A concept-drift-oriented internal threat behavior detection method and system

Abstract

The application discloses a concept-drift-oriented internal threat behavior detection method and system, and relates to the technical field of information security. The application comprises the following steps: performing semantic coding on a user behavior log, generating a behavior embedding vector by a Transformer feature extractor, and obtaining a threat probability; constructing a dynamic behavior domain, calculating a selection coefficient, and performing selective domain adversarial training; instantiating a domain discriminator and inserting a gradient reversal layer; and performing end-to-end joint training by taking the weighted sum of a classification loss, a prototype learning loss and a selective domain adversarial loss as a total loss. The application realizes unified semantic expression of heterogeneous user behavior logs and efficient capture of complex time sequence patterns, is conducive to automatic discovery of various behavior pattern types hidden in user behaviors, realizes dynamic adjustment of domain structure in a concept-drift scenario, realizes adaptive alignment of different domains, retains distinguishability of normal behaviors, and enhances detection sensitivity to new threat patterns.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method and system for detecting internal threat behaviors oriented towards concept drift. Background Technology

[0002] Insider threat detection aims to identify malicious or unauthorized actions carried out by legitimate users within an enterprise, such as data theft, privilege abuse, and resource sabotage. Unlike traditional external attack detection, insider threats are often hidden within a large number of normal business operations, exhibiting characteristics such as strong camouflage, long duration, and dynamically changing behavioral patterns, posing significant challenges to detection tasks.

[0003] Early insider threat detection methods primarily relied on rule-based expert systems or statistical baseline models, such as setting fixed thresholds, user operation frequency statistics, and resource access control lists. While these methods are simple to implement and highly interpretable, the rules depend on human experience and cannot adapt to behavioral changes brought about by business iterations. They struggle to cope with the dynamic evolution of internal user behavior and unknown threat patterns, exhibiting significant drawbacks such as fixed thresholds, high rule maintenance costs, and persistently high false positive rates when facing behavioral drift. With the development of machine learning technology, insider threat detection solutions based on supervised, unsupervised, and semi-supervised learning have been implemented. Supervised learning-based methods train classifiers to distinguish between normal and threatening behaviors using labeled samples; unsupervised learning methods build behavioral baselines based on historical normal samples and determine anomalies based on deviation; and semi-supervised learning methods optimize models using a small number of labeled samples combined with a massive amount of unlabeled samples, alleviating the problem of scarce labeled data.

[0004] While the aforementioned technologies offer some improvement in detection accuracy compared to traditional rule-based models, existing machine learning detection solutions still suffer from fundamental shortcomings: most algorithms are based on the idealized assumption that user behavior distribution remains constant over a long period, lacking the ability to adapt to the shifts in real-world scenarios. In actual operational environments, objective factors such as job rotation, organizational restructuring, system version iterations, seasonal business shifts, and new project launches all drive regular changes in users' daily operational logic, access objects, and operation sequences, causing continuous shifts in data distribution and resulting in concept drift. Existing technologies cannot precisely distinguish between benign behavior drift caused by normal business changes and malicious behavior mutations caused by attackers' deliberate camouflage. As long as the behavior to be tested deviates from the distribution of the historical training set, it is judged as abnormal, and the false positive rate rises sharply in drift scenarios. In addition, existing models lack the ability to autonomously mine diverse user behavior patterns, cannot distinguish between individual-specific operating habits and universal business behaviors, cannot configure constraint strategies differently for different behavior patterns, and have insufficient ability to detect new malicious threats that are niche and gradually evolving. At the same time, traditional domain adversarial solutions adopt a uniform adversarial strength across the entire domain and perform domain alignment processing on all behavioral features indiscriminately. While smoothing out drift interference, it is easy to damage the feature discrimination of normal behavior, further aggravating the dual problems of false positives for normal drift samples and false negatives for hidden malicious behaviors.

[0005] To address the shortcomings of existing technologies, such as high false alarm rates in concept-drift environments, inability to distinguish between benign behavioral changes and malicious threats, inability to adapt to multiple user behavior patterns, and lack of comprehensive adversarial destructive feature recognition, this invention proposes an internal threat behavior detection method and system for concept-drift environments. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for detecting internal threat behaviors oriented towards concept drift. This method extracts behavioral sequences from user behavior logs and performs semantic encoding. A Transformer feature extractor transforms heterogeneous logs into behavioral embedding vectors in a unified semantic space. A threat classifier is used for threat discrimination. Simultaneously, a prototype clustering mechanism is used to automatically discover various hidden behavioral patterns in user behavior, and a dynamic domain is constructed based on the prototype assignment results. Furthermore, selective domain adversarial training is employed. Selection coefficients based on prototype stability, user entropy, and normality rate are calculated. The adversarial training intensity is reduced for stable domains that are prevalent across users and have a high normality rate, while domain-invariant feature learning is enforced for rare, user-specific domains with a high anomaly rate. Ultimately, this constructs a system capable of effectively distinguishing between normal behavioral drift and genuine malicious threat behaviors, thus addressing the limitations of existing machine learning-based internal threat detection methods when facing concept drift.

[0007] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: As a first aspect provided by the present invention, the present invention is an internal threat behavior detection method oriented towards concept drift, comprising the following steps: Semantic encoding of user behavior logs yields behavior sequence semantic vectors. The Transformer feature extractor extracts features from the behavior sequence semantic vectors and pools them to generate behavior embedding vectors. The behavior embedding vector is input into the threat classifier to obtain the threat probability, and learnable prototype vectors are configured. The similarity between the behavior embedding vector and each prototype vector is calculated to perform prototype clustering and obtain prototype assignment results. Based on the prototype allocation results, samples assigned to the same prototype are constructed as dynamic behavior domains. The selection coefficient of each dynamic behavior domain is calculated by combining prototype stability, user entropy and normality rate, and selective domain adversarial training is performed. A domain discriminator is instantiated for each dynamic behavior domain. A gradient reversal layer is inserted between the feature extractor and the domain discriminator. The domain discriminant loss of each domain is weighted and summed using the selection coefficient as the weight to obtain the selective domain adversarial loss. The adaptive alignment of concept drift is completed through selective domain adversarial training. End-to-end joint training is performed using the weighted sum of the classification loss of the threat classifier, the prototype learning loss of prototype clustering, and the selective domain adversarial loss as the total loss. We use a trained feature extractor and threat classifier to perform threat detection on real-time behavioral data.

[0008] Furthermore, the semantic encoding method is as follows: The system acquires user behavior logs and maps the recorded actions, objects, results, and user roles into behavior vectors using a learnable embedding matrix. It then maps timestamps into time-encoded vectors using relative time difference calculation, logarithmic scaling, and linear embedding. Finally, it concatenates the behavior vectors and time-encoded vectors into a single behavior semantic vector. The behavior semantic vectors corresponding to the behavior records within a preset time window constitute the behavior sequence semantic vector.

[0009] Furthermore, the method for generating the behavior embedding vector includes: injecting positional information into the behavior sequence using sine and cosine positional encoding to obtain the initial input; outputting the vector sequence corresponding to the features within the window after passing through a multi-head self-attention layer, a feedforward neural network layer, residual connections, and layer normalization of a multi-layer Transformer feature extractor; performing mean pooling on the vector sequence along the sequence length dimension to obtain the behavior embedding vector; mapping the original records such as operation actions, operation objects, operation results, user roles, and timestamps into continuous vector representations through the embedding layer; and modeling the long-range dependencies in the behavior sequence using a Transformer encoder. The original log data is transformed into behavior embedding vectors with rich semantic information, providing high-quality feature inputs for subsequent threat classification, prototype clustering, and domain adversarial learning, thereby improving the accuracy and robustness of internal threat detection.

[0010] Furthermore, the threat classifier employs a multilayer perceptron structure, outputting threat probabilities using a sigmoid function. During the training phase, the cross-entropy loss function is used to optimize the threat classifier. In the prototype clustering phase, the negative Euclidean distance between the behavior embedding vector and the prototype vector is used as the similarity. The similarity is converted into soft assignment probabilities using a Softmax function with a temperature parameter, and the prototype corresponding to the maximum soft assignment probability is taken as the hard assignment result. The prototype learning loss includes clustering loss and separation loss. The clustering loss forces the same sample to move closer to its assigned prototype center, while the separation loss forces different prototypes to maintain distance. By maintaining a set of learnable prototype vectors, samples with similar behavior patterns are automatically clustered into the same prototype. Based on this, a domain set is dynamically constructed based on the prototype assignment results, and the number and division of domains are automatically adjusted according to the batch data distribution. This mechanism overcomes the limitations of existing methods that statically divide domains and cannot adapt to dynamic changes in data distribution. It can automatically adjust the domain structure when user behavior patterns change naturally, accurately distinguishing between normal pattern drift and genuine malicious behavior, and effectively reducing the false positive rate in concept drift scenarios.

[0011] Furthermore, in the construction of the dynamic behavior domain, in each training batch, the samples are divided into the corresponding dynamic behavior domains based on the prototype allocation results. The number of dynamic behavior domains varies with the training batch, and the corresponding dynamic behavior domain is instantiated only when there are allocated samples in the current batch.

[0012] Furthermore, prototype stability is used to characterize the duration of each prototype, and is taken as the ratio of the number of consecutive training rounds in which the prototype appears to a preset normalization upper limit, with a maximum value limited to 1; the user entropy is used to measure the distribution entropy value of the users covered by the prototype, and the information entropy is calculated based on the ratio of the frequency of each user appearing in the prototype to the number of prototype samples, and the information entropy is normalized to the interval [0, 1]; the normality rate is the ratio of the number of samples labeled as normal in the dynamic behavior domain to the total number of samples.

[0013] Furthermore, the gradient reversal layer transmits the input identically during forward propagation and multiplies the gradient by a negative coefficient during backward propagation; the domain discrimination loss is the binary cross-entropy loss, and the selective domain adversarial loss is the weighted sum of the domain discrimination losses of each domain with the selection coefficient as the weight.

[0014] Furthermore, during end-to-end joint training, a progressive adversarial training strategy is adopted. Within a preset number of rounds, the selective domain adversarial loss weights are updated to the preset maximum value using a linearly increasing strategy. After the preset number of rounds are completed, the maximum value of the selective domain adversarial loss weights is maintained. Classification and prototype clustering optimization are completed first, and then domain adversarial training is introduced.

[0015] Furthermore, when performing threat detection on real-time behavioral data, a single forward propagation is performed using a trained feature extractor and threat classifier. The real-time collected user behavior window is processed through feature extraction to obtain a behavior embedding vector, which is then input into the threat classifier to obtain the threat probability. The threat probability is compared with a preset threshold to output the threat determination result.

[0016] As a second aspect of the present invention, the present invention provides an internal threat behavior detection system oriented towards concept drift. The internal threat behavior detection system is used to implement the internal threat behavior detection method described in the first aspect, and the internal threat behavior detection system includes: The data acquisition and feature extraction subsystem is used to collect user behavior logs and extract behavior embedding vectors. The threat detection and prototype clustering subsystem is used to discriminate threats from behavior embedding vectors and output threat probabilities, and to obtain prototype assignment results by performing prototype clustering through learnable prototype vectors. The selective domain adversarial subsystem is used to construct dynamic behavior domains based on prototype assignment results, calculate the selection coefficient of each dynamic behavior domain, and perform selective domain adversarial training with the selection coefficient as the weight. The online detection and alarm subsystem is used to determine threats to real-time behavior windows using a trained feature extractor and threat classifier, and generate alarms when a threat is determined.

[0017] The present invention has the following beneficial effects: This invention employs a behavioral modeling mechanism that combines behavioral sequence semantic encoding with Transformer feature extraction, which facilitates the unified semantic representation of heterogeneous user behavior logs and the efficient capture of complex temporal patterns. It transforms raw log data into behavioral embedding vectors with rich semantic information, providing high-quality feature inputs for subsequent threat classification, prototype clustering, and domain adversarial learning, thereby improving the accuracy and robustness of internal threat detection. This invention employs an adaptive mechanism combining prototype clustering and dynamic domain construction, which facilitates the automatic discovery of various hidden behavioral patterns in user behavior and enables dynamic adjustment of domain structure in concept drift scenarios. By maintaining a set of learnable prototype vectors, samples with similar behavioral patterns are automatically clustered into the same prototype. Based on the prototype allocation results, a set of domains is dynamically constructed. The number and division of domains are automatically adjusted according to the batch data distribution, overcoming the limitations of existing methods that statically divide domains and cannot adapt to dynamic changes in data distribution. It can automatically adjust the domain structure when user behavior patterns change naturally, accurately distinguishing between normal pattern drift and genuine malicious behavior, and effectively reducing the false positive rate in concept drift scenarios. This invention employs a selective domain adversarial training mechanism based on prototype stability, user entropy, and normality rate. This mechanism facilitates adaptive alignment across different domains, enhancing the detection sensitivity of new threat patterns while preserving the distinguishability of normal behavior. By comprehensively evaluating the prototype's stability, cross-user universality, and normality rate through selection coefficients, the adversarial training intensity is reduced for stable, universal domains with high normality rates, while domain-invariant features are forcibly learned for rare, user-specific domains with high anomalous rates. This overcomes the limitation of traditional domain adversarial training, which treats all domains equally and easily leads to a decrease in the distinguishability of normal behavior, and achieves adaptive generalization to concept drift.

[0018] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the steps of the internal threat behavior detection method for concept drift according to the present invention; Figure 2 This is a schematic diagram of the overall scheme of the internal threat behavior detection method for concept drift according to the present invention; Figure 3This is a schematic diagram of the model structure of the internal threat behavior detection method for concept drift according to the present invention; Figure 4 This is a functional block diagram of the internal threat behavior detection system for concept drift according to the present invention; Figure 5 This is a system framework diagram of the internal threat behavior detection system for concept drift according to the present invention. Detailed Implementation

[0021] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0022] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0023] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0025] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0027] Example 1: Please see Figures 1-3 As shown, this invention is an internal threat behavior detection method oriented towards concept drift, comprising the following steps: This system acquires user behavior log data from within the system, defines core fields for behavior records including user identifier, operation action, operation object, operation result, user role, and timestamp, performs semantic encoding on user behavior logs to obtain behavior sequence semantic vectors, extracts features from the behavior sequence semantic vectors using a Transformer feature extractor, and pools them to generate behavior embedding vectors. Heterogeneous user behavior logs are transformed into behavior embedding vectors in a unified semantic space. After multi-layer encoding, the output is mean-pooled along the sequence length dimension to obtain fixed-dimensional behavior embedding vectors. These vectors encode the comprehensive behavior pattern of users within the current time window, providing high-quality feature input for subsequent threat identification and prototype clustering. The behavior modeling mechanism combining behavior sequence semantic encoding and Transformer feature extraction facilitates the unified semantic expression of heterogeneous user behavior logs and the efficient capture of complex temporal patterns. The behavior embedding vector is input into the threat classifier to obtain the threat probability, and learnable prototype vectors are configured. The similarity between the behavior embedding vector and each prototype vector is calculated to perform prototype clustering to obtain the prototype assignment result. Samples with similar behavior patterns are grouped into the same prototype through prototype clustering. Based on the prototype allocation results, samples assigned to the same prototype are constructed into dynamic behavior domains. The selection coefficient of each dynamic behavior domain is calculated by combining prototype stability, user entropy and normality rate, and selective domain adversarial training is performed. An adaptive mechanism combining prototype clustering and dynamic domain construction is adopted, which is conducive to automatically discovering multiple hidden behavior patterns in user behavior and realizing dynamic adjustment of domain structure in concept drift scenarios. A domain discriminator is instantiated for each dynamic behavior domain. A gradient reversal layer is inserted between the feature extractor and the domain discriminator. The domain discriminant loss of each domain is weighted and summed using the selection coefficient as the weight to obtain the selective domain adversarial loss. End-to-end joint training is performed using the weighted sum of the classification loss of the threat classifier, the prototype learning loss of prototype clustering, and the selective domain adversarial loss as the total loss. We use a trained feature extractor and threat classifier to perform threat detection on real-time behavioral data.

[0028] This application employs a selective domain adversarial training mechanism based on prototype stability, user entropy, and normality rate. This facilitates adaptive alignment across different domains, enhancing the detection sensitivity for new threat patterns while preserving the distinguishability of normal behavior. The invention comprehensively evaluates the prototype's stability, cross-user prevalence, and normality rate through selection coefficients. For stable, prevalent domains with high normality rates, the adversarial training intensity is reduced; for rare, user-specific domains with high anomaly rates, domain-invariant features are forcibly learned. This mechanism overcomes the limitations of traditional domain adversarial training, which treats all domains equally and easily leads to a decrease in the distinguishability of normal behavior, achieving adaptive generalization to concept drift.

[0029] Example 2: Please see Figures 1-3 As shown, as an embodiment of the present invention, preferably based on embodiment one, the semantic encoding method is as follows: Acquire user behavior log data from within the system. Each behavior record reflects a user's operation within the system. Map the recorded operation actions, operation objects, operation results, and user roles into behavior vectors using a learnable embedding matrix. Specifically: Define a single behavior record It includes the following fields: user identifier, operation action, operation object, operation result, timestamp, and user role. An embedding layer maps each field to a continuous vector representation, inputting discrete and heterogeneous behavior log information into a deep learning model. For each behavior record... Each field is then vectorized and encoded separately: For an operation action, let the number of action types be . Define a learnable embedding matrix , to perform the operation Mapped to action vectors ; For the objects being operated on, let the number of object types be... Define a learnable embedding matrix , will operate on the object Mapped to object vectors ; For the operation results, let the number of result types be... Define a learnable embedding matrix The operation results Mapped to result vector ; For user roles, let the number of role types be . Define a learnable embedding matrix User roles Mapped to character vectors ; Among them, the behavior vector includes action vector, object vector, result vector, and role vector; For timestamps, let the current action record be... Record of the previous behavior The timestamps are respectively and The relative time difference is Logarithmic scaling , scaled Mapped through a learnable linear embedding layer to Dimensional vector: ,in and These are the weights and biases, respectively. Action vectors Object vectors Result vector Character vectors and time-coded vector By splicing the data together, each behavior record is obtained. Behavioral semantic vectors Then the behavioral semantic vector for: ; Among them, the behavioral semantic vector dimension for: ; By embedding semantic encoding, the system transforms the user behavior logs from discrete raw records into fixed-dimensional behavioral semantic vectors.

[0030] As an embodiment of the present invention, preferably, all user behavior logs are sorted by user identifier. The data is grouped, and each user's activity records are sorted in ascending order by timestamp, with a fixed-length time window set. The behavior timeline of each user is divided into consecutive detection windows. For each window, all behavior records of that user within that window constitute a behavior sequence. Let the number of behavior records within a window be... If the vector sequence of its behavioral sequence semantic encoding is represented as the behavioral sequence semantic vector X, then: .

[0031] As an embodiment of the present invention, preferably, the semantic vector sequence is input into a Transformer feature extractor, which captures long-range dependencies in the sequence through a multi-head self-attention mechanism and a feedforward neural network. The Transformer's multi-head self-attention mechanism can simultaneously focus on behavioral records at different positions in the sequence, effectively capturing temporal correlations and complex interaction patterns between user operations. Specifically, the Transformer feature extractor is used to extract features from the semantic vector X of the behavioral sequence to capture complex temporal patterns in the behavioral sequence. The feature extraction method includes: First, positional information is injected into the behavioral sequence, using sine and cosine positional encoding. , obtain the initial input The Transformer feature extractor consists of N stacked coding layers, each containing multi-head self-attention (MHA). For the Nth layer... The Transformer encoding layer converts the input... Linear transformation to query matrix Key matrix Sum matrix Calculated through scaling the dot product self-attention: ; Then, the bullish self-attention is represented as: ; in, , To output the projection matrix, each Transformer encoding layer also includes a feedforward neural network (FFN), residual connections, and layer normalization. The complete operation of the Transformer encoding layer is represented as follows: ;

[0032] in: , After normalization at the representation layer and passing through N Transformer encoding layers, the vector sequence representation corresponding to the features within the window is obtained. .

[0033] As an embodiment of the present invention, preferably, the feature extraction vector sequence is... Pooling is performed along the sequence length dimension, and mean pooling is used to average the features across all time steps: ; in, express The Row vectors are pooled to obtain fixed-dimensional in-window row embedding vectors. The behavior embedding vector encodes the user's overall behavioral pattern within the current time window.

[0034] This application maps discrete fields to continuous vectors through a learnable embedding layer. The timestamp field calculates the time difference with the previous record and, after logarithmic scaling, maps it to a time-encoded vector. These vectors are then concatenated to obtain the complete semantic vector for each behavioral record. Behavioral records are constructed into behavioral sequences according to a fixed time window, outputting a semantic vector sequence. Through this encoding process, the original behavioral logs are transformed from discrete, heterogeneous text into a structured continuous vector sequence, facilitating subsequent processing by deep learning models.

[0035] Example 3: Please see Figures 1-3 As shown, in a preferred embodiment of the present invention, based on Embodiments 1 and 2, the similarity between the behavior embedding vector and each prototype vector is calculated to obtain the soft assignment probability distribution and hard assignment results. Clustering loss and separation loss are used to guide the prototypes to learn different behavior patterns, providing an assignment basis for subsequent dynamic domain construction. Threat discrimination is performed on the behavior embedding vectors of the samples, and unsupervised clustering of their behavior patterns is performed simultaneously to provide a prototype assignment basis for dynamic domain construction; the input to the threat classifier is the feature-extracted behavior embedding vector. This threat classifier is used to determine whether user behavior within the current time window constitutes an internal threat. It employs a multilayer perceptron (MLP) structure, consisting of multiple stacked fully connected layers, each followed by a ReLU activation function. The classifier contains... A hidden fully connected layer, making If the input vector is , then the th Layer output Represented as: ; in, For the first The weight matrix of the layer, As a bias term, after multiple fully connected transformations, the output of the last layer is... For input / output layers: ; in, This is the output layer weight matrix. For output layer bias terms, For the Sigmoid function, The threat probability predicted by the model. A value closer to 1 indicates that the user behavior within that window is more likely to be threatening, while a value closer to 0 indicates that it is more likely to be normal behavior. During the training phase, the cross-entropy loss function is used to optimize the threat classifier. For a batch of samples, the classification loss function is expressed as: ; in, For the true label of the sample, This represents the threat probability predicted by the model, where 0 indicates normal behavior and 1 indicates threatening behavior.

[0036] As an embodiment of the present invention, preferably, in order to automatically discover multiple hidden behavior patterns in user behavior data, a set of learnable prototype vectors is maintained. Prototype clustering is used to group samples with similar behavior patterns into the same prototype, thereby providing a grouping basis for subsequent dynamic domain construction. Let the number of prototypes be... The set of prototype vectors is , where each prototype vector The prototype vectors are randomly initialized at the start of training by sampling from a standard normal distribution and continuously updated during training through backpropagation. Each prototype vector represents a discriminative behavior pattern type. For each behavior embedding vector within a time window, its similarity to all prototype vectors is calculated. Negative Euclidean distance is used as the similarity metric. Indicates the first The similarity is represented as the behavioral embedding vector of each sample: ; in, Let L2 norm of a vector be the distribution probability. Indicates the first The sample belongs to the first A prototype probability is used to achieve soft assignment from sample to prototype, via a temperature parameter. The Softmax function converts similarity into soft-assigned probabilities: ; Take the prototype with the highest soft assignment probability as the first... Hard assignment probability of each sample That is, the prototype index of the final allocation, then: .

[0037] As an embodiment of the present invention, preferably, in order to guide the prototype vector to learn a discriminative behavioral pattern representation, the prototype learning loss function is made... It includes clustering loss and separation loss. Among them, clustering loss... This forces identical samples to be closer to their assigned prototype center, enhancing the compactness of similar samples. For each sample, this is based on the hard assignment probability. Calculate the squared Euclidean distance from the prototype: ; A smaller clustering loss indicates that each sample is closer to its assigned prototype, and samples of the same prototype are more clustered in the embedding space, while the separation loss... To force different prototypes to maintain a certain distance and prevent all prototypes from collapsing to the same point, the distance between two prototypes is calculated, and when the distance is less than a preset boundary... Penalties are incurred at times, resulting in separation losses. for: ; Separation loss This encourages prototype vectors to be spaced far apart in the embedding space, thus ensuring that the prototype vectors can cover different regions of the data distribution. Prototype learning loss function. The prototype learning loss function is a weighted sum of clustering loss and separation loss. for: ; in and With preset weight coefficients, the model automatically clusters the behavior of each sample into different prototypes through a prototype clustering mechanism. Each prototype corresponds to a distinctive behavior pattern type, providing prototype allocation information for subsequent dynamic domain construction.

[0038] Example 4: Please see Figures 1-3 As shown, as an embodiment of the present invention, preferably, based on embodiments one to three, after completing the extraction of behavior embedding vectors and prototype clustering, a dynamic domain is further constructed based on the prototype allocation results, and adaptive alignment of concept drift is achieved through selective domain adversarial training. In each batch of training, a set of domains is dynamically constructed based on the prototype allocation results. Let the sample set in the current batch be... Hard-assigned probability for each sample The samples are then assigned to the corresponding dynamic behavior domains based on the allocation: ; Each dynamic behavior domain Defined as a set of samples assigned to the same prototype; the number of domains varies with the batch size for each prototype. Only the assigned sample exists in the current batch (i.e. Only when this condition is met will the corresponding dynamic behavior domain be instantiated for that prototype. This enables the domain structure to adaptively adjust as data distribution changes, achieving dynamic domain construction: As an embodiment of the present invention, preferably, a selection coefficient is defined to distinguish the importance of different domains in adversarial training. To quantify dynamic behavior domain The necessity of participating in domain adversarial training. Selection coefficient. Calculated based on the following three types of attributes: Prototype stability This refers to the number of consecutive rounds in which the prototype appears during the training process; the prototype is counted. The prototype stability is defined as the number of consecutive rounds that have occurred during the training process:

[0039] in, As prototype The number of consecutive rounds, To pre-determine the normalization upper limit, the stable prototype corresponds to A higher value indicates a stable prototype that has existed for a long time, which usually represents a normal periodic behavior pattern; therefore, the selection coefficient should be smaller. User Entropy : The entropy value that measures the user distribution covered by the prototype reflects whether the pattern is user-specific or universally present across users. Let the prototype be... The user set included is ,user The frequency of occurrence in this prototype is User entropy is defined as: ; High user entropy indicates that the prototype is prevalent across users, representing a general behavioral pattern rather than an individual anomaly. Drift in such prototypes typically does not require alignment, and the selection factor should be small. Normalization yields ; Normal rate : Represents the proportion of normal samples in the prototype. The normality rate is defined as: ; A high normality rate indicates that the prototype mainly represents a variant of normal behavior, which may be a normal periodic behavior drift, and its selection coefficient should be relatively small; After weighting and fusing the above attributes, the selection coefficient is obtained through the Sigmoid function. This coefficient measures the importance of the domain in domain adversarial training. Defined as: ; in, For the Sigmoid function, For prototypes with preset weighting coefficients, the selection coefficients approach 0 for stable prototypes that are common across users and have a high normality rate; for prototypes that are rare, user-specific, and have a high anomaly rate, the selection coefficients approach 1.

[0040] As an embodiment of the present invention, preferably, in order to achieve domain-invariant feature learning, for each dynamically constructed dynamic behavior domain... Instantiate a domain discriminator Domain discriminator A multilayer perceptron architecture is employed, consisting of two stacked fully connected layers. Each fully connected layer is followed by a ReLU activation function, and finally, a sigmoid output layer outputs the probability that a sample belongs to that domain. The behavior embedding vector of the input sample... The calculation process of the domain discriminator is as follows: ; ; in, and This is the weight matrix. and For bias terms, Indicates sample Belongs to the dynamic behavior domain The output predicted probability, i.e. .

[0041] As an embodiment of the present invention, preferably, a gradient reversal layer (GRL) is inserted between the Transformer feature extractor and the domain discriminator. The gradient reversal layer transmits the input identically during forward propagation and multiplies the gradient by a negative coefficient during backward propagation. This creates an adversarial game between the feature extractor and the domain discriminator. Let GRL be a function. Then the forward and backward propagation behaviors are represented as: ; in, To counteract the strength coefficient, Given an identity matrix, through a gradient inversion layer, the feature extractor and the domain discriminator engage in an adversarial game. The optimization objective of the feature extractor is to minimize the domain discrimination loss, i.e., to correctly identify the domain assignment of samples as much as possible; while the optimization objective of the feature extractor is to maximize this loss under the action of the gradient reversal layer, i.e., to learn domain-invariant feature representations through gradient reversal, making it impossible for the domain discriminator to distinguish which domain a sample originates from. Both optimize together in an adversarial process, ultimately resulting in the behavior embedding vector output by the feature extractor. While retaining the ability to detect threats, redundant information related to the domain is eliminated.

[0042] As an embodiment of the present invention, preferably, for dynamic behavior domains Positive samples are those within the domain, and negative samples are those not belonging to the domain in the current batch. The domain discrimination loss uses binary cross-entropy loss. Then: ; in, This indicates that the current batch does not belong to the dynamic behavior domain. The sample set, This indicates that the gradient inversion layer is applied to the embedding vector.

[0043] The selective domain adversarial loss is the domain discrimination loss of each domain expressed as a selection coefficient. The weighted sum of the weights is used to implement selective domain adversarial training, and the selective domain adversarial loss is: ; By adjusting the selection coefficient, the model achieves selective domain adversarial training. For stable domains that are prevalent across users and have a high normality rate, the selection coefficient approaches 0, reducing the intensity of adversarial training to preserve the model's ability to distinguish normal behavior patterns in that domain. For rare, user-specific domains with a high anomaly rate, the selection coefficient approaches 1, forcing domain-invariant feature learning to enhance the model's generalization ability to new threat patterns. Specifically, for domains with a small selection coefficient (stable, prevalent across users, and with a high normality rate)... The feature extractor receives almost no adversarial training gradients from the domain, thus preserving its original ability to distinguish normal behavior patterns in the domain; for domains with large selection coefficients (rare, user-specific and with high anomaly rates). This forces the implementation of domain-invariant feature learning, compelling the feature extractor to extract threat-related features that are independent of the domain, thereby enhancing the model's ability to generalize to concept drift and its sensitivity to detecting emerging threat patterns.

[0044] As an embodiment of the present invention, preferably, the feature extractor, threat classifier, prototype vector, and domain discriminator are jointly trained end-to-end using a total loss function. The total loss function comprises a weighted sum of classification loss, prototype learning loss, and selective domain adversarial loss. All modules (feature extractor, threat classifier, prototype vector, and domain discriminator) are trained using the total loss function. After unified optimization, the total loss function is: ; in, To preset weights, Selective domain adversarial loss weights are used; classification loss guides the model to accurately distinguish between normal and threatening behaviors; prototype learning loss guides the model to discover hidden behavioral patterns in the data; and selective domain adversarial loss guides the model to learn domain-invariant feature representations.

[0045] As an embodiment of the present invention, preferably, to ensure training stability, a progressive adversarial training strategy is adopted, and a small selective domain adversarial loss weight is set at the beginning of training. This prioritizes the optimization of threat classification and prototype clustering tasks in the model; as the number of training rounds increases, the [value] is gradually increased. Once the preset maximum value is reached, domain adversarial mechanisms are gradually introduced. The complete training steps for the entire model are as follows: Step S1: Parameter Initialization: Randomly initialize the parameters of the Transformer feature extractor network, the threat classifier network, and the prototype vector. The domain discriminator is initially empty, and initial selective domain adversarial loss weights are set. Target selectivity region adversarial loss weights Preset number of rounds Initialize the current selective domain adversarial loss weights. ; Step S2: Training round by round: For each training round Perform the following operations: Step S21: Update the adversarial loss weights: if Update according to linear increment strategy Otherwise, keep ; Step S22: Batch Processing: For each batch in the training dataset, perform the following sub-steps in sequence: Step S221: Feature Extraction: Extract semantic vectors of behavioral sequences within a batch. Input the feature extractor to obtain the behavior embedding vector. ; Step S222: Threat Classification and Forward Calculation: ... Input threat classifier, output threat probability Calculate classification loss ; Step S223: Prototype Clustering and Loss Calculation: Calculate The prototype assignment results are obtained by comparing the similarity with each prototype vector. The clustering loss and separation loss are calculated, and the prototype learning loss is obtained by weighting them. ; Step S224: Dynamic Domain Construction: Based on the prototype allocation results, construct dynamic behavior domains from samples assigned to the same prototype. Instantiate a domain discriminator for each non-empty dynamic behavior domain. ; Step S225: Selection coefficient calculation: For each non-spatial domain, calculate the prototype stability. User entropy and normal rate The selection coefficient is obtained by weighted fusion. ; Step S226: Domain adversarial loss calculation: After passing the behavior embedding vector through the gradient reversal layer, input it into the discriminator of each domain, calculate the discriminative loss of each domain, and obtain the selective domain adversarial loss by weighting the sum with selection coefficients. ; Step S227: Parameter Update: Calculate Total Loss The feature extractor network parameters, threat classifier network parameters, and prototype vector are updated through backpropagation. and the parameters of each domain discriminator; Step S3: Training Termination: Repeat step S2 until the preset maximum number of training rounds is reached. .

[0046] This application employs a progressive adversarial training strategy during training, gradually increasing the adversarial loss weight to a preset maximum value based on the number of training rounds. This allows the model to prioritize optimizing threat classification and prototype clustering tasks in the early stages of training, and then gradually introduce domain adversarial training once the model has a stable basic capability, ensuring the overall stability of the training.

[0047] Example 5: Please see Figures 1-3 As shown in the figure, as an embodiment of the present invention, preferably, based on embodiments one to four, real-time threat determination is performed during the inference phase. The trained feature extractor and threat classifier are used for efficient forward propagation to output threat detection results. During the inference phase, the system performs online threat detection on real-time collected user behavior logs. Unlike the training phase, the inference phase does not include a prototype clustering module and a domain discriminator module; it only uses the trained Transformer feature extractor and threat classifier for a single forward propagation to ensure low inference latency and meet real-time detection requirements.

[0048] As an embodiment of the present invention, preferably, for each user behavior window to be detected, a fixed-length time window is traced backward from the current time as a reference. Collect all user behavior records within the current window, sort them in ascending order by timestamp, and construct a behavior semantic vector. First, behavior sequence encoding and feature extraction are performed. An embedding layer maps each field to a continuous vector, resulting in a semantic vector sequence. This sequence is then input into a trained Transformer feature extractor, which encodes the sequence through multiple multi-layer multi-head self-attention and feedforward neural networks. The output is then pooled to obtain a fixed-dimensional behavior embedding vector. Then, threat probability prediction is performed, and the behavior is embedded into a vector. Input a trained threat classifier and output the threat probability for that window. The closer the threat probability is to 1, the more likely the behavior window is to be an internal threat; the closer it is to 0, the more likely it is to be normal behavior. Finally, a threat determination is made, with a preset detection threshold. The threat probability is compared with a threshold to obtain the final judgment result: .

[0049] Example 6: Please see Figures 4-5 As shown in the sixth embodiment of the present invention, the present invention is an internal threat behavior detection system oriented towards concept drift. This internal threat behavior detection system is used to implement the internal threat behavior detection methods described in embodiments one through five. The internal threat behavior detection system includes four subsystems: a data acquisition and feature extraction subsystem (data layer), a threat detection and prototype clustering subsystem (model layer), a selective domain adversarial subsystem (algorithm layer), and an online detection and alarm subsystem (application layer). Specifically: The data acquisition and feature extraction subsystem is used to collect raw user behavior logs and preprocess them. It transforms heterogeneous logs into behavior embedding vectors in a unified semantic space through semantic encoding and Transformer feature extractor. The threat detection and prototype clustering subsystem is used to discriminate threats from behavior embedding vectors and output threat probabilities. It also performs prototype clustering using learnable prototype vectors to obtain prototype assignment results. Based on behavior embedding vectors, it discriminates threats and automatically discovers various behavior pattern types through the prototype clustering mechanism, providing an assignment basis for dynamic domain construction. The selective domain adversarial subsystem is used to construct dynamic behavior domains based on prototype assignment results, calculate the selection coefficient of each dynamic behavior domain, and perform selective domain adversarial training with the selection coefficient as the weight. The online detection and alarm subsystem is used to determine threats to real-time behavior windows using a trained feature extractor and threat classifier, and generate alarms when a threat is determined.

[0050] As an embodiment of the present invention, preferably, the data acquisition and feature extraction subsystem includes: The data acquisition and preprocessing module: This module collects real-time user activity logs within the system, including raw records of user logins, file access, command execution, and permission changes, by deploying a lightweight log collection agent or integrating with an existing security log platform. Simultaneously, it preprocesses the raw logs, parsing out core fields such as user identifier, action, target, result, user role, and timestamp. After sorting by user identifier and timestamp, the module divides user behavior sequences into fixed time windows. The module supports multiple log protocols and features data buffering, compressed transmission, and breakpoint resume mechanisms to ensure data acquisition integrity and low latency. The behavioral sequence semantic encoding module uses a learnable embedding layer to vectorize behavioral records. For discrete fields such as operation actions, operation objects, operation results, and user roles, they are mapped to continuous vectors using corresponding embedding matrices. For the timestamp field, the time difference with the previous record is calculated and logarithmically scaled before being mapped to a time-encoded vector using a linear embedding layer. The vectors from each field are concatenated to obtain the complete semantic vector for each behavioral record, outputting a semantic vector sequence. The Transformer feature extraction module, based on the Transformer encoder architecture, extracts features from semantic vector sequences. The module first injects sine and cosine positional encodings into the sequence to preserve temporal information. Then, it captures long-range dependencies and complex interaction patterns in the behavioral sequence through multiple stacked multi-head self-attention layers and feedforward neural network layers. Each Transformer encoding layer is followed by residual connections and layer normalization operations. The module performs mean pooling on the encoder output along the sequence length dimension to obtain a fixed-dimensional behavioral embedding vector, which comprehensively encodes the user's behavioral patterns within the current time window.

[0051] As an embodiment of the present invention, preferably, the threat detection and prototype clustering subsystem includes: Threat classifier module: Based on a multilayer perceptron architecture, it takes behavior embedding vectors as input and outputs the threat probability for the current time window. The module contains multiple fully connected hidden layers, each followed by a ReLU activation function, and the output layer uses a Sigmoid function. The module supports both training and inference modes, calculating the classification loss and participating in gradient backpropagation during the training phase. The prototype clustering module maintains a set of learnable prototype vectors, each representing a discriminative behavior pattern type. The module calculates the negative Euclidean distance between the behavior embedding vector and each prototype vector as similarity, obtains a soft assignment probability distribution using a temperature-parameterized Softmax function, and selects the prototype with the highest probability as the hard assignment result. The prototype learning loss function during module training includes a clustering loss that forces similar samples to be close to their assigned prototypes, and a separation loss that forces different prototypes to maintain distance, guiding the prototype vectors to learn discriminative behavior pattern representations.

[0052] As an embodiment of the present invention, a preferred selective domain adversarial subsystem includes: The dynamic domain construction module is used to construct dynamic domains. In each training batch, based on the hard assignment results output by the prototype clustering module, samples are assigned to corresponding domains. Each prototype corresponds to one domain, and the number of domains varies with the batch. A domain is instantiated for a prototype only when there are assigned samples in the current batch. This module enables adaptive adjustment of the domain structure, allowing the domain partitioning to change dynamically with changes in data distribution. The selection coefficient calculation module calculates a selection coefficient for each dynamically constructed domain, quantifying the necessity of that domain in domain adversarial training. The selection coefficient comprehensively evaluates three attributes: prototype stability (the number of consecutive rounds the prototype appears during training); user entropy (the entropy value of the user distribution covered by the prototype, reflecting whether the pattern is user-specific or universally present across users); and normality rate (the proportion of normal samples in the prototype). The module normalizes each attribute and then weights and fuses them, outputting the selection coefficient through the Sigmoid function. For stable, universally present domains with a high normality rate, the selection coefficient approaches 0; for rare, user-specific domains with a high anomaly rate, the selection coefficient approaches 1. The domain discriminator module instantiates a domain discriminator for each dynamically constructed domain. Based on a multilayer perceptron architecture, it takes behavior embedding vectors as input and outputs the probability that a sample belongs to that domain. The module inserts a gradient reversal layer between the feature extractor and the domain discriminator. During forward propagation, the input is passed identically, and during backpropagation, the gradient is multiplied by a negative coefficient, forming an adversarial game. The module uses selection coefficients as weights to perform a weighted sum of the domain discriminant losses for each domain, obtaining a selective domain adversarial loss, which is used to update the parameters of the feature extractor and the domain discriminator. Joint Training Scheduling Module: This module is responsible for the end-to-end joint training scheduling of the entire model. The module's total loss function is a weighted sum of classification loss, prototype learning loss, and selective domain adversarial loss. The module employs a progressive adversarial training strategy, setting a small adversarial loss weight at the beginning of training to prioritize the optimization of threat classification and prototype clustering tasks. As the number of training epochs increases, the adversarial loss weight is gradually increased to a preset maximum value, gradually introducing domain adversarial training to ensure training stability.

[0053] As an embodiment of the present invention, preferably, the online detection and alarm subsystem includes: The online detection module performs online threat detection on real-time collected user behavior logs during the inference phase. User behavior sequences are input into the trained semantic encoding module and Transformer feature extraction module to obtain behavior embedding vectors. These embedding vectors are then input into the trained threat classifier, which outputs the threat probability. The module compares the threat probability with a preset threshold and outputs the final judgment result (normal / threat). Alarm Generation Module: This module receives threat assessment results from the online detection module. When a threat is identified, it generates structured alarm information, including key fields such as user identifier, time window, and threat probability. The module supports pushing alarm information to the upper-level operations and maintenance platform via message queues, and supports various notification methods such as email and work order systems.

[0054] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0055] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for detecting internal threat behaviors oriented towards concept drift, characterized in that, Includes the following steps: Semantic encoding of user behavior logs yields behavior sequence semantic vectors. The Transformer feature extractor extracts features from the behavior sequence semantic vectors and pools them to generate behavior embedding vectors. The behavior embedding vector is input into the threat classifier to obtain the threat probability, and learnable prototype vectors are configured. The similarity between the behavior embedding vector and each prototype vector is calculated to perform prototype clustering and obtain prototype assignment results. Based on the prototype allocation results, samples assigned to the same prototype are constructed as dynamic behavior domains, and the selection coefficient of each dynamic behavior domain is calculated by combining prototype stability, user entropy and normality rate. A domain discriminator is instantiated for each dynamic behavior domain. A gradient reversal layer is inserted between the feature extractor and the domain discriminator. The domain discriminant loss of each domain is weighted and summed using the selection coefficient as the weight to obtain the selective domain adversarial loss. End-to-end joint training is performed using the weighted sum of the classification loss of the threat classifier, the prototype learning loss of prototype clustering, and the selective domain adversarial loss as the total loss. We use a trained feature extractor and threat classifier to perform threat detection on real-time behavioral data.

2. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, The semantic encoding method is as follows: The system acquires user behavior logs and maps the recorded actions, objects, results, and user roles into behavior vectors using a learnable embedding matrix. It then maps timestamps into time-encoded vectors using relative time difference calculation, logarithmic scaling, and linear embedding. Finally, it concatenates the behavior vectors and time-encoded vectors into a single behavior semantic vector. The behavior semantic vectors corresponding to the behavior records within a preset time window constitute the behavior sequence semantic vector.

3. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, The method for generating the behavior embedding vector includes: injecting position information into the behavior sequence using sine and cosine position encoding to obtain the initial input; outputting the vector sequence corresponding to the features within the window after passing through the multi-head self-attention layer, feedforward neural network layer, residual connection and layer normalization of the multi-layer Transformer feature extractor; and performing mean pooling on the vector sequence along the sequence length dimension to obtain the behavior embedding vector.

4. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, The threat classifier employs a multilayer perceptron structure and outputs threat probabilities using a sigmoid function. During the training phase, the cross-entropy loss function is used to optimize the threat classifier. In the prototype clustering phase, the negative Euclidean distance between the behavior embedding vector and the prototype vector is used as the similarity. The similarity is converted into soft assignment probabilities using a Softmax function with a temperature parameter, and the prototype corresponding to the maximum soft assignment probability is taken as the hard assignment result. The prototype learning loss includes clustering loss and separation loss.

5. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, In the construction of the dynamic behavior domain, samples are assigned to the corresponding dynamic behavior domains based on the prototype allocation results in each training batch; the number of dynamic behavior domains varies with the training batch, and the corresponding dynamic behavior domain is instantiated only when there are allocated samples in the current batch.

6. The method for detecting internal threat behavior oriented towards concept drift according to claim 5, characterized in that, The prototype stability is used to characterize the duration of each prototype, and is taken as the ratio of the number of consecutive training rounds in which the prototype appears to the preset normalization upper limit, with the maximum value limited to 1; the user entropy is used to measure the distribution entropy value of the users covered by the prototype, and the information entropy is calculated according to the ratio of the frequency of each user appearing in the prototype to the number of samples of the prototype, and the information entropy is normalized to the interval [0, 1]. The normality rate is the ratio of the number of samples labeled as normal within the dynamic behavior domain to the total number of samples.

7. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, The gradient reversal layer transmits the input identically during forward propagation and multiplies the gradient by a negative coefficient during backward propagation; the domain discrimination loss is a binary classification cross-entropy loss.

8. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, When performing end-to-end joint training, a progressive adversarial training strategy is adopted. Within a preset number of rounds, the selective domain adversarial loss weights are updated to the preset maximum value in a linear increment strategy. After the preset number of rounds are completed, the maximum value of the selective domain adversarial loss weights is maintained. Classification and prototype clustering optimization are completed first, and then domain adversarial training is introduced.

9. The method for detecting internal threat behavior oriented towards concept drift according to claim 1, characterized in that, When performing threat detection on real-time behavioral data, a single forward propagation is performed using a trained feature extractor and threat classifier. The real-time collected user behavior window is processed by feature extraction to obtain a behavior embedding vector, which is then input into the threat classifier to obtain the threat probability. The threat probability is compared with a preset threshold to output the threat determination result.

10. An internal threat behavior detection system oriented towards concept drift, characterized in that, The internal threat behavior detection system is used to implement the internal threat behavior detection method according to any one of claims 1-9, and the internal threat behavior detection system includes: The data acquisition and feature extraction subsystem is used to collect user behavior logs and extract behavior embedding vectors. The threat detection and prototype clustering subsystem is used to discriminate threats from behavior embedding vectors and output threat probabilities, and to obtain prototype assignment results by performing prototype clustering through learnable prototype vectors. The selective domain adversarial subsystem is used to construct dynamic behavior domains based on prototype assignment results, calculate the selection coefficient of each dynamic behavior domain, and perform selective domain adversarial training with the selection coefficient as the weight. The online detection and alarm subsystem is used to determine threats to real-time behavior windows using a trained feature extractor and threat classifier, and generate alarms when a threat is determined.

Images