Model training method, behavior pattern recognition method, electronic device, and storage medium

Abstract

This application provides a model training method, a behavior pattern recognition method, an electronic device, and a storage medium, relating to the field of computer technology, for achieving proactive protection against unknown threats and improving the detection accuracy of complex attacks. The method includes: acquiring multiple first training samples; determining a first label, a second training sample, and a second label corresponding to each first training sample; inputting the first training samples and first prompt information into a large model to obtain a first prediction sequence; inputting the second training samples and the second prompt information into the large model to obtain a prediction probability distribution; determining a first loss based on the first label and the first prediction sequence, and determining a second loss based on the second label and the prediction probability distribution; updating the large model based on the first loss and the second loss corresponding to the multiple first training samples until a preset convergence condition is met to obtain a target large model.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to model training methods, behavior pattern recognition methods, electronic devices and storage media. Background Technology

[0002] The OpenStack cloud platform provides services through a series of RESTful APIs (such as Keystone, Nova, Neutron, etc.), and these APIs can become the main entry point for cyberattacks.

[0003] Most related security defense methods are rule-based detection and traditional machine learning-based anomaly detection. Rule-based detection relies on predefined signature libraries or regular expressions; traditional machine learning-based anomaly detection is usually based on statistical modeling using simple numerical metrics (such as request frequency or number of source IPs).

[0004] Therefore, existing security defense measures still suffer from the inability to effectively identify and defend against new attack methods and the low detection accuracy of complex attacks. Summary of the Invention

[0005] This application provides a model training method, a behavior pattern recognition method, an electronic device, and a storage medium for proactive protection against unknown threats and improving the detection accuracy of complex attacks.

[0006] In a first aspect, this application provides a model training method, comprising: acquiring multiple first training samples; the first training samples are keyword sequences determined based on the occurrence order of multiple keywords in historical API traffic data conforming to normal behavior patterns. Determining a first label, a second training sample, and a second label corresponding to each first training sample; the first label is obtained by right-shifting the first training sample by N positions; the second training sample is obtained by masking the first training sample using a target masking strategy; the second label is obtained by retaining the mask position in the first training sample. Inputting the first training samples and first prompt information into a large model to obtain a first prediction sequence; the first prompt information is used to prompt the large model to predict the keywords that may appear after each keyword in the first training sample. Inputting the second training samples and second prompt information into the large model to obtain a prediction probability distribution; the second prompt information is used to prompt the large model to predict the confidence of multiple preset keywords in a preset keyword library at the mask position; the prediction probability distribution is used to represent the confidence distribution of multiple preset keywords at the mask position. Determining a first loss based on the first label and the first prediction sequence, and determining a second loss based on the second label and the prediction probability distribution. Updating the large model based on the first loss and the second loss corresponding to the multiple first training samples until a preset convergence condition is met, thus obtaining a target large model.

[0007] The technical solution provided in this application offers at least the following beneficial effects: Since the first training sample is a keyword sequence determined based on the occurrence order of multiple keywords in historical API traffic data conforming to normal behavior patterns, and the first label is obtained by right-shifting the first training sample by N positions, training based on the first training sample and the first label enables the large model to learn normal behavior patterns and contextual relationships in API traffic data. This allows it to predict keywords that will appear in the future, thus avoiding reliance on existing attack type features and achieving proactive protection against unknown threats. Furthermore, during training, a target masking strategy is used to mask the first training sample to obtain a second training sample, and the masked positions in the first training sample are preserved to obtain a second label. Training based on the second training sample and the second label enables the target large model to predict the masked positions in the sequence, thereby learning to analyze the keywords represented by the masked positions in the sequence. Therefore, the target large model can further learn deeper internal relationships within the sequence. As can be seen, the scheme provided in this application updates the large model based on the first loss (corresponding to the first training sample and the first label) and the second loss (corresponding to the second training sample and the second label), which enables the model to take into account both prediction targets. It integrates unidirectional sequence patterns and bidirectional contextual information in the internal representation of the model, thereby enabling the identification of more complex attack scenarios and improving the detection accuracy of complex attacks.

[0008] One possible implementation involves randomly selecting a target masking strategy from multiple preset masking strategies according to a preset ratio. The preset masking strategies include at least one of the following: a first preset masking strategy for replacing keywords at random positions in the first training sample with placeholder markers; a second preset masking strategy for replacing keywords at random positions in the first training sample with other keywords; and a third preset masking strategy for not masking the first training sample. In the preset ratio, the ratio corresponding to the first preset masking strategy is greater than the ratios corresponding to the other preset masking strategies. The first training sample is then masked based on the target masking strategy.

[0009] Another possible implementation involves updating the large model based on the first and second losses corresponding to multiple first training samples, resulting in an updated large model. A validation sample set is obtained, comprising multiple validation samples and corresponding sample labels for each. Validation samples are keyword sequences determined based on the occurrence order of multiple keywords in historical API traffic data; sample labels indicate whether the behavior pattern conformed to by the validation sample is a normal or abnormal behavior pattern. First and second validation samples are generated based on the validation samples; the first validation sample is composed of some keywords from the validation samples, and the second validation sample is obtained by masking preset positions in the validation samples. The first validation sample and a third prompt are input into the updated large model to obtain the prediction perplexity; the third prompt is used to prompt the large model to determine the degree of deviation between the first validation sample and the normal behavior pattern, and the prediction perplexity represents the degree of deviation. The second validation sample and a fourth prompt are input into the updated large model to obtain the prediction probability distribution; the fourth prompt is used to prompt the large model to determine the confidence distribution corresponding to multiple preset keywords at preset positions. Based on the predicted perplexity and sample labels corresponding to multiple first validation samples, the perplexity corresponding to the validation sample set is determined; and based on the predicted probability distribution and validation samples corresponding to multiple second validation samples, the prediction accuracy corresponding to the validation sample set is determined. If the perplexity corresponding to the validation sample set is lower than a preset perplexity threshold and the prediction accuracy corresponding to the validation sample set is higher than a preset accuracy threshold, the preset convergence condition is satisfied, and the updated large model is used as the target large model.

[0010] Secondly, this application provides a behavior pattern recognition method, comprising: acquiring target API traffic data and multiple historical API traffic data within a preset time period prior to the target API traffic data that conform to normal behavior patterns; determining a target keyword sequence based on the order of keyword occurrence in the target API traffic data, and determining a historical keyword sequence based on multiple historical API traffic data; inputting the target keyword sequence, the historical keyword sequence, and a fifth prompt message into a target large model to obtain the target perplexity and probability sequence corresponding to the target keyword sequence; the probability sequence is used to represent the abnormal probability corresponding to each keyword in the target keyword sequence; the fifth prompt message is used to prompt the large model to determine the degree of deviation between the target keyword sequence and the historical keyword sequence, and to determine the abnormal probability corresponding to each keyword in the target keyword sequence; and determining the behavior pattern recognition result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence, wherein the behavior pattern recognition result is used to indicate whether the target keyword sequence conforms to a normal behavior pattern or an abnormal behavior pattern.

[0011] The technical solution provided in this application offers at least the following benefits: By acquiring target API traffic data and historical API traffic data conforming to normal behavior patterns within a pre-set time period, and constructing target keyword sequences and historical keyword sequences based on them respectively, a reliable benchmark of normal behavior patterns is established for subsequent comparative analysis, providing a reference for detection based on normal behavior patterns. Inputting the target keyword sequences and historical keyword sequences into the target large-scale model, supplemented by a fifth prompt to indicate the degree of sequence deviation and keyword anomaly probability, allows the model to leverage its pattern understanding of keyword sequences acquired during training, as well as its joint judgment of sequence coherence and contextual consistency, to discover the inherent logical relationships in API traffic data, thereby improving the detection accuracy of complex attacks. The target large-scale model can output an overall target perplexity and an anomaly probability sequence for each keyword in the sequence, providing both a global assessment and fine-grained local diagnosis of the target API traffic data's behavior patterns. The global target perplexity reflects the degree of deviation of the entire target sequence from the learned normal pattern; while the fine-grained probability sequence can accurately locate which keywords in the sequence are most likely to cause anomalies, providing interpretable clues for analysis. The final behavior pattern recognition result is determined by combining the target perplexity and probability sequence. This approach combines the overall anomaly level with local anomaly signals, making a more accurate judgment compared to a single indicator and effectively reducing the possibility of false alarms and false negatives.

[0012] One possible implementation involves extracting features from the target API traffic data to obtain target features. These target features include at least one of the following: request frequency features, contextual logic features, source IP features, or operation time features. The request frequency features represent the frequency of requests initiated by the target object corresponding to the target API traffic data. The contextual logic features represent the degree of matching between the target API traffic data and the historical behavioral characteristics of the target object. The source IP features represent the source IP of the target API traffic data. The operation time features represent the operation time of the target API traffic data. Based on the target perplexity and probability sequence corresponding to the target keyword sequence, the behavioral pattern recognition result of the target API traffic data is determined, including: determining the behavioral pattern recognition result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence and the target features.

[0013] Another possible implementation involves determining the attack type corresponding to the target API traffic data based on multiple preset attack weight models. Based on the attack type corresponding to the target API traffic data, the target perplexity, probability sequence, and the weight of each feature in the target features are determined. Based on the target perplexity and probability sequence corresponding to the target keyword sequence, and the target features, the behavioral pattern recognition result of the target API traffic data is determined, including: determining the behavioral pattern recognition result of the target API traffic data based on the target perplexity, probability sequence, and target features corresponding to the target keyword sequence, and the corresponding weights.

[0014] Another possible implementation involves determining the confidence level of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence. Specifically, if the confidence level is greater than or equal to a preset confidence threshold, it indicates that the behavior pattern recognition result shows the target keyword sequence conforms to an abnormal behavior pattern; if the confidence level is less than the preset confidence threshold, it indicates that the behavior pattern recognition result shows the target keyword sequence conforms to a normal behavior pattern.

[0015] Another possible implementation involves discarding the target API traffic data and ceasing to receive all data sent by the target source IP corresponding to the target API traffic data when the confidence level is greater than or equal to a first threshold; the first threshold is greater than the preset confidence threshold. When the confidence level is less than the first threshold but greater than or equal to a second threshold, the frequency of receiving data sent by the target source IP and the target object is reduced, and an authentication operation is triggered; the second threshold is less than the first threshold; the authentication operation verifies whether the target source IP matches the target object. When the confidence level is less than the second threshold but greater than or equal to a third threshold, the confidence level corresponding to the target API traffic data is recorded, and an alarm record is generated; the third threshold is less than the second threshold but greater than or equal to the preset confidence threshold.

[0016] Thirdly, this application provides a model training apparatus, comprising: an acquisition module, a processing module, and a training module. The acquisition module is used to acquire multiple first training samples; the processing module is used to determine a first label, a second training sample, and a second label corresponding to each first training sample; the training module is used to input the first training samples and first prompt information into a large model to obtain a first prediction sequence, input the second training samples and second prompt information into the large model to obtain a prediction probability distribution, determine a first loss based on the first label and the first prediction sequence, and determine a second loss based on the second label and the prediction probability distribution, and update the large model based on the first loss and the second loss corresponding to the multiple first training samples until a preset convergence condition is met to obtain the target large model.

[0017] In one possible implementation, the processing module is further configured to randomly select a target masking strategy from multiple preset masking strategies according to a preset ratio. The preset masking strategies include at least one of the following: a first preset masking strategy, used to replace keywords at random positions in the first training sample with placeholder markers; a second preset masking strategy, used to replace keywords at random positions in the first training sample with other keywords; and a third preset masking strategy, used to not mask the first training sample; wherein the preset ratio corresponds to the first preset masking strategy being greater than the ratios corresponding to the other preset masking strategies. The first training sample is then masked based on the target masking strategy.

[0018] Another possible implementation involves a training module that updates the large model based on the first and second losses corresponding to multiple first training samples, resulting in an updated large model. A validation sample set is obtained, comprising multiple validation samples and their corresponding sample labels. First and second validation samples are generated based on the validation samples. The first validation samples and a third prompt are input into the updated large model to obtain the prediction perplexity. The second validation samples and a fourth prompt are input into the updated large model to obtain the prediction probability distribution. Based on the prediction perplexity and sample labels corresponding to multiple first validation samples, the perplexity of the validation sample set is determined; and based on the prediction probability distribution and validation samples corresponding to multiple second validation samples, the prediction accuracy of the validation sample set is determined. If the perplexity of the validation sample set is lower than a preset perplexity threshold and the prediction accuracy of the validation sample set is higher than a preset accuracy threshold, a preset convergence condition is met, and the updated large model is used as the target large model.

[0019] Fourthly, this application provides a behavior pattern recognition device, comprising: an acquisition module, a processing module, and a recognition module. The acquisition module is used to acquire target API traffic data and multiple historical API traffic data within a preset time period preceding the target API traffic data that conform to normal behavior patterns. The processing module is used to determine a target keyword sequence based on the order of keyword appearance in the target API traffic data, and to determine a historical keyword sequence based on multiple historical API traffic data. The target keyword sequence, the historical keyword sequences, and a fifth prompt message are input into a target big model to obtain the target perplexity and probability sequence corresponding to the target keyword sequence. The recognition module is used to determine the behavior pattern recognition result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence. The behavior pattern recognition result is used to indicate whether the target keyword sequence conforms to a normal behavior pattern or an abnormal behavior pattern.

[0020] One possible implementation is that the identification module is also used to extract features from the target API traffic data to obtain target features; based on the target perplexity and probability sequence corresponding to the target keyword sequence, as well as the target features, the behavioral pattern recognition result of the target API traffic data is determined.

[0021] Another possible implementation involves an identification module that also determines the attack type corresponding to the target API traffic data based on multiple preset attack weight models. Based on the attack type corresponding to the target API traffic data, it determines the target perplexity, probability sequence, and the weight of each feature in the target features. Based on the target perplexity, probability sequence, and target features corresponding to the target keyword sequence, as well as their corresponding weights, it determines the behavioral pattern recognition result of the target API traffic data.

[0022] Another possible implementation involves an identification module that also determines the confidence level of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence. Specifically, if the confidence level is greater than or equal to a preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to an abnormal behavior pattern; if the confidence level is less than the preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to a normal behavior pattern.

[0023] In another possible implementation, the identification module is further configured to discard the target API traffic data and stop receiving all data sent by the target source IP corresponding to the target API traffic data when the confidence level is greater than or equal to a first threshold; the first threshold is greater than the preset confidence threshold. When the confidence level is less than the first threshold but greater than or equal to a second threshold, the frequency of receiving data sent by the target source IP and the target object is reduced, and an authentication operation is triggered; the second threshold is less than the first threshold; the authentication operation is used to verify whether the target source IP matches the target object. When the confidence level is less than the second threshold but greater than or equal to a third threshold, the confidence level corresponding to the target API traffic data is recorded, and an alarm record is generated; the third threshold is less than the second threshold and greater than or equal to the preset confidence threshold.

[0024] Fifthly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.

[0025] In a sixth aspect, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the method described in the first aspect.

[0026] In a seventh aspect, this application provides a computer program product comprising a computer program; when the computer program is run in an electronic device, it causes the electronic device to implement the method described in the first aspect.

[0027] The beneficial effects of the third to seventh aspects mentioned above are described in the corresponding descriptions of the first and second aspects, and will not be repeated here. Attached Figure Description

[0028] Figure 1 A schematic diagram of the architecture of a model training and behavior pattern recognition system provided in this application embodiment; Figure 2 A schematic flowchart illustrating a model training method provided in an embodiment of this application; Figure 3 A flowchart illustrating another model training method provided in an embodiment of this application; Figure 4 A flowchart illustrating a behavior pattern recognition method provided in an embodiment of this application; Figure 5 A flowchart illustrating another behavior pattern recognition method provided in this application embodiment; Figure 6 A flowchart illustrating a model training and behavior pattern recognition method provided in an embodiment of this application; Figure 7 This is a schematic diagram of the composition of a model training device provided in an embodiment of this application; Figure 8 This is a schematic diagram illustrating the composition of a behavior pattern recognition device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0029] The following will describe in detail, with reference to the accompanying drawings, a model training method, a behavior pattern recognition method, an electronic device, and a storage medium provided in this application.

[0030] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0031] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0032] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0033] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0034] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0035] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0036] The OpenStack cloud platform provides services through a series of RESTful APIs (such as Keystone, Nova, Neutron, etc.), and these APIs can become the main entry point for cyberattacks.

[0037] Most related security defense methods are rule-based detection and traditional machine learning-based anomaly detection. Rule-based detection relies on predefined signature libraries or regular expressions, and can only defend against known attack patterns (such as specific statement injection). It is entirely dependent on prior knowledge and lacks effective detection capabilities against unknown threats such as zero-day exploits and new attack methods. Traditional machine learning-based anomaly detection is usually based on simple numerical indicators (such as request frequency and number of source IPs) for statistical modeling. It cannot analyze the logical relationships between various features and has difficulty understanding the complex contextual semantics and logical relationships in API call sequences.

[0038] Therefore, existing security defense measures still suffer from limitations in effectively identifying and defending against new attack methods and have low detection accuracy against complex attacks. To address the aforementioned technical problems, this application provides a model training method and a behavior pattern recognition method. The approach is as follows: the first training sample is a keyword sequence determined based on the occurrence order of multiple keywords in historical API traffic data conforming to normal behavior patterns; the first label is obtained by right-shifting the first training sample by N positions. Therefore, training based on the first training sample and the first label allows the large model to learn normal behavior patterns and contextual relationships in API traffic data, enabling it to predict future keywords and avoid reliance on existing attack type features, thus achieving proactive protection against unknown threats. Furthermore, during training, a target masking strategy is used to mask the first training sample to obtain a second training sample, and the masked positions in the first training sample are preserved to obtain a second label. Training based on the second training sample and the second label allows the target large model to predict the masked positions in the sequence, thereby learning to analyze the keywords represented by the masked positions in the sequence. Therefore, the target large model can further learn deeper internal relationships within the sequence. As can be seen, the scheme provided in this application updates the large model based on the first loss (corresponding to the first training sample and the first label) and the second loss (corresponding to the second training sample and the second label), which enables the model to take into account both prediction targets. It integrates unidirectional sequence patterns and bidirectional contextual information in the internal representation of the model, thereby enabling the identification of more complex attack scenarios and improving the detection accuracy of complex attacks.

[0039] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0040] The model training method and behavior pattern recognition method provided in this application can be applied to, for example... Figure 1 The model training and behavior pattern recognition system shown. For example... Figure 1 As shown, the model training and behavior pattern recognition system 10 of this application includes: a training device 11 and a recognition device 12.

[0041] A communication connection is established between the training device 11 and the recognition device 12. For example, the connection can be wireless, such as Bluetooth or Wi-Fi; or it can be wired, such as fiber optic, etc., without limitation. For example, the training device 11 and the recognition device 12 can be connected to the Internet via a router, thereby establishing a communication connection between them.

[0042] In some embodiments, the training device 11 can determine a first label, a second training sample, and a second label corresponding to each first training sample based on the acquired first training samples, and train a target large model based on the first training samples, the first label, the second training samples, and the second label, so that the target large model can determine the perplexity of the sample and predict the accuracy of the sample. The training device 11 can also send the target large model to the recognition device 12, so that the recognition device 12 can determine the behavioral pattern recognition result of the API traffic data based on the target large model.

[0043] In some embodiments, the training device 11 can be a server, such as a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster.

[0044] In some embodiments, the training device 11 may also be a terminal device, such as a mobile phone, tablet computer, desktop computer, laptop computer, workstation, or other intelligent device with computing capabilities. This application embodiment does not impose any special limitations on the specific form of the training device.

[0045] In some embodiments, the recognition device 12 can acquire a target large model from the training device 11, enabling the recognition device 12 to use the target large model to determine the behavioral pattern recognition result of the API traffic data. The recognition device 12 can also determine a keyword sequence based on the order of occurrence of keywords in the acquired API traffic data, and input the keyword sequence into the target model to obtain the corresponding target perplexity and probability sequence, so that the recognition device 12 can determine the behavioral pattern recognition result of the target API traffic data.

[0046] In some embodiments, the identification device 12 can be a server, such as a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster.

[0047] In some embodiments, the identification device 12 can be a terminal device, such as a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc. This application embodiment does not impose any special limitations on the specific form of the terminal device.

[0048] Optionally, the identification device 12 can also store the acquired API traffic-related data to facilitate data retrieval, processing, and analysis.

[0049] In some embodiments, the model training and behavior pattern recognition system 10 may further include a prompting device 13.

[0050] There is a communication connection between the prompting device 13 and the identification device 12.

[0051] In some embodiments, the prompting device 13 may send a request for behavioral pattern recognition and API traffic data to the identification device 12, enabling the identification device 12 to perform behavioral pattern recognition on the API traffic data. If abnormal behavioral patterns are found in the API traffic data in the prompting device 13, the prompting device 13 may also receive alarm information or blocking operations from the identification device 12. The prompting device 13 may also be used to display the behavioral pattern recognition results and protective measures. For example, the prompting device 13 may be a display device, in which case the prompting device 13 presents the behavioral pattern recognition results and protective measures to the user by displaying them on a screen.

[0052] In some embodiments, the identification device 12 and the prompting device 13 can be as follows: Figure 1 As shown, it is a standalone device, or the identification device 12 and the prompting device 13 can be integrated into the same device.

[0053] It should be noted that the system architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0054] The following description, in conjunction with the accompanying drawings, introduces a model training method and a behavior pattern recognition method provided in the embodiments of this application.

[0055] For example, the model training method and behavior pattern recognition method provided in this application can be used... Figure 1 The model training and behavior pattern recognition system shown is implemented.

[0056] See Figure 2 This is a flowchart illustrating a model training method provided in an embodiment of this application. Figure 2 As shown, the model training method provided in this application includes the following steps S201~S206.

[0057] S201. Obtain multiple first training samples.

[0058] The first training sample is a keyword sequence determined by the order of occurrence of multiple keywords in historical API traffic data that conforms to normal behavior patterns.

[0059] In some embodiments, API traffic data refers to a collection of network communication data generated during interactions with one or more application programming interfaces (APIs). For example, API traffic data may include structured data records collected through logging, network packet capture, or application middleware. API traffic data can record bidirectional information of a complete API call's request and response, typically existing in the form of continuous log entries or session streams.

[0060] In some embodiments, historical API traffic data that conforms to normal behavior patterns refers to API traffic data used during the model training phase that originates from a certain period in the past and has been pre-verified or determined not to contain abnormal behavior patterns such as attacks.

[0061] In some embodiments, a keyword sequence refers to a sequence of keywords extracted from single or aggregated API traffic data in chronological order. Keyword sequences are used to abstractly represent the logic and sequence of an API interaction.

[0062] In some embodiments, historical API traffic log files or database records can be read in batches by accessing a storage system or log management platform to obtain multiple historical API traffic data that conform to normal behavior patterns. For example, raw, unstructured API traffic data can be collected from different levels, such as OpenStack Osprofiler, audit logs, and API gateway mirror traffic. OpenStack Osprofiler provides a distributed tracing perspective, capturing the complete call chain of an API request flowing between internal microservices. Audit logs are the most direct operation records. Raw network traffic can be collected from API gateway mirror traffic, serving as a unified entry point for all traffic.

[0063] In some embodiments, after acquiring historical API traffic data, the API traffic data is semantically preprocessed based on keywords and converted into standardized sequences. For example, the collected raw logs (such as POST / v2.1 / servers / abcd / action) are parsed and mapped to convert them into standardized sequences rich in business semantics. For instance, the conversion result might be: [USER_A] [PERFORM][ACTION:STOP] [RESOURCE_TYPE: VIRTUAL_MACHINE][RESOURCE_ID: abcd]. Standardized sequences can elevate low-level API traffic data to higher-level business intents.

[0064] In some embodiments, standardized sequences conforming to normal behavior patterns can be filtered out through multiple steps. For example, a rule engine can be used for rapid filtering. Blacklist and whitelist rules are established; standardized sequences conforming to whitelist rules are directly allowed into the whitelist, while standardized sequences conforming to blacklist rules are identified as exhibiting abnormal behavior patterns. The whitelist is then analyzed using statistical features. A Python script is written to group standardized sequences by user or operation type, and the abnormality of standardized sequences is determined by analyzing access frequency, time, and cardinality. Normal standardized sequences are marked, and then manually reviewed; abnormal standardized sequences are removed from the whitelist. Finally, OpenStack's own logic is invoked for verification, performing permission checks, resource ownership checks, and workflow status checks on the standardized sequences in the whitelist; standardized sequences that fail the checks are removed from the whitelist.

[0065] In some embodiments, the standardized sequences in the whitelist are grouped according to keywords such as usernames and arranged in chronological order to construct a keyword library. Finally, the contents of the standardized sequences are converted into numbers according to the keyword library to obtain the first training sample. For example, the standardized sequences in the whitelist are grouped by usernames and arranged in chronological order, with the data format as follows: {“USER_A”:# Normalized sequence data of user A.}

[0066] [“[USER_A] [ROLE:DEV][QUERY] [RESOURCE_TYPE:PROJECT]”, # User A performed a query operation, the object of which is project resources.

[0067] "[USER_A] [ROLE: DEV][QUERY] [RESOURCE_TYPE: VIRTUAL_MACHINE][LIST]", # User A performs a query operation, the object of which is virtual machine resources, and the specific action is to create a list.

[0068] "[USER_A] [ROLE:DEV][PERFORM] [ACTION: CREATE][RESOURCE_TYPE:VIRTUAL_MACHINE] [PARAM: name=web-server]"] # User A performed a creation operation, creating a virtual machine resource and providing a parameter: the virtual machine's name is web-server.

[0069] } In some embodiments, the keyword library contains all legal or meaningful keywords that may appear in a specific domain or task, and may also include the corresponding numbers for the keywords. For example, the keyword library format can be: { "[PAD]": 0, #fill "[UNK]": 1, #Unknown "[CLS]": 2, #Category "[SEP]": 3, #separator "[MASK]": 4, #mask "[user_dev]": 5, #user "[ROLE:DEVELOPER]": 6, #character "[QUERY]": 7, # Operation type "[PERFORM]": 8, # Operation type "[ACTION:CREATE]": 9, #Specific action "[ACTION:UPLOAD]": 10, #Specific action "[ACTION:DELETE]": 11, #Specific action ......}, For example, the content in the standardized sequence is converted into numbers according to the keyword library. For example, "[USER_A][ROLE: DEVELOPER][QUERY] [RESOURCE_TYPE: VIRTUAL_MACHINE][LIST]" is converted into [5,7,9,13,15], which yields the first training sample.

[0070] S202. Determine the first label, second training sample, and second label corresponding to each first training sample.

[0071] The first label is obtained by right-shifting the first training sample by N positions; the second training sample is obtained by masking the first training sample using a target masking strategy; and the second label is obtained by retaining the mask position in the first training sample.

[0072] In some embodiments, the first label refers to target data paired with the first training sample and used to train the model to perform a specific task. The first label is generated by right-shifting the sequence of the first training samples.

[0073] For example, in causal language modeling (CLM), the content seen by the model is controlled by setting the sequence length and the sliding length, thereby predicting the content that will appear at the next position. Assuming the sequence length is 6 and the sliding length is 1, the first training sample is the data in the sequence corresponding to the sequence length and the data before the sequence length, and the first label is the data in the sequence corresponding to the right shift of the sequence by the sliding length of 1.

[0074] In some embodiments, CLM is a pre-trained objective based on unidirectional context prediction. In CLM, the model is trained to predict the next word at a given position in a sequence based on all words preceding that position. The model cannot see future information during prediction. This training method enables the model to learn the generative patterns and coherence of language, making it suitable for tasks requiring autoregressive prediction, such as text generation, dialogue, and code completion.

[0075] In some embodiments, the second label refers to target data paired with the second training sample and used to train the model to perform a masked language modeling task. The second label retains the original keywords at the masked positions in the first training sample. For example, only the original keywords are retained at the masked positions, and the remaining positions are padded with -100.

[0076] For example, in masked language modeling (MLM), the content positions to be processed in the first training sample are selected first, while unselected content remains unchanged. The second label can then be designed as [-100, 5, -100, -100, -100, 15, -100, -100]. Here, -100 indicates that the loss calculation for that position is ignored. Only the masked positions need to have their loss calculated; other positions are set to -100 to prevent the model from learning content with known answers.

[0077] In some embodiments, MLM is a pre-trained objective based on bidirectional context for prediction. During MLM training, a certain percentage (e.g., 15%) of the content in the first training sample is randomly replaced with a special [MASK] marker. The model predicts the original word at the masked position based solely on all unmasked contextual information on the left and right sides of the marker. MLM enables the model to learn deep bidirectional relationships and semantics between words, thereby achieving powerful text understanding capabilities.

[0078] In some embodiments, the second training sample refers to a variant sequence of the first training sample after being masked. The second training sample is used to train the model to perform a specific task.

[0079] In some embodiments, among a plurality of preset masking strategies, a target masking strategy is randomly selected according to a preset ratio, and then the first training sample is masked based on the target masking strategy to obtain the second training sample.

[0080] In some embodiments, the preset masking strategy includes at least one of the following: a first preset masking strategy for replacing keywords at random positions in the first training sample with placeholder markers; a second preset masking strategy for replacing keywords at random positions in the first training sample with other keywords; a third preset masking strategy for not masking the first training sample; and in the preset ratio, the ratio corresponding to the first preset masking strategy is greater than the ratio corresponding to the other preset masking strategies.

[0081] For example, the masking strategy ratio can be set as follows: the first preset masking strategy has a probability of 80%, the second preset masking strategy has a probability of 10%, and the third preset masking strategy has a probability of 10%. For example, the strategy to be executed is selected by a random number. The random number is between 0 and 1. If the random number is greater than 0.2, the first preset masking strategy is adopted, such as: [CLS] [MASK]ROLE:DEV LOGIN QUERY_PL [MASK] CREATE_VM [SEP].

[0082] S203. Input the first training sample and the first prompt information into the large model to obtain the first prediction sequence.

[0083] The first hint is used to prompt the large model to predict the keywords that may appear after each keyword in the first training sample.

[0084] In some embodiments, the first predicted sequence refers to the sequence of keywords output by the large model based on the input prompts and training samples. The first predicted sequence reflects the model's prediction of the subsequent content of the input sequence.

[0085] In some embodiments, the first prompt message refers to a predefined text instruction or template. The first prompt message is used to guide and activate the large model to perform a specific prediction task. For example, the first prompt message may provide task background, evaluation objectives, output requirements, and domain knowledge hints.

[0086] For example, the task background could be: analyzing the first training sample based on user API traffic data in an OpenStack multi-tenant environment, and determining whether the current API traffic data deviates from the user's normal behavior pattern. The sample consisting of the user's historical API traffic data is {encoded_history}; the first training sample to be evaluated is {current_request_encoded}.

[0087] For example, the evaluation objectives could be: analyzing the logical coherence of the first training sample; assessing whether the current request is consistent with historical behavior patterns; determining whether there are abnormal operation patterns; and calculating the perplexity of the sample. The output requirement could be: please calculate and return the perplexity of the entire sample, reflecting the degree of deviation between the current API traffic data and the user's historical API traffic data. A higher perplexity indicates a more anomalous sample, while a lower perplexity indicates a more consistent pattern with expectations. Domain knowledge hints could be: normal users typically perform operations such as QUERY, CREATE, and START; DELETE operations are usually performed by administrators or in specific maintenance windows; accessing highly sensitive resources requires additional permissions; sudden changes in high-frequency operation patterns may indicate account intrusion.

[0088] In some embodiments, a base model (e.g., Qwen3-32B) can be used as the base pre-trained model, and then the task is triggered by prompt words to obtain the first predicted sequence. For example, the configuration of the base model can be set as follows: vocabulary size - 512, embedding dimension - 768, number of Transformer layers - 12, number of attention heads - 12, maximum positional encoding - 512; training batch size - 32, batch size - 16, learning rate - 5e-5, weight decay - 0.01, Adam optimizer epsilon value - 1e-8, maximum gradient clipping value - 1.0, warm-up steps - 1000, total training steps - 50000, logging step interval - 100, model save step interval - 1000, loss weight - 1.0.

[0089] For example, a prompt word that could be used in a CLM task is "You are a professional token prediction expert who can analyze perplexity through sample parsing and output the first prediction sequence".

[0090] In some embodiments, the constructed keyword library is aligned with the original word embedding layer of the base model through a projection layer or embedding replacement to ensure that the model can correctly understand and process the custom keywords.

[0091] In some embodiments, after embedding a keyword library, a first training sample and a first label are input, and the content seen by the model is controlled by setting the sequence length and sliding length to predict the sequence that will appear at the next position.

[0092] For example, if the sample is [5, 7, 9, 13, 15], when passed to the model, a [CLS] prefix will be added, making the sample [2, 5, 7, 9, 13, 15]. During training, the model takes the current position and the preceding sequence as input, and the first label is the next sequence. For instance, when the model sees [2, 5, 7], the first label is the next sequence to be predicted, 9.

[0093] S204. Input the second training sample and the second prompt information into the large model to obtain the predicted probability distribution.

[0094] The second prompt information is used to indicate the confidence level of multiple preset keywords in the preset keyword library at the mask position in the large model prediction; the prediction probability distribution is used to represent the confidence level distribution of multiple preset keywords at the mask position.

[0095] In some embodiments, confidence level refers to the probability that the model predicts the occurrence of the true keyword at the masked location.

[0096] In some embodiments, the predicted probability distribution refers to a numerical distribution output by the large model for each masked position in the second training sample. The predicted probability distribution quantifies the probability that each preset keyword in the preset keyword library will appear at that masked position.

[0097] In some embodiments, the second prompt refers to a predefined text instruction or template. The second prompt is used to guide the large model to perform a prediction task different from the first prompt. For example, the second prompt may include task context, mask location instructions, output format requirements, evaluation objectives, and domain knowledge hints.

[0098] For example, the task context could be: In the following OpenStack API training samples, some keywords have been replaced with [MASK]. The task is to predict the normal values ​​of these masked keywords based on the context and evaluate the degree of anomalousness of the actual keywords. The second training sample is {encoded_history}, and the second label ([MASK] indicates the position to be predicted) is {masked_request_sequence}. The masking position description can be that each [MASK] corresponds to a keyword; keywords include: user identity, operation type, resource type, permission level, operation parameters, etc.; prediction needs to be based on the user's historical API traffic data and OpenStack operation and maintenance specifications. The evaluation objectives could be: predict the most likely keyword to appear in this context; calculate the probability P of the actual keyword appearing; evaluate the degree of anomalousness of the keyword (degree of anomalousness = 1 - P). Domain knowledge could include: [ACTION:DELETE] operations are less common in development environments; [OWNER:tenant_b] indicates cross-tenant access, requiring special permissions; [SENSITIVITY: HIGH] resources require higher-level access control; [PARAM: force=true] is typically used for forced operations and should be used with caution. The output format requirements are as follows: position index: [position]; actual keyword: [actual_token]; most likely predicted keyword: [predicted_token]; actual keyword probability: P(actual_token|context) = [probability_value]; keyword mutation probability: 1 - P = [mutation_score]; anomaly level: [NORMAL / SUSPICIOUS / HIGH_RISK].

[0099] In some embodiments, a base model (e.g., Qwen3-32B) can be used as the base pre-trained model, and then the predicted probability distribution can be obtained by triggering the task with prompt words. For example, the configuration of the base model can be configured as described in S203 above, except that the loss weight is set to 1.

[0100] For example, a prompt in an MLM task could be "As a professional expert in masked content prediction, calculate the keyword probability distribution by parsing the masked sequence."

[0101] In some embodiments, a second training sample and a second label are input into the model, and the model returns the probability distribution of that position belonging to each keyword in a preset keyword library.

[0102] S205. Determine the first loss based on the first label and the first predicted sequence, and determine the second loss based on the second label and the predicted probability distribution.

[0103] In some embodiments, the first loss can be determined by calculating the average cross-entropy loss of the first label and the first predicted sequence. For example, in a CLM, the first loss is the average of the negative log-likelihood of the conditional probability at each position in the predicted sequence.

[0104] In some embodiments, the true keyword at the current location can be determined by the second label, the distribution probability of the true keyword can be determined based on the predicted probability distribution, and the second loss can be determined by the second label and the predicted probability distribution. For example, the second loss can be obtained by subtracting the distribution probability of the true keyword from 1.

[0105] S206. Update the large model based on the first loss and second loss corresponding to multiple first training samples until the preset convergence condition is met, and obtain the target large model.

[0106] In some embodiments, updating refers to the process of calculating gradients based on the loss value and adjusting the internal parameters of the large model. The purpose of updating is to optimize the predictive power of the large model in the direction of reducing the loss value.

[0107] In some embodiments, the preset convergence condition refers to a pre-defined training stopping criterion. The preset convergence condition is used to determine whether a large model has been sufficiently trained. For example, the preset convergence condition can be that a first loss is less than a first loss threshold and a second loss is less than a second loss threshold. The first loss threshold can be 0.5-0.7, for example, 0.6; the second loss threshold can be 0.01-0.05, for example, 0.02.

[0108] In some embodiments, the target large model refers to a large model obtained after training that is capable of performing both causal language modeling and masked language modeling tasks. The target large model has the ability to analyze API traffic keyword sequences and output perplexity and probability distribution.

[0109] In some embodiments, perplexity is the expected first loss.

[0110] For example, such as Figure 3As shown. First, in Phase 1, S1, raw API traffic data is collected from multiple sources, such as cloud service platforms, audit logs, and API gateway mirror traffic. Next, S2, normalization sequence, transforms the raw API traffic data into a standardized sequence format. Next, in Phase 2, S3, normal traffic filter, if traffic data representing abnormal behavior patterns exists, then S4, abnormal traffic, removes the abnormal traffic data; then S5, clean normal traffic library, places normal traffic data into a dedicated clean normal traffic library. Finally, in Phase 3, S6, causal language modeling and S7, masking language modeling, are executed, enabling the large model to predict the next sequence after the current sequence and the content of masked sequences in the current sequence. Then, S8, model evaluation and validation, if it does not meet the preset rules, S6 and S7 are re-executed; if it meets the preset rules, S9, model export is executed.

[0111] See Figure 4 This is a flowchart illustrating a behavior pattern recognition method provided in an embodiment of this application. Figure 4 As shown, the behavior pattern recognition method provided in this application includes the following steps S401~S404.

[0112] S401. Obtain the target API traffic data, as well as historical API traffic data within a preset time period that conforms to normal behavior patterns.

[0113] In some embodiments, target API traffic data refers to the latest API traffic data for which behavioral pattern identification is currently performed. Target API traffic data is the detection object that needs to be determined as either a normal or abnormal behavioral pattern.

[0114] In some embodiments, a preset time period refers to a historical time range defined to establish a baseline for normal behavior patterns. The preset time period is located before the time point corresponding to the target API traffic data.

[0115] For example, the preset time period may include a continuous historical time interval whose end point is adjacent to the start point of the target API traffic data time window. The length of the preset time period can be fixed, such as the past 24 hours or 7 days; or it can be dynamic, such as including the previous complete business cycle.

[0116] In some embodiments, historical API traffic data conforming to normal behavior patterns refers to a set of API call data that occurred within a preset time period and has been pre-verified or marked as normal. Historical API traffic data conforming to normal behavior patterns provides a reference baseline for identifying anomalies in target API traffic data.

[0117] In some embodiments, target API traffic data within the current time window can be obtained by subscribing to real-time data streams or polling monitoring interfaces. Multiple historical API traffic data points conforming to normal behavior patterns can be obtained by querying a time-series database or log indexing system, using the starting point of the target API traffic data as a reference to trace back a preset time period, and adding normal behavior filtering conditions.

[0118] For example, the obtained API traffic data may be in the following format.

[0119] DELETE / v2 / images / prod-db-backup-2024 # Delete the image resource for API version 2. Host: openstack-api.internal:9292 # Specifies the host address and port number to which the request is sent. X-Auth-Token: gAAAAABmQx... #Proves that the requester has been authenticated and is authorized to perform the operation. X-OpenStack-Tenant-ID: tenant_a # Specifies the project or tenant space to which this operation belongs. User-Agent: python-novaclient / 18.4.0 # Identifies the client software that issued the request. X-Forwarded-For: 10.0.1.100 # The request originally came from IP address 10.0.1.100 Timestamp: 2024-01-15T14:30:25Z #Precise time the request occurred Request Body: #The following is the request body content {"force": true, # Requires forced deletion of the image} "purge_props": true # Requires clearing all custom metadata properties when deleting the image. S402. Determine the target keyword sequence based on the order of keyword appearance in the target API traffic data, and determine the historical keyword sequence based on multiple historical API traffic data.

[0120] In some embodiments, the target API traffic data and multiple historical API traffic data are preprocessed according to keywords, grouped by keywords such as usernames, and arranged in chronological order before being converted into a standardized sequence. For example, the resulting standardized sequence may take the form shown below.

[0121] user_history = [ # User's historical behavior] "[user_dev][ROLE:DEVELOPER][QUERY][RESOURCE_TYPE:SERVER][LIST][TENANT:tenant_a]", # User user_dev (role:DEVELOPER) performed a query operation under his tenant_a. The resource type queried was SERVER, and the specific operation was to list the servers.

[0122] "[user_dev][ROLE:DEVELOPER][PERFORM][ACTION:CREATE][RESOURCE_TYPE:VM][PARAM:name=test-web][TENANT:tenant_a]", # The user performed a creation operation under their tenant, creating a virtual machine as the resource type and specifying the virtual machine name as test-web.

[0123] "[user_dev][ROLE:DEVELOPER][QUERY][RESOURCE_TYPE:IMAGE][LIST][TENANT:tenant_a]", # User user_dev performed a query operation under its tenant. The resource type queried was IMAGE, and the specific operation was to list the image.

[0124] "[user_dev][ROLE:DEVELOPER][PERFORM][ACTION:UPLOAD][RESOURCE_TYPE:IMAGE][PARAM:name=dev-image][TENANT:tenant_a]", # User user_dev performs an upload operation under its tenant, uploading a resource of type IMAGE, and specifying the image name as dev-image.

[0125] "[user_dev][ROLE:DEVELOPER][QUERY][RESOURCE_TYPE:NETWORK][LIST][TENANT:tenant_a]" # User user_dev (role DEVELOPER) performed a query operation under their tenant tenant_a. The resource type queried was NETWORK, and the specific operation was to list the networks. In some embodiments, after conversion to a standardized sequence, the content in the standardized sequence can be converted into numbers according to a keyword library to obtain a keyword sequence. For example, the converted keyword sequence may be as follows.

[0126] encoded_history = [ #Historical keyword sequence] [5, 6, 7, 12, 16, 17], [5, 6, 8, 9, 13, 23, 17], [5, 6, 7, 14, 16, 17], [5, 6, 8, 10, 14, 24, 17], [5, 6, 7, 15, 16, 17] S403. Input the target keyword sequence, the historical keyword sequence, and the fifth prompt information into the target big model to obtain the target confusion degree and probability sequence corresponding to the target keyword sequence.

[0127] Among them, the probability sequence is used to represent the abnormal probability corresponding to each keyword in the target keyword sequence; the fifth prompt information is used to prompt the large model to determine the degree of deviation between the target keyword sequence and the historical keyword sequence, and to determine the abnormal probability corresponding to each keyword in the target keyword sequence.

[0128] In some embodiments, the fifth prompt message refers to a predefined text instruction or template. The fifth prompt message is used to guide the target large model to perform a specific evaluation task. For example, the fifth prompt message can refer to the first and second prompt messages to activate the large model to perform corresponding CLM and MLM tasks.

[0129] In some embodiments, the fifth prompt message, historical keyword sequence, and target keyword sequence can be combined into a complete context by string concatenation or template filling, and then input into the target large model to obtain the target perplexity and probability sequence. The inference interface of the target large model is designed to simultaneously output the overall perplexity assessment value of the input sequence, as well as the anomaly probability estimate for each element in the sequence.

[0130] For example, after inputting multiple historical behavior sequences and the current behavior sequence, the CLM task analyzes the rationality and fluency of the entire current behavior sequence and finally returns the sequence perplexity; the MLM task masks the input sequence to obtain the masked sequence, and the model calculates the probability of the true keyword appearing at each mask position and returns the anomaly probability estimate for each mask position element in the sequence.

[0131] S404. Based on the target perplexity and probability sequence corresponding to the target keyword sequence, determine the behavioral pattern recognition result of the target API traffic data.

[0132] Among them, the behavior pattern recognition result is used to indicate whether the target keyword sequence conforms to a normal behavior pattern or an abnormal behavior pattern.

[0133] In some embodiments, the behavior pattern recognition result refers to the final judgment conclusion obtained after comprehensive analysis. The behavior pattern recognition result clearly identifies whether the behavior represented by the target API traffic data belongs to a normal behavior pattern or an abnormal behavior pattern.

[0134] In some embodiments, to determine the behavioral pattern recognition results of the target API traffic data, the target API traffic data is first subjected to feature extraction to obtain target features.

[0135] The target features include at least one of the following: request frequency feature, context logic feature, source IP feature, or operation time feature; the request frequency feature is used to indicate the frequency of requests initiated by the target object corresponding to the target API traffic data; the context logic feature is used to indicate the degree of matching between the target API traffic data and the historical behavior features of the target object; the source IP feature is used to indicate the source IP of the target API traffic data; and the operation time feature is used to indicate the operation time of the target API traffic data.

[0136] In some embodiments, the request frequency characteristic is a metric calculated from target API traffic data to quantify the intensity of requests. The request frequency characteristic reflects the activity intensity of the target object per unit of time. For example, the request frequency characteristic score can be calculated as follows.

[0137]

[0138] in, Indicates the request frequency characteristic score. Indicates the current request frequency. This indicates the user's historical average frequency. The value ranges from 0 to 100.

[0139] In some embodiments, contextual logic features refer to metrics used to measure the consistency of current behavioral logic, obtained by comparing target API traffic data with the historical behavioral patterns of the target object. Contextual logic features reflect the degree of matching or deviation between the current operation and historical habitual patterns. For example, a contextual logic feature score can be calculated by calculating the cosine similarity between the current operation sequence and the user's historical high-frequency operation sequence, or by calculating the state transition probability of the current operation step in the user's historical behavior Markov model.

[0140] In some embodiments, source IP characteristics refer to the network address attributes extracted from target API traffic data that identify the origin of the request. Source IP characteristics are the basis for geolocation, network environment, and device association analysis.

[0141] An example, the calculation method for source IP feature scores can be as follows.

[0142]

[0143] in, Indicates the source IP characteristic score. This represents a reputation score, ranging from 0 to 1, where 1 indicates complete trustworthiness and 0 indicates complete untrustworthiness. Sourced from a threat intelligence database.

[0144] In some embodiments, operation time characteristics refer to attributes extracted from target API traffic data that identify the time or time window in which the request occurred. Operation time characteristics are the basis for determining whether the behavior occurred within a normal or expected time period.

[0145] In some embodiments, the operation time characteristic score can be calculated by dividing time periods according to risk level to reflect the risk of non-normal working hours. For example, the segmented assignments can be: working hours: 0; edge time (20:00-22:00): 30; late night time (22:00-06:00): 70; holidays: 90.

[0146] In some embodiments, after obtaining the target features, the behavioral pattern recognition result of the target API traffic data is determined based on the target perplexity and probability sequence corresponding to the target keyword sequence, as well as the target features.

[0147] In some embodiments, a target perplexity score can be calculated based on the target perplexity. An exemplary method for calculating the target perplexity score is as follows.

[0148]

[0149] in, Indicates the target confusion score. Indicates the degree of confusion surrounding the target. This represents the baseline perplexity, which defaults to 15. This represents the scaling factor, for example, 40.

[0150] For example, the impact of the baseline perplexity value on the behavior pattern recognition results can be seen in Table 1.

[0151] Table 1. Impact of Baseline Perplexity Value

[0152] In some embodiments, the attack type corresponding to the target API traffic data can then be determined based on multiple preset attack weight models.

[0153] In some embodiments, a preset attack weight model refers to a predefined and trained model or rule set. The preset attack weight model is used to quantify target features into a probability score for a specific attack type. For example, the preset attack weight model may include: discriminant functions constructed for different attack scenarios (such as brute-force attacks, privilege escalation, data breaches, denial-of-service attacks, etc.). Each preset attack weight model embeds weight parameters derived from expert knowledge or machine learning for that attack pattern, defining the importance contribution of different features (such as request frequency, operation logic, source IP, operation time) to judging this type of attack. The model receives standardized input and outputs a comprehensive score representing the probability of belonging to that type of attack.

[0154] For example, the various scores calculated above are substituted into preset attack weight models (such as brute-force attacks, privilege escalation, etc.) for parallel weighted calculation. Finally, the type with the highest weighted score is determined as the attack scenario to which the API traffic data belongs. Under this mechanism, even when facing the same original API traffic data, different comprehensive anomaly confidence scores and final decisions will be calculated due to different triggered weight models, thereby achieving scenario-adaptive intrusion defense.

[0155] In some embodiments, after determining the attack type corresponding to the target API traffic data, the target perplexity, probability sequence, and weight corresponding to each feature in the target features are determined based on the attack type corresponding to the target API traffic data. For example, in various attack types, the target perplexity, probability sequence, and weight corresponding to each feature in the target features can be as shown in Weight Table 2.

[0156] Table 2 Parameter weights for various attack types

[0157] In some embodiments, the confidence level of the target API traffic data is determined based on the target perplexity and probability sequence corresponding to the target keyword sequence.

[0158] In some embodiments, after determining the attack type corresponding to the target API traffic data, a confidence score is calculated based on the target perplexity, probability sequence, and target features corresponding to the target keyword sequence, as well as the corresponding weights. For example, the confidence score can be calculated by multiplying the target perplexity, probability sequence, and target features by their respective weights, summing the products, and then performing a normalization operation, such as dividing by 100 to obtain an abnormal confidence score between 0 and 1.

[0159] In some embodiments, if the confidence level is greater than or equal to a preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to an abnormal behavior pattern.

[0160] In some embodiments, if the confidence level is greater than or equal to a first threshold, the target API traffic data is discarded, and all data sent by the target source IP corresponding to the target API traffic data is stopped; the first threshold is greater than the preset confidence threshold. In some embodiments, if the confidence level is less than the first threshold and greater than or equal to the second threshold, the frequency of receiving data sent by the target source IP and the target object is reduced, and an authentication operation is triggered; the second threshold is less than the first threshold; the authentication operation is used to verify whether the target source IP and the target object match.

[0161] In some embodiments, if the confidence level is less than the second threshold and greater than or equal to the third threshold, the confidence level corresponding to the target API traffic data is recorded and an alarm record is generated; the third threshold is less than the second threshold and greater than or equal to the preset confidence threshold.

[0162] In some embodiments, if the confidence level is less than a preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to a normal behavior pattern.

[0163] For example, such as Figure 5 As shown, the API traffic data is first preprocessed semantically to obtain a standardized sequence, followed by the construction of a keyword sequence. Then, a large model is used to calculate the keyword sequence, simultaneously calculating the target perplexity and probability sequence; next, target feature analysis is performed, calculating scores for each target feature. Based on the results, the attack type is determined, and a weighting strategy is selected. Finally, a comprehensive scoring engine is used to calculate a confidence score, and decisions and responses are made based on the confidence score: if the API traffic data is low-risk, logs are recorded; if the API traffic data is medium-risk, an alert is generated; if the API traffic data is high-risk, it is blocked in real time.

[0164] For example, such as Figure 6As shown. The above method can be executed as follows: First, execute step S1, data input, inputting the target API traffic data and historical API traffic data; then execute step S2, data processing, processing the API traffic data into keyword sequences; next, execute step S3, data analysis, calculating the target perplexity, probability sequence, and target features corresponding to the target keyword sequence, as well as the corresponding weights, thereby calculating the confidence score; finally, execute step S4, intelligent decision-making and automatic response, analyzing whether the target API traffic data belongs to attack behavior based on the calculated confidence score, and taking corresponding measures for target API traffic data that contains attack behavior.

[0165] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0166] This application embodiment can divide the model training device and behavior pattern recognition device into functional modules according to the above method examples. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0167] In some embodiments, this application also provides a model training apparatus. The model training apparatus may include one or more functional modules for implementing the model training methods of the above method embodiments.

[0168] For example, Figure 7 This is a schematic diagram illustrating the composition of a model training device 700 provided in an embodiment of this application. Figure 7 As shown, the model training device includes: an acquisition module 701, a processing module 702, and a training module 703.

[0169] The acquisition module 701 is used to acquire multiple first training samples; the processing module 702 is used to determine the first label, second training sample and second label corresponding to each first training sample; the training module 703 is used to input the first training samples and the first prompt information into the large model to obtain the first prediction sequence, input the second training samples and the second prompt information into the large model to obtain the prediction probability distribution, determine the first loss based on the first label and the first prediction sequence, and determine the second loss based on the second label and the prediction probability distribution, update the large model based on the first loss and the second loss corresponding to multiple first training samples, until the preset convergence condition is met to obtain the target large model.

[0170] In one possible implementation, processing module 702 is further configured to randomly select a target masking strategy from multiple preset masking strategies according to a preset ratio. The preset masking strategies include at least one of the following: a first preset masking strategy, used to replace keywords at random positions in the first training sample with placeholder markers; a second preset masking strategy, used to replace keywords at random positions in the first training sample with other keywords; and a third preset masking strategy, used not to mask the first training sample. In the preset ratio, the ratio corresponding to the first preset masking strategy is greater than the ratios corresponding to the other preset masking strategies. The first training sample is then masked based on the target masking strategy.

[0171] Another possible implementation, training module 703, is also used to update the large model based on the first loss and second loss corresponding to multiple first training samples, to obtain the updated large model. A validation sample set is obtained, including multiple validation samples and sample labels corresponding to each validation sample. First and second validation samples are generated based on the validation samples. The first validation samples and third prompt information are input into the updated large model to obtain the prediction perplexity. The second validation samples and fourth prompt information are input into the updated large model to obtain the prediction probability distribution. Based on the prediction perplexity and sample labels corresponding to multiple first validation samples, the perplexity corresponding to the validation sample set is determined; and based on the prediction probability distribution and validation samples corresponding to multiple second validation samples, the prediction accuracy corresponding to the validation sample set is determined. If the perplexity corresponding to the validation sample set is lower than a preset perplexity threshold and the prediction accuracy corresponding to the validation sample set is higher than a preset accuracy threshold, a preset convergence condition is satisfied, and the updated large model is used as the target large model.

[0172] In some embodiments, this application also provides a behavior pattern recognition device. This behavior pattern recognition device may include one or more functional modules for implementing the behavior pattern recognition method of the above method embodiments.

[0173] For example, Figure 8 This is a schematic diagram illustrating the composition of a behavior pattern recognition device 800 provided in an embodiment of this application. Figure 8 As shown, the behavior pattern recognition device includes: an acquisition module 801, a processing module 802, and a recognition module 803.

[0174] The acquisition module 801 is used to acquire target API traffic data and multiple historical API traffic data that conform to normal behavior patterns within a preset time period prior to the target API traffic data; the processing module 802 is used to determine the target keyword sequence based on the order of keyword appearance in the target API traffic data and to determine the historical keyword sequence based on multiple historical API traffic data, and input the target keyword sequence, the historical keyword sequence, and the fifth prompt information into the target big model to obtain the target perplexity and probability sequence corresponding to the target keyword sequence; the identification module 803 is used to determine the behavior pattern identification result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence, and the behavior pattern identification result is used to indicate whether the target keyword sequence conforms to a normal behavior pattern or an abnormal behavior pattern.

[0175] In one possible implementation, the identification module 803 is also used to extract features from the target API traffic data to obtain target features; based on the target perplexity and probability sequence corresponding to the target keyword sequence, as well as the target features, the behavioral pattern recognition result of the target API traffic data is determined.

[0176] Another possible implementation involves the identification module 803 further determining the attack type corresponding to the target API traffic data based on multiple preset attack weight models. Based on the attack type corresponding to the target API traffic data, it determines the target perplexity, probability sequence, and the weight corresponding to each feature in the target features. Based on the target perplexity, probability sequence, and target features corresponding to the target keyword sequence, as well as the corresponding weights, it determines the behavioral pattern recognition result of the target API traffic data.

[0177] Another possible implementation involves the identification module 803 further determining the confidence level of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence. Specifically, if the confidence level is greater than or equal to a preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to an abnormal behavior pattern; if the confidence level is less than the preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to a normal behavior pattern.

[0178] In another possible implementation, the identification module 803 is further configured to discard the target API traffic data and stop receiving all data sent by the target source IP corresponding to the target API traffic data when the confidence level is greater than or equal to a first threshold; the first threshold is greater than the preset confidence threshold. When the confidence level is less than the first threshold but greater than or equal to a second threshold, the frequency of receiving data sent by the target source IP and the target object is reduced, and an authentication operation is triggered; the second threshold is less than the first threshold; the authentication operation is used to verify whether the target source IP matches the target object. When the confidence level is less than the second threshold but greater than or equal to a third threshold, the confidence level corresponding to the target API traffic data is recorded, and an alarm record is generated; the third threshold is less than the second threshold but greater than or equal to the preset confidence threshold.

[0179] In the case of implementing the functions of the integrated modules described above in hardware, this embodiment of the invention provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 9 As shown, the electronic device 900 includes: a processor 902, a communication interface 903, and a bus 904. Optionally, the electronic device 900 may also include a memory 901.

[0180] Processor 902 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0181] The communication interface 903 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0182] The memory 901 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0183] As one possible implementation, the memory 901 can exist independently of the processor 902. The memory 901 can be connected to the processor 902 via a bus 904 and is used to store instructions or program code. When the processor 902 calls and executes the instructions or program code stored in the memory 901, it can implement the model training method and behavior pattern recognition method provided in the embodiments of the present invention.

[0184] In another possible implementation, the memory 901 can also be integrated with the processor 902.

[0185] The 904 bus can be an extended industry standard architecture (EISA) bus, etc. The 904 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0186] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0187] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned service invocation device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned service invocation device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned service invocation device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned service invocation device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0188] This application also provides a computer program product, which includes a computer program that, when run on a computer, causes the computer to execute any of the model training methods and behavior pattern recognition methods provided in the above embodiments.

[0189] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A model training method, characterized in that, include: Obtain multiple first training samples; The first training sample is a keyword sequence determined based on the order of occurrence of multiple keywords in historical API traffic data that conforms to normal behavior patterns; Determine the first label, second training sample, and second label corresponding to each first training sample; The first label is obtained by right-shifting the first training sample by N bits; the second training sample is obtained by masking the first training sample using a target masking strategy. The second label is obtained by preserving the mask position in the first training sample; The first training sample and the first prompt information are input into the large model to obtain the first prediction sequence; The first prompt message is used to prompt the large model to predict the keywords that may appear after each keyword in the first training sample; The second training sample and the second prompt information are input into the large model to obtain the predicted probability distribution; The second prompt information is used to indicate the confidence level of multiple preset keywords in the preset keyword library predicted by the large model at the mask position; the prediction probability distribution is used to represent the confidence level distribution of the multiple preset keywords at the mask position; A first loss is determined based on the first label and the first predicted sequence, and a second loss is determined based on the second label and the predicted probability distribution; The large model is updated based on the first loss and second loss corresponding to multiple first training samples until a preset convergence condition is met, thus obtaining the target large model.

2. The method according to claim 1, characterized in that, The second training sample was determined in the following way: Among multiple preset masking strategies, the target masking strategy is randomly selected according to a preset ratio; the preset masking strategy includes at least one of the following: a first preset masking strategy, used to replace keywords at random positions in the first training sample with placeholder markers; The second preset masking strategy is used to replace keywords at random positions in the first training sample with other keywords; The third preset masking strategy is used to avoid masking the first training sample; In the preset ratios, the ratio corresponding to the first preset masking strategy is greater than the ratios corresponding to other preset masking strategies; The first training sample is masked based on the target masking strategy.

3. The method according to claim 1, characterized in that, The process of updating the large model based on the first loss and second loss corresponding to multiple first training samples until a preset convergence condition is met to obtain the target large model includes: The large model is updated based on the first loss and second loss corresponding to multiple first training samples to obtain the updated large model. Obtain a verification sample set, which includes: multiple verification samples and sample tags corresponding to each verification sample. The verification sample is a keyword sequence determined based on the occurrence order of multiple keywords in historical API traffic data. The sample tag is used to indicate whether the behavior pattern conforms to by the verification sample is a normal behavior pattern or an abnormal behavior pattern. A first verification sample and a second verification sample are generated based on the verification sample; the first verification sample is composed of some keywords in the verification sample, and the second verification sample is obtained by masking a preset position in the verification sample. The first verification sample and the third prompt information are input into the updated large model to obtain the predicted perplexity; the third prompt information is used to prompt the large model to determine the degree of deviation between the first verification sample and the normal behavior pattern, and the predicted perplexity is used to represent the degree of deviation; The second verification sample and the fourth prompt information are input into the updated large model to obtain the predicted probability distribution; the fourth prompt information is used to prompt the large model to determine the confidence distribution of the multiple preset keywords at the preset position. Based on the predicted perplexity and sample labels corresponding to multiple first validation samples, the perplexity corresponding to the validation sample set is determined; and based on the predicted probability distribution corresponding to multiple second validation samples and the validation samples, the prediction accuracy corresponding to the validation sample set is determined. If the perplexity of the validation sample set is lower than a preset perplexity threshold and the prediction accuracy of the validation sample set is higher than a preset accuracy threshold, then the preset convergence condition is satisfied, and the updated large model is taken as the target large model.

4. A behavior pattern recognition method, characterized in that, include: Acquire target API traffic data, as well as historical API traffic data within a preset time period preceding the target API traffic data that conforms to normal behavior patterns; The target keyword sequence is determined based on the order of occurrence of keywords in the target API traffic data, and the historical keyword sequence is determined based on the multiple historical API traffic data. The target keyword sequence, the historical keyword sequence, and the fifth prompt information are input into the target large model trained according to any one of claims 1-3 to obtain the target perplexity and probability sequence corresponding to the target keyword sequence; the probability sequence is used to represent the anomaly probability corresponding to each keyword in the target keyword sequence; the fifth prompt information is used to prompt the large model to determine the degree of deviation between the target keyword sequence and the historical keyword sequence, and to determine the anomaly probability corresponding to each keyword in the target keyword sequence; Based on the target perplexity and probability sequence corresponding to the target keyword sequence, the behavior pattern recognition result of the target API traffic data is determined. The behavior pattern recognition result is used to indicate whether the target keyword sequence conforms to a normal behavior pattern or an abnormal behavior pattern.

5. The method according to claim 4, characterized in that, The method further includes: Feature extraction is performed on the target API traffic data to obtain target features; the target features include at least one of the following: request frequency feature, context logic feature, source IP feature, or operation time feature; the request frequency feature is used to represent the request frequency initiated by the target object corresponding to the target API traffic data; the context logic feature is used to represent the degree of matching between the target API traffic data and the historical behavior features of the target object; the source IP feature is used to represent the source IP of the target API traffic data; the operation time feature is used to represent the operation time of the target API traffic data; The step of determining the behavioral pattern recognition result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence includes: Based on the target perplexity and probability sequence corresponding to the target keyword sequence, and the target features, the behavioral pattern recognition result of the target API traffic data is determined.

6. The method according to claim 5, characterized in that, The method further includes: The attack type corresponding to the target API traffic data is determined based on multiple preset attack weight models; Based on the attack type corresponding to the target API traffic data, determine the target perplexity, the probability sequence, and the weight corresponding to each feature in the target features; The step of determining the behavioral pattern recognition result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence, and the target features, includes: Based on the target perplexity, probability sequence, and target features corresponding to the target keyword sequence, as well as the corresponding weights, the behavioral pattern recognition result of the target API traffic data is determined.

7. The method according to any one of claims 4-6, characterized in that, The step of determining the behavioral pattern recognition result of the target API traffic data based on the target perplexity and probability sequence corresponding to the target keyword sequence includes: Based on the target perplexity and probability sequence corresponding to the target keyword sequence, determine the confidence level corresponding to the target API traffic data; Wherein, if the confidence level is greater than or equal to a preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to an abnormal behavior pattern; If the confidence level is less than the preset confidence threshold, it indicates that the behavior pattern recognition result is that the target keyword sequence conforms to a normal behavior pattern.

8. The method according to claim 7, characterized in that, The method further includes: If the confidence level is greater than or equal to the first threshold, the target API traffic data is discarded, and all data sent by the target source IP corresponding to the target API traffic data is stopped; the first threshold is greater than the preset confidence threshold. If the confidence level is less than the first threshold and greater than or equal to the second threshold, the frequency of receiving data sent by the target source IP and the target object is reduced, and an authentication operation is triggered; the second threshold is less than the first threshold; the authentication operation is used to verify whether the target source IP and the target object match; If the confidence level is less than the second threshold and greater than or equal to the third threshold, the confidence level corresponding to the target API traffic data is recorded and an alarm record is generated; the third threshold is less than the second threshold and greater than or equal to the preset confidence threshold.

9. An electronic device, characterized in that, The device includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the model training method as described in any one of claims 1 to 3 or the behavior pattern recognition method as described in any one of claims 4 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the model training method as claimed in any one of claims 1 to 3 or the behavior pattern recognition method as claimed in any one of claims 4 to 8.

Images