A method, apparatus and electronic device for detecting network security anomalies

Abstract

This invention discloses a method, apparatus, and electronic device for network security anomaly detection, relating to the field of network security technology. The method includes: receiving candidate network security anomaly events submitted by at least two anomaly detection agents, each event containing a suspicious entity identifier and an anomaly score; constructing a suspicious entity set and calculating an aggregate anomaly score and uncertainty measure for each entity; identifying entities with uncertainty measures exceeding a preset threshold as target entities and sending a solicitation request to agents that have not yet submitted the target entity; receiving support and confidence scores returned by the solicited entities and updating the aggregate anomaly score and uncertainty measure; and making an anomaly determination based on the aggregate anomaly score. This invention is applicable to multi-source anomaly detection scenarios in distributed network environments and can solve the problem of inaccurate detection in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security anomaly detection method, apparatus, and electronic device. Background Technology

[0002] As digital transformation deepens, network architectures are becoming increasingly complex. The widespread application of cloud computing, edge computing, the Internet of Things, and microservice architectures is blurring network boundaries and leading to a significant increase in asset scale. Simultaneously, cyberattack methods are constantly evolving, with new attack methods emerging one after another, such as advanced persistent threats, ransomware, supply chain attacks, and insider threats. Attack chains often span multiple network layers and time windows, exhibiting characteristics of high concealment, long incubation periods, and multi-stage coordination. Single security protection methods are insufficient to cope with such a complex threat landscape; cybersecurity anomaly detection urgently needs to evolve from single-point protection to a systematic and collaborative approach.

[0003] Existing network security monitoring systems typically deploy various types of security monitoring devices, covering different dimensions such as network traffic, host behavior, application logs, database operations, and terminal external connections. These devices each generate a large amount of detection data and alerts. However, due to differences in data formats, detection granularity, time bases, and threat assessment criteria among these devices, it is difficult to directly correlate and uniformly analyze the multi-source detection results. Information silos between different detection devices make it difficult for security analysts to form a complete view of the same attack target, easily creating detection blind spots and analysis breakpoints, thus leading to inaccurate detection. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a network security anomaly detection method, apparatus, and electronic device to solve the problem of inaccurate detection in the prior art.

[0005] In a first aspect, embodiments of the present invention provide a network security anomaly detection method, comprising:

[0006] Receive candidate cybersecurity anomaly events submitted by at least two anomaly detection agents, each candidate cybersecurity anomaly event containing a suspicious entity identifier and a corresponding anomaly score;

[0007] Based on the received candidate network security anomalies, a set of suspicious entities is constructed, and for each suspicious entity in the set: based on all the anomaly scores associated with the suspicious entity that have been received, an aggregate anomaly score and uncertainty measure for the suspicious entity are calculated;

[0008] Suspicious entities whose uncertainty measure is higher than a preset threshold are identified as target entities, and at least one anomaly detection agent that has not yet submitted the target entity's identifier is selected as the solicitation object. A solicitation request containing the target entity's identifier is sent to the solicitation object.

[0009] Receive the support and corresponding confidence scores for the target entity returned by the query object, and update the aggregate anomaly score and uncertainty measure of the target entity based on the support and confidence scores;

[0010] Based on the aggregated anomaly score, an anomaly determination is made for the target entity.

[0011] Furthermore, the calculation of the aggregated anomaly score and uncertainty measure of the suspicious entity includes:

[0012] When there are multiple abnormal scores that have been received and are associated with the suspicious entity, the uncertainty measure is calculated using the following statistical method: the variance or information entropy among all the abnormal scores;

[0013] When the number of abnormal scores associated with the suspicious entity received is one, the uncertainty metric is set to a default value, which is higher than the preset threshold.

[0014] Furthermore, updating the aggregated anomaly score and uncertainty measure of the target entity based on the support and the confidence includes:

[0015] Based on the confidence level, determine the fusion weight of the support.

[0016] Multiply the support by the fusion weight to obtain the weighted support;

[0017] The uncertainty measure is adjusted based on the deviation between the weighted support and the current aggregated anomaly score;

[0018] The weighted support is averaged with the current aggregated anomaly score to obtain the updated aggregated anomaly score.

[0019] Furthermore, determining the fusion weight of the support based on the confidence level includes:

[0020] Obtain the accuracy rate of the survey subjects in historical tests;

[0021] The fusion weight of the support is determined based on the confidence level and the accuracy.

[0022] Furthermore, before determining the fusion weight of the support based on the confidence level, the method further includes:

[0023] When the support level returned by the respondents contradicts the sign of the current aggregated anomaly score, an evidence conflict is identified.

[0024] Calculate the aggregate confidence score of the current aggregated anomaly score, which is determined based on the confidence scores of each support that has participated in the fusion; when there are no support scores that have participated in the fusion, the aggregate confidence score is set as the default confidence score.

[0025] The confidence level returned by the query object is compared with the aggregate confidence level;

[0026] If the confidence level returned by the solicitation object is higher than the aggregate confidence level, then the support level and confidence level returned by the solicitation object are used as the support level and confidence level of this round of fusion, respectively, triggering the execution of the fusion weight operation that determines the support level based on the confidence level;

[0027] If the aggregate confidence level is not lower than the confidence level returned by the query object, then the operation of determining the fusion weight of the support based on the confidence level will not be performed in this round.

[0028] Furthermore, the method also includes:

[0029] For the target entity, the steps of selecting the solicitation object, sending the solicitation request, receiving the response, and updating the aggregated anomaly score and uncertainty measure are repeated until the preset stopping condition is met;

[0030] The stopping conditions include at least one of the following: the uncertainty metric drops below the preset threshold, the preset maximum number of queries is reached, or there is no abnormal detection agent that has not yet submitted the target entity.

[0031] Furthermore, selecting at least one anomaly detection agent that has not yet submitted the target entity as the solicitation target includes:

[0032] Prioritize selecting an anomaly detection agent whose data source type is different from that of the anomaly detection agent that has submitted the target entity as the query target.

[0033] Furthermore, sending a request containing the target entity's identifier to the requesting object includes:

[0034] The query request may include a time window and / or contextual constraints for the desired retrieval, instructing the querying party to determine the scope of data to be retrieved in relation to the target entity.

[0035] Furthermore, before identifying suspicious entities whose uncertainty measure exceeds a preset threshold as target entities, the process also includes:

[0036] If the initial value of the uncertainty measure of any suspicious entity is lower than the preset threshold, the suspicious entity will be directly judged as abnormal without initiating a query.

[0037] Furthermore, the method is executed by a collaboration layer server deployed in the network security monitoring system;

[0038] The method further includes: deploying the at least two anomaly detection agents in host monitoring equipment, network traffic monitoring equipment, database auditing equipment, or illegal external connection monitoring equipment, respectively.

[0039] Secondly, embodiments of the present invention provide a network security anomaly detection device, comprising:

[0040] An anomaly receiving unit is used to receive candidate network security anomaly events submitted by at least two anomaly detection agents. Each candidate network security anomaly event includes a suspicious entity identifier and a corresponding anomaly score.

[0041] An anomaly aggregation unit is used to construct a set of suspicious entities based on the received candidate network security anomaly events, and for each suspicious entity in the set: based on all the anomaly scores associated with the suspicious entity that have been received, calculate the aggregated anomaly score and uncertainty measure of the suspicious entity;

[0042] An anomaly solicitation unit is used to identify suspicious entities whose uncertainty measure is higher than a preset threshold as target entities, and to select at least one anomaly detection agent that has not yet submitted the identifier of the target entity as a solicitation object, and to send a solicitation request containing the identifier of the target entity to the solicitation object.

[0043] An anomaly update unit is used to receive the support and corresponding confidence scores for the target entity returned by the query object, and update the aggregate anomaly score and uncertainty measure of the target entity based on the support and confidence scores;

[0044] An anomaly determination unit is used to determine anomalies in the target entity based on the aggregated anomaly score.

[0045] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the network security anomaly detection method described in the first aspect above.

[0046] The technical solution provided by this invention receives candidate network security anomaly events from multiple anomaly detection agents and constructs a set of suspicious entities. It unifies the multi-source heterogeneous detection results to the entity dimension for correlation analysis, and then calculates an aggregate anomaly score and uncertainty measure based on the anomaly score of each suspicious entity, thereby quantifying the degree of discrepancy between multi-source detection results. For suspicious entities with uncertainty measures higher than a preset threshold, it actively selects anomaly detection agents that have not yet submitted information on the target entity as solicitation targets and sends a solicitation request containing the target entity's identifier, breaking through the information barriers between detection devices in the prior art and realizing dynamic supplementation of evidence for the same attack target. By receiving the support and confidence levels returned by the solicitation targets and updating the aggregate anomaly score and uncertainty measure accordingly, it gradually eliminates detection blind spots and analysis breakpoints, and finally makes anomaly judgments based on the updated aggregate anomaly score, significantly improving the accuracy of network security anomaly detection. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 An architecture diagram of a network security monitoring system provided in an embodiment of the present invention;

[0049] Figure 2 This is a flowchart of a network security monitoring method provided in Embodiment 1 of the present invention;

[0050] Figure 3 This is a flowchart of a network security monitoring method provided in Embodiment 2 of the present invention;

[0051] Figure 4 This is a schematic diagram of a conflict arbitration mechanism provided in Embodiment 3 of the present invention;

[0052] Figure 5 This is a flowchart of a network security monitoring method provided in Embodiment 4 of the present invention;

[0053] Figure 6 This is a schematic diagram of the structure of a network security monitoring device provided in Embodiment 5 of the present invention;

[0054] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0055] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0056] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0057] This invention is applied to a network security monitoring system. See also... Figure 1 The system may include: a collaboration layer server; and multiple anomaly detection agents deployed on various heterogeneous security monitoring devices (n devices in the example in the diagram). These heterogeneous security monitoring devices include, but are not limited to: host monitoring devices, network traffic monitoring devices, database auditing devices, and unauthorized external connection monitoring devices. Each anomaly detection agent independently collects and analyzes security data for its corresponding monitoring dimension and reports anomalies to the collaboration layer server. The collaboration layer server aggregates the anomalies reported by each agent, performs fusion analysis on multi-source anomalies, and solicits evidence from relevant agents for anomalies with insufficient evidence to supplement the evidence. Based on the feedback, the analysis conclusion is iteratively optimized, and finally, the anomaly determination is completed. This embodiment of the invention is applicable to collaborative anomaly detection scenarios with multiple heterogeneous security monitoring devices deployed in a distributed network environment.

[0058] The technical solution of the present invention will be described in detail below through various embodiments.

[0059] Example 1

[0060] This embodiment provides a method for detecting network security anomalies, which can be executed by a corresponding network security anomaly detection device. The device can be deployed on a collaborative layer server within a network security monitoring system. See also... Figure 2 The method specifically includes the following steps 201-205.

[0061] Step 201: Receive candidate network security anomaly events submitted by at least two anomaly detection agents. Each candidate network security anomaly event includes a suspicious entity identifier and a corresponding anomaly score.

[0062] In this step, the collaboration layer server can establish communication connections with multiple anomaly detection agents deployed on different monitoring nodes via network interfaces. Each anomaly detection agent runs on different heterogeneous security monitoring devices, such as host monitoring devices, network traffic monitoring devices, database auditing devices, or unauthorized external connection monitoring devices. These monitoring devices differ in their deployment location and functional positioning, as well as their data sources and monitoring dimensions: host monitoring devices primarily collect operating system logs and process behavior data, focusing on host-level anomaly detection; network traffic monitoring devices primarily collect network data packets and flow statistics, focusing on network-level anomaly detection; database auditing devices primarily collect database access logs and SQL operation records, focusing on data-level anomaly detection; and unauthorized external connection monitoring devices primarily collect terminal external connection behavior and boundary traffic data, focusing on external connection channel anomaly detection.

[0063] Each anomaly detection agent independently analyzes raw security data based on the local data source and specific monitoring dimensions of its monitoring device, employing adapted detection rules or models, and generates candidate network security anomalies. Each candidate network security anomaly consists of two parts: a suspicious entity identifier and an anomaly score. The suspicious entity identifier uniquely identifies the detected suspicious object, which can be an IP address, a user account, a process identifier, or a database operation session. The anomaly score quantifies the degree of anomaly of the suspicious entity within the current monitoring dimension, typically a normalized numerical value.

[0064] The collaboration layer server monitors event reporting channels from various anomaly detection agents in real time or periodically. When a candidate network security anomaly event is received, the collaboration layer server parses the event's data structure, extracts the suspicious entity identifier and anomaly score, and stores the event in a pending queue. The collaboration layer server continues to receive events until a preset reception period or reception quantity threshold is reached, providing a data foundation for subsequently building a suspicious entity set.

[0065] Step 202: Construct a set of suspicious entities based on the received candidate network security anomalies, and for each suspicious entity in the set: calculate the aggregate anomaly score and uncertainty measure of the suspicious entity based on all the anomaly scores associated with the suspicious entity that have been received.

[0066] After receiving and caching candidate network security anomaly events within a preset period, the collaboration layer server performs a suspicious entity set construction operation. Specifically, the collaboration layer server iterates through all candidate network security anomaly events received within the preset period, groups and deduplicates them according to their suspicious entity identifiers, and merges events with the same suspicious entity identifier under the same entity entry to form a suspicious entity set. For each suspicious entity in the set, the collaboration layer server extracts all received anomaly scores associated with that suspicious entity as multi-source detection evidence for that suspicious entity.

[0067] For each suspicious entity, the collaboration layer server performs two calculations based on the extracted associated anomaly scores: first, aggregate anomaly scores, which aggregates anomaly scores from different anomaly detection agents according to a preset fusion strategy to obtain a quantitative value of the comprehensive anomaly degree of the suspicious entity under the current evidence conditions; second, uncertainty measure, which is used to characterize the degree of divergence or consistency among the detection results of each anomaly detection agent for the suspicious entity.

[0068] Regarding the calculation of the aggregated anomaly score, the collaboration layer server fuses all received anomaly scores associated with the suspicious entity. In specific implementations, the collaboration layer server can use an arithmetic average method, summing the anomaly scores and dividing by the number of scores to obtain the aggregated anomaly score; alternatively, it can assign fusion weights to different anomaly scores based on the historical accuracy of each anomaly detection agent or the reliability of the data source, and calculate the aggregated anomaly score using a weighted average method.

[0069] Regarding the specific calculation of uncertainty measurement, the collaboration layer server first counts the number of anomalous scores received that are associated with the suspicious entity. When there are multiple such scores, the collaboration layer server calculates the uncertainty measurement using the following statistical methods: calculating the variance among all associated anomalous scores to reflect the degree to which each score deviates from the central trend; a larger variance indicates greater divergence among agents and higher uncertainty. Alternatively, it calculates the information entropy of all associated anomalous scores to reflect the degree of disorder or information content in the score distribution; a higher information entropy indicates higher uncertainty. When there is only one such score, since there is only a single anomalous score, the degree of divergence cannot be calculated using variance or information entropy. The collaboration layer server sets the uncertainty measurement for the suspicious entity to a default value, which is pre-configured to be higher than the preset threshold used in subsequent steps to determine whether to initiate an inquiry. This ensures that, in the case of only a single source of evidence, the suspicious entity can be identified as a target entity requiring further supplementary evidence.

[0070] For example, suppose that for a suspicious entity A, the collaboration layer server receives three anomaly scores associated with A: 0.8 submitted by the first anomaly detection agent, 0.6 submitted by the second anomaly detection agent, and 0.9 submitted by the third anomaly detection agent. Using the arithmetic mean to calculate the aggregated anomaly score, the aggregated anomaly score is (0.8 + 0.6 + 0.9) / 3 = 0.7667. Regarding the uncertainty measure, if the variance method is used, first calculate the arithmetic mean of the three scores, 0.7667, and then calculate the squared deviations of each score from the mean: (0.8 - 0.7667)² ≈ 0.0011, (0.6 - 0.7667)² ≈ 0.0278, (0.9 - 0.7667)² ≈ 0.0178. Summing the squared deviations and dividing by the number of scores (3), we get a variance of approximately 0.0156, which is the uncertainty measure. If only a single anomaly score of 0.6 is received from the first agent, the collaboration layer server sets the uncertainty metric to a default value of 1.0, which is higher than the preset threshold of 0.5.

[0071] Step 203: Identify suspicious entities with uncertainty metrics exceeding a preset threshold as target entities, and select at least one anomaly detection agent that has not yet submitted the target entity's identifier as a solicitation target, and send a solicitation request containing the target entity's identifier to the solicitation target.

[0072] After constructing the suspicious entity set and calculating the aggregated anomaly score and uncertainty measure, the collaboration layer server iterates through each suspicious entity in the set and compares its uncertainty measure with a preset threshold. When the uncertainty measure of a suspicious entity exceeds the preset threshold, the collaboration layer server identifies that suspicious entity as a target entity and marks it as an object requiring further supplementary evidence.

[0073] Subsequently, the collaboration layer server filters out anomaly detection agents that have not yet submitted target entity data from all connected anomaly detection agents. Specifically, the collaboration layer server queries the received data records of candidate network security anomalies, identifies anomaly detection agents that have previously submitted candidate network security anomalies containing the identifier of the target entity, and excludes them; then, it selects at least one from the remaining anomaly detection agents as the query target. Preferably, anomaly detection agents with data source types different from those that have submitted target entity data are prioritized as the query targets. Since monitoring devices with different data source types differ in data acquisition methods, detection algorithm principles, and threat judgment standards, selecting agents with heterogeneous data sources for querying can avoid the systematic bias that may be caused by homogeneous data sources, improve the diversity and complementarity of supplementary evidence, and thus enhance the reliability of subsequent fusion analysis.

[0074] The collaboration layer server constructs a request, encapsulates the identifier of the target entity within the request, and sends the request to the requesting object. Upon receiving the request, the requesting object retrieves security events related to the target entity from its local monitoring data based on the target entity identifier. Preferably, a desired retrieval time window and / or contextual constraints are appended to the request to instruct the requesting object to determine the retrieval scope of data associated with the target entity. The time window limits the start and end time periods of the requesting object's backtracking retrieval, and the contextual constraints limit the data type or association conditions to be retrieved. By appending a time window and contextual constraints, the retrieval scope of the requesting object can be narrowed, its computational load reduced, and response latency shortened, while avoiding the return of too much irrelevant data that could interfere with the fusion results.

[0075] For example, the step of attaching the desired retrieval time window to the query request may include:

[0076] Obtain the data source type of the target audience;

[0077] Based on the obtained data source type, a preset time window configuration table is queried to determine the time window length corresponding to the data source type; wherein, the time window configuration table records the time window lengths corresponding to different data source types, and the time window lengths corresponding to different data source types are different;

[0078] Based on the time when the target entity is identified, a time window is generated by combining the determined time window length.

[0079] The generated time window is appended to the request.

[0080] In the above example, the collaboration layer server maintains a preset time window configuration table. This table is pre-set based on the data retention period, storage capacity, and event density characteristics of different data source types. For example, the time window length for network traffic monitoring devices is 2 hours, for host monitoring devices it is 12 hours, for database auditing devices it is 24 hours, and for unauthorized external connection monitoring devices it is 30 minutes. The collaboration layer server uses the time point at which the target entity is identified as a baseline, backtracks by half the time window length, and extends by half the time window length to generate a closed time interval, which is then encapsulated in a query request.

[0081] It should be noted that for suspicious entities with an uncertainty measure not exceeding a preset threshold, the collaboration layer server directly makes anomaly judgments based on the already calculated aggregated anomaly score without initiating further inquiries. Specifically, for suspicious entities with an uncertainty measure lower than or equal to the preset threshold, it indicates that the currently received multi-source anomaly scores have little discrepancy and the evidence is relatively sufficient, eliminating the need for further inquiries to other anomaly detection agents. The collaboration layer server directly compares the aggregated anomaly score of the suspicious entity with a preset alarm threshold. If the aggregated anomaly score is higher than the alarm threshold, the suspicious entity is determined to be anomaly and an alarm is output; if the aggregated anomaly score is not higher than the alarm threshold, the suspicious entity is determined to be normal, and it is removed from the suspicious entity set or marked as processed. Thus, the collaboration layer server only invests in inquiries for suspicious entities with high uncertainty, avoiding unnecessary communication overhead for entities with sufficient evidence, thereby improving overall detection efficiency.

[0082] Step 204: Receive the support and corresponding confidence scores for the target entity returned by the query object, and update the aggregated anomaly score and uncertainty measure of the target entity based on the support and confidence scores.

[0083] In this step, the collaboration layer server receives the support and corresponding confidence scores for the target entity returned by the query object selected in step 203, and uses the support and confidence scores as supplementary evidence to update the aggregate anomaly score and uncertainty measure of the target entity.

[0084] Support is a quantified value representing the strength of anomalies returned by the query object for the target entity. Its sign indicates the direction of judgment: a positive value indicates the query object considers the target entity to be abnormal, while a negative value indicates the target entity is considered normal. Its absolute value represents the strength; a larger absolute value indicates a higher degree of anomaly or normality confidence from the query object. It is worth noting that support, anomaly score, and aggregated anomaly score use the same normalization standard to ensure that subsequent weighted average calculations can be performed directly. Confidence is a quantified representation of the reliability of the query object's own support judgment, reflecting the degree of confidence the query object has when returning that support level. During fusion updates, the collaboration layer server determines the fusion weight of support based on confidence; query objects with higher confidence levels have a larger weight in the aggregated anomaly score update.

[0085] After the update is completed, the collaboration layer server compares the updated uncertainty metric with a preset threshold. If the updated uncertainty metric is still higher than the preset threshold, it indicates that there is still a significant discrepancy in the current evidence. The collaboration layer server retains the target entity in the suspicious entity set and continues to select other anomaly detection agents that have not yet submitted the target entity as new solicitation targets. The steps of sending solicitation requests, receiving responses, and updating scores and uncertainty metrics are repeated until the uncertainty metric drops below the preset threshold.

[0086] If the updated uncertainty metric is still higher than the preset threshold, but there are no longer any anomaly detection agents that have not yet submitted their reports for the target entity, the collaboration layer server stops the cyclical solicitation for that target entity and directly makes an anomaly determination for the target entity based on the currently updated aggregated anomaly score. If the updated uncertainty metric has dropped below the preset threshold, the collaboration layer server also makes an anomaly determination for the target entity based on the current aggregated anomaly score.

[0087] Step 205: Based on the aggregated anomaly score, make an anomaly judgment on the target entity.

[0088] In this step, the collaboration layer server obtains the aggregated anomaly score of the target entity updated in step 204, and compares the aggregated anomaly score with a preset alarm threshold. If the aggregated anomaly score is higher than the alarm threshold, the target entity is determined to be abnormal, and an anomaly judgment result is output. If the aggregated anomaly score is not higher than the alarm threshold, the target entity is determined to be normal, and a normal judgment result is output. The anomaly judgment result is used to trigger subsequent security response procedures or remove the anomaly mark from the target entity.

[0089] Example 2

[0090] This embodiment is based on Embodiment 1 above, and further optimizes step 204, "updating the aggregate anomaly score and uncertainty measure of the target entity based on the support and confidence levels." See also Figure 3 A network security anomaly detection method specifically includes the following steps 301-307.

[0091] Step 301: Receive candidate network security anomaly events submitted by at least two anomaly detection agents. Each candidate network security anomaly event includes a suspicious entity identifier and a corresponding anomaly score.

[0092] This step is the same as step 201 in Embodiment 1, and will not be repeated here.

[0093] Step 302: Construct a set of suspicious entities based on the received candidate network security anomalies, and for each suspicious entity in the set: calculate the aggregate anomaly score and uncertainty measure of the suspicious entity based on all the anomaly scores associated with the suspicious entity that have been received.

[0094] This step is the same as step 202 in Example 1, and will not be repeated here.

[0095] Step 303: Identify suspicious entities with uncertainty metrics exceeding a preset threshold as target entities, and select at least one anomaly detection agent that has not yet submitted the target entity's identifier as a solicitation target, and send a solicitation request containing the target entity's identifier to the solicitation target.

[0096] This step is the same as step 203 in Example 1, and will not be repeated here.

[0097] Step 304: Receive the support and corresponding confidence scores for the target entity returned by the query object, determine the fusion weight of the support based on the confidence score, and multiply the support by the fusion weight to obtain the weighted support.

[0098] In this step, after receiving the support and corresponding confidence scores for the target entity from each query object, the collaboration layer server determines the fusion weight of that support score based on the corresponding confidence score, and multiplies the support score by the determined fusion weight to obtain the weighted support score. Specifically, the collaboration layer server can directly use the confidence score as the fusion weight; or, the collaboration layer server can query a preset confidence score-weight mapping table to convert the confidence scores for the target entity returned by the query object into the corresponding fusion weights.

[0099] For example, if the collaboration layer server receives a support score of +0.8 and a confidence score of 0.9 for the target entity from the first query object, it determines the fusion weight to be 0.9 based on the confidence score of 0.9, and multiplies the support score of +0.8 with the fusion weight of 0.9 to obtain a weighted support score of +0.72. If the collaboration layer server receives a support score of -0.6 and a confidence score of 0.8 for the target entity from the second query object, it determines the fusion weight to be 0.8 based on the confidence score of 0.8, and multiplies the support score of -0.6 with the fusion weight of 0.8 to obtain a weighted support score of -0.48.

[0100] As a preferred implementation, determining the fusion weight of support based on confidence level includes: obtaining the accuracy rate of the target in historical detections; and determining the fusion weight of support based on the confidence level and the obtained accuracy rate. Specifically, the collaboration layer server queries the locally maintained agent historical accuracy records to obtain the historical detection accuracy rate of the target within a recent preset period; the confidence level and accuracy rate are weighted and combined or multiplied to obtain the fusion weight. For example, if the confidence level is 0.9 and the historical accuracy rate is 0.85, the collaboration layer server multiplies the two to obtain a fusion weight of 0.765, or calculates the fusion weight as 0.9 × 0.6 + 0.85 × 0.4 = 0.88 according to a preset ratio (e.g., confidence level accounts for 60% and accuracy rate accounts for 40%); then, this fusion weight is multiplied by the support to obtain the weighted support. Thus, the support of target candidates with stable historical detection performance receives a higher weight in the fusion, while the support weight of target candidates with large fluctuations in historical performance is correspondingly suppressed.

[0101] Step 305: Based on the deviation between the obtained weighted support and the current aggregated anomaly score of the target entity, adjust the uncertainty measure of the target entity.

[0102] In this step, the collaboration layer server obtains the weighted support obtained in step 304 and the current aggregated anomaly score of the target entity; calculates the deviation between the weighted support and the current aggregated anomaly score; and adjusts the uncertainty measure of the target entity based on the deviation.

[0103] Specifically, the current aggregated anomaly score refers to the historical baseline value before the update in step 306, i.e., the aggregated anomaly score accumulated by the target entity before the current solicitation and fusion operation. The collaboration layer server calculates the absolute value of the difference between the weighted support and the current aggregated anomaly score to obtain the deviation. The deviation characterizes the degree of deviation between the newly acquired weighted support and the historical consensus: if the deviation is large, it indicates that the judgment of the solicited object differs significantly from the historical consensus, and the collaboration layer server increases the uncertainty measure; if the deviation is small, it indicates that the judgment of the solicited object tends to be consistent with the historical consensus, and the collaboration layer server decreases the uncertainty measure.

[0104] For example, assuming the target entity's current aggregate anomaly score is +0.5 and the weighted support obtained in step 304 is +0.72, then the bias is |+0.72 - (+0.5)| = 0.22. Based on the bias of 0.22, the collaboration layer server corrects the uncertainty measure according to a preset adjustment strategy, such as reducing the original uncertainty measure from 0.8 to 0.6. If the weighted support is -0.48, then the bias is |-0.48 - (+0.5)| = 0.98. Based on this larger bias, the collaboration layer server increases the uncertainty measure from 0.8 to 1.2 to reflect the increased uncertainty caused by conflicting evidence.

[0105] Step 306: Calculate the weighted support obtained and the current aggregated anomaly score of the target entity using a weighted average to obtain the updated aggregated anomaly score of the target entity.

[0106] In this step, the collaboration layer server obtains the weighted support obtained in step 304 and the current aggregated anomaly score of the target entity; the weighted support and the current aggregated anomaly score are weighted and averaged to obtain the updated aggregated anomaly score of the target entity.

[0107] Specifically, the collaboration layer server sums the weighted support score with the current aggregated anomaly score and divides the sum by two to obtain the updated aggregated anomaly score; alternatively, the collaboration layer server assigns update weights to both the weighted support score and the current aggregated anomaly score, sums the assigned values, and obtains the updated aggregated anomaly score. The collaboration layer server uses the updated aggregated anomaly score to overwrite the current aggregated anomaly score, serving as the historical baseline for the next round of fusion operations for the target entity.

[0108] For example, assuming the target entity's current aggregate anomaly score is +0.5, and the weighted support obtained in step 304 is +0.72, the collaboration layer server sums +0.72 and +0.5 and divides by two to obtain the updated aggregate anomaly score of +0.61. If the collaboration layer server subsequently obtains a weighted support of -0.48 based on the new solicitation results, then +0.61 is used as the current aggregate anomaly score, and summed with -0.48 and divided by two to obtain the updated aggregate anomaly score of +0.065.

[0109] Step 307: Based on the aggregated anomaly score, make an anomaly judgment on the target entity.

[0110] This step is the same as step 205 in Example 1, and will not be repeated here.

[0111] Based on the above solutions, see Figure 4 The network security anomaly detection method provided in this embodiment also provides a conflict arbitration mechanism, specifically, before determining the fusion weight of support based on confidence level, it further includes:

[0112] When the support level returned by the respondents for the target entity contradicts the sign of the target entity's current aggregated anomaly score, an evidence conflict is identified.

[0113] Calculate the aggregate confidence of the current aggregated anomaly score of the target entity. The aggregate confidence is determined based on the confidence of each support of the target entity that has participated in the fusion. When there are no support of the target entity that has participated in the fusion, the aggregate confidence is set as the default confidence.

[0114] The confidence level for the target entity returned by the query object is compared with the aggregate confidence level;

[0115] If the confidence level returned by the solicitation object for the target entity is higher than the aggregate confidence level, then the support level and confidence level returned by the solicitation object for the target entity are used as the support level and confidence level for this round of fusion, respectively, triggering the execution of the fusion weight operation that determines the support level based on the confidence level.

[0116] If the aggregate confidence level is not lower than the confidence level returned by the query object, then the operation of determining the fusion weight based on the confidence level will not be performed in this round.

[0117] In the aforementioned conflict arbitration mechanism, the collaboration layer server compares the support level for the target entity returned by the solicitation object with the current aggregated anomaly score of the target entity; when the two signs are opposite, the collaboration layer server identifies an evidence conflict.

[0118] Next, the collaboration layer server calculates the aggregate confidence score of the current aggregated anomaly score of the target entity. Specifically, the collaboration layer server extracts each support level that has participated in the fusion of the target entity and its corresponding confidence score; it then calculates the aggregate confidence score based on the extracted confidence scores. As one implementation, the collaboration layer server performs an arithmetic average of the extracted confidence scores to obtain the aggregate confidence score. When there are no support levels that have participated in the fusion of the target entity, i.e., no solicitation fusion operation has been performed on the target entity, the collaboration layer server sets the aggregate confidence score as the default confidence score. The default confidence score can be determined based on the number of initial anomaly scores corresponding to the target entity and a preset baseline confidence score; for example, when there are two initial anomaly scores, the default confidence score is the product of the preset baseline confidence score and an adjustment coefficient, where the adjustment coefficient is greater than 1.0. Typically, the preset baseline confidence score is 0.5, and the adjustment coefficient ranges from 1.2 to 1.5.

[0119] Then, the collaboration layer server compares the confidence level for the target entity returned by the solicitation object with the aggregate confidence level. If the confidence level returned by the solicitation object is higher than the aggregate confidence level, the collaboration layer server uses the support level returned by the solicitation object as the support level for this round of fusion and performs the operation of determining the fusion weight based on the confidence level. If the aggregate confidence level is not lower than the confidence level returned by the solicitation object, the collaboration layer server does not perform the operation of determining the fusion weight based on the confidence level for this round, nor does it perform the subsequent operation of multiplying the support level by the fusion weight. The aggregate anomaly score and uncertainty measure of the target entity remain unchanged.

[0120] Example 3

[0121] This embodiment provides a preferred embodiment based on all the above embodiments. See also... Figure 5 A network security anomaly detection method specifically includes the following steps 501-510.

[0122] Step 501: Receive candidate network security anomaly events submitted by multiple anomaly detection agents. Each candidate network security anomaly event includes a suspicious entity identifier and a corresponding anomaly score.

[0123] Step 502: Construct a set of suspicious entities based on the received candidate network security anomaly events.

[0124] Step 503: Select one suspicious entity from the suspicious entity set that needs to be judged as the current suspicious entity.

[0125] Step 504: For the current suspicious entity: Based on all the received anomaly scores associated with the current suspicious entity, calculate the aggregate anomaly score and uncertainty measure of the current suspicious entity.

[0126] Step 505: Determine whether to perform an anomaly query for the current suspicious entity; if yes, proceed to step 506, otherwise proceed to step 508.

[0127] If at least one of the following conditions is met, it is determined that no abnormal inquiry is required for the current suspicious entity, and the process proceeds to step 508: The uncertainty measure of the current suspicious entity is below a preset threshold; The preset maximum number of inquiries has been reached; There are no anomaly detection agents that have not yet submitted the target entity identifier. If none of the above three conditions are met, it is determined that an anomaly solicitation for the current suspicious entity should be performed, and step 506 should be executed.

[0128] Step 506: Identify the current suspicious entity as the target entity, select an anomaly detection agent that has not yet submitted the target entity's identifier as the object of this solicitation, and send a solicitation request containing the target entity's identifier to the object of this solicitation.

[0129] Step 507: Receive the support and corresponding confidence scores for the target entity returned by the respondents in this solicitation. Update the aggregated anomaly score and uncertainty measure of the target entity based on the support and confidence scores. This anomaly solicitation ends; return to step 505.

[0130] Step 508: Based on the latest aggregated anomaly score, make an anomaly judgment on the current suspicious entity.

[0131] Step 509: Determine if there are other suspicious entities in the suspicious entity set that require anomaly judgment. If yes, return to step 503 to continue execution; otherwise, proceed to step 510.

[0132] Step 510: Output the anomaly judgment results for each suspicious entity in the suspicious entity set.

[0133] Example 4

[0134] This embodiment provides a network security anomaly detection device, which can be used to execute the network security anomaly detection method described in this embodiment of the invention, and can be implemented by software and / or hardware. See also Figure 6 The device specifically includes the following units:

[0135] Anomaly receiving unit 601 is used to receive candidate network security anomaly events submitted by at least two anomaly detection agents, each candidate network security anomaly event including a suspicious entity identifier and a corresponding anomaly score;

[0136] Anomaly aggregation unit 602 is configured to construct a set of suspicious entities based on the received candidate network security anomaly events, and for each suspicious entity in the set: calculate the aggregated anomaly score and uncertainty measure of the suspicious entity based on all the anomaly scores associated with the suspicious entity that have been received;

[0137] Anomaly solicitation unit 603 is used to identify suspicious entities whose uncertainty measure is higher than a preset threshold as target entities, and select at least one anomaly detection agent that has not yet submitted the identifier of the target entity as a solicitation object, and send a solicitation request containing the identifier of the target entity to the solicitation object.

[0138] Anomaly update unit 604 is used to receive the support and corresponding confidence of the target entity returned by the query object, and update the aggregate anomaly score and uncertainty measure of the target entity according to the support and the confidence.

[0139] The anomaly determination unit 605 is used to make an anomaly determination on the target entity based on the aggregated anomaly score.

[0140] For example, the anomaly aggregation unit 602 is specifically used to: when there are multiple anomaly scores that have been received and are associated with the suspicious entity, calculate the uncertainty measure using the following statistical method: the variance or information entropy among all the anomaly scores; when there is only one anomaly score that has been received and is associated with the suspicious entity, set the uncertainty measure to a default value, the default value being higher than the preset threshold.

[0141] For example, the exception update unit 604 specifically includes:

[0142] The fusion weight determination subunit is used to determine the fusion weight of the support based on the confidence level;

[0143] The weighted support generation subunit is used to multiply the support by the fusion weight to obtain the weighted support;

[0144] An uncertainty metric adjustment subunit is used to adjust the uncertainty metric based on the deviation between the weighted support and the current aggregated anomaly score;

[0145] The aggregated anomaly score update subunit is used to perform a weighted average of the weighted support and the current aggregated anomaly score to obtain the updated aggregated anomaly score.

[0146] Specifically, the fusion weight determination subunit can be used to: obtain the accuracy of the query object in historical detection; and determine the fusion weight of the support based on the confidence level and the accuracy level.

[0147] Optionally, the anomaly update unit 604 is further configured to, before determining the fusion weight of the support based on the confidence level:

[0148] When the support level returned by the respondents contradicts the sign of the current aggregated anomaly score, an evidence conflict is identified.

[0149] Calculate the aggregate confidence score of the current aggregated anomaly score, which is determined based on the confidence scores of each support that has participated in the fusion; when there are no support scores that have participated in the fusion, the aggregate confidence score is set as the default confidence score.

[0150] The confidence level returned by the query object is compared with the aggregate confidence level;

[0151] If the confidence level returned by the solicitation object is higher than the aggregate confidence level, then the support level and confidence level returned by the solicitation object are used as the support level and confidence level of this round of fusion, respectively, triggering the execution of the fusion weight operation that determines the support level based on the confidence level;

[0152] If the aggregate confidence level is not lower than the confidence level returned by the query object, then the operation of determining the fusion weight of the support based on the confidence level will not be performed in this round.

[0153] Based on the above scheme, for the target entity, the anomaly solicitation unit 603 will repeatedly execute the steps of selecting a solicitation target and sending a solicitation request, and the anomaly update unit 604 will repeatedly execute the steps of receiving the return, updating the aggregated anomaly score and uncertainty measure, until a preset stopping condition is met. The stopping condition includes at least one of the following: the uncertainty measure drops below a preset threshold, a preset maximum number of solicitations is reached, or there are no anomaly detection agents that have not yet submitted submissions for the target entity.

[0154] Preferably, the anomaly solicitation unit 603 is used to select at least one anomaly detection agent that has not yet submitted the target entity as the solicitation object, specifically including: preferentially selecting anomaly detection agents whose data source type is different from that of anomaly detection agents that have submitted the target entity as the solicitation object;

[0155] The anomaly query unit 603 is used to send a query request containing the identifier of the target entity to the query object, specifically including: attaching the expected retrieval time window and / or context constraints to the query request, so as to instruct the query object to determine the retrieval range of data associated with the target entity accordingly.

[0156] Furthermore, the anomaly determination unit 605 can also be used to: if the initial value of the uncertainty measure of any suspicious entity is lower than a preset threshold, then directly make an anomaly determination for that suspicious entity. In this case, the anomaly inquiry unit 603 will not be triggered to initiate an inquiry.

[0157] Typically, in this embodiment, the network security anomaly detection device is deployed on the collaboration layer server of the network security monitoring system; the at least two anomaly detection agents are respectively deployed in host monitoring equipment, network traffic monitoring equipment, database auditing equipment, or illegal external connection monitoring equipment.

[0158] The network security anomaly detection device in this embodiment can implement the network security anomaly detection method described in any of the foregoing embodiments. Its implementation principle and corresponding technical effects are basically the same, and will not be repeated here.

[0159] Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can implement the process of the embodiment of the method of the present invention, such as... Figure 7 As shown, the aforementioned electronic device may include: a housing 71, a processor 72, a memory 73, a circuit board 74, and a power supply circuit 75. The circuit board 74 is disposed inside the space enclosed by the housing 71, and the processor 72 and the memory 73 are disposed on the circuit board 74. The power supply circuit 75 is used to supply power to various circuits or devices of the aforementioned electronic device. The memory 73 is used to store executable program code. The processor 72 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 73, for executing the network security anomaly detection method described in any of the foregoing embodiments.

[0160] For details on the specific execution process of the above steps by the processor 72 and the steps further executed by the processor 72 by running executable program code, please refer to the description of the method embodiments of the present invention, which will not be repeated here.

[0161] This electronic device exists in various forms, including but not limited to:

[0162] (1) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0163] (2) Other electronic devices with data processing and communication functions.

[0164] In summary, the technical solution provided by the embodiments of the present invention has the following advantages:

[0165] First, by proactively triggering targeted inquiries through uncertainty measurement, the system overcomes information barriers between multi-source detection devices. Simultaneously, it reduces unnecessary communication overhead through a rapid decision-making channel when evidence is sufficient. For suspicious entities with high uncertainty, the collaboration layer server proactively sends inquiry requests to agents that have not yet submitted evidence to supplement the evidence. For entities with low uncertainty, the system directly makes decisions based on aggregated anomaly scores without inquiries. Thus, the system avoids detection blind spots caused by information barriers and improves overall detection efficiency.

[0166] Second, by using an aggregated confidence arbitration mechanism and dual-dimensional feedback of support and confidence, reliable fusion and refined quantification are achieved when evidence conflicts occur. When new evidence contradicts historical consensus symbols, the collaborative layer server arbitrates based on aggregated confidence, accepting only new evidence with high confidence. During the fusion process, the direction and strength of support and the reliability of confidence are considered simultaneously, suppressing false positives and false negatives caused by individual biases.

[0167] Third, by combining iterative loops with stopping conditions, the uncertainty of evidence is dynamically resolved. The collaboration layer server repeatedly executes the solicitation, reception, and update steps until the uncertainty metric drops below a threshold, the maximum number of solicitations is reached, or no available agents exist. Thus, the system gradually converges evidence discrepancies during the detection process, avoiding both misjudgments due to insufficient evidence and indefinite waiting.

[0168] It should be noted that in this article, relational terms such as first and second are only used to refer to...

[0169] Distinguishing one entity or operation from another does not necessarily require or imply these distinctions.

[0170] There is no such actual relationship or order between entities or operations. Furthermore, the terms "including" and "package" do not apply.

[0171] The word "comprise" or any other variation thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0172] In this embodiment of the invention, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0173] The various embodiments in this specification are described in a related manner. For the same or similar parts between the various embodiments, please refer to each other. Each embodiment focuses on describing the differences from other embodiments.

[0174] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0175] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0176] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0177] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting network security anomalies, characterized in that, include: Receive candidate cybersecurity anomaly events submitted by at least two anomaly detection agents, each candidate cybersecurity anomaly event containing a suspicious entity identifier and a corresponding anomaly score; Based on the received candidate network security anomalies, a set of suspicious entities is constructed, and for each suspicious entity in the set: based on all the anomaly scores associated with the suspicious entity that have been received, an aggregate anomaly score and uncertainty measure for the suspicious entity are calculated; Suspicious entities whose uncertainty measure is higher than a preset threshold are identified as target entities, and at least one anomaly detection agent that has not yet submitted the target entity's identifier is selected as the solicitation object. A solicitation request containing the target entity's identifier is sent to the solicitation object. Receive the support and corresponding confidence scores for the target entity returned by the query object, and update the aggregate anomaly score and uncertainty measure of the target entity based on the support and confidence scores; Based on the aggregated anomaly score, an anomaly determination is made for the target entity.

2. The method according to claim 1, characterized in that, The calculation of the aggregated anomaly score and uncertainty measure of the suspicious entity includes: When there are multiple abnormal scores that have been received and are associated with the suspicious entity, the uncertainty measure is calculated using the following statistical method: the variance or information entropy among all the abnormal scores; When the number of abnormal scores associated with the suspicious entity received is one, the uncertainty metric is set to a default value, which is higher than the preset threshold.

3. The method according to claim 1, characterized in that, The step of updating the aggregated anomaly score and uncertainty measure of the target entity based on the support and the confidence includes: Based on the confidence level, determine the fusion weight of the support. Multiply the support by the fusion weight to obtain the weighted support; The uncertainty measure is adjusted based on the deviation between the weighted support and the current aggregated anomaly score; The weighted support is averaged with the current aggregated anomaly score to obtain the updated aggregated anomaly score.

4. The method according to claim 3, characterized in that, The step of determining the fusion weight of the support based on the confidence level includes: Obtain the accuracy rate of the survey subjects in historical tests; The fusion weight of the support is determined based on the confidence level and the accuracy.

5. The method according to claim 3, characterized in that, Before determining the fusion weight of the support based on the confidence level, the method further includes: When the support level returned by the respondents contradicts the sign of the current aggregated anomaly score, an evidence conflict is identified. Calculate the aggregate confidence score of the current aggregated anomaly score, which is determined based on the confidence scores of each support that has participated in the fusion; when there are no support scores that have participated in the fusion, the aggregate confidence score is set as the default confidence score. The confidence level returned by the query object is compared with the aggregate confidence level; If the confidence level returned by the solicitation object is higher than the aggregate confidence level, then the support level and confidence level returned by the solicitation object are used as the support level and confidence level of this round of fusion, respectively, triggering the execution of the fusion weight operation that determines the support level based on the confidence level; If the aggregate confidence level is not lower than the confidence level returned by the query object, then the operation of determining the fusion weight of the support based on the confidence level will not be performed in this round.

6. The method according to claim 1, characterized in that, The method further includes: For the target entity, the steps of selecting the solicitation object, sending the solicitation request, receiving the response, and updating the aggregated anomaly score and uncertainty measure are repeated until the preset stopping condition is met; The stopping conditions include at least one of the following: the uncertainty metric drops below the preset threshold, the preset maximum number of queries is reached, or there is no abnormal detection agent that has not yet submitted the target entity.

7. The method according to claim 1, characterized in that, The step of selecting at least one of the anomaly detection agents that has not yet submitted the target entity as the solicitation object includes: Prioritize selecting an anomaly detection agent whose data source type is different from that of the anomaly detection agent that has submitted the target entity as the query target.

8. The method according to claim 1, characterized in that, Sending a request containing the target entity's identifier to the requesting party includes: The query request may include a time window and / or contextual constraints for the desired retrieval, instructing the querying party to determine the scope of data to be retrieved in relation to the target entity.

9. The method according to claim 1, characterized in that, Before identifying suspicious entities whose uncertainty measure exceeds a preset threshold as target entities, the process also includes: If the initial value of the uncertainty measure of any suspicious entity is lower than the preset threshold, the suspicious entity will be directly judged as abnormal without initiating a query.

10. The method according to claim 1, characterized in that, The method is executed by a collaboration layer server deployed in the network security monitoring system; The method further includes: deploying the at least two anomaly detection agents in host monitoring equipment, network traffic monitoring equipment, database auditing equipment, or illegal external connection monitoring equipment, respectively.

11. A network security anomaly detection device, characterized in that, include: An anomaly receiving unit is used to receive candidate network security anomaly events submitted by at least two anomaly detection agents. Each candidate network security anomaly event includes a suspicious entity identifier and a corresponding anomaly score. An anomaly aggregation unit is used to construct a set of suspicious entities based on the received candidate network security anomaly events, and for each suspicious entity in the set: based on all the anomaly scores associated with the suspicious entity that have been received, calculate the aggregated anomaly score and uncertainty measure of the suspicious entity; An anomaly solicitation unit is used to identify suspicious entities whose uncertainty measure is higher than a preset threshold as target entities, and to select at least one anomaly detection agent that has not yet submitted the identifier of the target entity as a solicitation object, and to send a solicitation request containing the identifier of the target entity to the solicitation object. An anomaly update unit is used to receive the support and corresponding confidence scores for the target entity returned by the query object, and update the aggregate anomaly score and uncertainty measure of the target entity based on the support and confidence scores; An anomaly determination unit is used to determine anomalies in the target entity based on the aggregated anomaly score.

12. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method described in any one of claims 1-10 above.

Images