AI quantification method for representing malicious behavior monitoring and storage medium

Abstract

The application belongs to the field of network security and is an AI quantification characterization malicious behavior monitoring method and storage medium, comprising: S1: training a light monitoring model based on a convolutional neural network according to historical behavior log data; S2: capturing system behavior data and inputting the light monitoring model for filtering; S3: diverting normal behavior to next period monitoring and diverting abnormal behavior to high-precision monitoring; S4: generating a plurality of high-dimensional feature vectors for abnormal behavior and entering a feature channel distribution module for distribution; S5: dynamically managing the feature channel management module according to the use of the feature channel; S6: performing principal component analysis dimension reduction on the high-dimensional feature vector; S7: completing prediction and risk assessment of potential malicious behavior according to the reduced feature; S8: calculating the statistical quantity corresponding to the risk assessment result and generating a high-dimensional feature vector update amount; S9: incrementally updating the high-dimensional feature vector update amount.

Description

Technical Field

[0001] This invention belongs to the field of cybersecurity, specifically an AI-based quantitative characterization method for monitoring malicious behavior and its storage medium. Background Technology

[0002] With the rapid development of computer technology, a large number of business scenarios have shifted from offline to online, resulting in the aggregation of massive amounts of information. To uncover potential value, big data analytics has been widely applied in many fields. At the same time, the aggregation of massive amounts of data has also led to the expansion of the system's attack surface, making the system face greater information security risks. To protect the healthy development of data, malicious behavior monitoring mechanisms have been widely used in the field of cybersecurity.

[0003] Malicious behavior monitoring mechanisms analyze behavioral data generated during system operation. To improve the accuracy of malicious behavior identification, comprehensive behavioral data is needed. Existing monitoring mechanisms often extract data from single behaviors or from behavioral data acquired across multiple systems and scenarios. With the continuous development of the Internet, system behavioral data has reached the zettabyte (ZB) level. Under such massive amounts of behavioral data, existing monitoring mechanisms place excessive demands on computing power and other resources, and cannot comprehensively collect feature indicators, increasing the difficulty of subsequent data analysis and training. Furthermore, during system evolution, new malicious behaviors or changes in the weights of malicious behaviors cannot be updated and learned in real time by existing systems, resulting in poor timeliness.

[0004] In summary, abnormal behavior monitoring based on behavioral data has been widely used due to its effectiveness against both known and unknown attack methods. However, when faced with massive malicious behavior datasets, existing monitoring mechanisms suffer from insufficient utilization of computing resources, resulting in poor monitoring timeliness and inadequate performance. Summary of the Invention

[0005] This invention proposes an AI-based quantitative characterization method for monitoring malicious behavior and a storage medium.

[0006] A method for monitoring malicious behavior using AI-based quantitative representation includes a hierarchical monitoring architecture. The first layer is a lightweight CNN model that quickly filters real-time captured behavioral data, classifying behaviors into normal and suspected abnormal behaviors. The second layer is a high-precision Transformer quantization model that performs in-depth analysis and feature extraction only on the filtered suspected abnormal data. The specific steps include: S1: A lightweight monitoring model based on a convolutional neural network is trained based on historical behavior log data; S2: Real-time capture of system behavior data, input into a lightweight monitoring model for filtering; S3: Normal behavior will be diverted to the next monitoring cycle, while abnormal behavior will be diverted to the high-precision monitoring stage; S4: Generate several high-dimensional feature vectors for the abnormal behaviors that are diverted, and then allocate them to the feature channel allocation module; S5: The feature channel management module dynamically manages the feature channels based on their usage. S6: Perform principal component analysis to reduce the dimensionality of high-dimensional feature vectors; S7: Based on the reduced-dimensional features, complete the prediction and risk assessment of potential malicious behavior; S8: Calculate the statistics corresponding to the risk assessment results and generate high-dimensional feature vector update quantities; S9: Incrementally update the high-dimensional feature vector while retaining historical update data.

[0007] Preferably, training the lightweight monitoring model in S1 includes: S11: Construct a behavioral feature dataset containing normal and abnormal behaviors based on historical behavior log data; S12: Perform feature engineering on the dataset, including missing value imputation, removal of redundant attributes, and elimination of low-relevance features. S13: Divide the processed dataset into training and validation sets to train and filter the model, resulting in a lightweight model with classification capabilities.

[0008] Preferably, the convolutional neural network model in S1 uses a amplitude-limited linear unit as the activation function to constrain the output range of the feature vector within a preset range, so as to adapt to the input requirements of the subsequent quantization model. The model compares the predicted value with the actual value and calculates the prediction error using a weighted mean square error. When the error between the actual value and the predicted value exceeds a preset threshold, it is determined to be abnormal.

[0009] Preferably, in step S4, a variety of high-dimensional feature vectors are generated, including time-series features, correlation features, attribute features, multi-account features, high-dimensional behavioral feature maps, and multi-source intelligence features. The feature channel allocation module initializes the high-precision Transformer quantization model and automatically adapts different types of feature inputs to the corresponding feature channels during the inference phase.

[0010] Preferably, the operation of the feature channel management module in S5 includes: S51: Configure a dynamic feature channel pool based on the data scale; S52: Dynamically adjust the usage ratio of feature channels based on actual usage; S53: When different types of feature data enter, it will automatically adapt to the corresponding feature channel; S54: A shared weight network is used among the feature channels; S55: Freeze unused feature channels first, and then unfreeze and use them in training when the amount of data increases.

[0011] Preferably, the specific operation of principal component analysis dimensionality reduction in S6 is as follows: S61: Obtain a high-dimensional feature vector dataset and perform standardization to eliminate the influence of dimensions; S62: Calculate the correlation coefficient matrix between each feature, and solve for the eigenvalues ​​and eigenvectors of the matrix; S63: Select eigenvectors as principal components according to the magnitude of eigenvalues ​​to generate orthogonal matrices; S64: Project the original data onto the principal component space to obtain dimensionality-reduced data; S65: Verify the information retention rate by comparing the reconstructed data with the original data based on the error.

[0012] Preferably, the potential malicious behavior prediction and risk assessment in S7 includes: S71: Use logistic regression to predict malicious ratings and generate a list of anomalous behaviors; S72: Based on the list of abnormal behaviors, a risk score is given for potential malicious behaviors. The risk score comprehensively considers the degree of deviation between the frequency of occurrence of the behavior in preset short-term and long-term time windows and the historical baseline. S73: Trigger an alert by comparing the risk score with a preset threshold.

[0013] Preferably, the statistical calculation in S8 specifically includes: S81: Initialize the mean and variance of the abnormal behavior characteristics; S82: Obtain newly added abnormal behavior data and update the sample mean and variance using streaming computation methods; S83: Calculate a standard score based on the updated mean and variance, the standard score being used to measure the degree to which sample feature values ​​deviate from the overall mean; S84: Calculate the weights and update the gradient based on the standard scores, and generate a high-dimensional feature vector update.

[0014] Preferably, the incremental update of the high-dimensional feature vector update amount in S9 includes: S91: Update the weight coefficients in the high-dimensional vector based on the update gradient; S92: While updating the weights, retain the updated data from multiple historical periods and store it in the historical training library; S93: The updated data is used for model performance backtracking calculations or for correlation analysis with multi-source intelligence data.

[0015] The present invention also discloses a storage medium storing a computer program that can be executed by a processor, characterized in that the computer program, when executed, implements the above-mentioned AI quantitative characterization method for monitoring malicious behavior.

[0016] The present invention has the following beneficial effects: 1. This invention adopts a hierarchical monitoring architecture, uses a convolutional neural network to quickly filter behavioral data with a filtering efficiency of ≥90%, and then uses a high-precision Transformer quantization hierarchical model to process only suspected abnormal data, generating multiple high-dimensional feature vectors, realizing feature fusion and incremental feature updates, and solving the problems of high system resource consumption and low monitoring accuracy of monitoring methods based on massive behavioral data.

[0017] 2. This invention employs PCA feature dimensionality reduction and incremental update mechanism to reduce the dimensionality of high-dimensional features while retaining the update channel for incremental features. This solves the problems of high system resource consumption and low monitoring accuracy in monitoring methods based on massive behavioral data.

[0018] 3. This invention is equipped with a dynamic computing power allocation module, which adjusts the computing power allocation ratio of the high-precision model according to the amount of real-time suspected abnormal data. At the same time, a multi-feature channel management module is introduced to call the corresponding feature channels according to different scenario requirements, thereby improving algorithm efficiency. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the steps of an AI-based quantitative characterization method for monitoring malicious behavior, as described in this invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly described below in conjunction with the examples.

[0021] Example 1 like Figure 1 As shown, this invention provides an AI-based quantitative characterization method and storage medium for monitoring malicious behavior, addressing the problems of high system resource consumption and low monitoring accuracy inherent in monitoring methods based on massive behavioral data. Based on a lightweight model, this invention filters out suspected abnormal data and then uses a deep quantification model for feature extraction to achieve comprehensive analysis. Specifically, it includes the following: A hierarchical monitoring architecture is adopted. The first layer is a lightweight CNN model that quickly filters behavioral data, classifying behaviors into normal and suspected abnormal categories with a filtering efficiency of ≥90%. The second layer is a high-precision Transformer quantization model that performs in-depth analysis only on suspected abnormal data to generate quantized feature vectors.

[0022] The feature channel management module adjusts the computing power allocation ratio of the high-precision model based on the amount of real-time suspected abnormal data.

[0023] An AI-based quantitative characterization method for monitoring malicious behavior, provided in this embodiment of the invention, includes the following steps: Step 1: Train a lightweight monitoring model based on a convolutional neural network using historical behavior log data; Step 2: Capture system behavior data in real time and input it into a lightweight monitoring model for filtering; Step 3: After filtering, normal behavior is divided into those entering the next monitoring cycle, and abnormal behavior is entered into high-precision monitoring; Step 4: Generate multiple high-dimensional feature vectors and allocate them in the feature channel allocation module; Step 5: The feature channel management module dynamically allocates features based on their usage. Step 6: Perform PCA dimensionality reduction on various high-dimensional feature vectors; Step 7: Based on the features after dimensionality reduction using various PCA methods, predict and assess potential malicious behavior to obtain a scoring vector; Step 8: Calculate the mean and variance of the scoring vector to generate a high-dimensional feature vector update. Step 9: Incrementally update the high-dimensional feature vector while retaining the update data from multiple periods ago.

[0024] In this embodiment of the invention, the specific operation in step 1 is as follows: 1. Obtain a behavioral feature dataset based on historical behavior log data, the dataset including normal behavior and abnormal behavior; 2. Perform feature engineering on behavioral feature data, including missing value imputation, removal of redundant attributes, and elimination of low-relevance features; 3. Divide the behavioral feature data into training and validation sets to train the lightweight model; 4. Use the validation set to select the lightweight model with the most suitable weight parameters; 5. Sort the lightweight models according to their performance metrics.

[0025] Specifically, the convolutional neural network uses clipped ReLU as the activation function, as shown in the following formula:

[0026] in: The final output of the activation function, The input value for the activation function (the output feature of the previous layer of the network). is a natural constant (value ≈ 2.71828); this formula constrains the output range of the neural network's feature vectors to... This avoids feature value overflow and adapts to the input requirements of subsequent quantization models.

[0027] The linear mapping model obtained in step 1 can be expressed as:

[0028] in: The final behavioral feature anomaly score is output by the model. For model bias terms, For the first The weight coefficients corresponding to the dimensional behavioral features The first of the input behavioral feature vectors One element, This represents the total number of dimensions of the input behavioral features.

[0029] The lightweight model compares the predicted value with the actual value and calculates the prediction error using a weighted mean square error, as shown in the following formula:

[0030] in: This represents the error loss value predicted by the model. The total number of dimensions of the input behavioral features. For the first The weight coefficients corresponding to the dimensional features For the first The true labeled values ​​of the behavioral features (normal behavior is labeled as 0, and abnormal behavior is labeled as 1). For the model to the first The predicted value of the dimensional feature; when the error between the actual value and the predicted value... If the threshold is exceeded, it is considered abnormal.

[0031] In this embodiment of the invention, step 2 specifically involves the following steps: 1. For the behavioral data in step 2, filter it using PCA dimensionality reduction or manual methods; 2. Input the data into the lightweight monitoring model for anomaly classification; 3. Classify behaviors that are normal and proceed to the next monitoring cycle; 4. Incorporate abnormal classification behaviors into high-precision monitoring.

[0032] In this embodiment of the invention, step 4 specifically involves the following steps: 1. The high-precision Transformer quantization model is initialized using the feature channel management module; 2. During the training phase, the number of feature channels is configured according to the size of the dataset, and the fusion mechanism for multiple types of features is set at the algorithm level. 3. Inference stage: For different feature inputs, feature channels are automatically adapted for feature fusion.

[0033] In this embodiment of the invention, step 4 generates a variety of high-dimensional features, including: 1. temporal features; 2. association features; 3. attribute features; 4. multi-account features; 5. high-dimensional behavioral feature map; and 6. multi-source intelligence features.

[0034] In this embodiment of the invention, the specific working process of the feature channel management module in step 5 is as follows: 1. Configure a dynamic feature channel pool according to the data scale; 2. Dynamically adjust the usage ratio of feature channels according to actual usage; 3. When different types of feature data enter, automatically adapt to the corresponding feature channels; 4. Feature channels adopt a shared weight sharing network; 5. For unused feature channels in the input data, freeze them first and do not train them. When the data volume increases, unfreeze them and participate in training.

[0035] In this embodiment of the invention, the specific operation of PCA dimensionality reduction in step 6 is as follows: 1. Obtain the high-dimensional feature vector dataset from the feature channels. Each data point in the dataset is... OK Columns; each sample, each row Each data point represents a different time series indicator. A continuous time series data Group index vector, The group of index vectors forms a vector matrix; 2. Standardize the dataset by performing a standard transformation according to the formula:

[0036] in: These are the standardized eigenvalues. For the first One sample Time steps down The raw data for each indicator For the first The average value of each indicator across the entire dataset. For the first The standard deviation of each indicator on the full dataset; after standardization, the mean of all features is 0 and the variance is 1, eliminating the influence of the units on PCA dimensionality reduction.

[0037] 3. After obtaining the standardized data, calculate the Pearson correlation coefficient matrix between each feature, as shown in the following formula:

[0038] in: The first in the correlation coefficient matrix Line number The elements of the column represent the first element. The first indicator and the first The Pearson correlation coefficients among the indicators range from [value missing]. The closer the absolute value is to 1, the stronger the linear correlation between the two indicators. The total number of samples involved in the calculation. For the first The first sample The standardized value of each indicator, For the first The first sample The standardized value of each indicator, , The first , The average value of each indicator; in this embodiment That is, the total number of feature indicators is 6.

[0039] 4. Calculate the matrix The eigenvectors and eigenvalues ​​are identified; the eigenvectors are sorted from largest to smallest according to their corresponding eigenvalues, and a certain number of vectors are selected as principal components to generate an orthogonal matrix. ; 5. Project the original sample data and perform a linear transformation to obtain the dimensionality-reduced data, as shown in the following formula:

[0040] in: The sample data matrix after dimensionality reduction has a dimension of . ( The total number of samples, (Number of principal components selected). The standardized original sample data matrix has dimensions of . ( (Total dimension of original features). The matrix of orthogonal eigenvectors corresponding to the selected principal components has dimensions of . .

[0041] 6. After obtaining the dimensionality-reduced data, perform linear reconstruction; 7. After obtaining the dimensionality-reduced sample data, perform sample reconstruction to obtain the reconstructed data, as shown in the following formula:

[0042] in: The reconstructed original dimension sample data matrix, the dimensions and the original matrix completely consistent; This is the dimensionality-reduced sample data matrix; Eigenvector matrix The transpose of the matrix; The reconstructed first The j-th data in the column vector, Representation matrix The Okay; the information retention rate of PCA dimensionality reduction can be verified by the reconstruction error. In this scheme, the information retention rate of principal components is ≥95%.

[0043] In this embodiment of the invention, the specific operations for predicting potential malicious behavior and assessing risks in step 7 are as follows: 1. Use logistic regression to predict malicious ratings, rank the prediction results, and obtain the range of predicted values. Inside, predicted value And the score corresponding to each predicted value, which is provided by the model itself; 2. Based on the predicted value And the predicted malicious rating value from the rating value. The malicious scores are sorted in the system to obtain a list of abnormal behaviors; 3. Assess the risk of potential malicious behavior based on the list of abnormal behaviors; 4. The risk scoring method is the risk scoring formula:

[0044] in: The final output is a behavioral risk score. A higher score indicates a greater risk of malicious intent. There is no fixed upper limit, and the empirical range for typical scenarios is [insert range here]. ; This refers to the actual number of times this behavior occurred in the past 24 hours; This is the median number of times this behavior occurred each day over the past 60 days; that is, the middle value after sorting the number of occurrences of all behavior samples over the past 60 days. The percentage of the occurrences of this behavior in the past 24 hours relative to the 90th percentile of its occurrences in the past 60 days is defined as the value at the top 90th percentile after sorting the occurrences of all behavior samples over the past 60 days. In this embodiment... The value is 10; The percentage of the occurrences of this behavior in the past 24 hours relative to the 80th percentile of its occurrences in the past 7 days is defined as the value at the top 80th percentile after sorting the occurrences of all behavior samples in the past 7 days. In this embodiment... The value is 20; in this embodiment The value is 20; the denominator in the formula This is used to avoid division by zero errors when the median is 0.

[0045] 5. Threshold control and early warning alerts; 6. Set risk thresholds Risk threshold As an empirical threshold, when If the risk level exceeds the risk threshold, the system will issue a warning.

[0046] In this embodiment of the invention, step 8 specifically involves the following steps: 1. Initialize the mean and variance of the abnormal behavior data, calculated using the following formula:

[0047]

[0048] in: The mean of the abnormal behavior sample features during the initialization phase. The unbiased variance of the abnormal behavior sample features during the initialization phase; This represents the total number of abnormal behavior samples during the initialization phase. For the first The feature values ​​of the abnormal behavior samples are calculated using unbiased variance, which conforms to statistical standards and avoids the problem of underestimation of variance in small samples.

[0049] 2. Obtain the updated abnormal behavior data and calculate the updated sample mean and variance:

[0050]

[0051] in: This represents the mean of the sample features after incremental updates. The incrementally updated sample features are free of biased variance. This represents the total number of newly added batches of samples exhibiting abnormal behavior. The feature mean of the newly added batch of samples, The formula provides unbiased variance for the features of newly added batches of samples; it enables streaming incremental calculation without reloading all historical data, significantly improving update efficiency.

[0052] 3. Calculate the standard score Z-score:

[0053] in: Z-score is a standardized score used to measure the degree to which a single sample feature value deviates from the overall mean. It has no fixed range and the absolute value of a typical outlier sample is ≥3. This represents the mean of the sample features after incremental updates. This represents the standard deviation of the sample features after incremental updates.

[0054] 4. Calculate the corresponding update gradient based on the standard score, using the following formula:

[0055] in: Update the gradient for the weights in the current iteration step. The weight values ​​before the update. The iteration step size (learning rate) has a range of values. The default value for this solution is 0.001. The Z-score is the corresponding feature score; this formula implements adaptive gradient updates based on the degree of anomaly, with a larger adjustment range for weights as the degree of anomaly increases.

[0056] 5. Update the weight coefficients in the high-dimensional vector according to the updated gradient, using the following formula:

[0057] in: The updated weight values, The weight values ​​before the update. Update the gradient for the weights calculated in the current iteration step.

[0058] In this embodiment of the invention, step 9 specifically involves the following steps: 1. While updating high-dimensional vector values, retain update data from multiple periods ago; 2. Update the data and store it in the historical training database for use in updating gradient calculations; 3. Calculate updated data for any time period according to computational requirements; 4. Updated data can be used independently or correlated with multi-source intelligence data for analysis.

[0059] Example 2 The technical features that distinguish this embodiment from Embodiment 1 are as follows: The AI-based quantitative characterization method for malicious behavior monitoring employed in this embodiment adopts a layered monitoring architecture. The first layer is a lightweight CNN model that quickly filters behavioral data, classifying behaviors into normal and suspected abnormal categories, with a filtering efficiency of ≥90%. The second layer is a high-precision Transformer quantization model that performs in-depth analysis only on suspected abnormal data, generating quantized feature vectors. The method uses a combination of PCA feature dimensionality reduction and incremental update mechanisms to reduce the dimensionality of high-dimensional features while retaining the update channel for incremental features. The method is configured with a dynamic computing power scheduling module to adjust the computing power allocation ratio of the high-precision model based on the real-time volume of suspected abnormal data. The method is also configured with a feature channel management module to realize the dynamic allocation and management of feature channels.

[0060] The method specifically includes the following steps: Step 1: Train a lightweight monitoring model based on a convolutional neural network using historical behavior log data; Step 2: Capture system behavior data in real time and input it into a lightweight monitoring model for filtering; Step 3: Normal behavior proceeds to the next monitoring cycle; abnormal behavior proceeds to high-precision monitoring. Step 4: Generate multiple high-dimensional feature vectors and allocate them in the feature channel allocation module; Step 5: The feature channel management module dynamically allocates features based on their usage. Step 6: Perform PCA dimensionality reduction on various high-dimensional feature vectors; Step 7: Based on the features after dimensionality reduction using various PCA methods, predict and assess potential malicious behavior to obtain a scoring vector; Step 8: Calculate the mean and variance of the scoring vector to generate a high-dimensional feature vector update. Step 9: Incrementally update the high-dimensional feature vector while retaining the update data from multiple periods ago.

[0061] This embodiment is a complete engineering implementation of the AI-based quantitative characterization method for monitoring malicious behavior. It fully executes all the steps of the aforementioned combined technical methods to achieve full-process monitoring and quantitative characterization of malicious behavior in the system.

[0062] First, perform step 1: train a lightweight monitoring model based on a convolutional neural network using historical behavior log data.

[0063] The historical behavior log data includes, but is not limited to: system process startup logs, file access logs, network connection logs, registry modification logs, user account login logs, and command line execution logs; the behavior feature dataset corresponding to the historical behavior log data includes normal behavior samples and abnormal behavior samples, with normal behavior samples accounting for no less than 95% and abnormal behavior samples covering known malicious behavior types.

[0064] The specific execution process of step 1 includes five sub-processes: constructing the behavioral feature dataset, feature engineering processing, dataset partitioning, model training, and model selection and ranking.

[0065] The behavioral feature dataset construction sub-process extracts feature dimensions related to system behavior based on collected historical behavior log data. Each feature dimension corresponds to a quantifiable behavioral indicator in the log, and the total number of feature dimensions is denoted as . Each behavioral sample corresponds to a set The feature vector is dimensional, and a label is added to each behavior sample. The label of normal behavior sample is 0, and the label of abnormal behavior sample is 1.

[0066] The feature engineering subprocess preprocesses the constructed behavioral feature dataset. Preprocessing operations include, but are not limited to, missing value imputation, deletion of redundant attributes, and removal of low-relevance features.

[0067] (1) Missing value imputation adopts the imputation method based on the mean of samples with the same label. For missing values ​​under a certain feature dimension, the mean of all non-missing samples with the same label under that feature dimension is used to imput them, so as to ensure that the data distribution after imputation is consistent with the original data distribution.

[0068] (2) Redundant attributes are removed by using a variance threshold-based screening method. The variance of all samples under each feature dimension is calculated, and feature dimensions with variances lower than the preset variance threshold are removed to eliminate redundant attributes with no distinguishing power.

[0069] (3) Eliminating low-relevance features: The screening method based on Pearson correlation coefficient is adopted. The Pearson correlation coefficient between each feature dimension and the sample label is calculated. Feature dimensions with an absolute value of correlation coefficient lower than the preset correlation coefficient threshold are eliminated, and features with higher correlation to malicious behavior are retained.

[0070] The dataset partitioning process divides the behavioral feature dataset after feature engineering into a training set and a validation set according to a preset ratio. The training set is used for parameter training of the lightweight monitoring model, and the validation set is used for performance verification and parameter selection of the model after training. The preset ratio includes, but is not limited to, 8:2 and 7:3.

[0071] The model training sub-process inputs the behavioral feature data of the training set into the TensorFlow framework to train the convolutional neural network. The convolutional neural network consists of convolutional layers, pooling layers, and fully connected layers, resulting in a lightweight model with binary classification capabilities.

[0072] The convolutional neural network adopts a 1D convolutional structure to adapt to the input of a one-dimensional behavioral feature vector. The kernel size of the convolutional layer is not limited to 3 or 5, and the stride of the convolutional layer is not limited to 1 or 2. The pooling layer adopts max pooling, and the kernel size is not limited to 2. The stride of the pooling layer is not limited to 2. The output dimension of the fully connected layer matches the feature dimension of the input. Finally, the output layer adopts the sigmoid activation function and outputs a classification probability value between 0 and 1.

[0073] The hidden layers of the convolutional neural network use ReLU as the activation function, as shown in the following formula:

[0074] Wherein: This formula is a limited ReLU activation function adapted to the output range constraints of this scheme, and the expression of the basic ReLU activation function is: It can only achieve one-sided negative value suppression, which cannot meet the requirement that the output range of the neural network feature vector in this scheme is... Due to constraints, upper and lower limit operations are added to the basic ReLU function to achieve this. The operation limits the maximum output value to 1. ,pass The operation limits the minimum output value to 0. Ultimately, this achieves precise constraints on the output range.

[0075] In the formula, The final output of the activation function, The input values ​​to the activation function are the output features of the previous layer of the network. It is a natural constant with a value of approximately 2.71828.

[0076] After the convolutional neural network is trained, the final linear mapping model can be represented as:

[0077] Wherein: This formula is the final linear mapping expression of the lightweight monitoring model, used to output anomaly scores for behavioral features.

[0078] In the formula, The final behavioral feature anomaly score is output by the model. For model bias terms, For the first The weight coefficients corresponding to the dimensional behavioral features The first of the input behavioral feature vectors One element, This represents the total number of dimensions of the input behavioral features.

[0079] The lightweight model compares the predicted value with the actual value and calculates the prediction error using a weighted mean square error, as shown in the following formula:

[0080] Where: This formula is the weighted mean squared error loss function, and the expression for the basic mean squared error loss function is: To accommodate the varying contributions of different feature dimensions to malicious behavior in this scheme, a weighting coefficient is added to the basic mean squared error. Higher weights are assigned to feature dimensions that are more relevant to malicious behavior, thereby improving the accuracy of error calculation.

[0081] In the formula, This represents the error loss value predicted by the model. The total number of dimensions of the input behavioral features. For the first The weight coefficients corresponding to the dimensional features For the first The true labeled values ​​for behavioral features: 0 for normal behavior and 1 for abnormal behavior. For the model to the first The predicted value of the dimensional feature; when the error between the actual value and the predicted value... If the threshold is exceeded, it is considered abnormal.

[0082] The model selection and ranking sub-process uses a validation set to verify the performance of multiple trained lightweight models, selects the model with the most suitable weight parameters, and ranks the models according to performance metrics, including but not limited to: classification accuracy, recall, precision, and inference latency.

[0083] Among them, the core indicator for model selection is filtering efficiency. The selected lightweight models have a filtering efficiency of ≥90% for normal behavior, ensuring that the vast majority of normal behavior can be quickly diverted, reducing the computing power consumption of subsequent high-precision monitoring links.

[0084] Based on the lightweight monitoring model trained in step 1 above, step 2 is executed: real-time capture of system behavior data is input into the lightweight monitoring model for filtering.

[0085] In step 2, the feature dimensions of the system behavior data captured in real time are completely matched with the feature dimensions of the behavior feature dataset used for training the lightweight monitoring model in step 1, ensuring the consistency of the model input and avoiding model inference anomalies caused by feature dimension mismatch.

[0086] Step 2 specifically includes three sub-processes: real-time capture of behavioral data, feature selection, and model inference classification.

[0087] The real-time behavior data capture sub-process collects all behavior data generated during system operation in real time through behavior capture hooks in the system kernel. The types of behavior data collected are completely consistent with the types of historical behavior log data in step 1, including but not limited to: system process startup data, file access data, network connection data, registry modification data, user account login data, and command line execution data. The collected behavior data is aggregated according to preset time windows, with each time window corresponding to a behavior sample. The length of the time window includes but is not limited to 1 minute, 5 minutes, and 10 minutes.

[0088] The feature selection sub-process performs feature selection on the real-time captured and aggregated behavioral data through PCA dimensionality reduction or manual methods. The selected feature dimensions are completely consistent with the input dimensions of the lightweight monitoring model, ensuring that the model can perform inference normally.

[0089] The model inference and classification sub-process inputs the real-time behavior data, after feature filtering, into the lightweight monitoring model for anomaly classification. The model outputs the prediction error loss value for each behavior sample. It then performs a binary classification decision based on a preset error threshold.

[0090] Based on the classification results obtained in step 2 above, step 3 is executed: normal behavior enters the next cycle of monitoring; abnormal behavior enters high-precision monitoring.

[0091] In step 3, for the behavioral samples obtained by model inference in step 2, if their prediction error loss value... If the error does not exceed the preset error threshold, it is determined to be normal behavior. This normal behavior sample will not enter the subsequent high-precision monitoring stage and will directly enter the behavior data capture and filtering process of the next monitoring cycle; if its prediction error loss value If the error exceeds the preset error threshold, it is judged as a suspected abnormal behavior. The suspected abnormal behavior sample enters the subsequent high-precision monitoring stage. At the same time, the computing power dynamic scheduling module counts the amount of suspected abnormal data entering the high-precision monitoring stage in real time. Based on the real-time suspected abnormal data volume, the computing power allocation ratio of the high-precision Transformer quantization model is adjusted. When the suspected abnormal data volume increases, the computing power allocation ratio of the high-precision model is increased; when the suspected abnormal data volume decreases, the computing power allocation ratio of the high-precision model is decreased, thereby realizing the dynamic optimization and allocation of computing power resources.

[0092] For the suspected abnormal behavior data obtained in step 3 above, step 4 is executed: generate multiple high-dimensional feature vectors and allocate them to the feature channel allocation module.

[0093] The various high-dimensional features generated in step 4 include, but are not limited to: time-series features, correlation features, attribute features, multi-account features, high-dimensional behavioral feature maps, and multi-source intelligence features. Each type of feature corresponds to an independent feature dimension group, and each feature dimension group contains multiple sub-feature dimensions. All feature dimension groups together constitute a high-dimensional feature vector.

[0094] Among them, temporal features are features extracted based on the time sequence of behavior occurrence, including but not limited to: frequency of behavior occurrence, time interval of behavior occurrence, periodicity of behavior occurrence, and time series trend of behavior occurrence; correlation features are features extracted based on the correlation between different behaviors, including but not limited to: process and file access correlation, process and network connection correlation, and account and operation behavior correlation; attribute features are features extracted based on the inherent attributes of the behavior subject, including but not limited to: process signature attributes, file permission attributes, network connection address attributes, and account permission attributes; multi-account features are features extracted based on the behavioral correlation between multiple accounts, including but not limited to: multi-account operation coordination, multi-account login address correlation, and multi-account behavioral pattern similarity; high-dimensional behavioral feature graph is a graph structure feature constructed based on the correlation between the behavior subject and the behavior object, including but not limited to: node features, edge features, and graph topology features; multi-source intelligence features are features extracted based on external threat intelligence data, including but not limited to: malicious IP address matching features, malicious domain name matching features, and malicious file hash matching features.

[0095] Step 4 specifically includes three sub-processes: high-precision model initialization, high-dimensional feature generation, and feature channel allocation.

[0096] The high-precision model initialization sub-process uses the feature channel management module to initialize the high-precision Transformer quantization model. The initialization content includes, but is not limited to: the number of Transformer encoder layers, the number of attention heads, the total number of feature channel pools, and the quantization bit width parameter. In this embodiment, the high-precision Transformer quantization model adopts the INT4 quantization method, which significantly reduces the model's memory usage and inference latency while ensuring the model's inference accuracy.

[0097] The high-dimensional feature generation subprocess extracts the aforementioned six types of high-dimensional features from the input suspected abnormal behavior data and generates corresponding high-dimensional feature vectors. Each type of feature corresponds to an independent feature vector, and all feature vectors together constitute a high-dimensional feature vector set.

[0098] The feature channel allocation sub-process inputs the generated high-dimensional feature vectors into the feature channel allocation module, which then completes the matching and allocation of features and feature channels, providing a foundation for subsequent dynamic management of feature channels.

[0099] Based on the high-dimensional feature vector and feature channel mapping relationship allocated in step 4 above, step 5 is executed: the feature channel management module dynamically allocates features according to their usage.

[0100] Step 5 specifically includes five sub-processes: feature channel pool configuration, dynamic adjustment of channel usage ratio, automatic feature channel adaptation, execution of weight sharing mechanism, and channel freezing and unfreezing.

[0101] The feature channel pool configuration sub-process configures a dynamic feature channel pool based on the scale of the input suspected abnormal behavior data. The total number of channels in the feature channel pool matches the total number of high-dimensional feature types. Each feature channel corresponds to one type of high-dimensional feature, and the total number of channels can be dynamically adjusted according to the data scale.

[0102] The channel usage ratio dynamic adjustment sub-process: The feature channel management module counts the actual usage frequency and data processing volume of each feature channel in real time. Based on the actual usage, it dynamically adjusts the computing power resource allocation ratio and feature fusion weight of each feature channel. For feature channels with higher usage frequency and larger data processing volume, more computing power resources and higher fusion weight are allocated. For feature channels with lower usage frequency and smaller data processing volume, less computing power resources and lower fusion weight are allocated.

[0103] The automatic feature channel adaptation sub-process ensures that when different types of feature data enter the feature channel management module, the module automatically adapts the feature data to the corresponding feature channel based on the feature type label, thus ensuring that different types of feature data are processed in their respective dedicated channels and avoiding mutual interference between different types of features.

[0104] The weight-sharing mechanism executes a sub-process where all feature channels use a shared weight-sharing network. The weight parameters of the bottom-level feature extraction network of each feature channel are shared among all channels, while the weight parameters of the top-level feature adaptation network are set independently for each channel. This significantly reduces the number of model parameters and lowers the training and inference costs of the model while ensuring the adaptability of different types of features.

[0105] The channel freezing and unfreezing sub-process involves freezing the weight parameters of unused feature channels in the input data, preventing them from being trained and updated, thus reducing unnecessary computational power consumption. When the amount of input feature data increases and it is necessary to enable the unused feature channel, the module unfreezes the weight parameters of the channel, allowing it to participate in the model's training and inference process, thereby achieving elastic scaling of feature channels.

[0106] Based on the high-dimensional feature vectors processed by the feature channels in step 5 above, step 6 is executed: PCA dimensionality reduction is performed on the various high-dimensional feature vectors.

[0107] Step 6 specifically includes seven sub-processes: high-dimensional feature dataset construction, data standardization processing, correlation coefficient matrix calculation, eigenvalue and eigenvector solving, principal component selection and orthogonal matrix generation, data projection and dimensionality reduction, linear reconstruction and sample reconstruction.

[0108] The high-dimensional feature dataset construction sub-process obtains a high-dimensional feature vector dataset from the feature channels, where each data point in the dataset is... OK Columns; each sample, each row Each data point represents a different time series indicator. A continuous time series data Group index vector, The group of index vectors forms a vector matrix, where The total number of feature indicators. This represents the total number of time steps in the time series.

[0109] The data standardization sub-process standardizes the constructed high-dimensional feature vector dataset by performing a standard transformation according to the formula:

[0110] Wherein: This formula is the Z-score standardization formula, used to eliminate the dimensional differences between different feature indicators and avoid interference from different dimensions on the PCA dimensionality reduction results. The expression of the basic Z-score standardization formula is as follows: This solution is adapted for time-series 3D feature data, extending the formula to 3D data scenarios.

[0111] In the formula, These are the standardized eigenvalues. For the first One sample Time steps down The raw data for each indicator For the first The average value of each indicator across the entire dataset. For the first The standard deviation of each indicator on the full dataset; after standardization, the mean of all feature indicators is 0 and the variance is 1, completely eliminating the influence of dimensional differences.

[0112] The correlation coefficient matrix calculation sub-process, after obtaining standardized data, yields the Pearson correlation coefficient matrix between each feature, as shown in the following formula:

[0113] Wherein: This formula is the Pearson correlation coefficient calculation formula, which is used to measure the degree of linear correlation between two feature indicators and provides a basis for subsequent principal component analysis.

[0114] In the formula, The first in the correlation coefficient matrix Line number The elements of the column represent the first element. The first indicator and the first The Pearson correlation coefficients among the indicators range from [value missing]. The closer the absolute value is to 1, the stronger the linear correlation between the two indicators. The total number of samples involved in the calculation. For the first The first sample The standardized value of each indicator, For the first The first sample The standardized value of each indicator, , The first , The average value of each indicator.

[0115] The sub-process for solving eigenvalues ​​and eigenvectors, and the resulting correlation coefficient matrix Perform eigenvalue decomposition and calculate the matrix. The eigenvectors and their corresponding eigenvalues ​​are given. The magnitude of the eigenvalue represents the amount of original data information contained in the corresponding eigenvector. The larger the eigenvalue, the more information it contains.

[0116] The principal component selection and orthogonal matrix generation sub-process involves sorting the eigenvectors by their eigenvalues ​​from largest to smallest, selecting a certain number of eigenvectors as principal components, and generating an orthogonal matrix. The number of principal components selected is based on a cumulative information contribution rate of ≥95%, ensuring that the features after dimensionality reduction can retain the vast majority of effective information from the original data.

[0117] The data projection and dimensionality reduction sub-process projects the original sample data and performs a linear transformation to obtain the dimensionality-reduced data, as shown in the following formula:

[0118] Wherein: This formula is the core projection formula of PCA dimensionality reduction, which is used to project high-dimensional original data into low-dimensional principal component space to achieve feature dimensionality reduction.

[0119] In the formula, The sample data matrix after dimensionality reduction has a dimension of . ,in The total number of samples, The number of principal components selected; The standardized original sample data matrix has dimensions of . ,in This represents the total dimension of the original features; The matrix of orthogonal eigenvectors corresponding to the selected principal components has dimensions of . .

[0120] The linear reconstruction and sample reconstruction sub-processes, after obtaining the dimensionality-reduced data, perform linear reconstruction to complete the sample reconstruction and obtain the reconstructed data, as shown in the following formula:

[0121] Wherein: This formula is the PCA data reconstruction formula, which is used to remap the dimensionality-reduced low-dimensional data back to the original high-dimensional space. By calculating the error between the reconstructed data and the original data, the information retention rate of the dimensionality reduction process is verified.

[0122] In the formula, The reconstructed original dimension sample data matrix, the dimensions and the original matrix completely consistent; This is the dimensionality-reduced sample data matrix; Eigenvector matrix The transpose of the matrix; The reconstructed first The column vector of the first data, Representation matrix The OK, This represents the matrix transpose operation.

[0123] After the sample reconstruction is completed, the mean square error between the reconstructed data and the original data is calculated to verify the information retention rate of the dimensionality reduction process. The information retention rate is ensured to be ≥95%. If the information retention rate does not meet the preset standard, the number of principal components is increased and the dimensionality reduction and reconstruction process is repeated until the information retention rate requirement is met.

[0124] Based on the feature data after PCA dimensionality reduction in step 6 above, step 7 is executed: based on the features after PCA dimensionality reduction, the prediction and risk assessment of potential malicious behavior are completed, and a scoring vector is obtained.

[0125] Step 7 specifically includes four sub-processes: malicious scoring prediction, abnormal behavior list generation, risk score calculation, threshold control, and early warning alerts.

[0126] The malicious rating prediction sub-process uses logistic regression to predict malicious ratings. The feature data, after PCA dimensionality reduction, is used as input to the logistic regression model. The model outputs a predicted probability of malicious behavior for each behavior sample. The prediction results are then sorted to obtain the predicted values. And the score corresponding to each predicted value, where For the first The predicted probability of malicious behavior corresponding to each feature dimension, with a value range of [value range missing]. The score is the model's confidence score for the predicted value, and the value range is [value range missing]. .

[0127] The abnormal behavior list generation sub-process generates a predicted malicious score based on the predicted value and the score value. The system sorts the malicious ratings from largest to smallest to obtain a list of abnormal behaviors. The higher the malicious rating, the higher the likelihood of the behavior being malicious.

[0128] The risk scoring calculation sub-process scores potential malicious behaviors based on the list of abnormal behaviors. The risk scoring method uses the following risk scoring formula:

[0129] Wherein: This formula is a malicious behavior risk scoring formula adapted to this scheme, which comprehensively considers the long-term baseline level of behavior and the degree of short-term abnormal fluctuations, so as to achieve a quantitative assessment of malicious behavior risk.

[0130] In the formula, The final output is a behavioral risk score. A higher score indicates a greater risk of malicious intent. There is no fixed upper limit, and the empirical range for typical scenarios is [insert range here]. ; This refers to the actual number of times this behavior occurred in the past 24 hours; The median number of times the behavior occurred daily over the past 60 days is used to measure the long-term baseline level of the behavior. The percentage of the number of times the behavior occurred in the past 24 hours relative to the 90th percentile of the number of times it occurred in the past 60 days is used to measure the long-term abnormality of the behavior. The percentage of the frequency of this behavior in the past 24 hours relative to the 80th percentile of its frequency in the past 7 days is used to measure the short-term abnormality of the behavior; the denominator in the formula... This is used to avoid division by zero errors when the median is 0, ensuring the robustness of the formula.

[0131] Threshold control and early warning sub-process, setting risk threshold. Risk threshold As an empirical threshold, the recommended value range for typical scenarios is [value range missing]. When the calculation is obtained Greater than the risk threshold When this occurs, the system issues an early warning and marks the behavior sample as a high-risk malicious behavior, incorporating it into the subsequent incremental update dataset of the model.

[0132] Based on the scoring vector and risk assessment results obtained in step 7 above, step 8 is executed: calculate the mean and variance of the scoring vector to generate a high-dimensional feature vector update.

[0133] Step 8 specifically includes five sub-processes: statistic initialization, incremental statistic calculation, standard score calculation, gradient update calculation, and weight update generation.

[0134] The statistics initialization subroutine initializes the mean and variance of the abnormal behavior data, using the following formulas:

[0135]

[0136] Wherein: This formula is used to calculate the sample mean and unbiased sample variance, and is used to initialize the statistical distribution parameters of abnormal behavior characteristics. The mean of the abnormal behavior sample features during the initialization phase. The unbiased variance of the abnormal behavior sample features during the initialization phase; This represents the total number of abnormal behavior samples during the initialization phase. For the first The feature values ​​of each abnormal behavior sample are calculated using an unbiased variance method and divided by... Instead This conforms to statistical standards and avoids the problem of underestimation of variance in small sample scenarios.

[0137] The incremental statistics calculation sub-process obtains the updated abnormal behavior data and calculates the updated sample mean and variance, using the following formulas:

[0138]

[0139] This formula is for calculating the incremental mean and variance of streaming data. It does not require reloading all historical data. It can update the overall statistics based only on historical statistics and statistics of newly added batches, which greatly improves the efficiency of model updates.

[0140] In the formula, This represents the mean of the sample features after incremental updates. The incrementally updated sample features are free of biased variance. This represents the total number of newly added batches of samples exhibiting abnormal behavior. The feature mean of the newly added batch of samples, The features of the newly added batch of samples are unbiased variance.

[0141] The standard score calculation subroutine calculates the standard score Z-score using the following formula:

[0142] Wherein: This formula is the Z-score standard score calculation formula, which is used to measure the degree to which the feature value of a single sample deviates from the overall sample mean, and provides a basis for subsequent weight gradient updates.

[0143] In the formula, The Z-score is a standardized score with no fixed range; the absolute value of the score for a typical outlier sample is ≥3. This represents the mean of the sample features after incremental updates. This represents the standard deviation of the sample features after incremental updates.

[0144] The gradient update calculation sub-process calculates the corresponding update gradient based on the standard score, using the following formula:

[0145] Wherein: This formula is an adaptive gradient update formula based on the degree of anomaly. The higher the degree of anomaly, the larger the absolute value of the Z-score, and the larger the gradient of the weight update, so as to realize targeted weight adjustment for anomalous features.

[0146] In the formula, Update the gradient for the weights in the current iteration step. The weight values ​​before the update. The iteration step size, i.e., the learning rate, has a range of values. In this embodiment, the default value is 0.001. This represents the Z-score of the corresponding feature.

[0147] The weight update generation sub-process updates the weight coefficients in the high-dimensional vector based on the update gradient, generating the high-dimensional feature vector update amount. The formula is as follows:

[0148] Wherein: This formula is the weight coefficient update formula. Based on the calculated update gradient, the weight coefficient is iteratively updated to generate the final high-dimensional feature vector update amount.

[0149] In the formula, The updated weight values, The weight values ​​before the update. Update the gradient for the weights calculated in the current iteration step.

[0150] Based on the high-dimensional feature vector update amount generated in step 8 above, step 9 is executed: incrementally update the high-dimensional feature vector update amount, while retaining the update data from multiple periods ago.

[0151] Step 9 specifically includes four sub-processes: incremental update of weight parameters, storage of historical update data, backtracking calculation of update data, and multi-source data correlation analysis.

[0152] The incremental update sub-process for weight parameters updates the weight parameters of the high-precision Transformer quantization model and the lightweight monitoring model based on the update amount of the generated high-dimensional feature vector. This eliminates the need for full model retraining, adjusting only the weight parameters corresponding to the update amount, thereby enabling rapid iterative optimization of the model and improving its ability to identify new malicious behaviors.

[0153] The historical update data storage subprocess updates high-dimensional vector values ​​while retaining update data from multiple periods ago. The updated data is then stored in the historical training library, which can be used for subsequent gradient calculations, model performance backtracking, and feature weight change analysis.

[0154] The update data backtracking calculation subprocess calculates the update data for any time period based on the update data stored in the historical training library, according to the calculation requirements. This includes, but is not limited to: the amount of weight change within a specific time period, the weight update trend of a specific feature dimension, and the adjustment range of feature weights corresponding to a specific type of malicious behavior.

[0155] The multi-source data correlation analysis subprocess allows the stored updated data to be used independently or correlated with multi-source intelligence data. By combining external threat intelligence data, it analyzes the correlation between feature weight updates and emerging threats, thereby improving the model's ability to perceive unknown threats.

[0156] Example 3 The difference between this embodiment and Embodiment 1 is as follows: This embodiment is a practical application of the aforementioned AI-based quantitative characterization method for monitoring malicious behavior in an enterprise intranet terminal security protection scenario. It fully reuses all the technical features and steps of the combined technical method, and completes the engineering implementation for adaptability to the operating environment and security requirements of enterprise intranet terminals, thereby achieving real-time monitoring and quantitative evaluation of malicious behavior of all terminals on the enterprise intranet.

[0157] The application environment of this embodiment is an enterprise intranet office terminal cluster. The terminal cluster contains no less than 1,000 terminal devices. The operating systems of the terminal devices include, but are not limited to, Windows, Linux, and macOS. The total number of terminal behavior logs generated daily by the enterprise intranet is no less than 10 million, covering the operational behavior data of the entire life cycle of the terminals.

[0158] The execution flow of this embodiment is completely consistent with the combined technical method described above. First, the historical behavior data collection and lightweight monitoring model training process is executed, which corresponds to step 1 of the technical method.

[0159] The process involves collecting all historical behavior logs from the enterprise's intranet terminals over the past 90 days to construct a behavior feature dataset. The dataset contains no fewer than 1.2 million valid samples, including no fewer than 1.14 million normal behavior samples and no fewer than 60,000 abnormal behavior samples. The types of malicious behavior covered by the abnormal behavior samples include, but are not limited to: ransomware process startup behavior, batch access to sensitive files behavior, lateral movement network connection behavior, system registry tampering behavior, abnormal account login behavior, and malicious command line execution behavior.

[0160] Specifically, feature engineering is performed on the collected historical behavior log data to complete operations such as missing value imputation, redundant attribute deletion, and low-relevance feature removal, ultimately retaining the total number of behavioral feature dimensions. It has 32 dimensions, covering six major categories of core behavioral indicators: terminal processes, files, network, registry, accounts, and command lines.

[0161] The dataset, after feature engineering, was divided into training and validation sets in an 8:2 ratio. A lightweight 1D-CNN monitoring model was trained using the TensorFlow framework. The model structure includes two 1D convolutional layers, one max pooling layer, and two fully connected layers. The hidden layers use the aforementioned amplitude-limited ReLU activation function. After the model training was completed, the validation set was used to screen the models. The final lightweight monitoring model obtained by screening had a filtering efficiency of 92.75% for normal behavior, which meets the design requirement of ≥90%.

[0162] Based on the trained lightweight monitoring model, a real-time behavior data capture and filtering process is executed, corresponding to steps 2 and 3 of the technical method.

[0163] Among them, the kernel-mode acquisition plugin of the enterprise intranet terminal management system captures the running behavior data of all terminals in real time. The acquisition frequency is once every 10 seconds, and the behavior data is aggregated according to a 5-minute time window. One terminal behavior sample is generated for each time window, and the total number of behavior samples captured and aggregated in a single hour is no less than 8,000.

[0164] Specifically, feature filtering is performed on the aggregated behavior samples in real time to ensure that the feature dimensions perfectly match the input dimensions of the lightweight monitoring model. The processed behavior samples are then input into the lightweight monitoring model for inference and classification, and the model outputs the prediction error loss value for each sample. The preset error threshold is 0.3.

[0165] Among them, for the behavioral samples obtained through reasoning, if If the behavior is normal, the sample will directly enter the next monitoring cycle and will not enter the high-precision monitoring stage; if If the sample is identified as a suspected abnormal behavior, it will enter the high-precision monitoring stage. The number of suspected abnormal behavior samples obtained in a single hour is approximately 580, and the filtering efficiency meets the design requirements.

[0166] The computing power dynamic scheduling module counts the number of suspected abnormal samples entering the high-precision monitoring stage in real time. Based on the preset computing power scheduling strategy, it dynamically adjusts the computing power allocation ratio of the high-precision Transformer quantization model. When the number of suspected abnormal samples in a single hour exceeds 1,000, the computing power allocation ratio of the high-precision model is increased to 80%; when the number of suspected abnormal samples in a single hour is less than 200, the computing power allocation ratio of the high-precision model is reduced to 20%, thereby achieving dynamic optimization of computing power resources.

[0167] For the suspected abnormal behavior samples obtained from the diversion, a high-precision feature extraction and feature channel management process is performed, corresponding to steps 4 and 5 of the technical method.

[0168] For each suspected abnormal behavior sample, six types of high-dimensional features are extracted: time-series features, correlation features, attribute features, multi-account features, high-dimensional behavior feature map, and multi-source intelligence features. Each type of feature corresponds to a 16-dimensional feature vector, and the final generated high-dimensional feature vector has a total dimension of 96.

[0169] The feature channel management module initializes six independent feature channels, each corresponding to a type of high-dimensional feature. During the training phase, the feature fusion weights of each channel are configured according to the dataset size. During the inference phase, the system automatically adapts to the corresponding feature channel for processing based on the type of input feature. The channels share the weight parameters of the underlying feature extraction network. Unused channels remain frozen and are only unfrozen and participate in processing when the corresponding feature data is input.

[0170] For the high-dimensional feature vector after feature channel processing, perform PCA dimensionality reduction processing, which corresponds to step 6 of the technical method.

[0171] Among them, a high-dimensional feature vector dataset is constructed, with each sample data being a 6-row, 16-column matrix, corresponding to 6 types of features and 16 time series indicators for each type. Z-score standardization is performed on the dataset to eliminate the differences in the dimensions of different feature indicators.

[0172] The process involves calculating the Pearson correlation coefficient matrix of the standardized data, performing eigenvalue decomposition on the correlation coefficient matrix to obtain eigenvalues ​​and corresponding eigenvectors, sorting the eigenvalues ​​from largest to smallest, and selecting the top three eigenvectors with a cumulative information contribution rate ≥ 95% as principal components to generate an orthogonal matrix. .

[0173] Specifically, the original 96-dimensional high-dimensional feature data is projected to the 3-dimensional principal component space using the projection formula to complete feature dimensionality reduction. After dimensionality reduction, data reconstruction is performed. The mean square error between the reconstructed data and the original data is calculated to be 0.032, and the information retention rate is 96.8%, which meets the design requirement of ≥95%.

[0174] Based on the reduced-dimensionality feature data, a malicious behavior prediction and risk assessment process is performed, corresponding to step 7 of the technical method.

[0175] The dimensionality-reduced 3D feature data is input into a logistic regression model, which outputs a predicted probability of malicious behavior for each sample. The maliciousness score is calculated by comparing the corresponding confidence score with the maliciousness score. The system then sorts the malicious behavior scores from highest to lowest to generate a list of abnormal behaviors.

[0176] Specifically, for each behavior sample in the abnormal behavior list, a risk score is calculated, and for a specific malicious command line execution behavior sample, the number of times it has been triggered in the past 24 hours is recorded. The median number of occurrences per day over the past 60 days was 120. The number of occurrences was 5. The 90th percentile of the occurrences in the past 60 days was 20, and the 80th percentile of the occurrences in the past 7 days was 15. This was calculated... 600%, The value is 800%, which is then substituted into the risk scoring formula to obtain the final risk score. It is 268.33.

[0177] Among them, the preset risk threshold The risk score of this sample is 80, which far exceeds the threshold. The system immediately issues a high-risk warning and marks the sample as a high-risk malicious behavior sample, and includes it in the incremental update dataset.

[0178] Based on the scoring vector obtained from the risk assessment and the high-risk malicious behavior samples, the incremental update process of the model is executed, corresponding to steps 8 and 9 of the technical method.

[0179] Specifically, based on incrementally updated datasets, the mean of the features of abnormal behavior samples is initialized. It is 18.6, with no bias. The mean was 124.3. Based on the newly added high-risk sample data, the mean after the incremental update was calculated. The variance is 22.4, with no bias. The standard deviation is 156.7. It is 12.52.

[0180] The Z-score of the high-risk sample was calculated. Set the iteration step size to 7.79. The value is 0.001, and the gradient for weight update is calculated. The value is -0.00779, which is used to perform incremental updates of the weight coefficients of the high-dimensional feature vector based on the update gradient.

[0181] After the update is completed, the weight update data will be stored in the historical training library, retaining the update data of the past 12 periods for subsequent model gradient updates and performance backtracking. At the same time, the updated data will be correlated with the enterprise's internal threat intelligence data to optimize the feature weight configuration strategy and improve the model's ability to identify enterprise intranet-specific threats.

[0182] This embodiment fully implements the entire process of the aforementioned AI-based quantitative characterization method for monitoring malicious behavior. In the context of enterprise intranet terminal security protection, it achieves a single-hour data processing latency of ≤180ms, a malicious behavior identification accuracy of 98.6%, a false alarm rate of ≤0.5%, and a 72% reduction in computing power compared to the traditional single Transformer model monitoring solution. This fully verifies the feasibility and effectiveness of the method in actual business scenarios.

[0183] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for monitoring malicious behavior using AI-based quantitative characterization, characterized in that, It includes a hierarchical monitoring architecture. The first layer is a lightweight CNN model that quickly filters real-time captured behavioral data and categorizes behaviors into normal behaviors and suspected abnormal behaviors. The second layer is a high-precision Transformer quantization model, which only performs in-depth analysis and feature extraction on the suspected abnormal data that is diverted. Specifically, the steps include the following: S1: A lightweight monitoring model based on a convolutional neural network is trained based on historical behavior log data; S2: Real-time capture of system behavior data, input into a lightweight monitoring model for filtering; S3: Normal behavior will be diverted to the next monitoring cycle, while abnormal behavior will be diverted to the high-precision monitoring stage; S4: Generate several high-dimensional feature vectors for the abnormal behaviors that are diverted, and then allocate them to the feature channel allocation module; S5: The feature channel management module dynamically manages the feature channels based on their usage. S6: Perform principal component analysis to reduce the dimensionality of high-dimensional feature vectors; S7: Based on the reduced-dimensional features, complete the prediction and risk assessment of potential malicious behavior; S8: Calculate the statistics corresponding to the risk assessment results and generate high-dimensional feature vector update quantities; S9: Incrementally update the high-dimensional feature vector while retaining historical update data.

2. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The training of the lightweight monitoring model in S1 includes: S11: Construct a behavioral feature dataset containing normal and abnormal behaviors based on historical behavior log data; S12: Perform feature engineering on the dataset, including missing value imputation, removal of redundant attributes, and elimination of low-relevance features. S13: Divide the processed dataset into training and validation sets to train and filter the model, resulting in a lightweight model with classification capabilities.

3. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The convolutional neural network model in S1 uses a amplitude-limited linear unit as the activation function to constrain the output range of the feature vector within a preset range in order to adapt to the input requirements of the subsequent quantization model. The model compares the predicted value with the actual value and calculates the prediction error using a weighted mean square error. When the error between the actual value and the predicted value exceeds a preset threshold, it is determined to be abnormal.

4. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, In S4, various high-dimensional feature vectors are generated, including time-series features, correlation features, attribute features, multi-account features, high-dimensional behavioral feature maps, and multi-source intelligence features. The feature channel allocation module initializes the high-precision Transformer quantization model and automatically adapts different types of feature inputs to the corresponding feature channels during the inference phase.

5. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The working process of the feature channel management module in S5 includes: S51: Configure a dynamic feature channel pool based on the data scale; S52: Dynamically adjust the usage ratio of feature channels based on actual usage; S53: When different types of feature data enter, it will automatically adapt to the corresponding feature channel; S54: A shared weight network is used among the feature channels; S55: Freeze unused feature channels first, and then unfreeze and use them in training when the amount of data increases.

6. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The specific operation of principal component analysis dimensionality reduction in S6 is as follows: S61: Obtain a high-dimensional feature vector dataset and perform standardization to eliminate the influence of dimensions; S62: Calculate the correlation coefficient matrix between each feature, and solve for the eigenvalues ​​and eigenvectors of the matrix; S63: Select eigenvectors as principal components according to the magnitude of eigenvalues ​​to generate orthogonal matrices; S64: Project the original data onto the principal component space to obtain dimensionality-reduced data; S65: Verify the information retention rate by comparing the reconstructed data with the original data based on the error.

7. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The potential malicious behavior prediction and risk assessment in S7 includes: S71: Use logistic regression to predict malicious ratings and generate a list of anomalous behaviors; S72: Based on the list of abnormal behaviors, a risk score is given for potential malicious behaviors. The risk score comprehensively considers the degree of deviation between the frequency of occurrence of the behavior in preset short-term and long-term time windows and the historical baseline. S73: Trigger an alert by comparing the risk score with a preset threshold.

8. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The statistical measures calculated in S8 specifically include: S81: Initialize the mean and variance of the abnormal behavior characteristics; S82: Obtain newly added abnormal behavior data and update the sample mean and variance using streaming computation methods; S83: Calculate a standard score based on the updated mean and variance, the standard score being used to measure the degree to which sample feature values ​​deviate from the overall mean; S84: Calculate the weights and update the gradient based on the standard scores, and generate a high-dimensional feature vector update.

9. The AI-based quantitative characterization method for monitoring malicious behavior according to claim 1, characterized in that, The incremental update of the high-dimensional feature vector update in S9 includes: S91: Update the weight coefficients in the high-dimensional vector based on the update gradient; S92: While updating the weights, retain the updated data from multiple historical periods and store it in the historical training library; S93: The updated data is used for model performance backtracking calculations or for correlation analysis with multi-source intelligence data.

10. A storage medium having a computer program stored thereon that can be executed by a processor, characterized in that, When the computer program is executed, it implements the AI-quantitative characterization method for monitoring malicious behavior as described in any one of claims 1 to 9.

Images