Method and system for detecting abnormal behavior of a communication information flow

Abstract

The application provides an abnormal behavior detection method and system for a communication information flow, relates to the technical field of network communication security, and first captures a raw communication information flow set containing a large number of communication session record units in a network communication link, each record unit carrying information such as source and destination internet protocol address labels. Then, the raw communication information flow set is subjected to communication behavior mode analysis, and a cross-session associated interactive behavior sequence cluster is constructed. Then, the features of the interactive behavior time sequence chain are extracted, and a joint embedding feature vector is generated through a semantic embedding layer and a time sequence convolution encoder. The vector is input into an abnormal behavior prototype network for prototype matching to obtain an initial abnormal behavior label. Finally, the abnormal behavior propagation path is traced according to the initial label to obtain a set of abnormal behavior propagation path sequences. The application can effectively detect abnormal behaviors in network communication and improve detection accuracy and reliability.

Description

Technical Field

[0001] This application relates to the field of network communication security technology, and more specifically, to a method and system for detecting abnormal behavior in communication information flow. Background Technology

[0002] In today's digital information age, network communication technology is developing rapidly, and network communication links carry massive amounts of communication information. These communication information flows exchange data based on the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), generating a large number of communication session record units. Each communication session record unit contains key information such as the source Internet Protocol address label, the destination Internet Protocol address label, the protocol type identifier, and application layer data payload fragments.

[0003] Currently, the detection of abnormal behavior in network communication mainly relies on traditional rule-based matching and simple statistical analysis methods. However, these methods have many limitations. Rule-based matching methods require the pre-definition of a large number of rules, making it difficult to cover all possible abnormal behavior patterns, and they cannot effectively and promptly identify newly emerging abnormal behaviors. Simple statistical analysis methods can only make judgments from the perspective of limited statistical features, failing to delve into the inherent relationships and complex interaction patterns between communication session recording units, resulting in low detection accuracy and making it difficult to meet the increasingly complex network communication security requirements. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method and system for detecting abnormal behavior in communication information flow.

[0005] According to a first aspect of this application, a method for detecting abnormal behavior in communication information streams is provided, the method comprising:

[0006] In the network communication link, the original communication information stream set is captured. The original communication information stream set includes a large number of communication session record units generated by data exchange based on Transmission Control Protocol and User Datagram Protocol during the continuous acquisition period. Each communication session record unit carries a source Internet Protocol address tag, a destination Internet Protocol address tag, a protocol type identifier, and an application layer data payload fragment.

[0007] The original communication information flow set is parsed to obtain the interaction behavior characteristics of the communication session record unit during the application layer protocol interaction. Based on the interaction behavior characteristics, the source Internet Protocol address tag and the destination Internet Protocol address tag, a cross-session associated interaction behavior sequence cluster is constructed. The interaction behavior sequence cluster includes the interaction behavior time sequence chain formed by the same source Internet Protocol address tag exchanging data with different destination Internet Protocol address tags in multiple communication session record units.

[0008] Extract the interaction behavior type label sequence and interaction behavior intensity feature vector sequence of each interaction behavior temporal chain in the interaction behavior sequence cluster. Input the interaction behavior type label sequence into a preset semantic embedding layer for embedding representation transformation processing to obtain the interaction behavior type semantic embedding matrix. Input the interaction behavior intensity feature vector sequence and the interaction behavior type semantic embedding matrix into a preset temporal convolutional encoder for spatiotemporal feature joint encoding processing to generate the joint embedding feature vector of the interaction behavior temporal chain.

[0009] The joint embedding feature vector is input into a preset abnormal behavior prototype network for prototype matching processing. The matching score between the joint embedding feature vector and each abnormal behavior prototype vector is calculated. Based on the matching score, the abnormal behavior type probability distribution of the interaction behavior time sequence chain is generated. The abnormal behavior type with the highest probability value in the abnormal behavior type probability distribution is used as the initial abnormal behavior label of the interaction behavior time sequence chain.

[0010] Based on the degree of correlation between the initial abnormal behavior marker and the interaction behavior features of each interaction behavior time-series chain in the interaction behavior sequence cluster, abnormal behavior propagation path tracing processing is performed to obtain a set of abnormal behavior propagation path sequences of all source Internet Protocol address tags and destination Internet Protocol address tags in the interaction behavior sequence cluster.

[0011] According to a second aspect of this application, an abnormal behavior detection system for communication information flow is provided. The abnormal behavior detection system for communication information flow includes a machine-readable storage medium and a processor. The machine-readable storage medium stores machine-executable instructions. When the processor executes the machine-executable instructions, the abnormal behavior detection system for communication information flow implements the aforementioned abnormal behavior detection method for communication information flow.

[0012] Based on any of the above aspects, the technical effect of this application is as follows:

[0013] By capturing rich sets of raw communication information streams within network communication links and performing communication behavior pattern analysis, a cluster of cross-session-related interaction behavior sequences is constructed. This allows for a comprehensive and in-depth characterization of the interaction relationships between communication session recording units, uncovering complex interaction behavior patterns hidden within massive amounts of data. Interaction behavior type label sequences and interaction behavior intensity feature vector sequences are extracted from the temporal chains of interaction behaviors. A semantic embedding layer and a temporal convolutional encoder are then used for joint spatiotemporal feature encoding to generate joint embedded feature vectors. This effectively integrates the semantic information and spatiotemporal features of interaction behaviors, improving the richness and accuracy of feature representation. Inputting the joint embedded feature vectors into an abnormal behavior prototype network for prototype matching enables accurate calculation of the probability distribution of abnormal behavior types and determination of initial abnormal behavior labels, significantly improving the accuracy and reliability of abnormal behavior detection. Finally, based on the initial abnormal behavior labels, abnormal behavior propagation path tracing is performed to obtain a set of abnormal behavior propagation path sequences. This helps to comprehensively understand the propagation process and scope of impact of abnormal behaviors, significantly enhancing the capability and level of network communication abnormal behavior detection. Attached Figure Description

[0014] Figure 1 A flowchart illustrating the abnormal behavior detection method for communication information flow provided in an embodiment of this application is shown.

[0015] Figure 2 The diagram shows a schematic representation of the component structure of an abnormal behavior detection system for communication information flow provided in an embodiment of this application. Detailed Implementation

[0016] Figure 1 This paper illustrates a flowchart of an abnormal behavior detection method and system for communication information streams provided in an embodiment of this application. The detailed steps include:

[0017] Step S110: Capture the original communication information stream set in the network communication link. The original communication information stream set includes a large number of communication session record units generated by data exchange based on Transmission Control Protocol and User Datagram Protocol during the continuous acquisition period. Each communication session record unit carries a source Internet Protocol address tag, a destination Internet Protocol address tag, a protocol type identifier, and an application layer data payload fragment.

[0018] In this embodiment, during a continuous network data acquisition period, traffic capture devices deployed on the core network link, such as network splitters based on port mirroring technology, capture all data packets passing through the link in real time. The captured raw communication information stream set is the collection of all data generated by data exchange based on Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) during this period. This raw data is reassembled into independent communication session record units. For TCP sessions, the start and end of the session are determined by identifying handshake messages and four-way handshake messages; for UDP sessions, a session is typically defined based on a five-tuple and a set timeout threshold. Each communication session record unit contains a set of core metadata, specifically: a source Internet Protocol address tag (IPA) to identify the host initiating the communication; a destination IPA to identify the target host receiving the communication; a protocol type identifier to indicate the transport layer protocol used in the session, such as TCP or UDP; and an application layer data payload fragment, i.e., the actual application data content transmitted in the session, such as a Hypertext Transfer Protocol (HTTP) request, a File Transfer Protocol (FTP) command, or a Domain Name System (DNS) query message.

[0019] Step S120: Perform communication behavior pattern parsing processing on the original communication information flow set to obtain the interaction behavior characteristics reflected by the communication session record unit in the application layer protocol interaction process, and construct a cross-session associated interaction behavior sequence cluster based on the interaction behavior characteristics, the source Internet Protocol address label and the destination Internet Protocol address label.

[0020] In this embodiment, the interaction behavior sequence cluster includes a time-series chain of interaction behaviors formed by the same source Internet Protocol address tag exchanging data with different destination Internet Protocol address tags in multiple communication session record units.

[0021] Next, each communication session record unit in the original communication information flow set is analyzed in depth to extract its behavioral patterns, i.e., interaction behavior features, during application layer protocol interaction. Then, based on these features and the address tags of the communicating parties, multiple session records belonging to the same source address are associated to construct a temporal chain of interaction behavior that reflects the behavioral patterns of that source address, ultimately forming a structured cluster of interaction behavior sequences.

[0022] Step S121: Read the protocol header field set of each communication session record unit sequentially from the original communication information stream set. The protocol header field set includes the source port number field, the destination port number field, the session start timestamp field, and the session end timestamp field.

[0023] Specifically, for each communication session record unit in the original communication information flow set, the field information located in the transport layer and network layer headers is first parsed and read from its storage structure. This information is organized into a protocol header field set. This set includes at least: a source port number field, whose value identifies the specific service process of the initiating host; a destination port number field, whose value identifies the target service process of the target host; a session start timestamp field, which records the precise time when the first data packet of the session was captured; and a session end timestamp field, which records the precise time when the last data packet of the session was captured.

[0024] Step S122: Identify the application layer protocol type used by the communication session record unit based on the value of the source port number field and the value of the destination port number field, and assign the identified application layer protocol type to the protocol type identifier.

[0025] Then, a pre-built port-protocol mapping table is used to match and identify the read source and destination port numbers. This mapping table records common application layer protocols and their corresponding default port numbers. For example, Hypertext Transfer Protocol (HTTP) typically corresponds to port 80, HTTP Security for HTTP corresponds to port 443, File Transfer Protocol (FTP) corresponds to port 21, and Simple Mail Transfer Protocol (SMLP) corresponds to port 25. When the source or destination port number of a communication session record unit matches a port number in the mapping table, its corresponding protocol type is identified as the application layer protocol type of that session. The identified protocol type, such as "Hypertext Transfer Protocol" or "File Transfer Protocol," is assigned to the protocol type identifier of that session.

[0026] Step S123: Invoke the application layer protocol parser corresponding to the protocol type identifier, and perform byte-by-byte scanning and parsing of the application layer data payload fragment through the application layer protocol parser.

[0027] Based on the protocol type identifier determined in step S122, a corresponding dedicated application layer protocol parser is dynamically loaded and invoked. For example, if the protocol type identifier is "Hypertext Transfer Protocol," the Hypertext Transfer Protocol parser is invoked; if it is "File Transfer Protocol," the File Transfer Protocol parser is invoked. This parser is designed to understand the syntax and semantics of a specific application layer protocol and begin a byte-by-byte scan of the application layer data payload fragment in the communication session record unit.

[0028] Step S124: During the byte-by-byte scanning and parsing process, based on the predefined offset of the request method field and the offset of the response status code field in the application layer protocol parser, the byte sequence of the request method field and the byte sequence of the response status code field are extracted from the specified offset position of the application layer data payload fragment.

[0029] During the byte-by-byte scan, the parser operates according to its internal predefined format specifications for the protocol. For sessions containing client requests, the parser locates the beginning of the request method field in the application layer data payload fragment based on a predefined offset for the request method field, and reads a continuous sequence of bytes from that beginning until it encounters a delimiter or terminator. For example, in a Hypertext Transfer Protocol request, this offset points to the position of keywords such as "GET" or "POST". Similarly, for sessions containing server responses, the parser locates the beginning of the response status code field based on a predefined offset for the response status code field and extracts its byte sequence, such as "200" or "404".

[0030] Step S125: Convert the byte sequence of the extracted request method field into a first string, convert the byte sequence of the extracted response status code field into a second string, and use the combination of the first string and the second string as the interaction behavior type label of the communication session record unit.

[0031] The byte sequence of the request method field extracted in step S124 is processed into a readable first string through character encoding conversion (such as from ASCII or UTF-8 encoding). Similarly, the byte sequence of the extracted response status code field is converted into a second string. Then, these two strings are combined according to a predefined format, such as by hyphenation, to form a label that characterizes the type of interaction in the session. For example, the combined interaction type label might be "GET-200," indicating a successful Hypertext Transfer Protocol resource retrieval request; or "POST-500," indicating a submission request that resulted in an internal server error. For some sessions where the request and response cannot be parsed, such as pure data transfer, the interaction type label might be marked as "DATA-TRANSFER."

[0032] Step S126: Read the value of the session start timestamp field from the protocol header field set as the start time point, read the value of the session end timestamp field as the end time point, and calculate the difference between the end time point and the start time point as the session duration parameter.

[0033] Next, the session start timestamp and session end timestamp values ​​are retrieved from the protocol header field set. These two values ​​are typically Unix timestamps in milliseconds or microseconds. The difference between the end timestamp and the start timestamp is the duration of the communication session. This parameter reflects the length of the interaction process.

[0034] Step S127: Traverse all data packets contained in the communication session record unit, record the value of the total IP length field of each data packet in turn, arrange the values ​​of the total IP length field of all data packets according to the arrival order of the data packets in the communication session record unit, and generate the original data packet length sequence.

[0035] Then, each data packet that constitutes the record unit of this communication session is re-traversed. For each traversed data packet, the IP Total Length field value is read from its Internet Protocol header, which identifies the total number of bytes in the entire Internet Protocol data packet (including header and payload). The above values ​​are recorded strictly in the order in which the data packets appear in the session, forming an original sequence of varying lengths, namely the original data packet length sequence.

[0036] Step S128: Count the total number of data packet length values ​​contained in the original data packet length sequence as the first length value. When the first length value is greater than the set normalized target length value, perform equal-interval sampling on the original data packet length sequence, uniformly extracting a number of data packet length values ​​equal to the normalized target length value from the original data packet length sequence to generate a sampled data packet length sequence. Alternatively, when the first length value is less than the normalized target length value, add a preset padding value to the end of the original data packet length sequence so that the length of the supplemented data packet length sequence is equal to the normalized target length value to generate a supplemented data packet length sequence.

[0037] To facilitate subsequent machine learning model processing, it's necessary to unify all original data packet length sequences of varying lengths to a fixed dimension. First, the number of elements in the original data packet length sequence is counted, denoted as the first length value. This first length value is compared to a pre-defined normalized target length value. If the first length value is greater than the target length value, the original sequence is sampled at equal intervals. The sampling interval is calculated by dividing the first length value by the target length value. Then, according to the calculated interval, data packet length values ​​are uniformly extracted from the original sequence so that the length of the extracted new sequence is exactly equal to the target length value; this is the sampled data packet length sequence. Conversely, if the first length value is less than the target length value, a pre-defined value that does not represent the actual data packet length, such as "0," is padded to the end of the original sequence until the length of the entire sequence reaches the target length value; this is the padded data packet length sequence.

[0038] Step S129: Use the sampled data packet length sequence or the supplemented data packet length sequence as a data packet length distribution sequence, create an empty feature vector container, and store the session duration parameter as the first element in the feature vector container.

[0039] The sampled or supplemented data packet length sequences obtained in step S128 are collectively labeled as data packet length distribution sequences. Next, a blank dynamic array, or feature vector container, is created in computer memory to store numerical values. The session duration parameter calculated in step S126 is stored as the first element in this container.

[0040] Step S1210: The length values ​​of each data packet in the data packet length distribution sequence are sequentially appended into the feature vector container according to the order of arrangement in the data packet length distribution sequence, and the filled feature vector container is used as the interaction behavior intensity feature vector of the communication session record unit.

[0041] Then, each data packet length value in the data packet length distribution sequence is appended one by one into the feature vector container created in step S129, strictly according to their order of arrangement in the sequence. For example, the length of the first data packet is appended first, then the second, and so on, until all data packet length values ​​have been appended. At this point, the feature vector container is completely filled. This filled vector, containing a session duration parameter and a fixed number of data packet length values, serves as the interaction behavior intensity feature vector for this communication session record unit. This vector quantifies the intensity characteristics of this interaction behavior in numerical form.

[0042] Step S1211: Convert the interaction behavior type label into discrete numerical code, associate and encapsulate the discrete numerical code with the interaction behavior intensity feature vector to generate the interaction behavior feature tuple of the communication session record unit.

[0043] Finally, the string-based interaction behavior type label generated in step S125 is converted into a unique discrete numerical code through a predefined label-encoding mapping table. For example, "GET-200" might correspond to code "1", and "POST-500" might correspond to code "2". This discrete numerical code is then associated and encapsulated with the interaction behavior intensity feature vector generated in step S1210 to form a combined data structure, namely the interaction behavior feature tuple of the communication session record unit. This tuple completely describes the behavior type and intensity of a session.

[0044] Step S1212: Construct a cross-session associated interactive behavior sequence cluster based on the interactive behavior features, the source Internet Protocol address label, and the destination Internet Protocol address label.

[0045] In this embodiment, the interaction behavior sequence cluster includes a time-series chain of interaction behaviors formed by the same source Internet Protocol address tag exchanging data with different destination Internet Protocol address tags in multiple communication session record units.

[0046] After obtaining the interaction behavior feature tuples of each communication session record unit, the next step is to associate the isolated session records based on the addresses of the two communicating parties, construct a behavioral trajectory that reflects the interaction between a source address and multiple destination addresses in the time dimension, i.e., the interaction behavior time sequence chain, and then gather all the chains together to form a cluster.

[0047] Step S1212-1: Extract the source Internet Protocol address tag and destination Internet Protocol address tag of each communication session record unit from the original communication information flow set, and use the source Internet Protocol address tag as the first packet key value and the destination Internet Protocol address tag as the second packet key value.

[0048] For each communication session record unit in the original communication information flow set, the source Internet Protocol address (IPA) tag and the destination IPA tag are extracted from its metadata. In subsequent data aggregation operations, the source IPA tag is used as the primary key of the first-level packet, and the destination IPA tag is used as the subkey of the second-level packet.

[0049] Step S1212-2: Create a blank hash map table, wherein the hash map table uses the source Internet Protocol address label as the outer key, the destination Internet Protocol address label as the inner key, and the list of interaction behavior feature tuples as the values.

[0050] Initialize a multi-level nested hash table data structure in memory. The logical structure of this hash table is as follows: the key of the outer hash table is the source Internet Protocol address label, and its corresponding value is itself an inner hash table. The key of the inner hash table is the destination Internet Protocol address label, and its corresponding value is a list used to store all interaction feature tuples related to the source and destination address pairs.

[0051] Step S1212-3: Traverse each communication session record unit in the original communication information flow set. For the current communication session record unit, obtain the source Internet Protocol address tag of the current communication session record unit as the current outer key, and obtain the destination Internet Protocol address tag of the current communication session record unit as the current inner key.

[0052] Begin traversing the entire original communication information stream set. For the currently processed communication session record unit, first obtain its source Internet Protocol address label, marking it as the current outer key; then obtain its destination Internet Protocol address label, marking it as the current inner key.

[0053] Step S1212-4: Search for the outer hash bucket indexed by the current outer key in the hash mapping table. If the outer hash bucket does not exist, create a new outer hash bucket and store the correspondence between the current outer key and the new outer hash bucket in the hash mapping table.

[0054] Using the current outer key as an index, a search is performed in the hash map table created in step S1212-2. If the corresponding outer hash bucket is not found, it means that this is the first time the source address has been encountered. At this time, a new, empty outer hash bucket (i.e., a new inner hash table) is created for the current outer key in the hash map table, and the correspondence between the current outer key and the newly created outer hash bucket is stored in the outermost hash map table.

[0055] Step S1212-5: Within the found or newly created outer hash bucket, search for the inner hash bucket indexed by the current inner key. If the inner hash bucket does not exist, create a new inner hash bucket and store the correspondence between the current inner key and the new inner hash bucket into the outer hash bucket.

[0056] Next, within the outer hash bucket found (or newly created) in step S1212-4, a search is performed using the current inner key as an index. If no corresponding inner hash bucket is found within the outer hash bucket, it indicates that this is the first time the source address has communicated with the current destination address. In this case, within the outer hash bucket, a new inner hash bucket is created for the current inner key, and the correspondence between the current inner key and the newly created inner hash bucket is stored in this outer hash bucket.

[0057] Step S1212-6: Add the interaction behavior feature tuple of the current communication session record unit to the interaction behavior feature tuple list corresponding to the inner hash bucket, and record the timestamp tag of the current communication session record unit as the time attribute of the interaction behavior feature tuple.

[0058] Then, the interaction behavior feature tuple generated in step S1211 that belongs to the current communication session record unit is added to the interaction behavior feature tuple list corresponding to the inner hash bucket determined in step S1212-5. At the same time, the value of the session start timestamp field of the communication session record unit is used as a time attribute and associated with the interaction behavior feature tuple for subsequent time-series sorting.

[0059] Step S1212-7: After completing the traversal of all communication session record units, traverse each inner key corresponding to each outer key in the hash mapping table to obtain a list of interaction behavior feature tuples corresponding to each inner key.

[0060] Once the entire original communication information stream set has been traversed, the nested hash table stores all interaction behavior feature tuples organized by source and destination addresses. Next, the structure is traversed. First, an outer key is taken, and then all inner keys in the inner hash table corresponding to that outer key are traversed. For each inner key, a list of its corresponding interaction behavior feature tuples is obtained.

[0061] Step S1212-8: Sort the interactive behavior feature tuples in each interactive behavior feature tuple list in ascending order according to the time attribute of the interactive behavior feature tuples, and generate a sequence of interactive behavior feature tuples arranged in chronological order.

[0062] For each interactive behavior feature tuple list obtained in steps S1212-7, extract the time attribute associated with each tuple, and sort the tuples in the entire list in ascending order based on this time attribute. After sorting, the originally unordered list becomes a sequence of interactive behavior feature tuples arranged strictly in chronological order.

[0063] Step S1212-9: Extract the discrete numerical code of the interaction behavior type label of each interaction behavior feature tuple from the sorted interaction behavior feature tuple sequence in turn, and arrange all the discrete numerical codes in the order of the interaction behavior feature tuple sequence to form the interaction behavior type label sequence.

[0064] From the sorted sequence of interaction behavior feature tuples, each tuple is processed sequentially from beginning to end. For the current tuple, the discrete numerical encoding of the interaction behavior type label stored within it is extracted. These extracted codes are then arranged in their order within the tuple sequence to form a new, one-dimensional integer sequence, which is the interaction behavior type label sequence. This sequence records the type trajectory of the interaction behavior with the source-destination address pair over time.

[0065] Step S1212-10: Extract the interaction behavior intensity feature vector of each interaction behavior feature tuple from the sorted interaction behavior feature tuple sequence in turn, and stack all interaction behavior intensity feature vectors in the order of the interaction behavior feature tuple sequence to form an interaction behavior intensity feature vector sequence.

[0066] Meanwhile, the sorted sequence of interaction behavior feature tuples is iterated again. For the current tuple, its stored interaction behavior intensity feature vector is extracted. The vectors of the same length are stacked in the order they appear in the tuple sequence. For example, if there are N tuples and each intensity vector has a dimension of M, then the resulting sequence of interaction behavior intensity feature vectors is a two-dimensional tensor with N rows and M columns, where each row corresponds to the intensity feature at a time step.

[0067] Step S1212-11: Associate and store the interaction behavior type label sequence with the interaction behavior intensity feature vector sequence to generate an interaction behavior time sequence chain with the current outer key as the source Internet Protocol address label and the current inner key as the destination Internet Protocol address label.

[0068] The sequence of interaction behavior type labels generated in step S1212-9 and the sequence of interaction behavior intensity feature vectors generated in step S1212-10 are associated to form a new composite data structure. This data structure uniquely corresponds to all historical interaction behaviors between a source Internet Protocol address label (i.e., the current outer key) and a destination Internet Protocol address label (i.e., the current inner key), and is organized in chronological order. This composite data structure is thus labeled as a temporal chain of interaction behaviors.

[0069] Step S1212-12: Collect all interaction behavior time-series chains corresponding to the source Internet Protocol address tag and destination Internet Protocol address tag tuples, classify all interaction behavior time-series chains according to the source Internet Protocol address tag, and generate a multi-level mapping structure of interaction behavior time-series chains indexed by the source Internet Protocol address tag as the interaction behavior sequence cluster.

[0070] Repeat steps S1212-7 to S1212-11 until all inner keys under all outer keys in the nested hash map table have been processed, resulting in a large number of interaction behavior sequence chains. Finally, reorganize the above chains to form a data structure with the source Internet Protocol address label as the top-level index. For each source address, the interaction behavior sequence chains between it and all destination addresses that have communicated with it can be quickly found. This complete, multi-level indexed data structure is the final interaction behavior sequence cluster.

[0071] Step S130: Extract the interaction behavior type label sequence and interaction behavior intensity feature vector sequence of each interaction behavior temporal chain in the interaction behavior sequence cluster. Input the interaction behavior type label sequence into a preset semantic embedding layer for embedding representation transformation processing to obtain the interaction behavior type semantic embedding matrix. Input the interaction behavior intensity feature vector sequence and the interaction behavior type semantic embedding matrix into a preset temporal convolutional encoder for spatiotemporal feature joint encoding processing to generate the joint embedding feature vector of the interaction behavior temporal chain.

[0072] Next, feature encoding needs to be performed on each temporal chain of interaction behavior in the cluster, transforming it into a fixed-length, semantically rich vector representation for subsequent anomaly matching. This process involves embedding representations of type labels and temporal encoding of intensity features, and then fusing the two.

[0073] Step S131: Read an interaction behavior time sequence chain from the interaction behavior sequence cluster, and obtain the interaction behavior type label sequence and interaction behavior intensity feature vector sequence of the interaction behavior time sequence chain.

[0074] First, from the interaction behavior sequence cluster constructed in steps S1212-12, a temporal chain of interaction behaviors is read sequentially. From the data structure of this chain, two core components associated with it are deconstructed: the interaction behavior type label sequence and the interaction behavior intensity feature vector sequence.

[0075] Step S132: Obtain the discrete numerical code of each interaction behavior type label contained in the interaction behavior type label sequence. The discrete numerical code is an integer index value, and each integer index value uniquely corresponds to an interaction behavior type.

[0076] The obtained sequence of interaction behavior type labels is parsed. Each element in the sequence is a discrete numerical code generated in step S1211. The above code is an integer, such as 0, 1, 2, ... Each integer is uniquely mapped to a specific interaction behavior type, such as "GET-200" or "POST-500".

[0077] Step S133: Find the embedding vector corresponding to each integer index value from the embedding matrix of the preset semantic embedding layer. The number of rows in the embedding matrix is ​​the total number of categories of interactive behavior types, and the number of columns in the embedding matrix is ​​the preset embedding dimension value.

[0078] The system predefines and initializes a semantic embedding layer, the core of which is a learnable embedding matrix. The number of rows in this matrix equals the total number of possible interaction behavior type labels, and the number of columns is a preset hyperparameter, labeled as the embedding dimension. For each integer index value in the sequence, this index value is used as the row number to find the corresponding vector in the embedding matrix. This vector is the distributed representation of the discrete encoding in the continuous vector space.

[0079] Step S134: For the first interaction behavior type label in the interaction behavior type label sequence, use the discrete numerical encoding of the first interaction behavior type label as the row index, extract all column elements of the index row from the embedding matrix to form a row vector with a length equal to the embedding dimension value, and use the row vector as the distributed vector representation corresponding to the first interaction behavior type label.

[0080] Taking the first label in the sequence as an example. Assuming its discrete numerical code is ID_1, all elements in the ID_1 row are extracted from the embedding matrix. These elements form a row vector of length equal to the embedding dimension, denoted as Vector_1. This Vector_1 is the distributed vector representation of the first label.

[0081] Step S135: For the second interactive behavior type label in the interactive behavior type label sequence, the discrete numerical encoding of the second interactive behavior type label is used as the row index. All column elements of the first row index are extracted from the embedding matrix to form a row vector with a length equal to the embedding dimension value. The row vector is used as the distributed vector representation corresponding to the second interactive behavior type label.

[0082] Following the same logic, process the second tag. Using its encoding ID_2 as an index, extract the row vector Vector_2 from the embedding matrix at row ID_2.

[0083] Step S136: In the same manner, generate a corresponding distributed vector representation for each interaction behavior type label in the interaction behavior type label sequence, until the last interaction behavior type label in the interaction behavior type label sequence is processed.

[0084] Repeat steps S134 and S135 to traverse the entire sequence of interactive behavior type labels, generating a corresponding distributed vector representation of the same dimension for each label in the sequence.

[0085] Step S137: Create an empty matrix container, wherein the number of rows of the matrix container is preset to the length value of the interactive behavior type label sequence, and the number of columns of the matrix container is preset to the embedding dimension value.

[0086] After generating all vector representations, a blank two-dimensional matrix is ​​created in memory. The number of rows in this matrix is ​​set to the length of the interactive behavior type label sequence, denoted as L; the number of columns is set to the embedding dimension value, denoted as D.

[0087] Step S138: Fill the first row of the matrix container with the distributed vector representation corresponding to the first interaction behavior type label as a row vector, fill the second row of the matrix container with the distributed vector representation corresponding to the second interaction behavior type label as a row vector, and so on, until all distributed vector representations are filled into the matrix container row by row according to the order in which the distributed vector representations appear in the sequence of interaction behavior type labels, thereby generating an interaction behavior type semantic embedding matrix.

[0088] Next, all the distributed vector representations generated in steps S134 to S136 are sequentially filled into this empty matrix container according to their order of appearance in the original label sequence. That is, Vector_1 is filled into the first row, Vector_2 into the second row, and so on, until the last vector is filled into the Lth row. After filling, this L-row, D-column matrix constitutes the interaction behavior type semantic embedding matrix. This matrix transforms the discrete type sequence into a continuous, semantically rich matrix representation, where each row represents the type semantics at a time step.

[0089] Step S139: Organize the sequence of interaction behavior intensity feature vectors into a two-dimensional intensity tensor, wherein the first dimension of the two-dimensional intensity tensor is the time step dimension, and the second dimension of the two-dimensional intensity tensor is the feature dimension of the interaction behavior intensity feature vector.

[0090] Simultaneously, the sequence of interaction behavior intensity feature vectors obtained in step S131 is also formatted. This sequence itself is already a two-dimensional structure, where the first dimension is the time step, also of length L; the second dimension is the feature dimension of each intensity vector, denoted as F. Therefore, it can be directly regarded as a two-dimensional intensity tensor with shape L rows and F columns.

[0091] Step S1310: Concatenate the semantic embedding matrix of the interaction behavior type with the two-dimensional intensity tensor in the feature dimension to generate a concatenated feature tensor. The feature dimension of the concatenated feature tensor is equal to the sum of the embedding dimension value and the intensity feature dimension.

[0092] To achieve joint feature encoding, two types of temporal information with different properties need to be fused. The interaction behavior type semantic embedding matrix (shape L×D) generated in step S138 and the two-dimensional intensity tensor (shape L×F) generated in step S139 are concatenated along the second dimension (i.e., the feature dimension). Specifically, for each time step i (from 1 to L), the D-dimensional vector in the i-th row of the embedding matrix and the F-dimensional vector in the i-th row of the intensity tensor are concatenated end-to-end to form a new vector of dimension (D+F). After performing this operation on all time steps, a concatenated feature tensor with shape L rows and (D+F) columns is generated. This tensor simultaneously contains both the interaction type semantic information and the intensity numerical information at each time step.

[0093] Step S1311: Input the concatenated feature tensor into the input terminal of the temporal convolutional encoder, and perform layer-by-layer feature transformation processing through multiple stacked temporal convolutional blocks in the temporal convolutional encoder. Each temporal convolutional block contains dilated convolutional layers and gated linear units.

[0094] Next, the concatenated feature tensor generated in step S1310 is used as input and fed into a pre-built temporal convolutional encoder. This encoder consists of multiple temporal convolutional blocks stacked sequentially. Each temporal convolutional block contains two core sub-layers: a dilated convolutional layer and a gated linear unit. The dilated convolutional layer is used to capture dependencies across different time spans, while the gated linear unit is responsible for non-linearly filtering the features extracted by the convolution and controlling the flow of information.

[0095] Step S1312: In the first temporal convolutional block, the input feature tensor is dilated in the time dimension through the dilated convolutional layer to generate a first intermediate feature tensor. The first intermediate feature tensor is then nonlinearly gated and filtered through the gated linear unit to generate the output feature tensor of the first temporal convolutional block.

[0096] In the first temporal convolutional block, the concatenated input feature tensor first enters a dilated convolutional layer. This dilated convolutional layer contains a set of learnable convolutional kernels that slide along the temporal dimension, but a certain number of "holes" are inserted between the elements of the kernels, thereby expanding the receptive field of the kernels without increasing the number of parameters. The dilation rate parameter controls the size of the holes. Through this dilated convolution operation, the layer outputs a new tensor, labeled as the first intermediate feature tensor, whose temporal dimension length may be the same as the input or adjusted according to the padding strategy. Then, this first intermediate feature tensor is fed into a gated linear unit. The gated linear unit typically divides the input feature tensor into two parts along the channel dimension. One part is passed through an activation function (such as sigmoid) as a "gate," and the other part is used as a "candidate feature." The two parts are multiplied element-wise to selectively pass features. The output of the gated linear unit is the feature tensor processed by the first temporal convolutional block.

[0097] Step S1313: Input the output feature tensor of the first temporal convolutional block into the second temporal convolutional block, and repeat the steps of performing dilated convolution on the input feature tensor in the time dimension through dilated convolutional layers and nonlinear gating filtering through gated linear units to generate the output feature tensor of the second temporal convolutional block.

[0098] The output of the first temporal convolutional block in step S1312 is passed as input to the second temporal convolutional block. In the second block, the exact same operation process is repeated: first, dilated convolution is performed through its internal dilated convolutional layers to generate intermediate tensors; then, gating is performed through its gated linear units to obtain the output feature tensor of the second block.

[0099] Step S1314: In the same manner, the output feature tensor of the previous temporal convolutional block is input into the next temporal convolutional block for processing, until the processing of the last temporal convolutional block is completed, and the final temporal convolutional feature tensor is generated.

[0100] Following the above method, the feature tensor is sequentially passed through all temporal convolutional blocks in the encoder. As the number of layers increases, the model is able to capture increasingly abstract and global temporal patterns in the data. After processing by the last temporal convolutional block, the output tensor is the final temporal convolutional feature tensor, whose shape can be represented as L'×C, where L' is the length of the new time dimension after multiple convolutions, and C is the number of channels (feature dimension) output by the last convolutional block.

[0101] Step S1315: Perform global average pooling on the time dimension on the final temporal convolutional feature tensor, calculate the mean of the final temporal convolutional feature tensor at all time steps, and obtain a fixed-length mean vector as the joint embedding feature vector of the temporal chain of the interaction behavior.

[0102] Since the temporal dimension length L' of the final temporal convolutional feature tensor may vary depending on the chain, pooling is required to obtain a fixed-length vector representation for subsequent matching. Global average pooling is performed on the first dimension (i.e., the time step dimension) of the final temporal convolutional feature tensor. Specifically, for each feature channel (C in total) of this tensor, its average value is calculated over all time steps. Ultimately, these C average values ​​form a C-dimensional vector. This vector no longer contains temporal series information but aggregates the global temporal features of the entire interaction behavior temporal chain. This vector serves as the joint embedding feature vector for this interaction behavior temporal chain, integrating the evolutionary information of the interaction behavior type and intensity over time.

[0103] Step S140: Input the joint embedding feature vector into a preset abnormal behavior prototype network for prototype matching processing, calculate the matching score between the joint embedding feature vector and each abnormal behavior prototype vector, generate the abnormal behavior type probability distribution of the interaction behavior time sequence chain based on the matching score, and take the abnormal behavior type with the largest probability value in the abnormal behavior type probability distribution as the initial abnormal behavior label of the interaction behavior time sequence chain.

[0104] After obtaining the joint embedded feature vector of each interaction behavior time sequence chain, the next step is to use a pre-trained abnormal behavior prototype network to determine whether the chain belongs to a certain known abnormal behavior pattern and to assign it an initial abnormal behavior label.

[0105] Step S141: Obtain multiple learnable abnormal behavior prototype vectors from the abnormal behavior prototype network. The dimension of each abnormal behavior prototype vector is exactly the same as the dimension of the joint embedding feature vector, and each abnormal behavior prototype vector corresponds to a preset abnormal behavior type.

[0106] The core of the anomalous behavior prototype network is a set of learnable vectors labeled as anomalous behavior prototype vectors. These vectors are automatically learned by the model during training. The dimension of each prototype vector is set to be exactly the same as the dimension C of the joint embedding feature vector generated in step S1315. Each prototype vector represents a "center" or "template" of a predefined anomalous behavior type in the semantic space; for example, one prototype vector might represent "port scanning behavior," while another might represent "data leakage behavior."

[0107] Step S142: Calculate the Euclidean distance between the joint embedding feature vector and the first abnormal behavior prototype vector, and take the negative of the Euclidean distance as the first matching score of the joint embedding feature vector relative to the first abnormal behavior prototype vector.

[0108] To measure the similarity between a sequential chain of interaction behaviors and a certain type of anomalous behavior, it is necessary to calculate the distance between their joint embedding feature vector and the corresponding prototype vector. First, the Euclidean distance between the joint embedding feature vector and the first anomalous behavior prototype vector is calculated. The smaller this distance, the closer the two are in the feature space. To convert the distance into a "score," and to ensure that a higher score indicates a better match, the negative of this Euclidean distance is taken as the matching score. Therefore, the first matching score is the negative Euclidean distance.

[0109] Step S143: Calculate the Euclidean distance between the joint embedding feature vector and the second abnormal behavior prototype vector, and take the negative of the Euclidean distance as the second matching score of the joint embedding feature vector relative to the second abnormal behavior prototype vector.

[0110] Then, in exactly the same way, the Euclidean distance between the joint embedded feature vector and the second abnormal behavior prototype vector is calculated, and its negative number is taken as the second matching score.

[0111] Step S144: Calculate the Euclidean distance between the joint embedded feature vector and each abnormal behavior prototype vector in sequence, and take the negative of each Euclidean distance as the corresponding matching score, until the matching score corresponding to all abnormal behavior prototype vectors is calculated.

[0112] Repeat the above calculation process, traversing all prototype vectors in the abnormal behavior prototype network. For each prototype vector traversed, calculate the Euclidean distance and take its negative value to obtain a corresponding matching score. Assuming there are K prototype vectors in total, K matching scores will be obtained in the end.

[0113] Step S145: Combine all the calculated matching scores into a matching score vector, the length of which is equal to the total number of abnormal behavior prototype vectors.

[0114] These K matching scores are organized according to their corresponding prototype vectors to form a one-dimensional vector, labeled as the matching score vector. The first element of this vector is the first matching score obtained in step S142, the second element is the second matching score obtained in step S143, and so on. Therefore, the length of this vector is the total number K of the abnormal behavior prototype vectors.

[0115] Step S146: Perform normalized exponential transformation on the matching score vector, calculate the exponential value of each element in the matching score vector, calculate the sum of the exponential values ​​of all elements, divide the exponential value of each element by the sum, and obtain the normalized probability value corresponding to each element.

[0116] The numerical range of the matching score vector is not fixed, so it needs to be transformed into a probability distribution such that the sum of the scores for all categories is 1, and each score lies between 0 and 1. To achieve this, a normalized exponential function is applied to the matching score vector. First, the exponent value of each element in the matching score vector is calculated to the base of the natural constant e. Then, the exponent values ​​of all K elements are summed. Finally, for each element, its exponent value is divided by this sum, and the quotient is the normalized probability value corresponding to that element.

[0117] Step S147: Arrange all normalized probability values ​​into a probability distribution vector according to the order of the normalized probability values ​​in the matching score vector. The length of the probability distribution vector is equal to the total number of abnormal behavior prototype vectors, and the sum of all elements in the probability distribution vector is equal to 1.

[0118] All the normalized probability values ​​calculated in step S146 are recombined into a new vector according to their original order in the matching score vector, and labeled as the probability distribution vector. This probability distribution vector also has a length of K, and the sum of all its elements is equal to 1. The value of the i-th element represents the predicted probability that the current interaction behavior sequence belongs to the i-th type of abnormal behavior.

[0119] Step S148: Find the probability value with the largest value from the probability distribution vector as the maximum probability value, and obtain the index position of the maximum probability value in the probability distribution vector as the maximum probability index.

[0120] Next, search the probability distribution vector to find the element with the largest value, which is the maximum probability value. Record the index position of this maximum probability value in the vector; for example, if the third element has the largest value, then the maximum probability index is 3.

[0121] Step S149: Map the maximum probability index to the corresponding abnormal behavior type identifier, and use the abnormal behavior type identifier as the initial abnormal behavior marker of the interaction behavior sequence chain.

[0122] Based on the maximum probability index obtained in step S148, a search is performed in a predefined index-type mapping table. This mapping table records the abnormal behavior type identifier corresponding to each index position; for example, index 3 may correspond to "data leakage behavior". The found abnormal behavior type identifier is determined as the most likely abnormal behavior type to which the current interaction behavior sequence chain belongs, and it is used as the initial abnormal behavior marker for that chain.

[0123] Step S1410: Append the initial abnormal behavior marker to the metadata field of the interaction behavior sequence chain to identify the abnormal behavior type to which the interaction behavior sequence chain belongs.

[0124] Finally, the initial abnormal behavior marker obtained in step S149 is appended as a new field to the metadata of the interaction behavior sequence chain, thus completing the preliminary abnormal type labeling of the chain.

[0125] Step S150: Based on the degree of correlation between the initial abnormal behavior marker and the interaction behavior features of each interaction behavior time-series chain in the interaction behavior sequence cluster, perform abnormal behavior propagation path tracing processing to obtain a set of abnormal behavior propagation path sequences of all source Internet Protocol address tags and destination Internet Protocol address tags in the interaction behavior sequence cluster.

[0126] Simply marking a single interaction sequence is insufficient, as anomalous behavior often propagates across the network. Therefore, it is necessary to trace the propagation path of anomalous behavior within the network based on these markers and the communication relationships between hosts, i.e., to construct the anomalous propagation sequence from one host to another.

[0127] Step S151: Select all interaction behavior time-series chains carrying the initial abnormal behavior tag from the interaction behavior sequence cluster, mark each selected interaction behavior time-series chain as an abnormal behavior time-series chain unit, and assign a unique unit identifier to each abnormal behavior time-series chain unit.

[0128] Traverse the entire cluster of interaction behavior sequences, checking if the metadata of each interaction behavior sequence chain contains an initial anomalous behavior marker. Filter out all chains containing this marker. For each filtered chain, treat it as an independent unit and label it as an anomalous behavior sequence chain unit. Simultaneously, generate a globally unique identifier for each unit, such as an incrementing integer or a universally unique identifier, for subsequent association and tracking.

[0129] Step S152: Obtain the source Internet Protocol address tag of each abnormal behavior time-series chain unit as the source address attribute of the abnormal behavior time-series chain unit, and obtain the destination Internet Protocol address tag of each abnormal behavior time-series chain unit as the destination address attribute of the abnormal behavior time-series chain unit.

[0130] For each anomalous behavior time-series chain unit, two key attributes are extracted from its associated metadata: the source Internet Protocol address tag, which is the initiator of the communication behavior represented by the chain, and is marked as the source address attribute; and the destination Internet Protocol address tag, which is the receiver of the communication behavior represented by the chain, and is marked as the destination address attribute.

[0131] Step S153: Using the destination address attribute as an index, search in the interaction behavior sequence cluster for other interaction behavior time-series chains whose source Internet Protocol address tags are exactly the same as the destination address attribute, and take the part of the other interaction behavior time-series chains that carry the initial abnormal behavior mark as the forward association unit set of the abnormal behavior time-series chain unit.

[0132] To trace the propagation of anomalous behavior from the current unit outwards, it is necessary to identify subsequent behaviors initiated by the destination address of the current unit. Specifically, using the destination address attribute of the current anomalous behavior sequence unit as the search key, all interaction behavior sequence chains with the same source Internet Protocol address label are searched throughout the entire interaction behavior sequence cluster. Among these found chains, those that also carry the initial anomalous behavior marker are further filtered out. These filtered chains represent the next step in the propagation of the anomalous behavior from the destination host of the current unit. These chains are then grouped together and labeled as the set of forward-related units of the current unit.

[0133] Step S154: Using the source address attribute as an index, search in the interaction behavior sequence cluster for all other interaction behavior time-series chains whose destination Internet Protocol address tags are exactly the same as the source address attribute, and take the part of the other interaction behavior time-series chains that carry the initial abnormal behavior mark as the backward association unit set of the abnormal behavior time-series chain unit.

[0134] To trace the source of anomalous behavior propagating to the current unit, it is necessary to identify preceding behaviors that receive the source address of the current unit. Specifically, using the source address attribute of the current anomalous behavior sequence unit as the search key, all interaction behavior sequence chains with the same destination Internet Protocol address label are searched throughout the entire interaction behavior sequence cluster. Among these found chains, those that also carry the initial anomalous behavior marker are further filtered out. These filtered chains represent the source host from a preceding host that propagated to the current unit. These chains are grouped together and labeled as the set of backward associated units of the current unit.

[0135] Step S155: Create a forward pointer list and a backward pointer list for each abnormal behavior timing chain unit. Add the unit identifier of each abnormal behavior timing chain unit in the forward associated unit set to the forward pointer list, and add the unit identifier of each abnormal behavior timing chain unit in the backward associated unit set to the backward pointer list.

[0136] For each anomalous behavior sequence unit, two lists are created in its data structure. One list, named the forward pointer list, stores the unit identifiers of all units in the forward-associated unit set found in step S153. The other list, named the backward pointer list, stores the unit identifiers of all units in the backward-associated unit set found in step S154. These two lists construct the directed graph relationship between the units.

[0137] Step S156: Count the number of elements in the forward pointer list of each abnormal behavior time-series unit as the in-degree value, and count the number of elements in the backward pointer list of each abnormal behavior time-series unit as the out-degree value.

[0138] To determine the topological location in the propagation path graph, the degree of each cell needs to be calculated. The number of elements in the forward pointer list of each anomalous behavior sequence chain cell is calculated; this value is labeled as the cell's in-degree, indicating how many subsequent anomalous cells point to it (i.e., how many anomalous cells use it as their destination address). The number of elements in its backward pointer list is calculated, labeled as the cell's out-degree, indicating how many preceding anomalous cells it points to (i.e., how many anomalous cells it originates from).

[0139] Step S157: Create an empty trace queue and an empty path record set, and add the unit identifiers of all abnormal behavior time-series chain units with an in-degree value of 0 as initial elements to the trace queue.

[0140] To trace the propagation path from its source, we first need to find all the starting points—those units with an in-degree of 0. These represent units where no earlier anomalous behavior points to them and are likely the origin of the anomaly. We initialize a first-in, first-out (FIFO) queue data structure, labeled the tracing queue. Then, we initialize an empty set to store the finally discovered paths, labeled the path record set. Next, we iterate through all the units in the anomalous behavior sequence, adding the unit identifiers of those units with an in-degree of 0 to the tracing queue in sequence.

[0141] Step S158: Take a unit identifier from the head of the traceability queue as the current traceability unit identifier, and obtain the forward pointer list of the abnormal behavior time-series chain units corresponding to the current traceability unit identifier.

[0142] Begin breadth-first or depth-first path traversal. Retrieve a cell identifier from the head of the tracing queue and use it as the current tracing cell identifier. Locate the corresponding abnormal behavior sequence chain cell based on this identifier and access its forward pointer list.

[0143] Step S159: Traverse each forward unit identifier in the forward pointer list, add the forward unit identifier to the end of the current tracing path, and add the forward unit identifier to the tail of the tracing queue.

[0144] For each forward unit identifier in the forward pointer list of the current trace unit, perform the following operations: First, append the forward unit identifier to the end of the current path in a path record that is being constructed; then, add the forward unit identifier to the tail of the trace queue so that subsequent traces can continue forward from it.

[0145] Step S1510: Repeat the step of retrieving a unit identifier from the head of the tracing queue until the tracing queue becomes empty. Save the tracing path recorded in each tracing process to the path record set. Clear the tracing queue. Add the unit identifiers of all abnormal behavior time-series chain units with an out-degree value of 0 back to the tracing queue as initial elements. Retrieve a unit identifier from the head of the tracing queue as the current tracing unit identifier. Obtain the backward pointer list of abnormal behavior time-series chain units corresponding to the current tracing unit identifier.

[0146] Steps S158 and S159 are repeated until the tracing queue is empty. During this process, each time a cell is taken from the head and its forward pointer is processed, a path is constructed that traces forward from the starting point. When the queue is empty, it means that all paths from the starting point along the forward pointer direction have been explored, and all path records have been saved in the path record set. To explore propagation along the backward pointer direction (i.e., backtracking from the endpoint), the tracing queue needs to be cleared, and then all cell identifiers with an out-degree value of 0 (i.e., endpoints without subsequent propagation) need to be added back to the tracing queue. Then, a cell identifier is taken from the head of the queue again as the current tracing cell identifier, and its corresponding backward pointer list is obtained.

[0147] Step S1511: Traverse each backward unit identifier in the backward pointer list, add the backward unit identifier to the starting position of the current tracing path, and add the backward unit identifier to the tail of the tracing queue. Repeat the step of taking a unit identifier from the head of the tracing queue until the tracing queue becomes an empty queue. Save the tracing path recorded in each tracing process to the path record set.

[0148] Now, begin the reverse tracing. For each backward unit identifier in the backward pointer list of the current tracing unit, perform the following operations: First, in a path record being constructed, add the backward unit identifier to the beginning of the current path (because we are tracing back to an earlier source); then, add the backward unit identifier to the tail of the tracing queue. Repeat the steps of removing units from the head of the queue and processing the backward pointer list until the queue is empty again. Each time, starting from the endpoint and tracing backward along the backward pointers, we will eventually return to a starting point, thus forming a complete backward tracing path, which is also saved to the path record set.

[0149] Step S1512: Perform deduplication on all traceability paths in the path record set, and extract the source Internet Protocol address tags and destination Internet Protocol address tags of all abnormal behavior time-series chain units involved in each deduplicated traceability path according to the traceability order to generate an abnormal behavior propagation path sequence.

[0150] After steps S157 to S1511, the path record set may contain some duplicate paths. A deduplication operation is performed to ensure that each path is unique. Each path retained after deduplication is essentially a sequence of unit identifiers. Each unit identifier in this sequence is traversed, and the corresponding anomalous behavior time-series unit is found based on the identifier. The source and destination Internet Protocol (IP) labels of that unit are extracted. The extracted address pairs are arranged strictly according to the order of the unit identifiers in the path sequence, forming a sequence of addresses, i.e., the anomalous behavior propagation path sequence. For example, a sequence might be represented as: source IP_A -> destination IP_B (corresponding to one unit), then source IP_B -> destination IP_C (corresponding to another unit), revealing the process of anomalous behavior propagating from host A to B, and then to C.

[0151] Step S1513: Collect all generated abnormal behavior propagation path sequences, perform length normalization processing on the abnormal behavior propagation path sequences, and generate the final abnormal behavior propagation path sequence set.

[0152] Collect all the abnormal behavior propagation path sequences generated in step S1512 to form an initial set. Since the lengths of these paths may vary, they can be normalized to facilitate subsequent batch analysis or model input. For example, the longest path can be truncated or short paths can be padded to make the lengths of all path sequences in the set uniform, thus obtaining the final, structured set of abnormal behavior propagation path sequences.

[0153] Furthermore, after step S150, this embodiment may further include:

[0154] Step S160: Based on the set of abnormal behavior propagation path sequences, perform abnormal behavior blocking point location processing on the original communication information flow set to generate an abnormal behavior handling instruction containing a blocking execution time window and a blocking target address list.

[0155] After obtaining the complete propagation path of the abnormal behavior, the key nodes that need to be blocked can be intelligently located based on this path information, and a specific, executable disposal instruction can be generated to implement the blocking on the network device.

[0156] Step S161: Read each abnormal behavior propagation path sequence sequentially from the abnormal behavior propagation path sequence set, and obtain all source Internet Protocol address tags and all destination Internet Protocol address tags contained in each abnormal behavior propagation path sequence.

[0157] First, iterate through each sequence in the set of abnormal behavior propagation path sequences generated in step S1513. For the path sequence currently being processed, parse its structure and extract all the source and destination Internet Protocol (IP) labels that appear.

[0158] Step S162: Create a blank address frequency statistics mapping table, and traverse each source Internet Protocol address label and each destination Internet Protocol address label in each abnormal behavior propagation path sequence.

[0159] An empty hash table is created in memory to count the total number of times each Internet Protocol address tag appears in the propagation path. The keys of this table are the address tags, and the values ​​are the cumulative frequencies. Then, iterate through all the address tags (including source and destination) extracted from all paths in step S161.

[0160] Step S163: For the Internet Protocol address tag currently being traversed, search for a frequency record with the Internet Protocol address tag currently being traversed as the key in the address frequency statistics mapping table. If a record is found, increment the frequency record by 1. If a record is not found, create a new frequency record with the Internet Protocol address tag currently being traversed as the key and set the frequency to the initial value.

[0161] For each address tag encountered during the current iteration, a lookup is performed in the address frequency statistics map. If the address tag already exists as a key in the map, its corresponding value (frequency record) is incremented by 1. If the address tag does not yet exist in the map, an entry is created for this new address tag, and its frequency record is initialized to 1.

[0162] Step S164: After completing the traversal of all abnormal behavior propagation path sequences, extract all Internet Protocol address tags whose frequency records exceed the preset blocking frequency threshold from the address frequency statistics mapping table, and add the Internet Protocol address tags whose frequency records exceed the preset blocking frequency threshold to the blocking candidate address set.

[0163] After traversing all paths and addresses, the address frequency statistics mapping table records the total number of times each address appears in the abnormal propagation activity. A blocking frequency threshold is set. Each entry in this mapping table is traversed, and all address tags with frequency records greater than the threshold are extracted. These addresses are nodes that frequently appear in multiple abnormal propagation paths and are likely key hubs. These addresses are placed into a temporary set and labeled as the blocking candidate address set.

[0164] Step S165: Perform propagation influence analysis on each blocking candidate address in the blocking candidate address set, and count the first quantity value of the abnormal behavior propagation path sequence with the blocking candidate address as the source Internet Protocol address label; count the second quantity value of the abnormal behavior propagation path sequence with the blocking candidate address as the destination Internet Protocol address label, and calculate the weighted sum of the first quantity value and the second quantity value as the influence weight value of the blocking candidate address.

[0165] High frequency of occurrence is not enough; it's also necessary to assess an address's "influence" within the propagation network. For each address in the blocking candidate address set, the following analysis is performed: First, count the number of paths in the entire set of anomalous behavior propagation path sequences that use that address as the source Internet Protocol address label, denoted as the first quantity value. This represents its ability to spread anomalous behavior as an initiator. Then, count the number of paths that use that address as the destination Internet Protocol address label, denoted as the second quantity value. This represents its ability to converge anomalous behavior as a receiver. Finally, calculate the address's influence weight value using a pre-defined weighted formula, for example, the influence weight value equals (the first quantity value multiplied by weight α) plus (the second quantity value multiplied by weight β), where α and β are pre-set coefficients based on network topology importance.

[0166] Step S166: Sort all blocking candidate addresses in the blocking candidate address set from largest to smallest according to the influence weight value, and generate a sorted blocking candidate address list.

[0167] After calculating the influence weight values ​​of all blocking candidate addresses, the addresses in the blocking candidate address set are sorted in descending order based on these weight values. Addresses with larger weight values ​​are considered to play a more important role in the anomaly propagation network, and blocking them is likely to be more effective. After sorting, a new list is obtained, which is the sorted blocking candidate address list.

[0168] Step S167: Select a preset number of blocking candidate addresses from the sorted blocking candidate address list as the final blocking target addresses, and arrange the final blocking target addresses in the ranking order to generate a blocking target address list.

[0169] Based on the actual network blocking capabilities and strategies, set an upper limit on the number of addresses to be blocked, i.e., a preset number. Starting from the head of the sorted list of candidate blocking addresses, select the first preset number of addresses and use them as the final targets for blocking. Reorganize the selected addresses according to their ranking in this list into a new list, labeled as the target blocking address list.

[0170] Step S168: Extract all abnormal behavior propagation path sequences containing the final blocking target address from the abnormal behavior propagation path sequence set, and obtain the start time and end time of each extracted abnormal behavior propagation path sequence.

[0171] To determine a reasonable blocking time window, it is necessary to analyze the time range of the abnormal activities participated in by these targets. The entire set of abnormal behavior propagation path sequences is traversed, and sequences containing any address from the target address list are selected. For each selected path sequence, the timestamp corresponding to the earliest interaction is taken as the start time of the path, and the timestamp corresponding to the latest interaction is taken as the end time of the path.

[0172] Step S169: Take the minimum value among the starting time points of all extracted abnormal behavior propagation path sequences as the start time of blocking execution, and take the maximum value among the ending time points of all extracted abnormal behavior propagation path sequences as the end time of blocking execution.

[0173] After obtaining the start and end times of all relevant paths, a conservative time window is needed to ensure that the blocking covers the entire abnormal activity cycle. Find the earliest start time among all these start times and use it as the start time for blocking execution. Then, find the latest end time among all these end times and use it as the end time for blocking execution.

[0174] Step S1610: Combine the start time of the blocking execution and the end time of the blocking execution into a blocking execution time window, and create a blank instruction data container.

[0175] The start and end times of the blocking execution determined in step S169 are combined to form a time interval, namely the blocking execution time window. For example, it can be represented as a data pair containing the start and end times. Simultaneously, a new, empty instruction data container is created in memory, which will be used to hold the final disposal instruction.

[0176] Step S1611: Convert the time representation of the blocking execution time window into a first data block and store it in the instruction data container; convert the address representation of the blocking target address list into a second data block and store it in the instruction data container; append an instruction type identifier and the target communication control node address to the instruction data container; and output the fully filled instruction data container as the abnormal behavior handling instruction.

[0177] Finally, the instructions are assembled. First, the blocking execution time window determined in step S1610 is serialized according to a predetermined data format (e.g., a 4-byte unsigned integer for both the start and end times) to generate a first data block, which is then stored in the instruction data container. Next, the blocking target address list generated in step S167 is serialized according to the same predetermined format (e.g., a 4-byte integer representing the number of addresses, followed by the 32-bit binary representations of each address), generating a second data block, which is also stored in the instruction data container. Then, a fixed instruction type identifier is appended to the instruction data container, such as a one-byte "0x01" representing an "abnormal blocking instruction," and a target communication control node address, such as the management Internet Protocol address of the firewall or router that needs to execute this instruction. At this point, the instruction data container is fully filled, forming a standard abnormal behavior handling instruction, which can be sent to the corresponding network device for execution.

[0178] Furthermore, the pre-built abnormal behavior prototype network is pre-constructed and trained through the following steps:

[0179] Step S210: Obtain a set of historical abnormal communication information flow samples collected in the historical network environment. The set of historical abnormal communication information flow samples contains multiple historical communication session record units, and each historical communication session record unit is associated with a known abnormal behavior type label.

[0180] The "pre-defined abnormal behavior prototype network" used in step S140 above is not created out of thin air, but requires prior construction and training. To this end, a batch of known abnormal communication data needs to be collected from the historical network environment. A sample set of historical abnormal communication information flows is collected, containing a large number of historical communication session record units. Unlike the units captured in real time, each of these historical units is manually or through other reliable methods labeled with a known abnormal behavior type, such as "port scanning," "brute-force attack," or "data leakage," as a supervision signal for subsequent training.

[0181] Step S220: Perform communication behavior pattern parsing processing on each historical communication session record unit in the historical abnormal communication information flow sample set to obtain the historical interaction behavior feature tuple of each historical communication session record unit.

[0182] For the historical sample set collected in step S210, the same data processing method as in step S120 (and its sub-steps S121 to S1211) is applied. That is, for each historical communication session record unit, a series of operations such as protocol parsing, behavior type extraction, and intensity vector construction are performed to finally generate a corresponding historical interaction behavior feature tuple. Each historical tuple also contains a discrete numerical code (based on historical behavior type) and a historical interaction behavior intensity feature vector.

[0183] Step S230: Construct a historical interaction behavior sequence cluster based on the historical interaction behavior feature tuple and the source Internet Protocol address tag and destination Internet Protocol address tag of each historical communication session record unit.

[0184] Next, for all historical interaction behavior feature tuples generated in step S220, the same data aggregation method as in step S1212 (and its sub-steps S1212-1 to S1212) is applied. Using the source and destination addresses of the historical session record units as keys, all historical tuples belonging to the same source-destination address pair are sorted by time to construct a historical interaction behavior time-series chain, ultimately forming a structured historical interaction behavior sequence cluster.

[0185] Step S240: Extract the historical interaction behavior type label sequence and the historical interaction behavior intensity feature vector sequence of each historical interaction behavior time chain from the historical interaction behavior sequence cluster.

[0186] Then, for each historical interaction behavior time-series chain in the historical interaction behavior sequence cluster constructed in step S230, the same extraction operation as in step S130 (specifically step S131) ​​is performed to obtain its historical interaction behavior type label sequence and historical interaction behavior intensity feature vector sequence, respectively.

[0187] Step S250: Input the sequence of historical interaction behavior type labels into the preset semantic embedding layer for embedding representation transformation processing to obtain the semantic embedding matrix of historical interaction behavior type.

[0188] For each historical interaction behavior time-series chain, a semantic embedding layer with the exact same structure as in steps S130 (specifically steps S132 to S138) is used to process its historical interaction behavior type label sequence. This embedding layer may be randomly initialized at this point, or initialized based on some prior knowledge. By looking up the embedding matrix, the discrete label sequence is transformed into a continuous historical interaction behavior type semantic embedding matrix.

[0189] Step S260: Input the sequence of historical interaction behavior intensity feature vectors and the semantic embedding matrix of historical interaction behavior type into the preset temporal convolutional encoder for spatiotemporal feature joint encoding processing to generate historical joint embedding feature vectors for each historical interaction behavior temporal chain.

[0190] Similarly, for each historical interaction sequence, a temporal convolutional encoder with the exact same structure as in step S130 (specifically steps S139 to S1315) is used to process the historical semantic embedding matrix generated in step S250 and the historical intensity vector sequence extracted in step S240. First, the vectors are concatenated, then processed through multiple temporal convolutional blocks, and finally, global average pooling is performed to generate a fixed-length historical joint embedding feature vector for each historical sequence. It is important to note that at this point, the parameters of the semantic embedding layer and the temporal convolutional encoder are in their initial, untrained state.

[0191] Step S270: Group the historical joint embedding feature vectors of all historical interaction behavior time-series chains according to the known abnormal behavior type labels associated with the historical interaction behavior time-series chains, to obtain the set of historical joint embedding feature vectors corresponding to each abnormal behavior type.

[0192] After processing all historical samples through steps S220 to S260, a large number of historical joint embedding feature vectors are obtained. Each vector corresponds to a historical interaction behavior time-series chain, and each chain is associated with a known anomalous behavior type label from step S210. Now, based on these known labels, all historical vectors are grouped. All historical vectors carrying the same label (e.g., "port scan") are grouped into the same set.

[0193] Step S280: For each set of historical joint embedded feature vectors corresponding to an abnormal behavior type, calculate the mean vector of all historical joint embedded feature vectors in the set of historical joint embedded feature vectors, and initialize the mean vector as the abnormal behavior prototype vector corresponding to the abnormal behavior type.

[0194] For each set partitioned in step S270, the mean of all historical vectors within that set is calculated. Specifically, assuming a set contains N vectors of dimension C, the values ​​of these N vectors are summed along each dimension, and then divided by N to obtain a mean vector of length C. This mean vector represents the central position of all samples of this type in the feature space. This mean vector is used as the initial prototype vector for this type of abnormal behavior.

[0195] Step S290: Combine the abnormal behavior prototype vectors corresponding to all abnormal behavior types to form the initial prototype vector set of the abnormal behavior prototype network.

[0196] The initial prototype vectors calculated for each anomalous behavior type in step S280 are collected and placed into a list. This list constitutes the initial prototype vector set of the anomalous behavior prototype network. At this point, the prototype network has a preliminary prototype.

[0197] Step S2100: Use the historical joint embedding feature vector as a training sample and the known abnormal behavior type label associated with the historical joint embedding feature vector as a supervision signal to iteratively optimize and train the abnormal behavior prototype network.

[0198] Although the prototype has been initialized, the entire model (including the semantic embedding layer, the temporal convolutional encoder, and the prototype vector itself) still needs joint optimization to make the vector space more conducive to classification. All historical joint embedding feature vectors generated in step S260 are used as training samples, and the known abnormal behavior type label corresponding to each sample is used as a supervision signal to begin iterative training.

[0199] Step S2110: In each training iteration, calculate the Euclidean distance between the historical joint embedding feature vector of the current training sample and each abnormal behavior prototype vector in the current prototype vector set to obtain the prediction matching score of the current training sample.

[0200] In each training iteration, for each selected training sample (a historical vector), the Euclidean distance is calculated between it and all prototype vectors in the current prototype vector set, and the negative value is taken to obtain a set of predicted matching scores. This process is exactly the same as step S140 (and its sub-steps S141 to S145).

[0201] Step S2120: Calculate the prototype loss function value based on the predicted matching score and the supervision signal. The prototype loss function value is used to measure the difference between the predicted matching score and the true label.

[0202] The calculated predicted matching score vector represents the model's prediction of the current sample's category. The supervision signal (i.e., the known abnormal behavior type label) indicates the sample's true category. A loss function, such as the cross-entropy loss function, is used to calculate the difference between the predicted score and the true label. The smaller the loss function value, the more accurate the prediction. This calculated value is the prototype loss function value.

[0203] Step S2130: Calculate the gradient of the prototype loss function value relative to the parameters of the temporal convolutional encoder, the parameters of the semantic embedding layer, and the prototype vector of the abnormal behavior using the backpropagation algorithm.

[0204] By utilizing the automatic differentiation function of the deep learning framework, starting from the loss function value, the gradient of the loss value with respect to all trainable parameters in the model is calculated layer by layer in reverse. These parameters include: the weights and biases of all convolutional kernels in the temporal convolutional encoder, all elements of the embedding matrix in the semantic embedding layer, and each prototype vector in the abnormal behavior prototype network itself.

[0205] Step S2140: Update and adjust the parameters of the temporal convolutional encoder, the parameters of the semantic embedding layer, and the abnormal behavior prototype vector according to the calculated gradient, and repeat the training iteration steps until the prototype loss function value converges or reaches the preset number of training iterations. The abnormal behavior prototype network after training is used as the final preset abnormal behavior prototype network.

[0206] Based on the gradient calculated in step S2130, an optimizer (e.g., the Adam optimizer) is used to update all trainable parameters at a certain learning rate, adjusting the parameters to dictate the direction of the loss function's descent. One update completes one iteration. Then, steps S2110 to S2140 are repeated, continuously training with new samples (or multiple iterations of the same batch of samples) until the loss function no longer significantly decreases (convergence) or the pre-set maximum number of iterations is reached. At this point, model training is complete. The semantic embedding layer, temporal convolutional encoder, and prototype vector set, after training, together constitute the final, usable pre-defined abnormal behavior prototype network for real-time detection in step S140.

[0207] Further, after step S150, the method may further include: step S310: performing path structure feature extraction processing on each abnormal behavior propagation path sequence in the abnormal behavior propagation path sequence set, counting the total number of Internet Protocol address tags contained in each abnormal behavior propagation path sequence as the path length feature; obtaining the joint embedding feature vector of the interaction behavior temporal chain corresponding to adjacent Internet Protocol address tags in each abnormal behavior propagation path sequence, calculating the cosine similarity between adjacent joint embedding feature vectors, arranging all the calculated cosine similarities according to the path order, and generating a path similarity change curve; performing peak detection processing on the path similarity change curve, identifying local maxima in the path similarity change curve where the cosine similarity value exceeds a preset similarity peak value, and recording the path position corresponding to the local maxima as a key turning point of the path; combining the path length feature of each abnormal behavior propagation path sequence with the position of the key turning point of the path to generate a path structure feature descriptor of the abnormal behavior propagation path sequence.

[0208] To gain a deeper understanding of the anomaly propagation patterns, after obtaining the set of anomaly behavior propagation path sequences in step S150, the structural features of each path can be further analyzed. First, for each anomaly behavior propagation path sequence in the set, the number of all Internet Protocol address tags appearing in the sequence is counted, denoted as the path length feature. Next, for each pair of adjacent addresses in the path sequence, such as source IP_A and destination IP_B, they correspond to an interaction behavior time-series chain. From the previous processing results, the joint embedding feature vector of this chain is obtained. Then, the cosine similarity between the joint embedding feature vectors corresponding to two adjacent addresses is calculated; this value reflects the consistency of two consecutive interactions in the feature space. The cosine similarities calculated for all adjacent points on the path are arranged in the path order to form a curve, i.e., the path similarity change curve. Peak detection is performed on this curve to find points whose values ​​exceed a preset similarity threshold and are local maxima. These points represent turning points where the behavior pattern changes significantly on the propagation path. The position index of each turning point in the path is recorded. Finally, the path length feature is combined with the indexes of all key turning points to form a feature descriptor that describes the structural characteristics of the path.

[0209] Step S320: Based on the path structure feature descriptor, perform cluster analysis on all abnormal behavior propagation path sequences in the abnormal behavior propagation path sequence set, and divide abnormal behavior propagation path sequences with similar path structure feature descriptors into the same path structure cluster.

[0210] After obtaining the structural feature descriptors for each path, they can be used as input for cluster analysis. A suitable clustering algorithm is chosen, such as density-based noise-applied spatial clustering or K-means clustering, using the distance between path structural feature descriptors (e.g., dynamic time-warped distance based on length differences and inflection point locations) as a similarity metric. Through clustering, all structurally similar paths are grouped into the same cluster. For example, all paths that are "long paths with one inflection point in the middle" might cluster together.

[0211] Step S330: For each path structure cluster, extract the source Internet Protocol address (IPA) tag set and the destination Internet Protocol address (IPA) tag set of all abnormal behavior propagation path sequences within the path structure cluster; calculate the intersection of the source IPA tag set and the destination IPA tag set, and mark the IPA tag in the intersection as the intra-cluster hub address of the path structure cluster; count the total number of times each intra-cluster hub address appears in the abnormal behavior propagation path sequence of its respective path structure cluster, and use the total number of times as the intra-cluster importance weight of the intra-cluster hub address.

[0212] For each path structure cluster obtained after clustering, firstly, collect all source Internet Protocol address labels appearing in all path sequences within the cluster, forming one set; simultaneously, collect all destination Internet Protocol address labels, forming another set. Calculate the intersection of these two sets. Addresses in this intersection, which serve as both origins and destinations in some paths, are likely to be key hubs for anomalous propagation within the cluster. Mark each address in the intersection as an intra-cluster hub address. Then, for each intra-cluster hub address, count the total number of times it appears in all path sequences within its cluster. This total number reflects the importance of the address in this type of anomalous propagation pattern and is used as the intra-cluster importance weight for that hub address.

[0213] Step S340: Associate and store the cluster identifier of each path structure cluster with the corresponding intra-cluster hub address and the intra-cluster importance weight of the intra-cluster hub address to generate an abnormal behavior propagation path structure feature library.

[0214] Finally, the unique identifier of each path structure cluster, along with all the cluster hub addresses identified within that cluster and the cluster importance weight corresponding to each hub address, are persistently stored in a database. This database constitutes the abnormal behavior propagation path structure feature library. In the future, when a new abnormal propagation path is detected in real time, its structural features can be compared with the patterns in the library to quickly identify its anomaly type and key nodes.

[0215] For example, further, after step S150, the method may also include:

[0216] Step S410: Perform path start address statistics on all abnormal behavior propagation path sequences in the abnormal behavior propagation path sequence set, count the number of times each source Internet Protocol address tag appears as the start address of the abnormal behavior propagation path sequence, and generate a start address frequency distribution; perform path termination address statistics on all abnormal behavior propagation path sequences in the abnormal behavior propagation path sequence set, count the number of times each destination Internet Protocol address tag appears as the termination address of the abnormal behavior propagation path sequence, and generate a termination address frequency distribution.

[0217] As a supplementary analysis of the set of anomalous behavior propagation path sequences, the "source-sink" attributes of each address in the network can be calculated. First, traverse each anomalous behavior propagation path sequence in the set and extract its first address, i.e., the starting address. Count the total number of times each source Internet Protocol address label appears as the starting address to form a starting address frequency distribution. Then, similarly, traverse each path sequence and extract its last address, i.e., the ending address. Count the total number of times each destination Internet Protocol address label appears as the ending address to form a ending address frequency distribution.

[0218] Step S420: Calculate the source-sink ratio of each Internet Protocol address tag based on the frequency distribution of the starting address and the frequency distribution of the ending address. The source-sink ratio is equal to the number of times the Internet Protocol address tag appears as a starting address divided by the number of times the Internet Protocol address tag appears as an ending address.

[0219] For each Internet Protocol address label that appears in the starting or ending address distribution, a ratio is calculated, denoted as the propagation source-sink ratio. This ratio is equal to the number of times the label appears in the starting address frequency distribution, divided by the number of times it appears in the ending address frequency distribution. For stability calculations, when the denominator is zero, it can be set to a very small positive number.

[0220] Step S430: Mark the Internet Protocol address tags whose propagation source-sink ratio exceeds the preset source-sink ratio threshold as the origin address of abnormal behavior, and mark the Internet Protocol address tags whose propagation source-sink ratio is less than the reciprocal of the preset source-sink ratio as the destination address of abnormal behavior.

[0221] Set a source-sink ratio threshold. If an address's propagation source-sink ratio is significantly greater than 1 and exceeds this threshold, it indicates that it has acted as the starting point of abnormal behavior far more often than as the ending point, making it highly likely to be the origin of the anomaly, and thus it is marked as the origin address of the abnormal behavior. Conversely, if an address's propagation source-sink ratio is significantly less than 1 and less than the reciprocal of this threshold, it indicates that it has acted as the ending point of abnormal behavior far more often than as the starting point, making it highly likely to be the destination address of the abnormal behavior, and thus it is marked as the destination address of the abnormal behavior.

[0222] Step S440: Select all abnormal behavior propagation path sequences containing the origin address of the abnormal behavior from the abnormal behavior propagation path sequence set as the source origin path set, and select all abnormal behavior propagation path sequences containing the destination address of the abnormal behavior convergence from the abnormal behavior propagation path sequence set as the destination convergence path set.

[0223] Based on the labeling results of step S430, the path set is filtered. All paths in the path sequence that contain any origin address of the abnormal behavior are extracted to form a dedicated source origin path set. Similarly, all paths that contain any destination address of the abnormal behavior are extracted to form a destination convergence path set.

[0224] Step S450: Perform path pattern mining processing on the abnormal behavior propagation path sequence in the source initiation path set, and extract the frequently occurring path subsequences in the source initiation path set as frequent source initiation patterns; perform path pattern mining processing on the abnormal behavior propagation path sequence in the destination convergence path set, and extract the frequently occurring path subsequences in the destination convergence path set as frequent destination convergence patterns.

[0225] Sequence pattern mining algorithms, such as the PrefixSpan algorithm, are applied to the set of source initiation paths. This algorithm aims to find frequently occurring, continuous or discontinuous subsequences within multiple sequences. The mined path subsequences that occur more frequently than a minimum support threshold are considered frequent source initiation patterns, revealing typical diffusion paths originating from the anomaly source. The same mining algorithm is applied to the set of destination convergence paths to identify frequently occurring path subsequences, which are then considered frequent destination convergence patterns, revealing typical preceding paths before converging to the anomaly target.

[0226] Step S460: Compare and analyze the source initiation frequent pattern and the destination convergence frequent pattern, and identify the common path subsequence that appears in both the source initiation frequent pattern and the destination convergence frequent pattern as the core propagation pattern of abnormal behavior; store the core propagation pattern of abnormal behavior in the abnormal behavior pattern knowledge base for subsequent abnormal behavior pattern matching and detection of the real-time captured communication information stream.

[0227] Finally, the two types of frequent patterns mined in step S450 are compared and analyzed. Common path subsequences that appear as both part of the source diffusion pattern and as part of the convergence pre-pattern are identified. These common subsequences, spanning the entire process from initiation to convergence, represent the most core and stable propagation law of abnormal behavior and are identified as the core propagation patterns of abnormal behavior. These core patterns are then structurally represented and stored in an abnormal behavior pattern knowledge base. In future real-time detection, when new communication information flows are captured and propagation paths are constructed, they can be quickly matched with the core patterns in the knowledge base. Once a match is successful, it can be determined as an anomaly with high confidence, thereby improving the accuracy and efficiency of detection.

[0228] Figure 2This application illustrates an abnormal behavior detection system 100 for communication information streams, including a processor 1001, a memory 1003, and application code stored in the memory 1003. The processor 1001 executes the application code to implement the steps of an abnormal behavior detection method for communication information streams. The processor 1001 and the memory 1003 are connected, for example, via a bus 1002. Optionally, the abnormal behavior detection system 100 may further include a transceiver 1004, which can be used for data interaction between this abnormal behavior detection system and other abnormal behavior detection systems for communication information streams, such as sending and / or receiving data. It should be noted that in actual scheduling, the transceiver 1004 is not limited to one, and the structure of this abnormal behavior detection system 100 does not constitute a limitation on the embodiments of this application. The memory 1003 stores the application code executing the embodiments of this application and is controlled by the processor 1001. The processor 1001 is used to execute the application code stored in the memory 1003 to implement the steps shown in the foregoing method embodiments.

[0229] This application provides a computer-readable storage medium storing application code. When the application code is executed by a processor, it can implement the steps and corresponding content of the aforementioned method embodiments.

[0230] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application, without departing from the technical concept of this application, also fall within the protection scope of the embodiments of this application.

Claims

1. A method for detecting abnormal behavior in communication information streams, characterized in that, The method includes: In the network communication link, the original communication information stream set is captured. The original communication information stream set includes a large number of communication session record units generated by data exchange based on Transmission Control Protocol and User Datagram Protocol during the continuous acquisition period. Each communication session record unit carries a source Internet Protocol address tag, a destination Internet Protocol address tag, a protocol type identifier, and an application layer data payload fragment. The original communication information flow set is parsed to obtain the interaction behavior characteristics of the communication session record unit during the application layer protocol interaction. Based on the interaction behavior characteristics, the source Internet Protocol address tag and the destination Internet Protocol address tag, a cross-session associated interaction behavior sequence cluster is constructed. The interaction behavior sequence cluster includes the interaction behavior time sequence chain formed by the same source Internet Protocol address tag exchanging data with different destination Internet Protocol address tags in multiple communication session record units. Extract the interaction behavior type label sequence and interaction behavior intensity feature vector sequence of each interaction behavior temporal chain in the interaction behavior sequence cluster. Input the interaction behavior type label sequence into a preset semantic embedding layer for embedding representation transformation processing to obtain the interaction behavior type semantic embedding matrix. Input the interaction behavior intensity feature vector sequence and the interaction behavior type semantic embedding matrix into a preset temporal convolutional encoder for spatiotemporal feature joint encoding processing to generate the joint embedding feature vector of the interaction behavior temporal chain. The joint embedding feature vector is input into a preset abnormal behavior prototype network for prototype matching processing. The matching score between the joint embedding feature vector and each abnormal behavior prototype vector is calculated. Based on the matching score, the abnormal behavior type probability distribution of the interaction behavior time sequence chain is generated. The abnormal behavior type with the highest probability value in the abnormal behavior type probability distribution is used as the initial abnormal behavior label of the interaction behavior time sequence chain. Based on the degree of correlation between the initial abnormal behavior marker and the interaction behavior features of each interaction behavior time-series chain in the interaction behavior sequence cluster, abnormal behavior propagation path tracing processing is performed to obtain a set of abnormal behavior propagation path sequences of all source Internet Protocol address tags and destination Internet Protocol address tags in the interaction behavior sequence cluster.

2. The method for detecting abnormal behavior in communication information streams according to claim 1, characterized in that, The process of parsing the communication behavior pattern of the original communication information stream set to obtain the interaction behavior characteristics of the communication session record unit during application layer protocol interaction includes: The protocol header field set of each communication session record unit is read sequentially from the original communication information stream set. The protocol header field set includes the source port number field, the destination port number field, the session start timestamp field, and the session end timestamp field. The application layer protocol type used by the communication session recording unit is identified based on the value of the source port number field and the value of the destination port number field, and the identified application layer protocol type is assigned to the protocol type identifier. Invoke the application layer protocol parser corresponding to the protocol type identifier, and perform byte-by-byte scanning and parsing of the application layer data payload fragment through the application layer protocol parser; During the byte-by-byte scanning and parsing process, the byte sequence of the request method field and the byte sequence of the response status code field are extracted from the specified offset position of the application layer data payload segment according to the predefined request method field offset and response status code field offset in the application layer protocol parser. The extracted request method field byte sequence is converted into a first string, the extracted response status code field byte sequence is converted into a second string, and the combination of the first string and the second string is used as the interaction behavior type label of the communication session record unit. Read the value of the session start timestamp field from the protocol header field set as the start time point, read the value of the session end timestamp field as the end time point, and calculate the difference between the end time point and the start time point as the session duration parameter. Traverse all data packets contained in the communication session record unit, record the value of the total IP length field of each data packet in turn, and arrange the values ​​of the total IP length field of all data packets according to the arrival order of the data packets in the communication session record unit to generate the original data packet length sequence. The total number of data packet length values ​​contained in the original data packet length sequence is taken as the first length value. When the first length value is greater than the set normalized target length value, the original data packet length sequence is sampled at equal intervals. The same number of data packet length values ​​as the normalized target length value are uniformly extracted from the original data packet length sequence to generate the sampled data packet length sequence. Alternatively, when the first length value is less than the normalized target length value, a preset padding value is added to the end of the original data packet length sequence so that the length of the supplemented data packet length sequence is equal to the normalized target length value, thereby generating the supplemented data packet length sequence. Use the sampled data packet length sequence or the supplemented data packet length sequence as a data packet length distribution sequence, create an empty feature vector container, and store the session duration parameter as the first element in the feature vector container; Each data packet length value in the data packet length distribution sequence is appended to the feature vector container in the order of arrangement in the data packet length distribution sequence, and the filled feature vector container is used as the interaction behavior intensity feature vector of the communication session record unit. The interaction behavior type label is converted into a discrete numerical code, and the discrete numerical code is associated and encapsulated with the interaction behavior intensity feature vector to generate the interaction behavior feature tuple of the communication session record unit.

3. The method for detecting abnormal behavior in communication information streams according to claim 2, characterized in that, The step of constructing a cross-session associated cluster of interactive behavior sequences based on the interactive behavior features, the source Internet Protocol address (IPA) tag, and the destination IPA tag includes: Extract the source Internet Protocol address tag and the destination Internet Protocol address tag of each communication session record unit from the original communication information flow set, and use the source Internet Protocol address tag as the first packet key value and the destination Internet Protocol address tag as the second packet key value; Create a blank hash map table, wherein the hash map table uses the source Internet Protocol address label as the outer key, the destination Internet Protocol address label as the inner key, and a list of interaction behavior feature tuples as the values; Traverse each communication session record unit in the original communication information flow set. For the current communication session record unit, obtain the source Internet Protocol address tag of the current communication session record unit as the current outer key, and obtain the destination Internet Protocol address tag of the current communication session record unit as the current inner key. The outer hash bucket indexed by the current outer key is searched in the hash mapping table. If the outer hash bucket does not exist, a new outer hash bucket is created and the correspondence between the current outer key and the new outer hash bucket is stored in the hash mapping table. Inside the found or newly created outer hash bucket, search for the inner hash bucket indexed by the current inner key. If the inner hash bucket does not exist, create a new inner hash bucket and store the correspondence between the current inner key and the new inner hash bucket into the outer hash bucket. Add the interaction behavior feature tuple of the current communication session record unit to the interaction behavior feature tuple list corresponding to the inner hash bucket, and record the timestamp tag of the current communication session record unit as the time attribute of the interaction behavior feature tuple. After completing the traversal of all communication session record units, traverse each inner key corresponding to each outer key in the hash mapping table to obtain a list of interaction behavior feature tuples corresponding to each inner key. The interactive behavior feature tuples in each interactive behavior feature tuple list are sorted in ascending order according to the time attribute of the interactive behavior feature tuples to generate a sequence of interactive behavior feature tuples arranged in chronological order. Extract the discrete numerical code of the interaction behavior type label of each interaction behavior feature tuple from the sorted interaction behavior feature tuple sequence, and arrange all the discrete numerical codes in the order of the interaction behavior feature tuple sequence to form the interaction behavior type label sequence. Extract the interaction behavior intensity feature vector of each interaction behavior feature tuple from the sorted interaction behavior feature tuple sequence, and stack all interaction behavior intensity feature vectors in the order of the interaction behavior feature tuple sequence to form an interaction behavior intensity feature vector sequence. The interaction behavior type label sequence is associated and stored with the interaction behavior intensity feature vector sequence to generate an interaction behavior time sequence chain with the current outer key as the source Internet Protocol address label and the current inner key as the destination Internet Protocol address label. Collect all interaction behavior time-series chains corresponding to the source Internet Protocol address tag and destination Internet Protocol address tag tuples, classify all interaction behavior time-series chains according to the source Internet Protocol address tag, and generate a multi-level mapping structure of interaction behavior time-series chains indexed by the source Internet Protocol address tag as the interaction behavior sequence cluster.

4. The method for detecting abnormal behavior in communication information streams according to claim 1, characterized in that, The process involves extracting the interaction behavior type label sequence and interaction behavior intensity feature vector sequence for each temporal chain of the interaction behavior sequence cluster; inputting the interaction behavior type label sequence into a preset semantic embedding layer for embedding representation transformation to obtain an interaction behavior type semantic embedding matrix; and inputting the interaction behavior intensity feature vector sequence and the interaction behavior type semantic embedding matrix into a preset temporal convolutional encoder for spatiotemporal feature joint encoding to generate a joint embedding feature vector for the temporal chain of the interaction behavior, including: Read an interaction behavior time sequence chain from the interaction behavior sequence cluster, and obtain the interaction behavior type label sequence and interaction behavior intensity feature vector sequence of the interaction behavior time sequence chain; Obtain the discrete numerical code of each interaction behavior type label contained in the interaction behavior type label sequence. The discrete numerical code is an integer index value, and each integer index value uniquely corresponds to an interaction behavior type. Find the embedding vector corresponding to each integer index value from the embedding matrix of the preset semantic embedding layer. The number of rows in the embedding matrix is ​​the total number of categories of interactive behavior types, and the number of columns in the embedding matrix is ​​the preset embedding dimension value. For the first interaction behavior type label in the interaction behavior type label sequence, the discrete numerical code of the first interaction behavior type label is used as the row index. All column elements of the index row are extracted from the embedding matrix to form a row vector with a length equal to the embedding dimension value. The row vector is used as the distributed vector representation corresponding to the first interaction behavior type label. For the second interaction behavior type label in the interaction behavior type label sequence, the discrete numerical code of the second interaction behavior type label is used as the row index. All column elements of the first row index are extracted from the embedding matrix to form a row vector with a length equal to the embedding dimension value. The row vector is used as the distributed vector representation corresponding to the second interaction behavior type label. In the same manner, a corresponding distributed vector representation is generated for each interaction behavior type label in the interaction behavior type label sequence, until the last interaction behavior type label in the interaction behavior type label sequence is processed; Create an empty matrix container, wherein the number of rows of the matrix container is preset to the length value of the interactive behavior type label sequence, and the number of columns of the matrix container is preset to the embedding dimension value; The distributed vector representation corresponding to the first interaction behavior type label is filled into the first row of the matrix container as a row vector. The distributed vector representation corresponding to the second interaction behavior type label is filled into the second row of the matrix container as a row vector, and so on, until all distributed vector representations are filled into the matrix container row by row according to the order in which the distributed vector representations appear in the sequence of interaction behavior type labels, thereby generating an interaction behavior type semantic embedding matrix. The sequence of interaction behavior intensity feature vectors is organized into a two-dimensional intensity tensor. The first dimension of the two-dimensional intensity tensor is the time step dimension, and the second dimension of the two-dimensional intensity tensor is the feature dimension of the interaction behavior intensity feature vector. The semantic embedding matrix of the interaction behavior type and the two-dimensional intensity tensor are concatenated along the feature dimension to generate a concatenated feature tensor. The feature dimension of the concatenated feature tensor is equal to the sum of the embedding dimension value and the intensity feature dimension. The concatenated feature tensor is input to the input end of the temporal convolutional encoder, and layer-by-layer feature transformation is performed through multiple stacked temporal convolutional blocks in the temporal convolutional encoder. Each temporal convolutional block contains a dilated convolutional layer and a gated linear unit. In the first temporal convolutional block, the input feature tensor is dilated convolutionally performed in the time dimension through the dilated convolutional layer to generate a first intermediate feature tensor. The first intermediate feature tensor is then non-linearly gated and filtered through the gated linear unit to generate the output feature tensor of the first temporal convolutional block. The output feature tensor of the first temporal convolutional block is input into the second temporal convolutional block. The steps of performing dilated convolution on the input feature tensor in the time dimension through dilated convolutional layers and nonlinear gating filtering through gated linear units are repeated to generate the output feature tensor of the second temporal convolutional block. In the same way, the output feature tensor of the previous temporal convolutional block is input into the next temporal convolutional block for processing, until the processing of the last temporal convolutional block is completed, and the final temporal convolutional feature tensor is generated. The final temporal convolutional feature tensor is subjected to global average pooling in the time dimension, and the mean of the final temporal convolutional feature tensor at all time steps is calculated to obtain a fixed-length mean vector as the joint embedding feature vector of the temporal chain of the interaction behavior.

5. The method for detecting abnormal behavior in communication information streams according to claim 4, characterized in that, The step of inputting the joint embedded feature vector into a preset abnormal behavior prototype network for prototype matching processing, calculating the matching score between the joint embedded feature vector and each abnormal behavior prototype vector, generating an abnormal behavior type probability distribution of the interaction behavior time sequence chain based on the matching score, and taking the abnormal behavior type with the highest probability value in the abnormal behavior type probability distribution as the initial abnormal behavior label of the interaction behavior time sequence chain includes: Multiple learnable abnormal behavior prototype vectors are obtained from the abnormal behavior prototype network. The dimension of each abnormal behavior prototype vector is exactly the same as the dimension of the joint embedding feature vector. Each abnormal behavior prototype vector corresponds to a preset abnormal behavior type. Calculate the Euclidean distance between the joint embedding feature vector and the first abnormal behavior prototype vector, and take the negative of the Euclidean distance as the first matching score of the joint embedding feature vector relative to the first abnormal behavior prototype vector. Calculate the Euclidean distance between the joint embedding feature vector and the second abnormal behavior prototype vector, and use the negative of the Euclidean distance as the second matching score of the joint embedding feature vector relative to the second abnormal behavior prototype vector; The Euclidean distance between the joint embedded feature vector and each abnormal behavior prototype vector is calculated sequentially, and the negative of each Euclidean distance is used as the corresponding matching score, until the matching score corresponding to all abnormal behavior prototype vectors is calculated. All calculated matching scores are combined into a matching score vector, the length of which is equal to the total number of abnormal behavior prototype vectors. The matching score vector is subjected to normalized exponential transformation. The exponential value of each element in the matching score vector is calculated, and then the sum of the exponential values ​​of all elements is calculated. The exponential value of each element is divided by the sum to obtain the normalized probability value corresponding to each element. All normalized probability values ​​are arranged in the order of the normalized probability values ​​in the matching score vector to form a probability distribution vector. The length of the probability distribution vector is equal to the total number of abnormal behavior prototype vectors, and the sum of all elements in the probability distribution vector is equal to 1. Find the probability value with the largest value from the probability distribution vector as the maximum probability value, and obtain the index position of the maximum probability value in the probability distribution vector as the maximum probability index; The maximum probability index is mapped to the corresponding abnormal behavior type identifier, and the abnormal behavior type identifier is used as the initial abnormal behavior marker of the interaction behavior sequence chain. The initial abnormal behavior marker is appended to the metadata field of the interaction behavior sequence chain to identify the abnormal behavior type to which the interaction behavior sequence chain belongs.

6. The method for detecting abnormal behavior in communication information streams according to claim 1, characterized in that, The abnormal behavior propagation path tracing process, based on the correlation degree between the initial abnormal behavior marker and the temporal chains of each interactive behavior in the interactive behavior sequence cluster, yields a set of abnormal behavior propagation path sequences for all source Internet Protocol address tags and destination Internet Protocol address tags in the interactive behavior sequence cluster, including: All interaction behavior time-series chains carrying the initial abnormal behavior tag are selected from the interaction behavior sequence cluster. Each selected interaction behavior time-series chain is marked as an abnormal behavior time-series chain unit and a unique unit identifier is assigned to each abnormal behavior time-series chain unit. Obtain the source Internet Protocol address tag of each abnormal behavior time-series unit as the source address attribute of the abnormal behavior time-series unit, and obtain the destination Internet Protocol address tag of each abnormal behavior time-series unit as the destination address attribute of the abnormal behavior time-series unit; Using the destination address attribute as an index, search for all other interactive behavior time-series chains in the interactive behavior sequence cluster whose source Internet Protocol address tags are exactly the same as the destination address attribute. The portion of the other interactive behavior time-series chains that carry the initial abnormal behavior marker is taken as the forward association unit set of the abnormal behavior time-series chain unit. Using the source address attribute as an index, search in the interaction behavior sequence cluster for all other interaction behavior time-series chains whose destination Internet Protocol address tags are exactly the same as the source address attribute, and take the part of the other interaction behavior time-series chain that carries the initial abnormal behavior tag as the set of backward association units of the abnormal behavior time-series chain unit. Create a forward pointer list and a backward pointer list for each abnormal behavior timing chain unit. Add the unit identifier of each abnormal behavior timing chain unit in the forward associated unit set to the forward pointer list, and add the unit identifier of each abnormal behavior timing chain unit in the backward associated unit set to the backward pointer list. The number of elements in the forward pointer list of each abnormal behavior time-sequence chain unit is used as the in-degree value, and the number of elements in the backward pointer list of each abnormal behavior time-sequence chain unit is used as the out-degree value. Create an empty trace queue and an empty path record set, and add the unit identifiers of all abnormal behavior time-series chain units with an in-degree value of 0 as the initial elements to the trace queue; Take a unit identifier from the head of the tracing queue as the current tracing unit identifier, and obtain the forward pointer list of the abnormal behavior time chain unit corresponding to the current tracing unit identifier; Iterate through each forward unit identifier in the forward pointer list, add the forward unit identifier to the end of the current tracing path, and add the forward unit identifier to the tail of the tracing queue; Repeat the step of retrieving a unit identifier from the head of the tracing queue until the tracing queue becomes empty. Save the tracing path recorded in each tracing process to the path record set. Clear the tracing queue. Add the unit identifiers of all abnormal behavior time-series chain units with an out-degree value of 0 back to the tracing queue as initial elements. Retrieve a unit identifier from the head of the tracing queue as the current tracing unit identifier. Obtain the backward pointer list of abnormal behavior time-series chain units corresponding to the current tracing unit identifier. Traverse each backward unit identifier in the backward pointer list, add the backward unit identifier to the starting position of the current tracing path, and add the backward unit identifier to the tail of the tracing queue. Repeat the step of taking a unit identifier from the head of the tracing queue until the tracing queue becomes an empty queue. Save the tracing path recorded in each tracing process to the path record set. All tracing paths in the path record set are deduplicated. The source Internet Protocol address tags and destination Internet Protocol address tags of all abnormal behavior time-series chain units involved in each deduplicated tracing path are extracted in tracing order to generate an abnormal behavior propagation path sequence. Collect all generated abnormal behavior propagation path sequences, perform length normalization on the abnormal behavior propagation path sequences, and generate the final abnormal behavior propagation path sequence set.

7. The method for detecting abnormal behavior in communication information streams according to claim 1, characterized in that, After obtaining the set of abnormal behavior propagation path sequences of all source Internet Protocol address tags and destination Internet Protocol address tags in the interaction behavior sequence cluster, the method further includes: Based on the set of abnormal behavior propagation path sequences, the original communication information flow set is processed to locate abnormal behavior blocking points, generating abnormal behavior handling instructions containing blocking execution time windows and a list of blocking target addresses, including: Read each abnormal behavior propagation path sequence sequentially from the set of abnormal behavior propagation path sequences, and obtain all source Internet Protocol address tags and all destination Internet Protocol address tags contained in each abnormal behavior propagation path sequence; Create a blank address frequency statistics mapping table, and iterate through each source Internet Protocol address label and each destination Internet Protocol address label in each abnormal behavior propagation path sequence; For the Internet Protocol address tag currently being traversed, search for a frequency record with the Internet Protocol address tag currently being traversed as the key in the address frequency statistics mapping table. If the record is found, increment the frequency record by 1. If the record is not found, create a new frequency record with the Internet Protocol address tag currently being traversed as the key and set the frequency to the initial value. After traversing all abnormal behavior propagation path sequences, extract all Internet Protocol address tags whose frequency records exceed the preset blocking frequency threshold from the address frequency statistics mapping table, and add the Internet Protocol address tags whose frequency records exceed the preset blocking frequency threshold to the blocking candidate address set. For each blocking candidate address in the blocking candidate address set, a propagation influence analysis is performed, and the first quantity value of the abnormal behavior propagation path sequence with the blocking candidate address as the source Internet Protocol address label is counted. The second quantity value of the abnormal behavior propagation path sequence of Internet Protocol address tags with the blocking candidate address as the target is calculated, and the weighted sum of the first quantity value and the second quantity value is used as the influence weight value of the blocking candidate address. Sort all blocking candidate addresses in the blocking candidate address set according to the influence weight value from largest to smallest to generate a sorted blocking candidate address list; Select a predetermined number of blocking candidate addresses from the sorted blocking candidate address list as the final blocking target addresses, and arrange the final blocking target addresses in the ranking order to generate a blocking target address list; Extract all abnormal behavior propagation path sequences containing the final blocking target address from the abnormal behavior propagation path sequence set, and obtain the start time and end time of each extracted abnormal behavior propagation path sequence. The minimum value among the starting time points of all extracted abnormal behavior propagation path sequences is taken as the start time of blocking execution, and the maximum value among the ending time points of all extracted abnormal behavior propagation path sequences is taken as the end time of blocking execution. The blocking execution start time and the blocking execution end time are combined into a blocking execution time window, and a blank instruction data container is created. The time representation of the blocking execution time window is converted into a first data block and stored in the instruction data container. The address representation of the blocking target address list is converted into a second data block and stored in the instruction data container. An instruction type identifier and the target communication control node address are appended to the instruction data container. The filled instruction data container is output as the abnormal behavior handling instruction.

8. The method for detecting abnormal behavior in communication information streams according to claim 1, characterized in that, The pre-built abnormal behavior prototype network is constructed and trained in advance through the following steps: Obtain a set of historical abnormal communication information flow samples collected in the historical network environment. The set of historical abnormal communication information flow samples contains multiple historical communication session record units, and each historical communication session record unit is associated with a known abnormal behavior type label. Each historical communication session record unit in the historical abnormal communication information flow sample set is subjected to communication behavior pattern parsing processing to obtain the historical interaction behavior feature tuple of each historical communication session record unit. A historical interaction behavior sequence cluster is constructed based on the historical interaction behavior feature tuples and the source Internet Protocol address tag and destination Internet Protocol address tag of each historical communication session record unit. Extract the historical interaction behavior type label sequence and the historical interaction behavior intensity feature vector sequence of each historical interaction behavior time chain from the historical interaction behavior sequence cluster; The sequence of historical interaction behavior type labels is input into the preset semantic embedding layer for embedding representation transformation processing to obtain the semantic embedding matrix of historical interaction behavior type. The sequence of historical interaction behavior intensity feature vectors and the semantic embedding matrix of historical interaction behavior type are input into the preset temporal convolutional encoder for spatiotemporal feature joint encoding processing to generate historical joint embedding feature vectors for each historical interaction behavior temporal chain. The historical joint embedding feature vectors of all historical interaction behavior time-series chains are grouped according to the known abnormal behavior type labels associated with the historical interaction behavior time-series chains to obtain the historical joint embedding feature vector set corresponding to each abnormal behavior type; For each abnormal behavior type, calculate the mean vector of all historical joint embedding feature vectors in the set of historical joint embedding feature vectors, and initialize the mean vector as the abnormal behavior prototype vector corresponding to the abnormal behavior type. The abnormal behavior prototype vectors corresponding to all abnormal behavior types are combined to form the initial prototype vector set of the abnormal behavior prototype network. The historical joint embedding feature vector is used as a training sample, and the known abnormal behavior type label associated with the historical joint embedding feature vector is used as a supervision signal to iteratively optimize and train the abnormal behavior prototype network. In each training iteration, the Euclidean distance between the historical joint embedding feature vector of the current training sample and each abnormal behavior prototype vector in the current prototype vector set is calculated to obtain the prediction matching score of the current training sample. The prototype loss function value is calculated based on the predicted matching score and the supervision signal. The prototype loss function value is used to measure the difference between the predicted matching score and the true label. The gradient of the prototype loss function value with respect to the parameters of the temporal convolutional encoder, the parameters of the semantic embedding layer, and the prototype vector of the abnormal behavior is calculated using the backpropagation algorithm. The parameters of the temporal convolutional encoder, the parameters of the semantic embedding layer, and the abnormal behavior prototype vector are updated and adjusted according to the calculated gradient. The training iteration steps are repeated until the prototype loss function value converges or reaches the preset number of training iterations. The abnormal behavior prototype network after training is used as the final preset abnormal behavior prototype network.

9. The method for detecting abnormal behavior in communication information streams according to claim 1, characterized in that, After obtaining the set of abnormal behavior propagation path sequences of all source Internet Protocol address tags and destination Internet Protocol address tags in the interaction behavior sequence cluster, the method further includes: For each abnormal behavior propagation path sequence in the set of abnormal behavior propagation path sequences, path structure features are extracted, and the total number of Internet Protocol address tags contained in each abnormal behavior propagation path sequence is counted as the path length feature. Obtain the joint embedding feature vector of the interaction behavior time sequence chain between adjacent Internet Protocol address tags in each abnormal behavior propagation path sequence, calculate the cosine similarity between adjacent joint embedding feature vectors, arrange all the calculated cosine similarities according to the path order, and generate a path similarity change curve. Peak detection processing is performed on the path similarity change curve to identify local maxima where the cosine similarity value exceeds a preset similarity peak value. The path position corresponding to the local maxima is recorded as a key turning point of the path. The path length feature of each abnormal behavior propagation path sequence is combined with the location of the key turning points of the path to generate the path structure feature descriptor of the abnormal behavior propagation path sequence. Based on the path structure feature descriptor, cluster analysis is performed on all abnormal behavior propagation path sequences in the abnormal behavior propagation path sequence set, and abnormal behavior propagation path sequences with similar path structure feature descriptors are divided into the same path structure cluster. For each path structure cluster, extract the source Internet Protocol address label set and the destination Internet Protocol address label set of all abnormal behavior propagation path sequences within the path structure cluster; Calculate the intersection of the source Internet Protocol address tag set and the destination Internet Protocol address tag set, and mark the Internet Protocol address tags in the intersection as the intra-cluster hub addresses of the path structure cluster; The total number of times each cluster hub address appears in the abnormal behavior propagation path sequence of its respective path structure cluster is counted, and the total number of times is used as the cluster importance weight of the cluster hub address; The cluster identifier of each path structure cluster is associated with and stored with the corresponding intra-cluster hub address and the intra-cluster importance weight of the intra-cluster hub address to generate an abnormal behavior propagation path structure feature library.

10. An abnormal behavior detection system for communication information streams, characterized in that, The method includes a processor and a computer-readable storage medium storing machine-executable instructions that, when executed by the processor, implement the abnormal behavior detection method for communication information flow as described in any one of claims 1-9.

Images