058] Alternatively, in another example, the behavior sequence-based network security reconnaissance method and the wireless terminal can also be separate devices, and the behavior sequence-based network security reconnaissance method can be connected to the wireless terminal via wired and / or wireless networks, and transmit interactive information in accordance with an agreed data format.

Claims

1. A network security reconnaissance method based on behavioral sequences, characterized in that, include: Normalize the events in the original log to obtain a normalized event stream; Event-level encoding and attention focusing are performed on the normalized event stream to obtain a sequence of tactical fragment vectors; Tactical layer encoding and attention focusing are performed on the sequence of tactical fragment vectors to obtain the attack activity context vector; Threat assessment is performed on the context vector of the attack activity to obtain a threat score.

2. The network security investigation method based on behavior sequence according to claim 1, characterized in that, The normalized event stream is encoded at the event level and focused with attention to obtain a sequence of tactical fragment vectors, including: Obtain the sequence of normalized events from the normalized event stream; The sequence of normalized events is embedded to obtain a sequence of event vectors; The sequence of event vectors is segmented to obtain multiple event subsequences; Sub-event context semantic association encoding is performed on the multiple event sub-sequences to obtain multiple event layer hidden states; Event-level attention aggregation is performed on the multiple event-level hidden states to obtain a tactical fragment vector, and this process is repeated to obtain a sequence of the tactical fragment vectors.

3. The network security investigation method based on behavior sequence according to claim 2, characterized in that, The process of embedding a sequence of normalized events into an event vector sequence includes: inputting the sequence of normalized events into an embedding layer based on a Word2Vec model to obtain the sequence of event vectors.

4. The network security investigation method based on behavior sequence according to claim 2, characterized in that, Event-level attention aggregation is performed on the multiple event-level hidden states to obtain a tactical fragment vector, and this process is repeated to obtain a sequence of the tactical fragment vectors, including: The event attention weights for each hidden state of an event layer are calculated using the following formula to obtain multiple event attention weights: , in, Hide the state for each event layer. For event attention weights, , and For learnable parameters, For the tanh function, To hide intermediate feature vectors for the event layer, This is the transpose of the vector. It is an exponential function with base e; Using multiple event attention weights as weight coefficients, a weighted sum of the hidden states of multiple event layers is calculated to obtain the tactical fragment vector.

5. The network security investigation method based on behavior sequence according to claim 1, characterized in that, Tactical layer encoding and attention focusing are performed on the sequence of tactical fragment vectors to obtain the attack activity context vector, including: The sequence of tactical fragment vectors is input into a tactical layer encoder based on a bidirectional LSTM model to obtain the sequence of tactical layer hidden states; Calculate the tactical attention weights of each tactical layer hidden state in the sequence of tactical layer hidden states to obtain the sequence of tactical attention weights; Based on the sequence of tactical attention weights, a weighted sum of the sequences of tactical layer hidden states is calculated to obtain the attack activity context vector.

6. The network security reconnaissance method based on behavior sequence according to claim 5, characterized in that, Calculating the tactical attention weights of each tactical layer hidden state in the sequence of tactical layer hidden states to obtain a sequence of tactical attention weights includes: calculating the tactical attention weights of each tactical layer hidden state in the sequence of tactical layer hidden states using the following formula: , in, To hide the state for each tactical layer, For tactical attention weight, , and For learnable parameters, Hiding intermediate feature vectors for the tactical layer.

7. The network security investigation method based on behavior sequence according to claim 1, characterized in that, Threat assessment of the attack activity context vector to obtain a threat score includes: inputting the attack activity context vector into a fully connected layer, followed by a Sigmoid activation function to obtain the threat score.

Images