A log detection method, device, storage medium and computer device

Abstract

This application provides a log detection method, apparatus, storage medium, and computer device. Addressing the challenges of existing security log analysis systems—namely, their inability to detect covert attacks with identical cross-entity semantics due to their "user / IP + timeline" perspective, their lack of behavioral semantic abstraction capabilities due to graph analysis granularity remaining at the log instance level, their high false positive rate due to ignoring differences in log source environments, and their inability to continuously adapt to new variant attacks due to the lack of a closed-loop feedback mechanism—this application proposes semantic behavior clustering, environment-weighted correction, large language model intent inference, cross-domain propagation prediction, and feedback evolution to achieve accurate and adaptive malicious behavior identification from logs.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a log detection method, apparatus, storage medium, and computer device. Background Technology

[0002] Network security situation awareness and log analysis are important tasks in modern Security Operations Centers (SOCs). Accurate anomaly detection and analysis of massive, multi-source, heterogeneous logs in enterprise networks can effectively maintain enterprise network security.

[0003] Traditional log detection methods often use the time of each log entry as the main thread, concatenating different logs into a log sequence, and then identifying abnormal logs by detecting the log sequence based on static thresholds or preset rules. However, this detection method suffers from low detection accuracy, a high rate of missed detections and false positives, and is difficult to effectively detect various complex and ever-changing anomaly attacks. Summary of the Invention

[0004] In view of this, this application provides a log detection method, apparatus, storage medium, and computer device to improve the detection accuracy of multi-source heterogeneous logs and avoid missed and false alarms of abnormal logs.

[0005] Specifically, this application is implemented through the following technical solution: In a first aspect, embodiments of this disclosure provide a log detection method, the method comprising: Obtain the logs to be detected from any of the multiple security domains and the currently constructed semantic behavior graph; the semantic behavior graph includes multiple semantic behavior nodes and entity nodes that have a first connection edge with the semantic behavior nodes; Based on the target semantic vector and log entity of the log to be detected, determine whether there is a target node pair that matches the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph; If so, the first score of the log to be detected is determined based on the current risk base of the target behavior node in the target node pair, the frequency dispersion of the log entity executing the target semantic behavior corresponding to the target behavior node, the latest security base of the second node pair composed of the source security domain of the target behavior node and the log to be detected, and the time when the log entity last executed the target semantic behavior. Based on the transition probabilities between the various historical semantic behaviors executed by the log entity, which are dynamically maintained by the behavior transition matrix, the transition coefficient of the log entity to the target semantic behavior is determined. The prediction coefficients of the second node pair are determined based on the next-hop node pair and the predicted jump probability predicted by the graph neural network for the second node pair, and the attack probability predicted by the large language model for the target behavior node. Based on the first score, the transition coefficient, and the prediction coefficient, a second score is determined for the log to be detected, and an anomaly detection result for the log to be detected is determined based on the second score.

[0006] Secondly, embodiments of this disclosure also provide a log detection device, the device comprising: The acquisition module is used to acquire the logs to be detected from any of the multiple security domains and the currently constructed semantic behavior graph; the semantic behavior graph includes multiple semantic behavior nodes and entity nodes that have a first connection edge with the semantic behavior nodes; The first determining module is used to determine, based on the target semantic vector and log entity of the log to be detected, whether there is a target node pair that matches the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph; The second determining module is used to determine the first score of the log to be detected based on the current risk base of the target behavior node in the target node pair, the frequency dispersion of the log entity executing the target semantic behavior corresponding to the target behavior node, the latest security base of the second node pair composed of the source security domain of the target behavior node and the log to be detected, and the time when the log entity last executed the target semantic behavior. The third determining module is used to determine the transfer coefficient of the log entity to the target semantic behavior based on the transfer probabilities between the various historical semantic behaviors executed by the log entity dynamically maintained by the behavior transfer matrix. The fourth determining module is used to determine the prediction coefficients of the second node pair based on the next-hop node pair and the predicted jump probability predicted by the graph neural network for the second node pair, and the attack probability predicted by the large language model for the target behavior node. The fifth determining module is used to determine the second score of the log to be detected based on the first score, the transfer coefficient and the prediction coefficient, and to determine the anomaly detection result of the log to be detected based on the second score.

[0007] Thirdly, an optional implementation of this disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps in the first aspect described above.

[0008] Fourthly, an optional implementation of this disclosure also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps in the first aspect described above.

[0009] The log detection method, apparatus, storage medium, and computer device provided in this disclosure construct a semantic behavior graph with semantic behaviors as nodes. Compared to the prior art method of constructing a graph structure with single log entries as nodes, this method can cluster massive amounts of multi-source heterogeneous logs into a finite number of semantic behavior classes. This reduces the order of magnitude of the number of nodes in the semantic behavior graph, lowers the graph structure complexity, and reduces the number of matches for newly arriving logs to be detected, thereby improving query speed. Furthermore, semantic behaviors can unify the descriptions of different actions in multi-source heterogeneous logs. Regardless of how many different log entities execute the same semantic behavior class, they will all be clustered into one class, thus exposing the overall scale of distributed scanning attacks. This method has higher robustness to log variants and can achieve log detection based on identified semantic behaviors without maintaining a large number of detection rules. By using the target semantic vector and log entity in the log to be detected, and matching them with the first node pair composed of log entity and semantic behavior nodes in the semantic behavior graph, and using the corresponding current risk base, frequency dispersion, latest security base, transition coefficient, predicted jump probability and attack probability of the matched target node, anomaly scoring is performed on the log to be detected. This can improve the accuracy of anomaly scoring for the log to be detected, avoid false positives and false negatives for logs under variant attacks, improve log detection accuracy, and can also detect cross-entity and cross-time collaborative attacks in a timely manner, further improving the accuracy of log detection, thereby effectively detecting various complex and ever-changing anomaly attacks.

[0010] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a log detection method in an exemplary embodiment of this application; Figure 2 This is a schematic diagram of the system architecture of a log detection method shown in an exemplary embodiment of this application; Figure 3 This is a schematic diagram of a log detection device shown in an exemplary embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device shown in an exemplary embodiment of this application. Detailed Implementation

[0012] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0013] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0014] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0015] Research has revealed that enterprise networks generate massive amounts of multi-source heterogeneous security logs daily, including threat alert logs, network traffic logs, endpoint operation logs, configuration change logs, and device anomaly logs. These multi-source heterogeneous logs are often characterized by dispersed sources, heterogeneous log formats, diverse semantic representations, and high noise redundancy. Therefore, accurately and effectively detecting multi-source heterogeneous logs has become a technical challenge. Traditional log detection methods typically fall into two categories: The first type of detection is based on log time. This method first standardizes the fields of multi-source heterogeneous logs (e.g., converting them to standard log protocols (such as Syslog) or common event formats) and normalizes the values ​​(e.g., unifying IP, port, and timestamp formats). Then, the transformed logs are stored in a relational database or retrieval engine such as Elasticsearch. Next, using "user account" or "IP" in the logs as entity identifiers, and with the timeline as the main thread, all logs generated by each log entity within a certain time window are linked together in chronological order to form a "log sequence" corresponding to the log entity. Anomalies are detected by using set static thresholds for threshold judgment, rule matching based on preset rules, or simple statistical models (e.g., whether it deviates from the baseline of historical sequences). However, this method has the following problems: 1. It uses a single user account or IP as the core analysis dimension, and the analysis perspective is only the log sequence under a single log entity, naturally severing the possibility of multiple entities collaborating on the same attack behavior, and failing to detect cross-entity collaborative attacks. For example, in Advanced Persistent Threat (APT) attacks, multiple botnets sequentially perform the same registry modification operations. Analyzing them individually by IP address will not reveal any obvious anomalies; log sequences strung together by timeline also cannot achieve cross-IP correlation, leading to severe underreporting of distributed coordinated attacks. 2. The method of stringing logs together by time proximity and field matching relies only on the surface features of the log sequence, ignoring the deep semantic relationships between different logs and failing to identify behaviors with "different expressions but the same semantics." For example, the logs for "User A failed to log in multiple times" and "Account B's password was incorrectly locked" are different in their fields and expressions but both belong to authentication failure anomalies. They cannot be classified into the same log sequence and the same log category, resulting in scattered attacks of the same type that cannot be aggregated. 3. Time-series analysis has weak anti-interference capabilities and is easily affected by noise. For example, the interspersing of abnormal log behaviors with normal log behaviors will interrupt the continuous abnormal log sequence. Time-series-based anomaly detection models are prone to high false negatives and high false positives, making them difficult to adapt to complex business environments.

[0016] The second type is the graph-based detection method, which abstracts the log entities in each log as nodes and the relationships between entities as edges to construct a static or time-series knowledge graph. Then, it uses graph queries (such as Neo4j query language) or graph algorithms (such as community detection, shortest path algorithm, etc.) to match predefined attack patterns (such as various predefined connection edges) to identify malicious attack behaviors. However, this method has the following problems: (1) The graph granularity is limited to the log instance level, resulting in an explosion in the scale of the graph structure and low query efficiency. For example, using a single log as a node or event edge will cause the number of graph nodes and edges to increase linearly with the amount of logs, resulting in a significant increase in the time consumption of subsequent queries and calculations, which cannot support large-scale real-time log analysis. (2) It lacks a behavioral semantic abstraction layer and cannot identify attack variants. The graph query process relies on manually predefined attack structure patterns, which only support exact matching and cannot automatically abstract behavioral semantics, resulting in the inability to effectively identify variant attacks that are not completely consistent with the predefined attack structure pattern. For example, the attacker changes "create script file" to "create batch file". The two attacks have the same semantics but different graph structures, which makes the existing graph query method unable to effectively identify them. (3) It is not possible to retrieve similar behaviors in batches, and the detection capability is limited. It only supports precise graph structure matching and cannot retrieve sets of behaviors that are "semantically similar but have different instances" in batches. For example, it cannot answer key analysis questions such as "which IPs performed operations that are semantically similar to creating suspicious scheduled tasks".

[0017] Therefore, it is evident that existing log detection methods are all inadequate for efficiently and accurately identifying real attack behaviors and potential threats from massive amounts of heterogeneous logs from multiple sources. In particular, they are unable to cope with advanced threats such as APT attacks, distributed collaborative attacks, and variants of attack methods, and have obvious problems of low detection accuracy and serious false negatives and false negatives.

[0018] Based on the above research, this disclosure provides a log detection method, apparatus, storage medium, and computer device. By constructing a semantic behavior graph with semantic behaviors as nodes, compared to the existing method of constructing a graph structure with single log entries as nodes, it can cluster massive amounts of multi-source heterogeneous logs into a finite number of semantic behavior classes. This reduces the order of magnitude of the number of nodes in the semantic behavior graph, lowers the graph structure complexity, and reduces the number of matches for newly arriving logs to be detected, thereby improving query speed. Furthermore, semantic behaviors can unify the descriptions of different actions in multi-source heterogeneous logs. Regardless of how many different log entities execute the same semantic behavior class, they will all be clustered into one class, thus exposing the overall scale of distributed scanning attacks. It has higher robustness to log variants and can achieve log detection based on identified semantic behaviors without maintaining a large number of detection rules. By using the target semantic vector and log entity in the log to be detected, and matching them with the first node pair composed of log entity and semantic behavior nodes in the semantic behavior graph, and using the corresponding current risk base, frequency dispersion, latest security base, transition coefficient, predicted jump probability and attack probability of the matched target node, anomaly scoring is performed on the log to be detected. This can improve the accuracy of anomaly scoring for the log to be detected, avoid false positives and false negatives for logs under variant attacks, improve log detection accuracy, and can also detect cross-entity and cross-time collaborative attacks in a timely manner, further improving the accuracy of log detection, thereby effectively detecting various complex and ever-changing anomaly attacks.

[0019] The shortcomings of the above solutions are the result of the inventor's practical experience and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this disclosure below should be considered as the inventor's contribution to this disclosure.

[0020] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0021] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0022] To facilitate understanding of this embodiment, a log detection method disclosed in this disclosure will first be described in detail. The execution subject of the log detection method provided in this disclosure is generally a terminal device or other processing device with certain computing power. The terminal device can be a user equipment (UE), a mobile device, a terminal, a personal digital assistant (PDA), a handheld device, a computer device, etc. In some possible implementations, the log detection method can be implemented by the processor calling computer-readable instructions stored in the memory.

[0023] The log detection method provided in this disclosure embodiment will be described below using a computer device as an example.

[0024] like Figure 1 The flowchart shown is a log detection method provided in an embodiment of this disclosure, which may include the following steps: S101: Obtain the log to be detected from any of the multiple security domains and the currently constructed semantic behavior graph; the semantic behavior graph includes multiple semantic behavior nodes and entity nodes that have a first connection edge with the semantic behavior nodes.

[0025] Here, multiple security domains can be pre-defined areas from which logs may originate. These areas can include at least the core industrial production area, office area, demilitarized zone (DMZ), and development and testing area.

[0026] The log to be detected can be any type of log collected in real time from any security domain. The log type can include at least threat data type, user operation data type, configuration data type, device alarm type, and network flow type. That is, the log to be detected can be any type of log from any source in a multi-source heterogeneous log collection.

[0027] The currently constructed semantic behavior graph is the latest semantic behavior graph constructed by the behavior clustering and graph construction layer in this application. The behavior clustering and graph construction layer is used to perform semantic density-based semantic behavior clustering and the construction and updating of the semantic behavior graph. In the initial detection phase, this semantic behavior graph can be the initially constructed behavior graph; in non-initial detection phases, it can be a behavior graph obtained by updating the initially constructed behavior graph through at least one iteration. The initially constructed behavior graph can be set based on expert experience or pre-constructed using a large number of collected sample logs. The semantic behavior graph can include semantic clustering of a large number of historical logs, which can include multiple semantic behavior nodes and multiple entity nodes. A semantic behavior node can be a node corresponding to a semantic vector obtained from a cluster, representing a semantic behavior class (SBC), such as authentication failure class, remote execution class, data export class, etc. Therefore, each semantic behavior node can be called an SBC node, and each SBC node can have a unique identifier. Entity nodes can be log entities carried in historical logs. Log entities can be, for example, user Internet Protocol (IP), user account or name, or device identifier. There can be connection edges between entity nodes and semantic behavior nodes. This connection edge is defined as the first connection edge, which indicates that the log entity corresponding to the entity node it is connected to has executed the semantic behavior corresponding to the semantic behavior node it is connected to.

[0028] In practical implementation, the log collection layer provided in this application can be used to collect and preprocess multi-source heterogeneous logs. For example, after the log collection layer collects the logs to be detected from any security domain, it can perform structured processing such as field alignment and numerical normalization on the logs to be detected, resulting in structured logs to be detected. Field alignment, for example, can utilize the association between preset fields and standard fields in a preset field mapping table to map target fields in the logs to be detected that match the preset fields to standard fields, while directly retaining target fields in the logs to be detected that do not match any preset fields. Numerical normalization can normalize the numerical information in the logs to be detected, such as time information, IP information, log status code information, etc. The log status code is used to indicate the execution result status of the logs to be detected, such as successful or failed execution. Simultaneously with obtaining the logs to be detected, the latest constructed semantic behavior graph at the current moment can be obtained.

[0029] S102: Based on the target semantic vector and log entity of the log to be detected, determine whether there is a target node pair that matches the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph.

[0030] Here, the first node pair is the node pair (Entity, SBC) consisting of the semantic behavior node (SBC node) and the entity node (Entity node) connected by the first connecting edge. The target node pair can be a first node pair where the entity node matches the log entity in the log to be detected and the semantic behavior node matches the target semantic vector. The target semantic vector can be a vector obtained by semantic embedding the log to be detected. The log entity in the log to be detected can be the user IP, user account or name, device identifier, etc. carried in the log to be detected.

[0031] In practice, a semantic parsing and embedding layer can be used to perform semantic parsing and feature embedding on the structured log to be detected, obtaining the target semantic vector of the log and the log entities carried in the log. Then, a semantic query and matching layer can be used to match the node pairs associated with the first connecting edges in the currently constructed semantic behavior graph with the target semantic vector and log entities of the log to be detected, to determine whether there are any target node pairs that match the log to be detected.

[0032] In one embodiment, the above-described S102 can be implemented according to the following steps: S102-1: Filter candidate node pairs that include log entities from the first node pairs included in the semantic behavior graph.

[0033] In practice, a semantic query and matching layer can be used to match the entity nodes in each first node pair of the currently constructed semantic behavior graph with the log entity of the log to be detected, thereby obtaining each candidate entity node that includes the log entity, and taking the first node pair containing each candidate entity node as the candidate node pair.

[0034] Optionally, if there are candidate node pairs carrying log entities, it can be said that the log entity in the log to be detected is a newly appearing entity, and the log to be detected can be added to the candidate pool in the following text.

[0035] S102-2: Determine the current similarity threshold for the candidate node pair based on the number of times the historical logs matching the candidate node pair are marked as abnormal logs.

[0036] Here, the historical logs matching the candidate node pairs can be those logs from historically collected data that match the candidate node pairs. The operation of marking historical logs as anomalous logs can be the result of manual annotation of historical logs by security analysts. Anomalous logs indicate that the historical logs contain logs showing actual attack behavior.

[0037] In practice, for each first node pair (Entity, SBC), when the node pair first appears in the semantic behavior graph, a global entity-level dynamic matching threshold θ_entity can be set for that node pair. Then, after a security analyst manually labels the historical logs matching the node pair as anomalous logs, the previously determined θ_entity for that node pair can be dynamically adjusted, for example, by decreasing θ_entity to obtain the latest θ_entity. This makes it easier for log entities in the node pair to be classified into the semantic behavior class of that node pair when performing similar behaviors in the future. The current similarity threshold is the latest determined θ_entity for the candidate node pair. After identifying each candidate node pair, for each candidate node pair, the number of times the historical logs matching the candidate node pair have been labeled as anomalous logs can be obtained. Then, based on this number and a preset adjustment function, the current similarity threshold corresponding to the candidate node pair can be determined. Understandably, if none of the historical logs matching the candidate node pair have been labeled as anomalous logs, then the current similarity threshold corresponding to the candidate node pair is the preset global threshold.

[0038] S102-3: Based on the similarity between the semantic behavior vector carried by the semantic behavior node in the candidate node pair and the target semantic vector, and the current similarity threshold, determine whether there is a matching target node pair among the candidate node pairs.

[0039] Here, the semantic behavior vector carried by the semantic behavior node is the semantic vector obtained by clustering the semantic behavior node.

[0040] In practice, each candidate node pair can be matched sequentially. For the currently matched candidate node pair, the similarity between the semantic behavior vector carried by the semantic behavior node in the candidate node pair and the target semantic vector of the log to be detected can be calculated. It is then determined whether the similarity is greater than the current similarity threshold corresponding to the candidate node pair. If so, the candidate node pair can be taken as the target node pair, and the matching of subsequent candidate node pairs can be stopped. If not, the matching of the next candidate node pair can continue until the target node pair is determined, or until all candidate node pairs have been matched and it is determined that no target node pair exists.

[0041] S103: If so, then the first score of the log to be detected is determined based on the current risk base of the target behavior node in the target node pair, the frequency dispersion of the target semantic behavior corresponding to the target behavior node executed by the log entity, the latest security base of the second node pair composed of the target behavior node and the source security domain of the log to be detected, and the time when the log entity last executed the target semantic behavior.

[0042] Here, the target behavior node can be a semantic behavior node carried in a target node pair. The target semantic behavior is the semantic behavior class corresponding to the target behavior node. Each semantic behavior node can dynamically maintain a risk base, which is used to characterize the static risk level of the semantic behavior corresponding to the semantic behavior node. The current risk base is the latest risk base determined for the target semantic behavior. Frequency dispersion is used to characterize the frequency with which the log entity executes the target semantic behavior over a preset time period, and the degree of deviation relative to the historical execution frequency of the target semantic behavior.

[0043] Similarly, for each semantic behavior node in the semantic behavior graph, node pairs can be constructed between the semantic behavior node and the security domains to which each historical log matches the node. These node pairs are called second node pairs. That is, each second node pair carries a security domain and a semantic behavior node that appeared first in that security domain. Each second node pair can dynamically maintain a security cardinality, which represents the weight of the semantic behavior corresponding to the semantic behavior node within the security domain.

[0044] The source security domain is the security domain to which the log to be detected belongs. The target behavior node and the source security domain can form a second node pair. The latest security base is the latest security base determined for this second node pair.

[0045] Each first connected edge in the semantic behavior graph can maintain the log entity under the entity node corresponding to that first connected edge in its edge attributes, and the various times when the semantic behavior corresponding to the semantic behavior node of that first connected edge was executed. The time when the log entity last executed the target semantic behavior can be obtained from the edge attributes of the first connected edge to which the target node belongs.

[0046] In one embodiment, the current risk baseline is related to the number of times the historical logs corresponding to the target behavior node are marked as anomalous logs and / or false positives. Here, the historical logs corresponding to the target behavior node can be historical logs whose log semantic vectors match the semantic vectors carried by the target behavior node, that is, historical logs that have executed the semantic behavior class corresponding to the target behavior node. False positives are anomalous logs that are identified as anomalous logs by the log detection method provided in this application, but are determined to be false positives by security analysts after manual annotation. Anomalous logs are those manually annotated by security analysts as indicating a real attack. Security analysts can provide feedback on the manual annotation results through a closed-loop feedback evolution layer.

[0047] In practical implementation, for any historical log, if it is manually marked as an anomalous log exhibiting "real attack" behavior, the current risk base of the semantic behavior node (SBC node) matched with that historical log can be increased, for example, by adjusting it upwards by a preset step size. Conversely, for any historical log, if it is manually marked as an anomalous false positive, the current risk base of the semantic behavior node (SBC node) matched with that historical log can be decreased, for example, by adjusting it downwards by a preset step size. Simultaneously, a negative feedback weight vector can be added to that semantic behavior node, so that when subsequent logs with semantic similarity to the anomalous false positive log are matched with that semantic behavior node, the second score is multiplied by a coefficient less than 1.

[0048] For example, for a target behavior node, the first number of times it is marked as an abnormal log and / or the second number of times it is marked as an abnormal false alarm can be obtained from each historical log corresponding to the target behavior node. Based on the first number and the second number, the current risk base of the target behavior node can be determined.

[0049] Similarly, the frequency dispersion is related to the frequency with which log entities execute the target semantic behavior over a preset time period in the past, and the average frequency with which different log entities execute the target semantic behavior historically. The preset time period can be set empirically, and this embodiment does not impose a specific limitation. For example, the preset time period can be half an hour, one hour, etc. Regarding the target semantic behavior, it may have been executed by log entities in different historical logs, so the average frequency with which all log entities execute the target semantic behavior historically can be statistically analyzed. This frequency can be considered the global average frequency with which the target semantic behavior is executed.

[0050] In practice, for a log entity in the log to be detected, after determining the target node pair to which the log entity belongs, the frequency of the log entity performing the target semantic behavior corresponding to the target node pair over a preset time period can be determined based on the currently constructed semantic behavior graph (this frequency is defined as the current frequency), and the average frequency of all log entities that have performed the target semantic behavior over historical time periods can be determined. Then, the frequency dispersion of the log entity can be determined as max(current frequency / (average frequency + ε), 1), where max represents the maximum value between current frequency / (average frequency + ε) and 1, and ε can be a preset smoothing term.

[0051] Similarly, the latest security baseline can be correlated with the importance of the source security domain and the number of times the corresponding historical logs of the second node pair are marked as false alarms. Here, different security domains can have different levels of importance, which can be represented by the baseline security baseline set for each domain. For example, the baseline security baseline α_zone for any security domain can range from 0.5 to 1.5, with α_zone=1.2 for the core production area, α_zone=1.0 for the DMZ area, α_zone=0.8 for the office area, and α_zone=0.6 for the development and testing area. A larger baseline security baseline indicates a more important security domain. The historical logs corresponding to the second node pair can be historical logs from the source security domain within the second node pair that possess the target semantic behavior of the second node pair.

[0052] In practice, when the same semantic behavior class appears in a high-importance security domain, its latest security baseline will be amplified based on the previously determined security baseline; when it appears in a low-importance security domain, its latest security baseline will be reduced based on the previously determined security baseline, thereby avoiding false positives for normal attack simulation behavior in the test environment. In the initial detection phase, the previously determined security baseline can serve as the baseline security baseline for the security domain. Similarly, for any second node pair, its security baseline can be adaptively adjusted based on the number of times its corresponding historical logs are manually marked as false positives. For example, if a second node pair of a certain (SBC, zone) combination is repeatedly marked as a false positive (i.e., if a large number of historical logs under a certain (SBC, zone) combination are continuously marked as false positives), the security baseline of the second node pair corresponding to that combination can be automatically reduced based on the previously determined security baseline, with a minimum of 0.5.

[0053] For example, a security domain factor calculation layer can be used to dynamically and adaptively adjust the security base of the second node pairs corresponding to each security domain, obtaining the latest security base for each second node pair. For instance, for a second node pair consisting of a target behavior node and the source security domain of the log to be detected, the security domain factor calculation layer can be used to obtain the total number of times each historical log corresponding to this second node pair has been marked as an anomaly false alarm. Then, based on this total number and the importance of the source security domain of the log to be detected, the previously determined security base is adjusted to obtain the latest security base for this second node pair. In this way, if logs associated with a certain SBC node under a certain security domain are repeatedly marked as an anomaly false alarm, the security base of that (SBC, zone) combination is automatically reduced, which can improve the reasonableness of detecting subsequent logs under that (SBC, zone).

[0054] Through the closed-loop adaptive adjustment of the risk base and security base described above, the accuracy of anomaly detection can be continuously improved. Even if attackers use variant syntax (e.g., changing "create scheduled task" to "register SCHTASKS"), as long as the semantic vector is similar to the existing attack class, accurate identification can still be achieved after feedback enhancement.

[0055] In the specific implementation of S103 above, after the target node pair is found from the currently constructed semantic behavior graph using the semantic query and matching layer, the anomaly scoring layer can be used to obtain the current risk base of the target SBC node in the target node pair, the frequency dispersion of the target entity executing the target semantic behavior class corresponding to the target SBC node in the target node pair, the latest security base of the second node pair (target SBC node, T_zone) composed of the target SBC node and the source security domain (defined as T_zone) of the log to be detected, and the time of the log entity of the log to be detected most recently executing the target semantic behavior class corresponding to the target SBC node obtained from the edge attributes of the first connection table corresponding to the target node pair. Then, the time decay factor of the log to be detected can be determined based on the time difference between the time of the most recent execution of the target semantic behavior class corresponding to the target SBC node and the generation time of the log to be detected. For example, the time decay factor TemporalDecay can be... ;in, λ The attenuation coefficient can be preset. This represents the time difference.

[0056] Then, the first score of the log to be detected can be determined using the following formula: Basescore=BaseRisk(SBC)×EntityHistoricalFactor×ZoneWeight×TemporalDecay×C; (Formula 1) Wherein, Basescore represents the first score corresponding to the log to be detected, BaseRisk(SBC) represents the current risk cardinality of the target behavior node, EntityHistoricalFactor represents the frequency dispersion of the log entity of the log to be detected performing the target semantic behavior, ZoneWeight represents the latest security cardinality of the second node pair composed of the target behavior node and the source security domain of the log to be detected, TemporalDecay represents the time decay factor, and C represents the matching confidence coefficient, which is 1 when the target node pair is found.

[0057] S104: Determine the transition coefficient of the log entity to the target semantic behavior based on the transition probabilities between the various historical semantic behaviors executed by the log entity, which are dynamically maintained by the behavior transition matrix.

[0058] Here, for each entity node in the currently constructed semantic behavior graph, a behavior transition matrix can be dynamically maintained for that entity node. This behavior transition matrix records the transition probabilities between various historical semantic behaviors executed by the log entity corresponding to that entity node, and the transition probabilities between various historical semantic behaviors can be continuously updated as the collected logs increase.

[0059] The transition coefficient is used to indicate the likelihood of a log entity being transferred from its previous historical semantic behavior to the target semantic behavior.

[0060] In practice, an anomaly scoring layer can be used to obtain the latest behavior transition matrix corresponding to the log entity in the log to be detected. From the transition probabilities recorded in this behavior transition matrix, the transition probability of the log entity in the log to be detected transitioning from the historical semantic behavior executed in the last time to the target semantic behavior can be found. Then, the transition probability can be used to determine the transition coefficient. For example, the found transition probability can be directly used as the transition coefficient.

[0061] S105: Determine the prediction coefficients of the second node pair based on the next-hop node pair predicted by the graph neural network for the second node pair and the predicted jump probability, and the attack probability predicted by the large language model for the target behavior node.

[0062] Here, the graph neural network (Graph Neural Network) can be a graph network trained in the latest iteration, which can be used to predict the probability of the semantic behavior of anomaly logs spreading across different security domains. For example, for any second node pair, the Graph Neural Network can predict the next security domain and semantic behavior node most likely to spread from the second node pair, as well as the probability of the spread. The next-hop node pair is the other second node pair most likely to spread from the second node pair consisting of the target behavior node and the source security domain of the log to be detected, as predicted by the Graph Neural Network. The predicted jump probability is the spread probability of jumping to the next-hop node predicted by the Graph Neural Network. The Large Language Model (LLM) can be a language model trained in the latest iteration, which is deployed locally and can be used to perform semantic annotation and attack intent prediction for each semantic behavior node, outputting the attack probability of the semantic behavior corresponding to each semantic behavior node. The prediction coefficients are used to characterize the possibility of the second node pair spreading across security domains and generating attack behavior. For example, the LLM can be any model fine-tuned in the security domain, such as the security domain large language model based on Qwen.

[0063] In practical implementation, the graph neural network can be a graph attention network (GAT). After determining the first score, the anomaly scoring layer can be used to obtain the next-hop node pair and predicted jump probability predicted by the GAT network for the second node pair. This next-hop node pair and predicted jump probability can be predicted by the GAT network after the most recent update of the semantic behavior graph, or it can be obtained by the anomaly scoring layer calling the GAT network in real time and inputting the relevant information of the second node pair into the GAT network. Simultaneously, the anomaly scoring layer can be used to obtain the attack probability predicted by the LLM model for the target behavior node. This attack probability can be output by the LLM model based on the most recent updated semantic behavior graph, or it can be obtained by the anomaly scoring layer calling the LLM model in real time and inputting the relevant information of the target node pair into the LLM model. Then, the prediction coefficient can be determined by multiplying the importance of the security domain in the next-hop node pair, the predicted jump probability, and the attack probability.

[0064] S106: Determine the second score of the log to be detected based on the first score, the transition coefficient, and the prediction coefficient, and determine the anomaly detection result of the log to be detected based on the second score.

[0065] Here, the anomaly detection result is used to indicate whether the log to be detected is an abnormal log, that is, it can characterize whether there is abnormal attack behavior in the log to be detected. The second score is the anomaly score of the log to be detected.

[0066] In practice, the product of the first score, the transfer coefficient, and the prediction coefficient can be calculated and used as the second score. The second score is then compared with a score threshold. If the second score is greater than the score threshold, the log to be detected is determined to be an abnormal log and an alarm is triggered. If the second score is not greater than the score threshold, the log to be detected is determined to be a normal log and the detection of the next log to be detected continues.

[0067] Optionally, to prevent the risk of detection from being overemphasized for the log to be detected, the second score can be limited to less than or equal to 10. If the second score calculated in real time is greater than 10, 10 can be directly used as the final second score.

[0068] Thus, based on the above embodiments, it is possible to calculate the final anomaly score in real time for each log to be detected and the first node pair corresponding to each log to be detected, and save it to the semantic behavior graph. This makes it easier for security analysts to quickly list the "node pairs obtained by combining the top N entities with the highest anomaly scores and semantic behavior classes" when querying the semantic behavior graph, thereby helping security analysts to quickly focus on high-risk semantic behaviors.

[0069] Optionally, if no target node pair matches the log to be detected, a temporary matching mechanism can be used to calculate a temporary score for the log to be detected to avoid missing abnormal logs. The temporary matching mechanism can be as follows: from candidate node pairs, based on the semantic behavior vectors carried by the semantic behavior nodes in the candidate node pairs, find the candidate node pair with the highest similarity to the target semantic vector of the log to be detected, and use this candidate node pair as the matching node pair. Then, by determining the current risk cardinality, frequency dispersion, latest security cardinality, the time when the log entity last executed the semantic behavior in the matching node pair, and a matching confidence coefficient of 0.5, a first score for the log to be detected is determined. Then, based on the first score, the transition coefficient of the log entity to the semantic behavior in the matching node pair, the next-hop node pair predicted by the graph neural network for the second node pair combining the source security domain and the semantic behavior nodes in the matching node pair, and the attack probability predicted by the large language model for the semantic behavior nodes in the matching node pair, a second score for the log to be detected is determined, and the anomaly detection result of the log to be detected is determined based on the second score. The process of using matching node pairs to detect whether the log to be detected is an abnormal log can be referred to the process of using target node pairs to detect whether the log to be detected is an abnormal log, and will not be repeated here.

[0070] In one embodiment, if no target node pair matches the log to be detected, the currently constructed behavior node graph can be updated by continuously collecting logs of each non-target node pair, thereby continuously enriching the behavior semantic classes in the semantic node graph. Specifically, the graph structure of the semantic behavior graph can be updated by performing steps A1 to A5 as follows: A1: If no target node pair exists, store the logs to be detected in the candidate pool.

[0071] In practice, if there is no matching target node pair among the (Entity, SBC) pairs included in the currently constructed semantic behavior graph for the currently collected log to be detected, it can be said that a new log entity and / or a new semantic behavior has appeared in the log to be detected, and the log to be detected can be stored in the candidate pool first.

[0072] A2: In response to triggering the preset clustering conditions, the logs to be detected stored in the candidate pool are processed in a structured manner to obtain each structured log.

[0073] Here, the preset clustering conditions can be at least one of the following: reaching a preset clustering period, the number of logs to be detected from the same security domain in the candidate pool reaching a first preset number, or the total number of logs to be detected in the candidate pool reaching a second preset number. Both the first and second preset numbers can be set empirically, and this embodiment does not impose specific limitations, but the first preset number is usually less than the second preset number. For example, the first preset number can be 100, and the second preset number can be 200. The duration of the preset clustering period can also be set empirically, and this embodiment does not impose specific limitations. For example, the duration of the preset clustering period can be every hour, every 2 hours, etc. Structured processing can at least include field alignment processing and numerical normalization processing.

[0074] In practice, in response to triggering any preset clustering condition, the log collection layer can retrieve each log to be detected currently stored in the candidate pool, and perform field alignment and numerical normalization on each log to be detected to obtain each structured log to be detected. Understandably, if the log to be detected has already been structured before matching the target node pair corresponding to the log to be detected, then all the logs to be detected stored in the candidate pool are structured logs to be detected, and A3 below can be executed directly when the preset clustering condition is triggered.

[0075] A3: For each structured log, extract keyword information from the structured log according to the preset keyword type, and use a pre-trained semantic vector model to generate the target semantic vector corresponding to the structured log.

[0076] Here, structured logs refer to structured logs to be inspected. Preset keyword types can include at least action verb types, operation object types, log entity types, and log execution result types. Keyword information can include keywords under each preset keyword type. For example, for any structured log entry, keywords for the action verb type could be "login," "modify," "create," "block," etc.; keywords for the operation object type could be "file," "registry," "firewall rule," "user account," etc.; keywords for the log entity type could be "user IP," "user account or name," "device identifier," etc.; and keywords for the log execution result type could be the execution result represented by a normalized status code, such as execution failure or execution success.

[0077] The pre-trained semantic vector model can be a Bidirectional Encoder Representations from Transformers (BERT) model pre-trained in the security domain. The target semantic vector is the log semantic vector corresponding to the structured log, and each structured log's target semantic vector will carry a security domain label indicating the source security of that target semantic vector.

[0078] In practice, for each structured log in the candidate pool, semantic parsing and embedding layers can be used to extract keywords and vectorize log semantics. Specifically, semantic parsing and embedding layers can be used to extract keywords from the structured log that match each preset keyword type. These keywords are used as the keyword information of the structured log, and will be subsequently used to determine the first connection edge between the semantic behavior node and the entity node corresponding to the structured log. Simultaneously, each structured log can be input into a pre-trained BERT model to convert each structured log into a fixed-length target semantic vector. For example, for the two structured logs "User A failed login" and "Account B incorrect password," the pre-similarity of their corresponding target semantic vectors will be extremely high, indicating that these two structured logs performed the same semantic behavior.

[0079] A4: Based on the target semantic vector corresponding to each structured log and the baseline security cardinality corresponding to each security domain, cluster each target semantic vector to obtain the cluster center vector of each target.

[0080] Here, each security domain can be pre-set with a baseline security base α_zone. The size of the baseline security base α_zone of a security domain is used to characterize the importance of the security domain.

[0081] In practical implementation, a pre-defined clustering algorithm (such as Density-Based Spatial Clustering of Applications with Noise (DBSCAN) or Hierarchical Density Clustering (HDBSCAN)) can be used. The baseline security cardinality corresponding to each security domain is used as the clustering weight. By ignoring the temporal order and entity identity of the structured logs, the target semantic vectors corresponding to each structured log are clustered together based on semantic similarity. This results in each cluster, the target cluster center vector for each cluster, and the association between each target cluster center vector and its corresponding target semantic vector. Each cluster can represent a Semantic Behavior Class (SBC), such as "Authentication Failure Class," "Remote Execution Class," or "Data Export Class." The target cluster center vector serves as the semantic vector prototype of the SBC under the corresponding cluster, and can also record the distribution characteristics of the SBCs corresponding to each target cluster center vector across different security domains.

[0082] Optionally, in addition to using the structured logs corresponding to each log to be detected in the candidate pool for clustering, the target semantic vectors of all logs to be detected collected in the preset clustering period can be used to calculate the distance between them to obtain the cluster center vectors of each target.

[0083] A5: Using each target cluster center vector as a new semantic behavior node, update the graph structure of the currently constructed semantic behavior graph based on the entity nodes in the currently constructed semantic behavior graph, the log entities in each structured log, and the keyword information of each structured log associated with the target cluster center vector, to obtain a new constructed semantic behavior graph.

[0084] Here, the newly constructed semantic behavior graph is the behavior graph updated from the previously constructed semantic behavior graph using structured logs from the candidate pool. The structured log entries associated with the target cluster center vectors are the structured log entries corresponding to the respective target semantic vectors associated with the target cluster center vectors.

[0085] In practice, after obtaining the target cluster center vectors for each structured log in the candidate pool through clustering, the stability of the cluster corresponding to each target cluster center vector can be determined. For example, if the number of target semantic vectors associated with the target cluster center vector is not less than a preset number (e.g., 10) and the average similarity between the target semantic vectors associated with the target cluster center vector is greater than a preset similarity (e.g., 0.8), then the cluster corresponding to the target cluster center vector can be determined to be stable. Otherwise, the target cluster center vector can be determined to be unstable, discarded, and the structured logs associated with the target cluster center vector and its associated target semantic vectors can be put back into the candidate pool to wait for the next clustering. Then, if no stable target cluster center vector exists, the current graph structure update can be stopped, and the next clustering can be waited for.

[0086] If a stable target cluster center vector exists, it can be used to update the graph structure of the currently constructed semantic behavior graph. Alternatively, if a stable target cluster center vector exists, all stable target cluster center vectors and the structured logs corresponding to the target semantic vectors associated with them can be sent to security analysts. After manual evaluation by the security analysts, if it is determined that the graph structure can be updated, the stable target cluster center vectors can be used to update the graph structure.

[0087] During graph structure updates, for each stable target cluster center vector, it can be treated as a new semantic behavior node (i.e., a new SBC node). Then, based on the entity nodes in the currently constructed semantic behavior graph, from each structured log entity (which can also be the log entity in the structured log corresponding to each target semantic vector associated with the target cluster center vector), determine the log entities that already exist as entity nodes and those that do not. For log entities that do not exist as entity nodes, these can be treated as new entity nodes. Then, based on the keyword information of each structured log associated with the target cluster center vector, determine the first connection edges that need to be created between the new semantic behavior node and the new entity node, as well as the first connection edges that need to be created between the new semantic behavior node and the existing entity node. Then, using these first connection edges, the new semantic behavior node, and the new entity node, update the graph structure of the currently constructed semantic behavior graph to obtain a new constructed semantic behavior graph.

[0088] In the semantic behavior graph, each semantic behavior node can store at least the following information: semantic behavior node identifier, prototype cluster center vector, generation time information of the semantic behavior node (this time information can also be the generation time of each log used to cluster the semantic behavior node and the time when the information stored in the semantic behavior node is updated), keyword information of each structured log associated with the cluster center vector, baseline security cardinality and latest security cardinality of each security domain to which the semantic behavior node is distributed, and baseline risk cardinality and current risk cardinality of the semantic behavior node. Each entity node can store at least the following information: log execution subject (i.e., log entity), such as user IP, device identifier, user account, etc.

[0089] Each first connection edge (defined as a PERFORME edge) in the semantic behavior graph connects a semantic behavior node and an entity node, and this connection edge must have at least the following attributes: a timestamp list, execution count, original log identifier, and security domain. The timestamp list stores the times at which the log entity corresponding to the entity node executes the semantic behavior corresponding to the semantic behavior node; the execution count represents the total number of times the log entity corresponding to the entity node executes the semantic behavior corresponding to the semantic behavior node; and the original log identifier can be a log recording the execution of the semantic behavior corresponding to the semantic behavior node by the log entity corresponding to the entity node. The edge attributes of the first connection table can be used not only for predicting attack probabilities but also for security analysts to perform backtracking and forensics. Understandably, when a log to be detected matches a target node pair, the time information corresponding to the log to be detected can be added to the edge attributes of the first connection edge between the target node pair, the execution count of the first connection edge can be updated, and the log identifier of the log to be detected can be synchronously updated in the middle edge attributes.

[0090] In addition, a context node can be set in the semantic behavior graph. This node is used to store the context information between the semantic behavior node and the entity node connected by each first connection edge. The context information can be, for example, the victim's assets, the target domain name, etc.

[0091] In this way, the semantic behavior graph is stored as a graph database, with the semantic behavior class corresponding to each semantic behavior node as the main index and time and entity as subordinate attributes. The timeline and user IP / account details are no longer used as the main index, but are stored as attributes of the PERFORMED edges. This keeps the upper-level SB nodes of the graph knowledge base stable and small in size, while the lower level supports backtracking of specific events through edge attributes, thus achieving the separation of "abstract behavior matching" and "concrete instance backtracking".

[0092] In one embodiment, the preset clustering condition may include reaching a preset period, which is the preset clustering period mentioned above. In this case, to balance the impact of structured logs under different security domains on the cluster centers, the baseline security cardinality of the security domain to which each structured log belongs can be used as the clustering participation weight to perform unsupervised clustering of the target semantic vector of the structured logs. This allows structured logs under low-security domains with low baseline security cardinality to still participate in clustering, but with slightly lower influence, thus avoiding the dilution of semantic behavior in the core generation region with high baseline security cardinality, while preserving the possibility of low-security domain-specific semantic behavior being clustered into independent semantic behavior nodes. Specifically, step A4 above can be implemented as follows: A4-1: Based on the security domain to which each structured log belongs, divide the logs to be clustered under each security domain.

[0093] Here, the security domain to which the structured log belongs is the same as the source security domain of the log to be inspected corresponding to the structured log.

[0094] In practice, the structured logs can be divided based on their security domains to obtain the logs to be clustered within each security domain. The logs to be clustered within the same security domain are the structured logs belonging to that security domain.

[0095] A4-2: For each security domain, when the number of logs to be clustered in the security domain reaches a preset number, cluster the target semantic vectors corresponding to each log to be clustered in the security domain according to the target semantic vectors corresponding to each log to be clustered and the baseline security cardinality of the security domain, and obtain the target cluster center vectors of each security domain.

[0096] Here, the preset quantity can be set based on experience, and this application embodiment does not impose a specific limitation. For example, the preset quantity can be 100 items.

[0097] For example, for each security domain, a clustering method can be adopted for that security domain alone. During clustering, it is first determined whether the number of logs to be clustered in that security domain is greater than or equal to a preset number. If not, it can be said that the logs in that security domain are sparse, and direct clustering may not be able to obtain stable clusters. Therefore, each log to be clustered in that security domain can be put back into the candidate pool and wait for subsequent clustering.

[0098] If so, it indicates that the security domain has sufficient logs to achieve effective clustering. Therefore, the clustering weights can be determined using the baseline security cardinality corresponding to the security domain and the type weights corresponding to the log types of each log to be clustered. Then, a preset clustering algorithm can be used, utilizing the clustering weights, to perform unsupervised clustering of the target semantic vectors corresponding to each log to be clustered within the security domain based on semantic similarity, ignoring the chronological order of structured logs and the identity of log entities. This yields each cluster within the security domain, the target cluster center vector for each cluster, and the association of each target cluster center vector with its corresponding target semantic vector. In this way, individual clustering of security domains with a sufficient number of logs can be achieved.

[0099] In another embodiment, if the number of logs to be clustered under any security domain does not reach a preset number, clustering processing for that security domain can also be achieved through steps B1 to B4: B1: If the number of logs to be clustered in a security domain does not reach the preset number, select the first security domain with the highest attribute similarity from other security domains that have been clustered to obtain cluster center vectors.

[0100] Here, other security domains that have already been clustered to obtain cluster center vectors can be security domains whose number of logs to be clustered reaches a preset number. Attribute similarity is used to characterize the similarity between security domain attributes. Security domain attributes may include, but are not limited to, the business functions, personnel division of labor, and baseline security base of the security domain.

[0101] In practice, for any security domain where the number of logs to be clustered has not reached a preset number (for ease of description, this security domain is defined as a sample sparse domain), to prevent the semantic behavior under this security domain from being unable to be matched using the currently constructed semantic behavior graph, a temporary borrowing scheme for the target cluster center vector can be adopted. Specifically, the security domain attributes of each security domain that has been clustered to the target cluster center vector can be calculated, along with the attribute similarity between each security domain and the security domain attributes of the sample sparse domain. Then, the security domain with the highest attribute similarity is taken as the first security domain.

[0102] B2: Take the target cluster center vectors in the first security domain as the target cluster center vectors in this security domain.

[0103] In practice, the target cluster center vectors clustered for the first security domain can be used as the target cluster center vectors for the sample sparse domain. Then, the first connection edges between the sample sparse domain and the semantic behavior nodes corresponding to these target cluster center vectors can be used to update the graph structure of the currently constructed semantic behavior graph. The process of graph structure updating can be referred to in A5 above, and will not be repeated here.

[0104] B3: Update the new semantic behavior node corresponding to the target cluster center vector under the security domain and the latest security cardinality of the security domain to the preset cardinality until the number of logs to be clustered in the security domain accumulates to the preset number. Then, perform clustering based on the target semantic vectors corresponding to each log to be clustered under the security domain to obtain each new target cluster center vector under the security domain.

[0105] Here, the preset base value can be a value lower than each baseline safety base value.

[0106] In practice, new semantic behavior nodes corresponding to each target cluster center vector in the sparse sample domain can be determined, and these nodes can be paired with second node pairs formed by the sparse sample domain. The latest safety cardinality of these second node pairs is then updated to a preset cardinality. This preset cardinality allows for a reduction in the final anomaly score when subsequent logs to be detected match these second node pairs, avoiding the impact of temporarily borrowed cluster center vectors in the sparse sample domain on matching accuracy. Then, the number of logs to be clustered collected in the sparse sample domain accumulates to a preset number. Clustering can then be performed using the target semantic vectors corresponding to each log to be clustered in the sparse sample domain, yielding new target cluster center vectors in the sparse sample domain.

[0107] B4: Using each new target cluster center vector as a new semantic behavior node, update the graph structure of the currently constructed semantic behavior graph based on each entity node in the currently constructed semantic behavior graph and the log entities in each log to be clustered under the security domain, to obtain a new constructed semantic behavior graph, and set the latest security cardinality between the new semantic behavior node corresponding to the new target cluster center vector and the security domain as the baseline security cardinality.

[0108] In practice, after obtaining each new target cluster center vector in the sparse domain of the samples, it can be determined whether the cluster corresponding to each new target cluster center vector is stable. If stable, the target cluster center vector can be used to update the graph structure of the currently constructed semantic behavior graph. During graph structure update, for each stable new target cluster center vector, it can be used as a new semantic behavior node (i.e., a new SBC node). Then, based on the entity nodes in the currently constructed semantic behavior graph, log entities that already have entity nodes and log entities that do not have entity nodes in the log entities to be clustered are determined from the log entities in the logs to be clustered. For log entities that do not have entity nodes, these log entities can be used as new entity nodes. Then, based on the keyword information of each log to be clustered associated with the new target cluster center vector, the first connection edge to be created between the new semantic behavior node and the new entity node, as well as the first connection edge to be created between the new semantic behavior node and the existing entity node, can be determined. Then, using these first connection edges, the new semantic behavior node, and the new entity node, the graph structure of the currently constructed semantic behavior graph can be updated to obtain a new constructed semantic behavior graph.

[0109] Understandably, in the process of clustering each new target cluster center vector under the sample sparse domain, the second node pair between the semantic behavior node corresponding to each target cluster center vector borrowed by the sample sparse domain and the sample sparse domain can be deleted from the semantic behavior graph.

[0110] Thus, the situation where the number of logs to be clustered in the security domain cannot reach the preset number usually occurs in the initial stage of detection. By allowing the borrowing of cluster centers from security domains with high attribute similarity as the initial SBC and setting a temporarily reduced preset cardinality, the problem of subsequent logs to be detected in sparse security domains can be avoided. Then, by re-clustering and updating the graph structure when the number of logs to be clustered accumulates to the preset number, timely updates of semantic behavior nodes corresponding to sparse security domains can be achieved.

[0111] In one embodiment, this application also provides an intent inference and cross-domain prediction layer for SBC intent inference and cross-security domain propagation prediction. This layer includes LLM and GAT models. The LLM model is used to automatically semantically label and infer attack intent for each semantic behavior node, while the GAT model is used to predict the propagation path of abnormal threats in different security domains. Specifically, after each newly constructed semantic behavior graph is built, the intent inference and cross-domain prediction layer can be used to achieve SBC intent inference and cross-security domain propagation prediction according to the following steps C1~C5: C1: For each new semantic behavior node in the newly constructed semantic behavior graph, use a large language model to predict the structured behavior description of the new semantic behavior node; the structured behavior description includes at least the behavior summary description of the new semantic behavior node, the tactical mapping information and attack chain stage of the new semantic behavior node under the preset tactical system, the attack probability, and the behavioral intention of the new semantic behavior node in each distributed security domain.

[0112] Here, the behavior summary description is used to comprehensively describe the natural language behavior corresponding to the semantic behavior node. For example, the behavior summary description for a certain semantic behavior node could be "In the core production area, multiple source IPs made multiple failed authentication attempts against the same object within a short period of time, accompanied by login patterns during unusual time periods." The preset tactical system can be the MITRE Adversarial Tactics, Techniques & Common Knowledge (MITRE ATT&CK). Tactical mapping information is used to indicate the tactics and techniques / sub-techniques used by the semantic behavior corresponding to the semantic behavior node. For example, the tactic could be TA00006 credential access, and the technique / sub-technique could be T1110 brute-force attack. The attack chain stage is used to indicate the attack chain in which the semantic behavior corresponding to the semantic behavior node is located and the stage in that attack chain (such as initial access, execution, etc.). This attack chain stage can be inferred by the LLM model based on the semantic behavior corresponding to the semantic behavior node and the context information carried by the context node corresponding to the semantic behavior node.

[0113] The security domains to which semantic action nodes are distributed are the security domains to which the associated logs of the semantic action nodes belong. Attack probability is used to characterize the confidence level of the structured behavior description predicted by the LLM model, and can also characterize the confidence level of the semantic behavior corresponding to the semantic action node as having an attack behavior.

[0114] In practice, for each new semantic behavior node in the newly constructed semantic behavior graph, the new semantic behavior node, the edge attributes of each first connecting edge of the semantic behavior node, the context node corresponding to the semantic behavior node, the entity nodes connected to the semantic behavior node, and the log semantic vectors associated with the semantic behavior node and the security domains distributed therein can be input into the pre-trained LLM model to obtain the structured behavior description predicted by the LLM model for the semantic behavior node.

[0115] Since the behavioral intent in the structured behavioral description can include the intent corresponding to each security domain where the new semantic behavioral node is distributed, it is possible to distinguish the different meanings of the same semantic behavioral class in different security domains, thereby achieving the purpose of disambiguation of perceived intent under different security domains and realizing differentiated intent inference for different security domains.

[0116] Then, the structured behavior description (behavior summary description, ATT&CK labels and attack probabilities, attack chain stages, and behavioral intent under the security domain) output by the LLM model for each new semantic behavior node can be structured and stored in the new semantic behavior node. Among them, the ATT&CK labels are the tactical and technical / sub-technical labels under the tactical mapping information. These labels can be converted into dense vectors using a pre-trained MITRE embedding matrix for use by the subsequent GAT model. The aforementioned attack probabilities can be used as auxiliary features in the anomaly scoring weighting.

[0117] Optionally, after obtaining a new constructed semantic behavior graph each time, not only can the LLM model be used to predict the structured behavior description of the newly emerging semantic behavior nodes, but the structured behavior description can also be regenerated for nodes whose node information has been updated among the previously constructed semantic behavior nodes. Updated node information may include, but is not limited to, the addition of associated log semantic vectors, the updating of edge attributes in the associated first join table, and the addition of associated entity nodes.

[0118] Optionally, if local computing resources are sufficient, after obtaining a new constructed semantic behavior graph each time, the LLM model can be used to predict the structured behavior description of each existing semantic behavior node in the new constructed semantic behavior graph.

[0119] In this way, by automatically generating natural language summaries, MITRE ATT&CK mappings, and attack chain stages for each semantic behavior class through LLM, the cognitive burden on security analysts can be significantly reduced, and the process of transforming massive logs into high-level attack tactics can be automated and standardized, effectively enhancing the interpretability of attack intent and the ability to perform automated analysis.

[0120] C2: Use the new semantic behavior nodes and their distributed security domains to form new second node pairs, and determine each new second node pair whose latest appearance time is within the target time window and whose attack chain stages have a causal relationship with each other, based on the latest appearance time of the new semantic behavior nodes and the attack chain stages in the structured behavior description of the new semantic behavior nodes.

[0121] To better detect the propagation of different log semantic behaviors with attack capabilities across different security domains, this application proposes a method for constructing a cross-security domain node graph and using a GAT network to learn attack diffusion behavior in the semantic behavior propagation graph. In the security domain node graph, there can be multiple second node pairs. Each second node pair can consist of a semantic behavior node and the security domain to which that semantic behavior node is distributed; therefore, the second node pair is described as a (security domain, ABC) pair. Second connection edges between different second node pairs can be established based on the latest occurrence time of the semantic behavior node in the second node pair. Attack diffusion behavior is used to describe the next second node pair that a second node pair may propagate to and the probability of propagation.

[0122] The new second node pair is the new semantic behavior node in the newly constructed semantic behavior graph and the second node pair consisting of the security domains to which it is distributed. That is, the security domain node graph can be updated after each update of the semantic behavior graph.

[0123] The length of the target time window can be set empirically, and this application embodiment does not impose a specific limitation. For example, the target time window can be half an hour, one hour, etc. A new set of second node pairs may include two new second node pairs, and a second connection edge needs to be established between these two new second node pairs.

[0124] Causality is used to characterize that the attack chain stages of two second node pairs correspond to the same attack chain, and there is a semantic causal order between the two attack chain stages.

[0125] The latest appearance time is the time when the semantic behavior corresponding to the semantic behavior node last appeared in the log.

[0126] In specific implementation, after constructing a new semantic behavior graph, for each new semantic behavior node in the new graph, the security domain to which the semantic behavior node is distributed can be determined, and the semantic behavior node and each security domain are respectively formed into a new second node pair. Then, based on the latest occurrence time of the new semantic behavior nodes in each new second node pair, each candidate second node pair whose latest occurrence time is within the target time window can be judged. Then, for each candidate second node pair, based on the attack chain stages recorded in the structured behavior descriptions of the new semantic behavior nodes in the two second node pairs, it can be determined whether there is a causal relationship between the new semantic behavior nodes in the two second node pairs. If so, the candidate second node pair can be considered as a new second node pair that requires the establishment of a second connection edge; otherwise, it can be determined that the candidate second node pair does not need to be considered as a new second node pair.

[0127] C3: Construct the second connection edge between each new pair of second nodes, and determine the edge attributes of each second connection edge based on the number of times each new pair of second nodes has appeared, the time interval between appearances, and the attack chain phase transition mode.

[0128] Here, the occurrence count of each new second node pair is used to characterize the total number of times the new second node pair has appeared historically, and the occurrence time interval is used to indicate the average time interval of each occurrence of the new second node pair historically. For example, if a new second node pair has appeared three times historically, the interval between the latest occurrence times of the two semantic action nodes in the first occurrence is interval 1, the interval between the latest occurrence times of the two semantic action nodes in the second occurrence is interval 2, and the interval between the latest occurrence times of the two semantic action nodes in the third occurrence is interval 3. Then the occurrence time interval of the new second node pair is the average of intervals 1, 2, and 3. The attack chain phase transition pattern of each new second node pair is used to characterize the next attack chain phase corresponding to the two causally related attack chain phases in the new second node pair.

[0129] In practical implementation, for each new pair of second nodes, a second connection edge can be constructed between the pairs. The occurrence count, occurrence time interval, attack chain phase transition mode, and propagation probability of the pair are determined, and these are used as edge attributes of the second connection edge. The propagation probability can be determined based on the occurrence frequency of the pair or as a preset probability. This propagation probability will be updated to the predicted jump probability after the GAT network outputs the predicted jump probability.

[0130] C4: Update the currently constructed security domain node graph using each second connecting edge and edge attribute to obtain a new security domain node graph; the currently constructed security domain node graph includes each constructed second node pair and the second connecting edges between the constructed second node pairs.

[0131] Here, the currently constructed security domain node graph is the security domain node graph that has been constructed at the current moment. This node graph can include multiple constructed second node pairs. Each constructed second node pair includes a security domain and a semantic behavior node that appears under the security domain. Among the constructed second node pairs, some of the constructed second node pairs have second connecting edges, and these connecting edges all have corresponding edge attributes.

[0132] In practice, each new semantic behavior node and its distributed security domain can be combined into a new second node pair, which is added to the currently constructed security domain node graph. The second connecting edge (carrying edge attributes) between each newly constructed second node pair is added to the currently constructed security domain node graph, thereby updating the currently constructed security domain node graph and obtaining a new security domain node graph.

[0133] For example, nodes in the security domain node graph are defined as (security domain, SBC) pairs. For any two (security domain, SBC) pairs, assuming these two (security domain, SBC) pairs are (security domain 1, SBC1) and (security domain 2, SBC2), if SBC1 appears in security domain 1 at time t, and SBC2 appears in security domain 2 at time t+Δt (Δt is the target time window), and there is a semantic causal relationship between SBC1 and SBC2 inferred by LLM (such as "port scan" → "vulnerability exploitation attempt"), then a directed edge can be established between these two (security domain, SBC) pairs in the security domain node graph, and the edge attributes of this directed edge can be set as the number of occurrences, the occurrence time interval, the propagation probability, and the attack chain stage transition mode.

[0134] C5: Input the new security domain node graph and the structured behavior description of each new semantic behavior node into the graph neural network to obtain the next-hop node pair and the predicted jump probability for each second node pair in the new security domain node graph.

[0135] In practice, the new security domain node graph, the structured behavioral description of each new semantic behavior node, the latest security cardinality of each new semantic behavior node, the context node information corresponding to each new semantic behavior node, and the average historical second score of each second node pair can be input into the GAT network. Based on the input information, the GAT network can predict the next hop node pair and the predicted jump probability for each second node pair in the new security domain node graph.

[0136] Alternatively, the GAT model can be used to predict the next-hop node pair and the jump probability for each second node pair in the new security domain node graph. During prediction, for each second node pair in the new security domain node graph, the second node pair, the structured behavioral description of each new semantic behavior node in the second node pair, the latest security cardinality, context node information, the average of historical second scores, and the edge attributes of each second connecting edge of the second node pair can all be input into the GAT model. Based on the input information, the GAT model predicts the most likely propagation target (i.e., the next node pair) for the next hop of the second node pair and the jump probability.

[0137] The training of the GAT model can be achieved by using historically labeled anomalous logs as positive samples to train the GAT model to learn the effective path patterns of anomalous attacks in the security domain node graph. This allows the GAT model to more accurately output the most likely propagation target of each (security domain, SBC) node in a given context, as well as the attack propagation risk score (predicted jump probability).

[0138] Optionally, this application can also set a startup strategy for the GAT model. For example, in the initial stage of log detection, when there is no historical labeled data, the GAT model cannot be trained. To address this, in the initial stage of log detection, a rule-based propagation probability can be adopted: based on the tactical chain predefined by MITRE ATT&CK (such as "reconnaissance → initial access → execution → lateral movement"), a fixed transition probability (e.g., scan → exploit = ​​0.5) is set between common (security domain, SBC) targets. Simultaneously, pre-trained GAT model parameters from publicly available security datasets can be loaded as initial weights. After accumulating at least 100 real attack labeled samples, online retraining is triggered to adjust the parameters of the GAT model, thereby improving the prediction accuracy of the GAT model.

[0139] In this way, by constructing a security domain node graph and graph attention network across security domains, risk scores can be improved in advance based on early reconnaissance behavior before attacks spread from low-importance security domains to core assets, achieving a leap from "post-event detection" to "pre-event prediction", and effectively defending against lateral movement and multi-stage penetration behaviors such as APT attacks.

[0140] In one embodiment, after obtaining the new constructed semantic behavior graph, this application can also dynamically update the behavior transition matrix corresponding to each entity node. Specifically, the update can be implemented according to the following steps D1~D3: D1: For any entity node in the newly constructed semantic behavior graph, determine the historical semantic behaviors currently being executed by the log entity corresponding to the entity node based on each first connection edge of the entity node.

[0141] In practice, an anomaly scoring layer can be used to maintain a sequence of historical semantic behavior class IDs [SBC1, SBC2, ..., SBC] for each log entity. nThe order of the historical semantic behavior class IDs in this sequence can be determined based on the latest time order in the timestamp list of the PERFORMED edges of the semantic behavior nodes. After obtaining a new constructed semantic behavior graph each time, for any entity node in the new constructed semantic behavior graph, the anomaly scoring layer can be used to determine the historical semantic behaviors currently executed by the log entity corresponding to that entity node based on each of the first connection edges (PERFORMED edges). Then, based on the latest time order in the timestamp list of each first connection edge, the latest historical semantic behavior class ID sequence corresponding to the log entity of that entity node is constructed.

[0142] D2: For every two historical semantic actions, calculate the latest transition probability between them based on the semantic actions corresponding to the semantic action nodes in each second node pair included in the latest security domain node graph, and the second connection edges of each second node pair.

[0143] Here, the latest security domain node graph is the latest constructed security domain node graph.

[0144] In practical implementation, for any two historical semantic behaviors in the latest historical semantic behavior class ID sequence corresponding to any log entity, the anomaly scoring layer can be used to determine the target second node pairs in which these two historical semantic behaviors appear from the various second node pairs included in the latest security domain node graph. Then, based on the edge attributes of the second connection edge of each target second node pair, the transition frequency and the latest transition probability between these two historical semantic behaviors can be determined.

[0145] For example, for any two historical semantic behavior class IDs (SBC) i Transfer to SBC j Based on the latest security domain node graph, the origin from SBC can be determined. i Transfer to SBC j The frequency of transitions and the latest transition probability, as well as the statistical determination from SBC j Transfer to SBC i The transition frequency and latest transition probability are considered. Understandably, if the latest security domain node graph does not contain a second connection edge from SBC_last to SBC_new, then its latest transition probability p=0, and its transition frequency is also 0. Here, SBC_last represents the historical semantic behavior of the log entity's last execution, and SBC_new represents the historical semantic behavior of the log entity's latest execution. This semantic behavior is typically the semantic behavior corresponding to a newly appearing semantic behavior node in the newly constructed semantic behavior graph.

[0146] After the target semantic vector of the current log to be detected is assigned to SBC_new, the historical semantic behavior SBC_last of the last execution of the log entity in the log to be detected can be queried, and then the latest transition probability p=P(SBC_new|SBC_last) from SBC_last to SBC_new can be calculated.

[0147] D3: Dynamically update the transition probabilities maintained in the behavior transition matrix corresponding to the entity node based on the latest transition probability between every two historical semantic behaviors.

[0148] In practice, after obtaining the latest transition probabilities between any two historical semantic actions executed by the log entity corresponding to the entity node, these latest transition probabilities can be used to dynamically update the transition probabilities maintained in the behavior transition matrix corresponding to the entity node. For example, if the behavior transition matrix maintains transition probabilities between two historical semantic actions, the transition probabilities can be updated to the latest transition probabilities. If the behavior transition matrix does not maintain transition probabilities between two historical semantic actions, the latest transition probabilities determined for the two historical semantic actions can be stored in the behavior transition matrix.

[0149] In one embodiment, S104 described above can be implemented according to the following steps: S104-1: Based on the second connection edges between each pair of second nodes in the latest security domain node graph, determine whether the target semantic behavior has a periodic loop.

[0150] Here, periodic loops can refer to semantic behaviors repeating multiple times within a preset step size (e.g., SBC1→SBC2→SBC6→SBC1→SBC3→SBC1→SBC). 10 →SBC 11 →SBC1). A step size can be understood as a transfer of semantic behavior. Multiple repeated loops can specifically be loop periods ≤ 3 and loop counts ≥ 3. When periodic loops occur, it indicates that there may be an anomaly in the cyclic transfer of semantic behavior.

[0151] For example, an anomaly scoring layer can be used to determine the transition chain corresponding to the target semantic behavior based on the edge attributes of the second connection edges between each pair of second nodes in the latest security domain node graph. Based on the transition chain, it is detected whether the target semantic behavior repeats multiple times within a preset step size. If so, it can be determined that the target semantic behavior has a periodic cycle, and the following S104-2 is executed; if not, it can be determined that there is no periodic cycle.

[0152] S104-2: If not, then determine the target probability of the log entity's last executed historical semantic behavior being transferred to the target semantic behavior based on the transfer probabilities between each historical semantic behavior dynamically maintained by the behavior transfer matrix.

[0153] In practice, if the target semantic behavior does not exhibit periodicity, the historical semantic behavior of the log entity in the log to be detected can be determined based on the currently constructed semantic behavior graph. Then, the transition probability from the historical semantic behavior of the log entity to the target semantic behavior is found in the behavior transition matrix maintained for the log entity in the log to be detected, and this transition probability is used as the target probability p.

[0154] S104-3: Determine the transfer coefficient based on the relationship between the target probability and the preset probability threshold.

[0155] In practice, if the target probability p is less than a preset probability threshold (e.g., 0.05), the transfer factor TransferFactor = (1 + η·(1-p)), where η is a preset transfer anomaly weight coefficient (e.g., 1.0), and p represents the target probability. If the target probability is not less than the preset probability threshold, the target probability can be used as the transfer factor, or a preset value can be used as the transfer factor, where the preset value can be 1.

[0156] Optionally, if the target semantic behavior has never appeared in the historical semantic behavior class ID sequence corresponding to the log entity of the log to be detected, the above target probability will be 0, and its transfer factor TransferFactor will be directly equal to 1+η.

[0157] In another embodiment, if the target semantic behavior exhibits periodicity, the transition coefficient for the log entity to move to the target semantic behavior is determined as the target coefficient. Here, the target coefficient can be a pre-set, relatively large coefficient, for example, a target coefficient of 1.5.

[0158] For example, if the target semantic behavior exhibits periodicity, the transfer factor (TransferFactor) can be determined as the target factor.

[0159] In one embodiment, S105 described above can be implemented according to the following steps: S105-1: If the importance of the security domain in the next-hop node pair is higher than the importance of the source security domain, and / or if the current risk base of the semantic behavior node in the next-hop node pair is greater than the preset base, determine whether the predicted jump probability is greater than the preset jump probability. S105-2: If so, the predicted jump probability is adjusted using the preset enhancement coefficient to obtain the adjusted probability.

[0160] Here, the preset cardinality serves as a threshold for distinguishing the risk level of semantic action nodes. If the current risk cardinality of a semantic action node is greater than the preset cardinality, it indicates that the semantic action corresponding to the semantic action node in the next jump node pair has a high attack risk. The preset cardinality can be, for example, 0.7.

[0161] The preset enhancement coefficient is used to adjust the predicted jump probability. It can be set empirically, and this embodiment does not impose specific limitations. The preset jump probability can be set empirically, and this embodiment does not impose specific limitations. If the predicted jump probability is greater than the preset jump probability, it means that the next log entry to be detected carrying the target semantic behavior vector is very likely to hit the next hop second node pair.

[0162] In practice, for the second node pair consisting of the target behavior node and the source security domain of the log to be detected, after obtaining the next-hop node pair and predicted jump probability output by the GAT model for this node pair, it can be determined whether at least one of the following conditions a and b is satisfied: Condition a: The importance of the security domain in the next-hop node pair is higher than the source security domain of the log to be detected; Condition b: The current risk base of the semantic behavior node in the next-hop node pair is greater than the preset base, or the historical log associated with the semantic behavior node in the next-hop node pair has generated an alarm within a preset historical period. The preset historical period can be, for example, the past 24 hours.

[0163] Specifically, if condition a is met, it can be shown that the target semantic behavior has the risk of expanding from a low-importance security domain to a high-importance security domain; if condition b is met, it can be shown that the low-risk target semantic behavior may jump to a high-risk semantic behavior.

[0164] If at least one of conditions a and b is met, it can be determined whether the predicted jump probability is greater than the preset jump probability. If not, the predicted jump probability can be directly used as the adjusted probability. If so, the adjusted probability PredictionFactor = β + γ × P_transition can be determined. Where β is the preset baseline factor, which can be 1; γ is the preset enhancement coefficient, which can be 0.8 for example; and P_transition represents the predicted jump probability of the second node pair in the next hop.

[0165] Thus, when a target semantic behavior (target SBC) is detected in a low-risk security domain (such as an office area), if the GAT model predicts that the predicted transition probability P_transition from the current (Z_current, target SBC) pair to a certain high-risk (Z_high_risk, SBC_high_risk) pair is higher than the threshold, a predictive weighting coefficient β and a preset enhancement coefficient γ are introduced to correct the basic anomaly score, which can further improve the accuracy of anomaly detection and thus avoid possible attacks in advance.

[0166] S105-3: Determine the prediction coefficients for the second node pair based on the attack probability and the adjusted probability.

[0167] In practice, the attack probability can be used as a multiplicative factor to further modify the adjusted probability, resulting in the prediction coefficient of the second node pair consisting of the target behavior node and the source security domain of the log to be detected. For example, the prediction coefficient = adjusted probability × (0.5 + 0.5 × attack probability). In this way, by correcting the adjusted probability with the attack probability, the influence of the adjusted probability on anomaly scoring can be reduced when the attack probability is low.

[0168] In one embodiment, S106 described above can be implemented according to the following steps: S106-1: Determine the third score based on the first score, the transition coefficient, and the prediction coefficient.

[0169] In practice, the third score can be determined by multiplying the first score, the transfer coefficient, and the prediction coefficient. That is, the third score = first score × transfer coefficient × prediction coefficient.

[0170] S106-2: If the historical logs of the target behavior node under multiple log entities are repeatedly marked as false alarms, and / or the historical logs of the target behavior node under multiple security domains are repeatedly marked as false alarms, then the third score is adjusted using preset weights to obtain the second score.

[0171] In practical implementation, after determining the third score, the number of times the historical logs generated by the target behavior node under multiple log entities were manually marked as false alarms can be obtained. If this number is greater than a first preset threshold, it indicates that the historical logs of the target behavior node under multiple log entities were repeatedly marked as false alarms; if this number is not greater than the preset threshold, it indicates that the detection accuracy of the historical logs of the target behavior node under multiple log entities is reliable. Furthermore, the number of times the historical logs of the target behavior node under multiple security domains were manually marked as false alarms can be obtained. If this number is greater than a second preset threshold, it indicates that the historical logs of the target behavior node under multiple security domains were repeatedly marked as false alarms; if this number is not greater than the second preset threshold, it indicates that the detection accuracy of the historical logs of the target behavior node under multiple security domains is reliable.

[0172] If at least one of the following conditions is met: the target behavior node's historical logs under multiple log entities are repeatedly marked as false alarms, or the target behavior node's historical logs under multiple security domains are repeatedly marked as false alarms, then it can be further determined whether the semantic behavior corresponding to the target behavior node has a semantic association with any known attack pattern. If not, it indicates that the detection accuracy under the target behavior node is unreliable. To avoid false alarms, the third score can be adjusted using a preset weight to obtain the second score. The preset weight can be a low preset weight, such as 0.2, to reduce the probability of triggering alarms for the logs to be detected. If there is a semantic association with any known attack pattern, the third score can be directly used as the second score.

[0173] Optionally, if the target behavior node is neither repeatedly marked as an anomalous false alarm in its historical logs under multiple log entities nor in its historical logs under multiple security domains, then the third score can be directly used as the second score.

[0174] Optionally, if at least one of the following conditions is met: the historical logs of the target behavior node under multiple log entities are repeatedly marked as false alarms, and the historical logs of the target behavior node under multiple security domains are repeatedly marked as false alarms, and the semantic behavior corresponding to the target behavior node has no semantic association with any known attack pattern, it can be further determined whether the target behavior node appears in the same log entity as any high-risk semantic behavior node whose current risk base is greater than the preset base in a short period of time. If not, the third score can be directly adjusted using the preset weight to obtain the second score; if so, the third score can be directly used as the second score.

[0175] Thus, when a certain SBC node in the semantic behavior graph is repeatedly marked as anomaly false positives in multiple log entities and multiple security domains, and it has no semantic association with any known attack patterns, this application adopts a method of not directly deleting the SBC node, but marking it as a low-priority behavior class, allowing the SBC node to continue participating in the semantic matching of subsequent logs to be detected, but automatically multiplying the anomaly score by a low preset weight, and no longer triggering alarms, unless it co-occurs with a high-risk SBC node in the same log entity within a short period of time, in which case the low preset weight will not be used for anomaly scoring. Furthermore, if the SBC node has no positive feedback for a long period of time (e.g., no cases of being marked as anomaly logs) and no co-occurrence of high-risk behaviors (e.g., not co-occurring with high-risk SBC nodes in the same log entity), it can be merged or archived, but a recovery mechanism is retained: once a security analyst marks the logs associated with the SBC node as anomaly logs, it can be immediately restored to a normal SBC node and the risk base is reset to the preset risk base.

[0176] In one embodiment, this application also provides a method for updating the cluster center vector carried by the semantic action node as shown in steps E1-E2: E1: If any semantic behavior node matches multiple logs to be detected, and the multiple logs to be detected come from a second security domain with a first preset importance and a third security domain with a second preset importance, then if the proportion of logs to be detected from the third security domain is greater than the preset proportion, the target semantic vectors of the multiple logs to be detected are clustered to obtain the cluster center vector to be used.

[0177] Here, the third preset importance is higher than the second preset importance. The preset percentage can be set based on experience. This application embodiment does not impose specific limitations. For example, the preset percentage can be 10%.

[0178] In specific implementation, for any semantic behavior node in the semantic behavior graph, if the semantic behavior node matches multiple logs to be detected (i.e., the semantic behavior node appears in multiple target node pairs matched by logs to be detected), it can be determined that in the source security domains corresponding to the multiple logs to be detected, there is a second security domain with an importance less than or equal to a first preset importance, and a third security domain with an importance greater than or equal to a second preset importance. If the number of the second and third security domains is not empty, the proportion of the number of logs to be detected from the third security domain to the total number of logs to be detected can be determined. It is then determined whether this proportion is greater than a preset proportion. If not, it can be determined that there is no need to update the cluster center vector of the semantic behavior node to prevent semantic behavior drift in the cluster center vector of the semantic behavior node. If so, a preset clustering algorithm can be used to cluster the target semantic vectors of the logs to be detected to obtain the cluster center vectors to be used.

[0179] E2: If the similarity between the cluster center vector to be used and the semantic behavior node is greater than the preset similarity, the semantic behavior node will be updated to the cluster center vector to be used.

[0180] In practice, after clustering to obtain the cluster center vectors to be used, the similarity between the cluster center vectors to be used and the prototype cluster center vectors carried by the semantic behavior node can be calculated, and it can be determined whether the similarity is greater than a preset similarity (e.g., 0.8). If not, it can be determined that there is no need to update the cluster center vectors of the semantic behavior node to prevent semantic behavior drift. Instead, the cluster center vectors to be used can be used as new semantic behavior nodes, and the currently constructed semantic behavior graph can be updated. If yes, the prototype cluster center vectors carried by the semantic behavior node can be updated to the cluster center vectors to be used, that is, the semantic behavior node is updated to the cluster center vectors to be used. This achieves the vector update of the semantic behavior node.

[0181] In this way, when a large number of new logs to be detected appear in the low-importance second security domain, the prototype cluster center vector of the SBC node is not immediately updated. Furthermore, by maintaining the "domain affiliation" metric for each SBC node in the semantic behavior graph—that is, the frequency distribution of SBC nodes in different security domains—the prototype cluster center vector of the SBC node is only allowed to be updated when the samples in the high-importance domain also support the drift direction (i.e., the cosine similarity between the old and new prototype vectors > 0.85 and the proportion of logs to be detected appearing in the samples of the high-importance third security domain > 10%). Otherwise, a large number of new log samples to be detected in the low-importance second security domain will tend to form new SBC nodes rather than pollute existing SBC nodes. This avoids semantic drift in the prototype vectors of SBC nodes.

[0182] Optionally, after obtaining a certain number of annotation results from security analysts through closed-loop feedback evolution layer annotation, a background task can be triggered to incrementally fine-tune the semantic vector model (e.g., using attack log pairs as positive samples and false positive log pairs as negative samples, and using triplet loss for training), making the semantic vector model more discriminative in its semantic representation of new variant attacks.

[0183] Based on the above embodiments, this application addresses the problems of existing security log analysis systems: their inability to detect covert attacks with identical cross-entity semantics due to the "user / IP + timeline" perspective; their lack of behavioral semantic abstraction capabilities due to graph analysis granularity remaining at the log instance level; their high false positive rate due to ignoring differences in log source environments; and their inability to continuously adapt to new variant attacks due to the lack of a closed-loop feedback mechanism. By proposing semantic behavior clustering, environment-weighted correction (i.e., security cardinality correction under security domains), large language model intent inference, cross-domain propagation prediction, and feedback evolution, this application achieves accurate and adaptive malicious behavior identification. Figure 2 The diagram shown illustrates the system architecture of a log detection method provided in this application embodiment. It includes a log collection layer, a semantic parsing and embedding layer, a security domain factor calculation layer, a behavior clustering and graph construction layer, an intent inference and cross-domain prediction layer, a semantic query and matching layer, an anomaly scoring layer, and a closed-loop feedback evolution layer. The log collection layer is used to collect and structure multi-source heterogeneous logs. The semantic parsing and embedding layer is used to perform semantic vectorization and keyword information extraction for each log to be detected. The security domain factor calculation layer is used to define the baseline security base for each security domain and to adaptively adjust the security base for each security domain. The behavior clustering and graph construction layer is used to perform semantic density-based clustering of log semantic vectors and to construct and update semantic behavior graphs. The intent inference and cross-domain prediction layer is used to automatically semantically label and infer attack intent from clustered semantic behavior nodes using an LLM model, and to predict the diffusion path of abnormal threats in different security domains using a GAT model (such as a second node pair and predicted jump probability). The semantic query and matching layer is used to match target node pairs on newly collected logs to be detected based on the semantic behavior graph. The anomaly scoring layer is used to score the logs to be detected for anomalies, thereby determining the anomaly detection result of the logs to be detected. The closed-loop feedback evolution layer is used to update the risk cardinality of semantic behavior classes, the similarity threshold corresponding to (Entity, SBC), and the security cardinality of security domains based on the annotation results of anomaly logs for alerts by security analysts, and can trigger incremental training of the semantic vector model.

[0184] In summary, this application constructs semantic behavior nodes by clustering log semantic vectors. This enables the detection of cross-entity and cross-time collaborative attacks when inspecting logs. Regardless of how many different user IPs execute the same semantic behavior class (e.g., "scanning ports"), they will be clustered together, effectively exposing the overall scale of distributed scanning attacks. Furthermore, by clustering massive amounts of logs into a finite number of semantic behavior classes, the data dimensionality and the number of nodes in the graph knowledge base can be significantly reduced, resulting in a substantial decrease in query and matching computation, thereby improving log detection efficiency. Since semantic behavior vectors can capture the inherent consistency of different expressions such as "write file," "create file," and "output to file," effective detection of various log variants can be achieved without maintaining a large number of log rules, demonstrating good robustness against log variants. Although the graph knowledge base corresponding to the semantic behavior graph uses semantic behavior classes as the main index, the timestamps and details of the original logs are retained in the edge attributes of each first connection edge, facilitating security analysts to trace and back specific events based on the semantic behavior graph. By using the security baseline of the security domain as the step size for anomaly scoring, the same semantic behavior will receive different anomaly scores in the core production area and the development and testing area. This effectively avoids the problem of invalid alarms triggered by a large number of legitimate attack tests in the development and testing area, and reduces false alarms caused by environmental noise. When scoring anomalies in the logs to be detected, each scoring factor (such as risk baseline, entity execution history, security baseline of the security domain, time decay, attack probability, etc.) can be backtracked, allowing security analysts to clearly understand why a certain log was judged as anomaly. This enhances the interpretability of the log detection method in this application and avoids the problem of non-quantification. Through a closed-loop feedback evolution layer, log detection can evolve with changes in the methods of real attackers without frequent manual retraining of the model. This ensures that the detection rate of similar behaviors can be improved after a small number of new variant attacks are labeled, thus improving the continuous adaptive evolution capability of the log detection method in this application.

[0185] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0186] Based on the same inventive concept, this disclosure also provides a log detection device corresponding to the log detection method. Since the principle of the device in this disclosure for solving the problem is similar to that of the log detection method described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0187] like Figure 3 The diagram shown is a schematic representation of a log detection device provided in an embodiment of this disclosure, comprising: The acquisition module 301 is used to acquire the log to be detected from any of the multiple security domains and the currently constructed semantic behavior graph; the semantic behavior graph includes multiple semantic behavior nodes and entity nodes that have a first connection edge with the semantic behavior nodes; The first determining module 302 is used to determine, based on the target semantic vector and log entity of the log to be detected, whether there is a target node pair that matches the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph; The second determining module 303 is used to determine the first score of the log to be detected based on the current risk base number of the target behavior node in the target node pair, the frequency dispersion of the log entity executing the target semantic behavior corresponding to the target behavior node, the latest security base number of the second node pair composed of the source security domain of the target behavior node and the log to be detected, and the time when the log entity last executed the target semantic behavior. The third determining module 304 is used to determine the transfer coefficient of the log entity to the target semantic behavior based on the transfer probabilities between the various historical semantic behaviors executed by the log entity dynamically maintained by the behavior transfer matrix. The fourth determining module 305 is used to determine the prediction coefficient of the second node pair based on the next-hop node pair and the predicted jump probability predicted by the graph neural network for the second node pair, and the attack probability predicted by the large language model for the target behavior node. The fifth determining module 306 is used to determine the second score of the log to be detected based on the first score, the transfer coefficient and the prediction coefficient, and to determine the anomaly detection result of the log to be detected based on the second score.

[0188] In one possible implementation, the first determining module 302, when determining whether there exists a target node pair matching the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph based on the target semantic vector and log entity of the log to be detected, is configured to: From the first node pairs included in the semantic behavior graph, candidate node pairs including the log entity are filtered. The current similarity threshold corresponding to the candidate node pair is determined based on the number of times the historical logs matching the candidate node pair are marked as abnormal logs. Based on the similarity between the semantic behavior vector carried by the semantic behavior node in the candidate node pair and the target semantic vector, and the current similarity threshold, it is determined whether there is a matching target node pair from the candidate node pairs.

[0189] In one possible implementation, the current risk baseline is related to the number of times the historical logs corresponding to the target behavior node are marked as abnormal logs and / or false alarms; The frequency dispersion is related to the frequency with which log entities perform the target semantic behavior over a preset time period in the past, and the average frequency with which different log entities perform the target semantic behavior in history. The latest security baseline is related to the importance of the source security domain and the number of times the second node marks the corresponding historical logs as false alarms.

[0190] In one possible implementation, the device further includes a first update module 307, configured to: If the target node pair does not exist, the log to be detected will be stored in the candidate pool; In response to triggering a preset clustering condition, each log entry to be detected stored in the candidate pool is processed in a structured manner to obtain each structured log entry; For each structured log entry, keyword information is extracted from the structured log entry according to a preset keyword type, and a target semantic vector corresponding to the structured log entry is generated using a pre-trained semantic vector model. Based on the target semantic vector corresponding to each structured log and the baseline security cardinality corresponding to each security domain, the target semantic vectors are clustered to obtain the cluster center vectors of each target. Using each target cluster center vector as a new semantic behavior node, the graph structure of the currently constructed semantic behavior graph is updated based on the entity nodes in the currently constructed semantic behavior graph, the log entities in each structured log, and the keyword information of each structured log associated with the target cluster center vector, to obtain a new constructed semantic behavior graph.

[0191] In one possible implementation, the preset clustering condition includes reaching a preset period; The first update module 307, when performing clustering on each target semantic vector based on the target semantic vector corresponding to each structured log and the baseline security cardinality corresponding to each security domain to obtain each target cluster center vector, is used to: Based on the security domain to which each structured log belongs, the logs to be clustered under each security domain are divided; For each security domain, when the number of logs to be clustered in the security domain reaches a preset number, the target semantic vectors corresponding to each log to be clustered in the security domain are clustered according to the target semantic vectors corresponding to each log to be clustered in the security domain and the baseline security cardinality of the security domain, so as to obtain the target cluster center vectors of each security domain.

[0192] In one possible implementation, the first update module 307 is further configured to: If the number of logs to be clustered under the security domain does not reach the preset number, the first security domain with the highest attribute similarity to the security domain is selected from other security domains that have been clustered into cluster center vectors. The target cluster center vectors in the first security domain are used as the target cluster center vectors in that security domain. The new semantic behavior node corresponding to the target cluster center vector under the security domain and the latest security cardinality between the security domain are updated to the preset cardinality until the number of logs to be clustered in the security domain accumulates to the preset number. Clustering is performed according to the target semantic vectors corresponding to each log to be clustered under the security domain to obtain each new target cluster center vector under the security domain. Using each new target cluster center vector as a new semantic behavior node, the graph structure of the currently constructed semantic behavior graph is updated based on each entity node in the currently constructed semantic behavior graph and the log entities in each log to be clustered under the security domain, to obtain a new constructed semantic behavior graph. The latest security cardinality between the new semantic behavior node corresponding to the new target cluster center vector and the security domain is set as the baseline security cardinality.

[0193] In one possible implementation, the apparatus further includes a second update module 308, which, after obtaining the new constructed semantic behavior graph, is used to: For each new semantic behavior node in the newly constructed semantic behavior graph, the large language model is used to predict the structured behavior description of the new semantic behavior node; the structured behavior description includes at least the behavior summary description of the new semantic behavior node, the tactical mapping information and attack chain stage of the new semantic behavior node under the preset tactical system, the attack probability, and the behavior intention of the new semantic behavior node in each distributed security domain. New second node pairs are formed using the new semantic behavior nodes and their distributed security domains. Based on the latest occurrence time of the new semantic behavior nodes and the attack chain stage in the structured behavior description of the new semantic behavior nodes, each new second node pair whose latest occurrence time is within the target time window and whose attack chain stages have a causal relationship is determined. Construct a second connection edge between each group of the new second node pairs, and determine the edge attributes of each second connection edge based on the number of occurrences, occurrence time intervals, and attack chain phase transition modes of each group of the new second node pairs; The security domain node graph is updated using each of the second connecting edges and the edge attributes to obtain a new security domain node graph; the current security domain node graph includes each of the constructed second node pairs and the second connecting edges between the constructed second node pairs; The new security domain node graph and the structured behavior description of each new semantic behavior node are input into the graph neural network to obtain the next-hop node pair and the predicted jump probability for each second node pair in the new security domain node graph.

[0194] In one possible implementation, the apparatus further includes a third update module 309, which, after obtaining the new constructed semantic behavior graph, is used to: For any entity node in the newly constructed semantic behavior graph, based on each first connection edge of the entity node, determine the various historical semantic behaviors currently being executed by the log entity corresponding to the entity node; For each pair of historical semantic actions, the latest transition probability between each pair of historical semantic actions is calculated based on the semantic actions corresponding to the semantic action nodes in each second node pair included in the latest security domain node graph, and the second connection edges of each second node pair. The transition probabilities maintained in the behavior transition matrix corresponding to the entity node are dynamically updated based on the latest transition probability between every two historical semantic behaviors.

[0195] In one possible implementation, the third determining module 304, when determining the transition coefficient of the log entity to the target semantic behavior based on the transition probabilities between the various historical semantic behaviors performed by the log entity dynamically maintained according to the behavior transition matrix, is used to: Based on the second connection edges between each pair of second nodes in the latest security domain node graph, determine whether the target semantic behavior has a periodic loop; If not, then based on the transition probabilities between each historical semantic behavior dynamically maintained by the behavior transition matrix, determine the target probability of the log entity's last executed historical semantic behavior being transferred to the target semantic behavior. The transition coefficient is determined based on the relationship between the target probability and the preset probability threshold.

[0196] In one possible implementation, the third determining module 304 is further configured to: If the target semantic behavior has a periodic cycle, then the transfer coefficient of the log entity to the target semantic behavior is determined as the target coefficient.

[0197] In one possible implementation, the fourth determining module 305, when determining the prediction coefficients of the second node pair based on the next-hop node pair predicted by the graph neural network for the second node pair and the predicted jump probability, and the attack probability predicted by the large language model for the target behavior node, is configured to: If the importance of the security domain in the next-hop node pair is higher than the importance of the source security domain, and / or if the current risk base of the semantic behavior node in the next-hop node pair is greater than a preset base, determine whether the predicted jump probability is greater than the preset jump probability. If so, the predicted jump probability is adjusted using a preset enhancement coefficient to obtain the adjusted probability; The prediction coefficients for the second node pair are determined based on the attack probability and the adjusted probability.

[0198] In one possible implementation, the fifth determining module 306, when determining the second score of the log to be detected based on the first score, the transition coefficient, and the prediction coefficient, is configured to: A third score is determined based on the first score, the transition coefficient, and the prediction coefficient; If the target behavior node is repeatedly marked as an anomaly false alarm in the historical logs of multiple log entities, and / or the target behavior node is repeatedly marked as an anomaly false alarm in the historical logs of multiple security domains, then the third score is adjusted using a preset weight to obtain the second score.

[0199] In one possible implementation, the device further includes a fourth update module 310, configured to: If any semantic behavior node matches multiple logs to be detected, and the multiple logs to be detected come from a second security domain with a first preset importance and a third security domain with a second preset importance, then if the proportion of logs to be detected from the third security domain is greater than a preset proportion, the target semantic vectors of the multiple logs to be detected are clustered to obtain the cluster center vector to be used. If the similarity between the cluster center vector to be used and the semantic behavior node is greater than a preset similarity, the semantic behavior node is updated to the cluster center vector to be used.

[0200] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0201] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0202] Based on the same technical concept, embodiments of this application also provide a computer device. (Refer to...) Figure 4 The diagram shown is a structural schematic of a computer device provided in an embodiment of this application, comprising: The processor 401, memory 402, and bus 403 are included. Memory 402 stores machine-readable instructions executable by the processor 401. The processor 401 executes the machine-readable instructions stored in memory 402. When the machine-readable instructions are executed by the processor 401, the processor 401 executes the above-described S101 to S106.

[0203] The aforementioned memory 402 includes a main memory 4021 and an external memory 4022. The main memory 4021, also known as internal memory, is used to temporarily store the computational data in the processor 401, as well as the data exchanged with external memory such as a hard disk 4022. The processor 401 exchanges data with the external memory 4022 through the main memory 4021. When the computer device is running, the processor 401 and the memory 402 communicate through the bus 403, so that the processor 401 executes the execution instructions mentioned in the above method embodiments.

[0204] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the log detection method described in the above method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0205] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the log detection method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0206] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0207] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0208] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0209] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0210] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0211] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the user through pop-up information or by asking the user to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0212] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A log detection method characterized by, The method includes: Obtain the logs to be detected from any of the multiple security domains and the currently constructed semantic behavior graph; the semantic behavior graph includes multiple semantic behavior nodes and entity nodes that have a first connection edge with the semantic behavior nodes; Based on the target semantic vector and log entity of the log to be detected, determine whether there is a target node pair that matches the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph; If so, the first score of the log to be detected is determined based on the current risk base of the target behavior node in the target node pair, the frequency dispersion of the log entity executing the target semantic behavior corresponding to the target behavior node, the latest security base of the second node pair composed of the source security domain of the target behavior node and the log to be detected, and the time when the log entity last executed the target semantic behavior. Based on the transition probabilities between the various historical semantic behaviors executed by the log entity, which are dynamically maintained by the behavior transition matrix, the transition coefficient of the log entity to the target semantic behavior is determined. The prediction coefficients of the second node pair are determined based on the next-hop node pair and the predicted jump probability predicted by the graph neural network for the second node pair, and the attack probability predicted by the large language model for the target behavior node. Based on the first score, the transition coefficient, and the prediction coefficient, a second score is determined for the log to be detected, and an anomaly detection result for the log to be detected is determined based on the second score.

2. The method of claim 1, wherein, The step of determining whether there exists a target node pair matching the log to be detected from the first node pairs associated with each first connection edge in the semantic behavior graph, based on the target semantic vector and log entity of the log to be detected, includes: From the first node pairs included in the semantic behavior graph, candidate node pairs including the log entity are filtered. The current similarity threshold corresponding to the candidate node pair is determined based on the number of times the historical logs matching the candidate node pair are marked as abnormal logs. Based on the similarity between the semantic behavior vector carried by the semantic behavior node in the candidate node pair and the target semantic vector, and the current similarity threshold, it is determined whether there is a matching target node pair from the candidate node pairs.

3. The method of claim 1, wherein, The current risk baseline is related to the number of times the historical logs corresponding to the target behavior node are marked as abnormal logs and / or false alarms; The frequency dispersion is related to the frequency with which log entities perform the target semantic behavior over a preset time period in the past, and the average frequency with which different log entities perform the target semantic behavior in history. The latest security baseline is related to the importance of the source security domain and the number of times the second node marks the corresponding historical logs as false alarms.

4. The method of claim 1, wherein, The method further includes: If the target node pair does not exist, the log to be detected will be stored in the candidate pool; In response to triggering a preset clustering condition, each log entry to be detected stored in the candidate pool is processed in a structured manner to obtain each structured log entry; For each structured log entry, keyword information is extracted from the structured log entry according to a preset keyword type, and a target semantic vector corresponding to the structured log entry is generated using a pre-trained semantic vector model. Based on the target semantic vector corresponding to each structured log and the baseline security cardinality corresponding to each security domain, the target semantic vectors are clustered to obtain the cluster center vectors of each target. Using each target cluster center vector as a new semantic behavior node, the graph structure of the currently constructed semantic behavior graph is updated based on the entity nodes in the currently constructed semantic behavior graph, the log entities in each structured log, and the keyword information of each structured log associated with the target cluster center vector, to obtain a new constructed semantic behavior graph.

5. The method of claim 4, wherein, The preset clustering conditions include reaching a preset period; The step involves clustering each target semantic vector based on the target semantic vector corresponding to each structured log entry and the baseline security cardinality corresponding to each security domain, to obtain each target cluster center vector, including: Based on the security domain to which each structured log belongs, the logs to be clustered under each security domain are divided; For each security domain, when the number of logs to be clustered in the security domain reaches a preset number, the target semantic vectors corresponding to each log to be clustered in the security domain are clustered according to the target semantic vectors corresponding to each log to be clustered in the security domain and the baseline security cardinality of the security domain, so as to obtain the target cluster center vectors of each security domain.

6. The method of claim 5, wherein, The method further includes: If the number of logs to be clustered under the security domain does not reach the preset number, the first security domain with the highest attribute similarity to the security domain is selected from other security domains that have been clustered into cluster center vectors. The target cluster center vectors in the first security domain are used as the target cluster center vectors in that security domain. The new semantic behavior node corresponding to the target cluster center vector under the security domain and the latest security cardinality between the security domain are updated to the preset cardinality until the number of logs to be clustered in the security domain accumulates to the preset number. Clustering is performed according to the target semantic vectors corresponding to each log to be clustered under the security domain to obtain each new target cluster center vector under the security domain. Using each new target cluster center vector as a new semantic behavior node, the graph structure of the currently constructed semantic behavior graph is updated based on each entity node in the currently constructed semantic behavior graph and the log entities in each log to be clustered under the security domain, to obtain a new constructed semantic behavior graph. The latest security cardinality between the new semantic behavior node corresponding to the new target cluster center vector and the security domain is set as the baseline security cardinality.

7. The method of claim 4, wherein, After obtaining the new constructed semantic behavior graph, the following is also included: For each new semantic behavior node in the newly constructed semantic behavior graph, the large language model is used to predict the structured behavior description of the new semantic behavior node; the structured behavior description includes at least the behavior summary description of the new semantic behavior node, the tactical mapping information and attack chain stage of the new semantic behavior node under the preset tactical system, the attack probability, and the behavior intention of the new semantic behavior node in each distributed security domain. New second node pairs are formed using the new semantic behavior nodes and their distributed security domains. Based on the latest occurrence time of the new semantic behavior nodes and the attack chain stage in the structured behavior description of the new semantic behavior nodes, each new second node pair whose latest occurrence time is within the target time window and whose attack chain stages have a causal relationship is determined. Construct a second connection edge between each group of the new second node pairs, and determine the edge attributes of each second connection edge based on the number of occurrences, occurrence time intervals, and attack chain phase transition modes of each group of the new second node pairs; The security domain node graph is updated using each of the second connecting edges and the edge attributes to obtain a new security domain node graph; the current security domain node graph includes each of the constructed second node pairs and the second connecting edges between the constructed second node pairs; The new security domain node graph and the structured behavior description of each new semantic behavior node are input into the graph neural network to obtain the next-hop node pair and the predicted jump probability for each second node pair in the new security domain node graph.

8. The method of claim 4, wherein, After obtaining the new constructed semantic behavior graph, the method further includes: For any entity node in the newly constructed semantic behavior graph, based on each first connection edge of the entity node, determine the various historical semantic behaviors currently being executed by the log entity corresponding to the entity node; For each pair of historical semantic actions, the latest transition probability between each pair of historical semantic actions is calculated based on the semantic actions corresponding to the semantic action nodes in each second node pair included in the latest security domain node graph, and the second connection edges of each second node pair. The transition probabilities maintained in the behavior transition matrix corresponding to the entity node are dynamically updated based on the latest transition probability between every two historical semantic behaviors.

9. The method of claim 1, wherein, The step of determining the transition coefficient from the log entity to the target semantic behavior, based on the transition probabilities between the various historical semantic behaviors executed by the log entity dynamically maintained according to the behavior transition matrix, includes: Based on the second connection edges between each pair of second nodes in the latest security domain node graph, determine whether the target semantic behavior has a periodic loop; If not, then based on the transition probabilities between each historical semantic behavior dynamically maintained by the behavior transition matrix, determine the target probability of the log entity's last executed historical semantic behavior being transferred to the target semantic behavior. The transition coefficient is determined based on the relationship between the target probability and the preset probability threshold.

10. The method of claim 9, wherein, The method further includes: If the target semantic behavior has a periodic cycle, then the transfer coefficient of the log entity to the target semantic behavior is determined as the target coefficient.

11. The method of claim 1, wherein, The step of determining the prediction coefficients of the second node pair based on the next-hop node pair and predicted jump probability predicted by the graph neural network for the second node pair, and the attack probability predicted by the large language model for the target behavior node, includes: If the importance of the security domain in the next-hop node pair is higher than the importance of the source security domain, and / or if the current risk base of the semantic behavior node in the next-hop node pair is greater than a preset base, determine whether the predicted jump probability is greater than the preset jump probability. If so, the predicted jump probability is adjusted using a preset enhancement coefficient to obtain the adjusted probability; The prediction coefficients for the second node pair are determined based on the attack probability and the adjusted probability.

12. The method of claim 1, wherein, Determining the second score of the log to be detected based on the first score, the transition coefficient, and the prediction coefficient includes: A third score is determined based on the first score, the transition coefficient, and the prediction coefficient; If the target behavior node is repeatedly marked as an anomaly false alarm in the historical logs of multiple log entities, and / or the target behavior node is repeatedly marked as an anomaly false alarm in the historical logs of multiple security domains, then the third score is adjusted using a preset weight to obtain the second score.

13. The method of claim 1, wherein, The method further includes: If any semantic behavior node matches multiple logs to be detected, and the multiple logs to be detected come from a second security domain with a first preset importance and a third security domain with a second preset importance, then if the proportion of logs to be detected from the third security domain is greater than a preset proportion, the target semantic vectors of the multiple logs to be detected are clustered to obtain the cluster center vector to be used. If the similarity between the cluster center vector to be used and the semantic behavior node is greater than a preset similarity, the semantic behavior node is updated to the cluster center vector to be used.

14. A log detection apparatus characterized by comprising: The device includes: The acquisition module is used to acquire the logs to be detected from any of the multiple security domains and the currently constructed semantic behavior graph; the semantic behavior graph includes multiple semantic behavior nodes and entity nodes that have a first connection edge with the semantic behavior nodes; The first determining module is used to determine, based on the target semantic vector and log entity of the log to be detected, whether there is a target node pair that matches the log to be detected from the first node pairs associated with each first connection edge included in the semantic behavior graph; The second determining module is used to determine the first score of the log to be detected based on the current risk base of the target behavior node in the target node pair, the frequency dispersion of the log entity executing the target semantic behavior corresponding to the target behavior node, the latest security base of the second node pair composed of the source security domain of the target behavior node and the log to be detected, and the time when the log entity last executed the target semantic behavior. The third determining module is used to determine the transfer coefficient of the log entity to the target semantic behavior based on the transfer probabilities between the various historical semantic behaviors executed by the log entity dynamically maintained by the behavior transfer matrix. The fourth determining module is used to determine the prediction coefficients of the second node pair based on the next-hop node pair and the predicted jump probability predicted by the graph neural network for the second node pair, and the attack probability predicted by the large language model for the target behavior node. The fifth determining module is used to determine the second score of the log to be detected based on the first score, the transfer coefficient and the prediction coefficient, and to determine the anomaly detection result of the log to be detected based on the second score.

15. A computer readable storage medium having stored thereon a computer program, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 13.

16. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 13.

Images