Machine learning based terminal behavior anomaly detection method

Abstract

This invention proposes a machine learning-based method for detecting anomalies in terminal behavior, belonging to the fields of network security and artificial intelligence. The method includes: a terminal-side behavior acquisition module that monitors the terminal's operating status in real time; the acquired events are sorted by timestamps to form a raw behavior event stream; the acquired raw events are standardized to construct an event vector ei; this invention, by performing contextual modeling on the terminal behavior sequence, can capture the temporal dependencies and causal relationships between events, and can identify multi-step, chain-like attack behaviors that traditional rule-based or static feature-based methods cannot detect, such as lateral movement, privilege escalation, and remote control.

Description

Technical Field

[0001] This invention proposes a method for detecting abnormal terminal behavior based on machine learning, belonging to the fields of network security and artificial intelligence technology. Background Technology

[0002] As endpoint security threats continue to evolve, attack methods have gradually shifted from traditional single-point malware to multi-step, chain-like, and highly covert behavioral attacks. Traditional endpoint protection technologies relying on rule matching or signature databases are no longer sufficient to meet detection needs. In recent years, with the development of artificial intelligence technology, more and more security products have begun to use machine learning and deep learning models to model endpoint behavior, in order to identify abnormal processes, suspicious network connections, malicious file operations, and other behaviors.

[0003] Major international EDR / XDR products (such as CrowdStrikeFalcon, Microsoft Defender for Endpoint, SentinelOne, Palo Alto CortexXDR, etc.) have all incorporated intelligent detection capabilities based on behavior analysis, and domestic manufacturers have also successively launched endpoint security products with behavior modeling capabilities. At the same time, the academic community is also constantly exploring endpoint behavior anomaly detection technologies based on sequence models, graph neural networks, self-supervised learning, and other methods.

[0004] Overall, endpoint security detection is rapidly evolving from "rule-based static detection" to "behavior-based intelligent detection." However, existing technologies still generally suffer from insufficient understanding of complex behavioral sequences, limited ability to detect unknown attacks, and insufficient ability to fuse multimodal endpoint data. Therefore, there is an urgent need for intelligent behavior analysis methods with higher accuracy and stronger generalization capabilities. Summary of the Invention

[0005] This invention provides a machine learning-based method for detecting anomalies in terminal behavior, to solve the following problems: Most existing solutions rely on static features or simple time window analysis, which cannot perform in-depth modeling of the contextual relationships of terminal behavior sequences and make it difficult to identify complex attacks with multiple steps and chains. Existing technologies typically only process single types of terminal data (such as analyzing only process events or network events), lacking the ability to fuse multimodal behavioral data such as processes, files, and network connections, resulting in an incomplete characterization of the overall behavioral state of the terminal. Traditional models rely on manually designed features, have weak generalization ability, and have limited detection effectiveness against unknown attacks, variant attacks, and low-frequency attacks. Due to significant differences in terminal environments and high levels of data noise, existing solutions lack stability in various scenarios, making them prone to false alarms or missed alarms. The present invention proposes a machine learning-based terminal behavior anomaly detection method, the method comprising: S1. The terminal-side behavior acquisition module monitors the terminal's operating status in real time. The acquired events are sorted by timestamps to form a raw behavior event stream. S2. Standardize the collected raw events and construct the event vector ei; S3. Combine the event vectors into a behavior sequence S={e1,e2,…,en} in chronological order, and divide it into subsequences Sk={ek1,ek2,…,ekm} according to a fixed window or process lifecycle. S4. For data of different modalities, construct sub-vectors Vproc, Vfile, and Vnet respectively, and use the fusion function to represent them in a unified way: Vfusion=g(vproc,vfile,vnet). S5. The central analysis server uses a deep sequence model to model behavioral sequences and generates a sequence representation ht=Model(Sk); S6. Based on the sequence representation ht, use the anomaly detection module to determine whether the behavior is abnormal; S7. When abnormal behavior is detected, the system constructs an attack chain graph Graph=(Nodes,Edges) based on the relationship between the behaviors; and finally outputs the attack chain and alarm information.

[0006] Beneficial effects of this invention: This invention significantly enhances the ability to identify complex attack chains. By performing contextual modeling on terminal behavior sequences, it can capture the temporal dependencies and causal relationships between events, and can identify multi-step, chain-like attack behaviors that traditional rule-based or static feature-based methods cannot detect, such as lateral movement, privilege escalation, and remote control.

[0007] Enhanced detection capabilities against unknown and variant attacks. This invention employs a predictive or reconstructive anomaly detection model that does not rely on a fixed feature library or manual rules. It can produce a significantly biased response to unseen attack patterns, thereby effectively detecting zero-day attacks, variant attacks, and low-frequency attacks.

[0008] This invention achieves unified modeling of multimodal terminal behavior data, improving detection accuracy. It integrates and models multi-source behavior data such as processes, files, and network connections, providing a more comprehensive picture of the terminal's operational status. Compared to existing technologies that rely on only a single data source, this significantly improves detection accuracy.

[0009] This invention reduces false positives and improves model stability across different terminal environments. Through behavior standardization, noise filtering, and contextual semantic understanding, it effectively distinguishes between normal business behavior and genuine abnormal behavior, reducing false positives caused by environmental differences and system noise, and improving the model's robustness across different operating systems and business scenarios.

[0010] It offers enhanced interpretability, facilitating understanding and response by security personnel. This invention constructs an attack chain diagram, presenting the causal, procedural, and network relationships between anomalous behaviors in a structured manner, enabling security personnel to quickly understand attack paths and improve response efficiency.

[0011] It supports collaborative detection capabilities in large-scale terminal environments. This invention adopts an architecture that combines lightweight processing on the terminal side with in-depth analysis on the central side, which can run stably on enterprise-level scales of hundreds to tens of thousands of terminals, enabling cross-terminal behavioral correlation analysis and identifying distributed attacks that cannot be detected by a single terminal.

[0012] It possesses excellent scalability and can be adapted to various environments such as cloud hosts, containers, and IoT. The behavior modeling method of this invention does not depend on a specific platform and can be extended to various scenarios such as cloud-native environments, container runtimes, and industrial control terminals, thus having a wider range of applications. Attached Figure Description

[0013] Figure 1 This is a diagram illustrating the steps of the method described in this invention. Detailed Implementation

[0014] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0015] One embodiment of the present invention, such as Figure 1 As shown, a machine learning-based terminal behavior anomaly detection method includes: S1. The terminal-side behavior acquisition module monitors the terminal's operating status in real time, collecting events including but not limited to process events (creation, exit, parent-child relationship, command line parameters), file events (read / write, deletion, permission changes), network events (connection establishment, port access, remote address), system call sequences, and registry or configuration change events. The collected events are sorted by timestamps to form a raw behavior event stream. S2. Standardize the collected raw events. The standardization process includes field normalization (e.g., path normalization, IP address formatting), noise filtering (e.g., system heartbeat events, meaningless repetitive events), and feature vector construction (e.g., event type, parameters, context information). Construct an event vector ei, which has the form ei = f(typei, attri, ctxi), where typei is the event type (process, file, network, etc.), attri is the event attribute (path, port, command line, etc.), ctxi is the context information (parent process, preceding event, etc.), and f(⋅) is the feature encoding function (e.g., embedding, one-hot, hash encoding, etc.). S3. Combine the event vectors into a behavior sequence S={e1,e2,…,en} in chronological order, and divide it into subsequences Sk={ek1,ek2,…,ekm} according to a fixed window (e.g., 5 seconds, 10 seconds) or according to the process lifecycle; S4. For data of different modalities such as processes, files, and networks, construct sub-vectors Vproc, Vfile, and Vnet respectively, and represent them uniformly through the fusion function Vfusion=g(vproc,vfile,vnet), where g(⋅) can be concat, attention mechanism, or weighted sum. S5. The central analysis server uses deep sequence models (such as Transformer, Bi-LSTM, GNN sequence models, etc.) to model behavioral sequences and generate sequence representations ht=Model(Sk); the model can capture the temporal dependencies, contextual semantics, and cross-event associations of attack chains between behaviors; S6. Based on sequence representation ht, use an anomaly detection module to determine whether the behavior is abnormal; adopt one of the following methods: predictive anomaly detection, where the model predicts the next event e. t+1 If the actual event deviates too much, it is judged as an anomaly, and the score is set to D(et+1,e). t+1 ), where D(⋅) is a distance function (such as KL divergence, cosine distance); reconstruction-based anomaly detection, the model reconstructs the input sequence, and if the reconstruction error is too large, it is judged as an anomaly, score=∥Sk−S k ∥; Classification detection, the model outputs the probability of malice, p=softmax(Wht+b); S7. When abnormal behavior is detected, the system constructs an attack chain graph Graph=(Nodes,Edges) based on the relationships between behaviors (causal relationships, process tree relationships, and network connection relationships, etc.), where Nodes are behavioral events and Edges are causal relationships (such as parent and child processes, file dependencies, and network connections); finally, the attack chain and alarm information are output.

[0016] The working principle and effects of the above technical solution are as follows: By collecting and standardizing multi-dimensional behavioral data from the terminal, and combining it with a deep sequence model to achieve deep modeling of behavioral sequences, the solution accurately captures the time dependencies and correlations between behaviors, significantly improving the accuracy of identifying complex multi-step attack chains and enhancing the detection capabilities for unknown and variant attacks. The fusion modeling of multi-modal behavioral data comprehensively depicts the terminal's operational status, reducing detection bias caused by analysis of a single data source and lowering the false positive and false negative rates of anomaly detection. The construction and output of the attack chain graph makes the propagation path of abnormal behavior clearer, improving the response efficiency of security personnel and avoiding delays in emergency response due to unclear information related to attack behaviors. The combination of lightweight processing on the terminal side and deep analysis on the central side not only adapts to the collaborative detection needs of large-scale terminals but also improves the model's operational stability in different terminal environments, reducing detection interference caused by environmental differences and data noise.

[0017] In one embodiment of the present invention, S1 includes: S11. The terminal-side behavior acquisition module monitors the terminal's operating status in real time, and collects process events, file events, network events, system call sequences, and registry or configuration change events to form a complete set of terminal behavior events. S12. Perform raw data screening on the full set of terminal behavior events, remove garbled and incomplete data generated during the collection process, and form a valid set of behavior events. S13. Match the corresponding timestamp information for each event data in the set of valid behavioral events to complete the association marking between events and time; S14. Sort and organize the set of valid behavior events that have been time-stamped according to the order of the timestamps to generate the original behavior event stream.

[0018] The working principle and effects of the above technical solution are as follows: By collecting various operational behavior events of the terminal from all dimensions, it can fully cover the dimensions of terminal behavior data, improve the data foundation integrity for subsequent behavior analysis, and avoid the problem of missed detection of anomalies due to incomplete data collection. The collected data undergoes raw screening to remove invalid data, reducing interference from messy data to subsequent processing and reducing the unnecessary computational power consumption of data processing. A timestamp is matched to each valid event and arranged in sequence, allowing the terminal behavior data to form a time-sequential continuous event stream, enhancing the temporal correlation of behavior data, avoiding the inability to accurately capture the sequential logical relationship between behaviors due to disordered event arrangement, and also making subsequent sequence modeling and behavior analysis more closely match the actual operational behavior trajectory of the terminal, further improving the accuracy and effectiveness of data processing in each subsequent stage.

[0019] In one embodiment of the present invention, step S14 includes: Extract all timestamp information and corresponding behavior event data from the set of valid behavior events with completed time stamping, and generate a time event association dataset; Perform a full-domain numerical sorting of the time dimension on the time-related dataset, arrange all data in chronological order, and generate an ordered time event sequence; Perform data continuity verification on ordered time event sequences, supplement missing time node association information in the sequence, and generate a complete set of time-series behavioral events; Perform streaming data format conversion on a complete set of temporal behavioral events to achieve continuous output processing of event data and generate the original behavioral event stream; Perform data integrity verification on the original behavioral event stream to ensure the temporal continuity and data validity of the event stream, and generate a standard original behavioral event stream.

[0020] The working principle and effects of the above technical solution are as follows: By extracting the correlation information between timestamps and behavioral events and sorting them according to the time dimension, the terminal behavioral data forms an ordered event sequence, improving the temporal regularity of the behavioral data and avoiding the inability to accurately analyze the sequential relationship between behaviors due to disordered event order. Continuity verification is performed on the ordered sequence, and missing information is supplemented to improve the temporal link of the behavioral data, enhance the integrity of the behavioral event flow, and reduce the gaps in behavioral analysis caused by missing data nodes. The complete sequence is converted into a streaming format and a final integrity verification is performed, making the data adaptable to the subsequent sequence modeling processing requirements, reducing the adaptation cost of subsequent data processing, and ensuring that the output standard original behavioral event stream has both temporal continuity and data validity. This avoids deviations in subsequent modeling and analysis due to data format or integrity issues, effectively improving the smoothness of data processing in each subsequent stage and the reliability of the analysis results.

[0021] In one embodiment of the present invention, S2 includes: S21. Perform field normalization processing on various types of data in the original behavior event stream, and complete the full-domain data organization of path normalization and IP address formatting; S22. Perform noise filtering on the normalized behavior event data to remove interfering data, including system heartbeat events and meaningless repetitive events; extract core dimension features from the denoised behavior event data, including event type, event attributes, context information, etc., to form a multi-dimensional behavior feature set. S23. Call the feature encoding function to encode and transform the multi-dimensional behavioral feature set, and construct the event vector ei, which has the form ei=f(typei, attri, ctxi). S24. Integrate all the constructed event vectors to form a standardized event vector dataset, providing a data foundation for subsequent sequence construction.

[0022] The working principle and effects of the above technical solution are as follows: It performs global field normalization on the original behavioral event stream, unifying the format standards of various data types, improving the regularity of behavioral data, and avoiding deviations in subsequent feature extraction and encoding due to messy data formats. It filters out various interfering data and extracts core dimensional features, reducing the computational consumption of invalid data in subsequent processing and enhancing the relevance and effectiveness of behavioral features. Through an encoding function, multi-dimensional features are transformed into event vectors, achieving the structuring transformation of unstructured features, reducing the difficulty of subsequent model processing, and making the data more suitable for sequence modeling needs. All event vectors are integrated to form a standardized dataset, building a solid and unified data foundation for subsequent behavioral sequences, avoiding interruptions in sequence construction due to inconsistent data formats, and also improving the overall efficiency and accuracy of subsequent behavioral analysis and anomaly detection.

[0023] In one embodiment of the present invention, S3 includes: S31. Combine the event vectors in the standardized event vector dataset in chronological order to generate a complete terminal behavior sequence S={e1,e2,…,en}. S32. Set a fixed time window threshold, and divide the complete terminal behavior sequence according to the threshold to generate several behavior sub-sequences in the time window dimension; S33. Based on the entire lifecycle nodes of the terminal process (startup, running, exit), the complete terminal behavior sequence is segmented at the process dimension to generate several sub-sequences of behavior at the process lifecycle dimension. S34. Perform data verification on the two types of subsequences after dividing the time window and process life cycle, remove invalid subsequences with too small a data volume, and generate standardized behavior subsequences Sk={ek1,ek2,…,ekm}.

[0024] The working principle and effects of the above technical solution are as follows: Standardized event vectors are combined into complete behavioral sequences according to time, restoring the temporal development trajectory of terminal behavior, improving the correlation of behavioral data, and avoiding the inability to fully present continuous terminal behavior due to data dispersion. The sequences are segmented from two dimensions: time window and process lifecycle, achieving refined division of behavioral data, enhancing the analytical capabilities for different dimensions of terminal behavior, and reducing the limitations of single-dimensional analysis. Data validation is performed on the segmented subsequences, and invalid data is removed to ensure the quality of the subsequence data input for subsequent modeling, reducing the interference of invalid data on model analysis, and avoiding deviations in modeling results due to low-quality subsequences. The resulting standardized behavioral subsequences not only meet the input requirements of deep sequence models but also enable the model to accurately capture behavioral features of different dimensions, effectively improving the accuracy of subsequent behavioral modeling and anomaly detection.

[0025] In one embodiment of the present invention, S32 includes: Collect operational characteristic data of historical behavior sequences of terminals to generate terminal behavior time characteristic dataset; Analyze and calculate the terminal behavior time feature dataset to generate a fixed time window threshold that adapts to the terminal's operating status; A fixed time window threshold is applied to the complete terminal behavior sequence to perform segmentation processing of the sequence and generate a preliminary time window segmented sequence set; Boundary event verification is performed on the initial segmented sequence set within the time window, the first and last event data of the subsequence are regularized, and behavioral subsequences are generated in the time window dimension.

[0026] The working principle and effects of the above technical solution are as follows: Historical behavioral characteristics of the terminal are collected and analyzed to generate suitable time window thresholds. This ensures the time window settings align with the actual operating state of the terminal, improving the rationality of sequence segmentation and avoiding segmentation deviations caused by mismatches between fixed thresholds and terminal behavior. The suitable thresholds are applied to the complete sequence for segmentation, achieving refined temporal division of the behavioral sequence and enhancing the ability to capture short-term behavioral characteristics of the terminal. Boundary event verification and data regularization are performed on the initial segmented sub-sequences, making the sub-sequence data of each time window more complete, reducing behavioral analysis loopholes caused by missing boundary events, and preventing analytical errors due to chaotic boundary data in subsequent modeling factor sequences. The final generated time window-dimensional behavioral sub-sequences retain the temporal continuity of terminal behavior while enabling subsequent models to accurately analyze behavioral characteristics at different times, effectively improving the targeting and effectiveness of behavioral sequence modeling.

[0027] In one embodiment of the present invention, S33 includes: S331. Extract process-related event data from the complete terminal behavior sequence and generate a terminal process behavior dataset; S332. Perform node identification on the terminal process behavior dataset, extract the feature information of process startup, running and exit, and generate a process life cycle node set; S333. Associate and match the process lifecycle node set with the complete terminal behavior sequence, divide the behavior data intervals corresponding to each process, and generate a process behavior interval dataset. S334. Segment the complete terminal behavior sequence according to the process behavior interval dataset, divide the independent behavior data sequence of each process, and generate the behavior subsequence of the process life cycle dimension.

[0028] The working principle and effects of the above technical solution are as follows: It extracts process-related data from the complete sequence and forms a dedicated dataset, focusing on the core of process behavior analysis, improving the efficiency of process behavior data extraction, and reducing interference from irrelevant data in process behavior judgment. It identifies process lifecycle nodes and generates node sets, accurately locating key stages of process execution, enhancing the ability to control process behavior trajectories, and avoiding confusion in process behavior division due to ambiguous nodes. It associates and matches the node sets with the complete sequence and divides data intervals, allowing the behavior data of each process to form an independent range, improving the clarity of process behavior data attribution, and avoiding analytical bias caused by the mixing of behavior data from different processes. It generates process lifecycle dimension sub-sequences by interval segmentation, realizing the independent presentation of single-process behavior. This allows subsequent models to accurately analyze the complete behavioral characteristics of a single process and clearly capture the behavioral relationships between processes, effectively improving the detection accuracy of abnormal process-related behaviors.

[0029] In one embodiment of the present invention, S333 includes: Extract the node time features and process identification information from the process lifecycle node set to generate a process node feature dataset; Perform a full-domain data traversal on the complete terminal behavior sequence, extract the time and process correlation information of each event in the sequence, and generate a sequence event correlation dataset; By integrating the process node feature dataset and the sequence event association dataset, a global matching of nodes and sequence events is achieved, generating a node sequence matching dataset. Based on the node sequence matching dataset, the behavioral data range of each process from start to exit is defined, and an independent behavioral data interval for each process is generated. Integrate the behavioral data range information of all processes, complete the format standardization and information summary of the data range, and generate a process behavior range dataset.

[0030] The working principle and effects of the above technical solution are as follows: First, extracting the time and identifier features of process nodes to generate a dedicated dataset. This makes the feature information of key process nodes more concentrated, improving the accuracy of node feature extraction and reducing the information screening cost during subsequent matching. Second, traversing the entire sequence to extract the time and process association information of events achieves comprehensive coverage of sequence event features, enhancing the information integrity of sequence events and avoiding matching deviations due to incomplete information extraction. Third, fusing the two types of datasets to complete full-domain matching ensures accurate correspondence between process nodes and sequence events, improving the matching efficiency of nodes and events and avoiding situations where nodes and events are out of sync. Fourth, defining and integrating the behavioral data range of each process based on the matching results clearly defines the behavioral interval of each process, reducing cross-interference between behavioral data of different processes. This ensures the independence of single-process behavioral data and allows subsequent sequence segmentation to better fit the actual running trajectory of the process, effectively avoiding errors in process behavior analysis caused by chaotic interval division.

[0031] In one embodiment of the present invention, step S4 includes: S41. Separate process-related data from the standardized behavior subsequences, construct feature vectors separately for process-related data, and generate process modality sub-vectors Vproc; S42. Separate file-related data from the standardized behavior subsequence, construct feature vectors separately for file-related data, and generate file modality subvectors Vfile; S43. Separate network class-related data from the standardized behavior subsequences, construct feature vectors separately for the network class data, and generate network modality subvectors Vnet; S44. Integrate the three modal vectors of process, file, and network, and call the fusion function to perform unified representation processing on the multi-source modal vectors to generate the fused feature vector Vfusion=g(vproc,vfile,vnet).

[0032] The working principle and effects of the above technical solution are as follows: Separating different types of data from standardized subsequences and constructing feature vectors separately allows for the accurate extraction of behavioral features across processes, files, and networks, improving the expression accuracy of single-modal data features and avoiding the ambiguity in feature extraction caused by the mixing of different modalities. Customizing subvectors for different modalities fully uncovers the unique features of each type of behavior, enhancing the feature recognition of single-modal data and reducing mutual interference between features of different modalities. Integrating the three types of modal subvectors and achieving a unified representation through a fusion function enables the organic fusion of multi-source behavioral data, resulting in a more comprehensive and three-dimensional characterization of terminal behavior features and avoiding detection blind spots caused by single-modal data analysis. The generated fused feature vector retains the core features of each modality and reflects the correlation between different modalities, effectively improving the subsequent model's ability to analyze the overall behavior of the terminal and making abnormal behavior detection more closely aligned with the actual operating state of the terminal.

[0033] In one embodiment of the present invention, step S5 includes: S51. Synchronously input the standardized behavioral subsequence Sk and the fusion feature vector Vfusion into the deep sequence model of the central analysis server to complete the loading and initialization of the model input data. S52. Deep sequence models perform temporal feature mining on input data, capture the temporal dependencies between behavioral events, and generate time-related feature data. S53. Deep sequence models perform semantic parsing on input data, uncover the contextual semantic relationships behind behavioral events, and generate contextual semantic feature data. S54. The deep sequence model integrates temporal correlation feature data with contextual semantic feature data to model and mine cross-event correlation features of the attack chain, generating a behavioral sequence representation ht=Model(Sk).

[0034] The working principle and effects of the above technical solution are as follows: Standardized subsequences and fused feature vectors are simultaneously input into the deep sequence model, providing the model with a complete and accurate data source, improving the quality of the basic data for modeling and analysis, and avoiding biased modeling results due to missing or singular data. The model mines temporal features to capture the temporal dependencies of behavior, accurately reconstructing the sequential logic of terminal behavior, enhancing the ability to control the temporal correlation of behavior, and reducing analytical bias caused by ignoring temporal features. Contextual semantic analysis mines the relationships behind behavior, deeply understanding the internal logic of terminal behavior, avoiding judgment errors caused by merely analyzing surface behavior. The fusion of temporal and semantic features in modeling and mining cross-event correlations in attack chains allows the model to accurately identify multi-step chain attack behaviors, significantly improving the ability to identify complex attacks. It can not only completely depict the overall behavioral characteristics of the terminal, but also provide subsequent anomaly detection with a more accurate sequence representation basis, effectively reducing the probability of missing complex and covert attacks.

[0035] In one embodiment of the present invention, step S6 includes: S61. Input the behavior sequence representation ht into the anomaly detection module to complete the data source loading of the detection module and start the terminal behavior anomaly detection process; S62. A predictive anomaly detection method is adopted, and the predicted event e for the next moment is generated through model deduction. t+1 Calculate the distance between the actual event and the predicted event: score = D(et+1, e) t+1 ), and determine whether the behavior is abnormal based on the distance value; S63. Employ a reconstruction-based anomaly detection method, using a model to reconstruct the input behavioral subsequences to generate S. k Calculate the error between the original sequence and the reconstructed sequence: score = |Sk−S k ∥, determine whether the behavior is abnormal based on the error value; S64. A classification-based detection method is adopted. The behavioral sequence representation is calculated through the model, and the malicious probability of the behavior is output by the softmax function, p=softmax(Wht+b). The abnormality of the behavior is judged based on the probability value.

[0036] The working principle and effects of the above technical solution are as follows: Inputting behavioral sequence representations into the anomaly detection module provides accurate feature data for the detection process, improving the quality of initial data for anomaly detection and avoiding subsequent detection errors due to feature representation bias. Predictive detection, through deductive comparison, determines anomalies, accurately capturing deviations in behavioral development trends, enhancing the ability to identify unknown attack behaviors, and reducing missed detections of new types of attacks. Reconstructive detection, by calculating errors through sequence reconstruction, can effectively identify hidden behavioral anomalies, reducing detection omissions caused by inconspicuous behavioral features and preventing abnormal behaviors from slipping through the cracks. Classification-based detection outputs malicious probability quantification of behavioral risks, making anomaly judgments more objective and improving the credibility of detection results. The complementary use of multiple detection methods not only adapts to different types of terminal behavioral anomaly scenarios but also significantly improves the overall detection accuracy, effectively reducing the false positive and false negative rates of anomaly detection, ensuring that all types of terminal abnormal behaviors can be identified in a timely manner.

[0037] In one embodiment of the present invention, step S7 includes: S71. Extract the abnormal behavior data determined by the anomaly detection module separately, and integrate all abnormal behaviors to form an abnormal behavior event set. S72. Conduct correlation analysis on the set of abnormal behavior events to uncover causal relationships, process tree relationships, and network connection relationships between events, and form a set of behavioral correlation relationships. S73. Construct the Nodes node of the attack chain graph based on the set of abnormal behavior events, construct the Edges edge of the attack chain graph based on the set of behavior associations, and generate the complete attack chain graph Graph=(Nodes,Edges). S74. Perform structured analysis on the attack chain diagram, sort out the propagation path and related logic of abnormal behavior, and generate standardized alarm information according to a fixed format; S75. Synchronously integrate the complete attack chain diagram with standardized alarm information to complete the full-domain output of attack chain and alarm information.

[0038] The working principle and effects of the above technical solution are as follows: It extracts and integrates the abnormal behaviors identified by the anomaly detection module into a set, focusing on core abnormal data to improve the targeting of abnormal behavior analysis and reduce interference from irrelevant data in subsequent judgments. It performs correlation analysis on the abnormal behavior set, uncovering various inherent relationships, clearly outlining the logical links between abnormal behaviors, enhancing the ability to control the development trajectory of attack behaviors, and avoiding the cognitive biases caused by isolated analysis of abnormal behaviors. Based on these relationships, it constructs a complete attack chain diagram, transforming abstract abnormal behaviors into a structured visual map, improving the visualization of attack behaviors, and allowing security personnel to quickly grasp the full picture of the attack. It parses the attack chain diagram and generates standardized alarm information, standardizing the presentation format of alarm content, reducing the information processing costs for security personnel, and avoiding response delays caused by cluttered alarm information. It synchronously integrates the attack chain diagram and alarm information and outputs them across the entire domain, which can not only intuitively display the attack path but also accurately convey the core information of abnormal alarms, significantly improving the emergency response efficiency of security personnel and effectively reducing the endpoint security risks brought about by attack behaviors.

[0039] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A terminal behavior anomaly detection method based on machine learning, characterized in that, The method includes: S1. The terminal-side behavior acquisition module monitors the terminal's operating status in real time. The acquired events are sorted by timestamps to form a raw behavior event stream. S2. Standardize the collected raw events and construct the event vector ei; S3. Combine the event vectors into a behavior sequence S={e1,e2,…,en} in chronological order, and divide it into subsequences Sk={ek1,ek2,…,ekm} according to a fixed window or process lifecycle. S4. For data of different modalities, construct sub-vectors Vproc, Vfile, and Vnet respectively, and use the fusion function to represent them in a unified way: Vfusion=g(vproc,vfile,vnet). S5. The central analysis server uses a deep sequence model to model behavioral sequences and generates a sequence representation ht=Model(Sk); S6. Based on the sequence representation ht, use the anomaly detection module to determine whether the behavior is abnormal; S7. When abnormal behavior is detected, the system constructs an attack chain graph Graph=(Nodes,Edges) based on the relationship between the behaviors; and finally outputs the attack chain and alarm information.

2. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, S1 includes: S11. The terminal-side behavior acquisition module monitors the terminal's operating status in real time, and collects process events, file events, network events, system call sequences, and registry or configuration change events to form a complete set of terminal behavior events. S12. Perform raw data screening on the full set of terminal behavior events, remove garbled and incomplete data generated during the collection process, and form a valid set of behavior events. S13. Match the corresponding timestamp information for each event data in the set of valid behavioral events to complete the association marking between events and time; S14. Sort and organize the set of valid behavior events that have been time-stamped according to the order of the timestamps to generate the original behavior event stream.

3. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The S2 includes: S21. Perform field normalization processing on various types of data in the original behavior event stream, and complete the full-domain data organization of path normalization and IP address formatting; S22. Perform noise filtering on the behavior event data that has been normalized to remove interfering data, and extract core dimensional features from the denoised behavior event data to form a multi-dimensional behavior feature set. S23. Call the feature encoding function to encode and transform the multi-dimensional behavioral feature set, and construct the event vector ei, which has the form ei=f(typei, attri, ctxi). S24. Integrate all the completed event vectors to form a standardized event vector dataset.

4. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The S3 includes: S31. Combine the event vectors in the standardized event vector dataset in chronological order to generate a complete terminal behavior sequence S={e1,e2,…,en}. S32. Set a fixed time window threshold, and divide the complete terminal behavior sequence according to the threshold to generate several behavior sub-sequences in the time window dimension; S33. Based on the entire lifecycle nodes of the terminal process (startup, running, exit), the complete terminal behavior sequence is segmented at the process dimension to generate several sub-sequences of behavior at the process lifecycle dimension. S34. Perform data verification on the two types of subsequences after dividing the time window and process life cycle, remove invalid subsequences with too small a data volume, and generate standardized behavior subsequences Sk={ek1,ek2,…,ekm}.

5. The terminal behavior anomaly detection method based on machine learning according to claim 4, characterized in that, S33 includes: S331. Extract process-related event data from the complete terminal behavior sequence and generate a terminal process behavior dataset; S332. Perform node identification on the terminal process behavior dataset, extract the feature information of process startup, running and exit, and generate a process life cycle node set; S333. Associate and match the process lifecycle node set with the complete terminal behavior sequence, divide the behavior data intervals corresponding to each process, and generate a process behavior interval dataset. S334. Segment the complete terminal behavior sequence according to the process behavior interval dataset, divide the independent behavior data sequence of each process, and generate the behavior subsequence of the process life cycle dimension.

6. The terminal behavior anomaly detection method based on machine learning according to claim 5, characterized in that, S333 includes: Extract the node time features and process identification information from the process lifecycle node set to generate a process node feature dataset; Perform a full-domain data traversal on the complete terminal behavior sequence, extract the time and process correlation information of each event in the sequence, and generate a sequence event correlation dataset; By integrating the process node feature dataset and the sequence event association dataset, a global matching of nodes and sequence events is achieved, generating a node sequence matching dataset. Based on the node sequence matching dataset, the behavioral data range of each process from start to exit is defined, and an independent behavioral data interval for each process is generated. Integrate the behavioral data range information of all processes, complete the format standardization and information summary of the data range, and generate a process behavior range dataset.

7. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The S4 includes: S41. Separate process-related data from the standardized behavior subsequences, construct feature vectors separately for process-related data, and generate process modality sub-vectors Vproc; S42. Separate file-related data from the standardized behavior subsequence, construct feature vectors separately for file-related data, and generate file modality subvectors Vfile; S43. Separate network class-related data from the standardized behavior subsequences, construct feature vectors separately for the network class data, and generate network modality subvectors Vnet; S44. Integrate the three modal vectors of process, file, and network, and call the fusion function to perform unified representation processing on the multi-source modal vectors to generate the fused feature vector Vfusion=g(vproc,vfile,vnet).

8. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The S5 includes: S51. Synchronously input the standardized behavioral subsequence Sk and the fusion feature vector Vfusion into the deep sequence model of the central analysis server to complete the loading and initialization of the model input data. S52. Deep sequence models perform temporal feature mining on input data, capture the temporal dependencies between behavioral events, and generate time-related feature data. S53. Deep sequence models perform semantic parsing on input data, uncover the contextual semantic relationships behind behavioral events, and generate contextual semantic feature data. S54. The deep sequence model integrates temporal correlation feature data with contextual semantic feature data to model and mine cross-event correlation features of the attack chain, generating a behavioral sequence representation ht=Model(Sk).

9. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The S6 includes: S61. Input the behavior sequence representation ht into the anomaly detection module to complete the data source loading of the detection module and start the terminal behavior anomaly detection process; S62. A predictive anomaly detection method is adopted, and the predicted event e for the next moment is generated through model deduction. t+1 Calculate the distance between the actual event and the predicted event: score = D(et+1, e) t+1 ), and determine whether the behavior is abnormal based on the distance value; S63. Employ a reconstruction-based anomaly detection method, using a model to reconstruct the input behavioral subsequences to generate S. k Calculate the error between the original sequence and the reconstructed sequence: score = |Sk−S k ∥, determine whether the behavior is abnormal based on the error value; S64. A classification-based detection method is adopted. The behavioral sequence representation is calculated through the model, and the malicious probability of the behavior is output by the softmax function, p=softmax(Wht+b). The abnormality of the behavior is judged based on the probability value.

10. The terminal behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The S7 includes: S71. Extract the abnormal behavior data determined by the anomaly detection module separately, and integrate all abnormal behaviors to form an abnormal behavior event set. S72. Conduct correlation analysis on the set of abnormal behavior events to uncover causal relationships, process tree relationships, and network connection relationships between events, and form a set of behavioral correlation relationships. S73. Construct the Nodes node of the attack chain graph based on the set of abnormal behavior events, construct the Edges edge of the attack chain graph based on the set of behavior associations, and generate the complete attack chain graph Graph=(Nodes,Edges). S74. Perform structured analysis on the attack chain diagram, sort out the propagation path and related logic of abnormal behavior, and generate standardized alarm information according to a fixed format; S75. Synchronously integrate the complete attack chain diagram with standardized alarm information to complete the full-domain output of attack chain and alarm information.

Images