Method and system for internal threat detection based on feature mask reconstruction and contrast enhancement

Abstract

The present application relates to the technical field of information security, and particularly relates to a kind of internal threat detection method and system based on feature mask reconstruction and contrast enhancement, directed heterogeneous graph sequence is randomly masked and graph enhancement processing, obtain mask graph representation and multi-view representation data;Mask graph representation and multi-view representation data are used to train detection network, the detection network includes: hybrid encoder and discriminant network, the hybrid encoder is composed of graph attention network and gated recurrent unit, wherein, temporal mask reconstruction is carried out to mask graph representation using hybrid encoder and decoder, and graph reconstruction loss is determined;Contrast enhancement learning is carried out to multi-view data using hybrid encoder, and contrast loss is determined;And the detection network parameters are optimized by back propagation algorithm;The directed heterogeneous graph sequence of user real-time interaction in target network environment is input into network model, to detect user interaction abnormal behavior.The present application can improve the robustness of malicious behavior identification.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an internal threat detection method and system based on feature mask reconstruction and contrast enhancement. Background Technology

[0002] With the rapid development and widespread application of information technology, insider threats have become one of the main factors affecting information system security. Internal employees possess legitimate identities and business permissions, and their improper behavior can directly threaten the confidentiality, integrity, and availability of the system. The increasing number of insider threat incidents and the resulting losses mean that individual enterprises suffer losses due to internal risks, and on average, it takes more than 80 days to fully contain such incidents. Compared to external attacks, abnormal behavior by internal users often manifests as using legitimate permissions to access and download sensitive data in bulk, inadvertently clicking on phishing emails leading to terminal compromise, and executing malicious scripts and cleaning up log traces, causing system damage. These abnormal behaviors are often hidden within a large number of normal behaviors, making it difficult for static rule-based detection methods to identify them in a timely and accurate manner. Therefore, how to address the concealment of abnormal behavior and improve the robustness of detection models in complex scenarios has become one of the urgent problems to be solved in the detection of abnormal internal user behavior.

[0003] Currently, methods for detecting anomalies in internal user behavior are mainly categorized into feature engineering-based, sequence-based, and graph representation learning-based methods. Feature engineering-based methods extract discrete features of user behavior through statistical analysis to establish baseline patterns. However, when processing massive amounts of multi-source log data, these methods heavily rely on expert experience for feature design and struggle to capture complex, non-linear interaction patterns. Sequence-based methods treat user activity as time-series data, typically dividing data by session or day. They utilize recurrent neural networks such as LSTM and GRU to capture the evolution of user behavior over time, predicting whether behavioral sequences within a specific time period deviate from historical baselines. While these methods excel in time-series pattern mining, they often overlook the complex interaction topology between users and network entities, making it difficult to comprehensively characterize user behavior patterns. To compensate for the shortcomings of sequence methods, researchers have recently introduced graph neural networks (GNNs) to model the interaction relationships between entities. These methods construct log data as a graph, learning higher-order semantic representations of nodes by aggregating neighborhood information, thus effectively capturing the structured dependencies between users and resources. However, they still have the following shortcomings when dealing with complex internal threat scenarios in real-world environments:

[0004] 1) Internal user behavior exhibits complex spatial interaction topology and temporal evolution characteristics. Existing methods often focus on single-dimensional modeling, neglecting the coupling dependencies between spatiotemporal dimensions, making it difficult to effectively integrate historical spatiotemporal context information, resulting in insufficient abnormal behavior detection capabilities.

[0005] 2) Abnormal user behavior is highly concealed; malicious users can manipulate statistical characteristics such as access frequency and login time to disguise themselves as normal behavior. Existing methods mainly rely on the characteristics of easily manipulated user nodes, ignoring their interaction with business resource nodes, making it difficult to effectively identify hidden abnormal behavior.

[0006] 3) User behavior patterns are prone to fluctuations due to changes in legitimate business operations. Existing methods typically assume that the data is complete and accurate and that the behavior patterns are stable during training. The learned representations are prone to overfitting to specific behavior patterns and have limited discriminative ability in noisy environments.

[0007] Therefore, there is an urgent need for a means to identify hidden abnormal behavior in order to improve the security of internal information systems. Summary of the Invention

[0008] To address the issue of internal threats to information system security, this invention provides an internal threat detection method and system based on feature mask reconstruction and contrast enhancement. By using a feature attribution analysis model to analyze the dependency logic of voiceprint features, the transparency and reliability of voiceprint recognition are improved.

[0009] According to the design scheme provided by the present invention, on the one hand, an internal threat detection method based on feature mask reconstruction and contrast enhancement is provided, comprising:

[0010] Based on the collected raw logs, a user directed heterogeneous graph sequence is constructed, and random masking and graph augmentation processing are performed on the directed heterogeneous graph sequence to obtain the corresponding masked graph representation and the enhanced multi-view representation data. The directed heterogeneous graph is used to describe the interaction topology between users and network entities.

[0011] A threat detection target model is obtained by training a detection network using masked graph representation and multi-view representation data. The detection network includes a hybrid encoder and a discriminator network. The hybrid encoder consists of a graph attention network and a gated recurrent unit. During the training process, the hybrid encoder and decoder are used to perform spatiotemporal mask reconstruction on the masked graph representation to determine the graph reconstruction loss. The hybrid encoder is used to perform contrastive reinforcement learning on the multi-view data to determine the contrast loss. Based on the graph reconstruction loss and the contrast loss, the detection network parameters are optimized using a backpropagation algorithm.

[0012] Directed heterogeneous graph modeling is performed on the raw user logs in the target network environment to obtain a sequence of directed heterogeneous graphs of real-time interactions between users and entities in the target network. The sequence of directed heterogeneous graphs of real-time interactions is then input into the threat detection target model, which is used to determine whether there are any anomalies in user interaction behavior in the target network.

[0013] As part of the internal threat detection method based on feature mask reconstruction and contrast enhancement of this invention, a user-directed heterogeneous graph sequence is further constructed, comprising:

[0014] Collect users, terminals, network domains, and email domains in the network environment and form a heterogeneous node set;

[0015] Discretize continuous time into a fixed-length time window;

[0016] The data flow within a time window in the network environment is abstracted into several event sequences, where each event represents a user interacting with an entity at a corresponding time with a corresponding operation type;

[0017] The set of interaction edges within a time window is obtained based on the time series, and the features and adjacency matrix of each node are extracted. The weight of the interaction edge is obtained by aggregating its interaction frequency under the corresponding edge.

[0018] Based on the node set, interaction edge set, node features, adjacency matrix, and interaction edge weights, construct a directed heterogeneous graph of users under the corresponding time window.

[0019] As an internal threat detection method based on feature mask reconstruction and contrast enhancement of the present invention, further, node features are extracted, including:

[0020] For user behaviors under each operation type, frequency statistics and time-domain anomaly features are extracted under the corresponding time window. The frequency statistics feature is described by the cumulative number of times the user behavior occurs under the corresponding time window, and the time-domain anomaly feature is described by the frequency of the user behavior during non-working time periods under the corresponding time window.

[0021] As an internal threat detection method based on feature mask reconstruction and contrast enhancement of the present invention, further, a random mask is applied to the directed heterogeneous graph sequence to obtain a masked graph representation, including:

[0022] For the node feature vectors in a directed heterogeneous graph, a subset of benign nodes is randomly sampled proportionally. The numerical features in the benign node subset are replaced with learnable mask vectors while keeping the node type embedding unchanged, resulting in the feature vector representation after node masking.

[0023] As an internal threat detection method based on feature mask reconstruction and contrast enhancement of the present invention, further, a spatiotemporal mask reconstruction of the mask map representation is performed using a hybrid encoder and decoder, comprising:

[0024] A multi-head attention mechanism is used to capture the topology of the mask graph, and the graph attention network is used to perform weighted aggregation of the information of the multi-head neighbor nodes to obtain the spatiotemporal representation of the nodes output by the graph attention network.

[0025] The spatiotemporal representation of nodes is modeled temporally using gated cyclic units to obtain the temporal evolution characteristics of nodes. The temporal modeling dynamically regulates the retention of historical information and the fusion of the current node representation through update gates and reset gates.

[0026] The temporal evolution features of nodes are aggregated to obtain the neighborhood context aggregation representation, which is then used to reconstruct the feature matrix of the mask map using the decoder.

[0027] As an internal threat detection method based on feature mask reconstruction and contrast enhancement of the present invention, further, a spatiotemporal mask reconstruction of the mask map is performed using a hybrid encoder and decoder to determine the graph reconstruction loss, including:

[0028] Scaling cosine error is used to measure the difference between the original node features and the reconstructed features of the mask image to obtain the feature reconstruction loss;

[0029] Binary cross-entropy is used to constrain the prediction of edges in the mask graph in order to obtain the edge reconstruction loss.

[0030] The feature reconstruction loss and edge reconstruction loss are weighted and summed based on a preset balance coefficient to obtain the graph reconstruction loss.

[0031] As an internal threat detection method based on feature mask reconstruction and contrast enhancement of the present invention, further, a contrast enhancement learning process is performed on multi-view data using a hybrid encoder to determine the contrast loss, including:

[0032] The enhanced view data is input into the hybrid encoder with shared parameters to obtain the corresponding node representation;

[0033] The projection head, composed of a multilayer sensing mechanism, maps the node representation to the contrast learning space. In the contrast learning space, positive sample pairs are constructed based on the projection representation of the same node in different views, and negative sample pairs are constructed based on the projection representation of different nodes in different views.

[0034] Based on cosine similarity and using a temperature coefficient to score the similarity of sample pairs, a contrastive learning loss function is constructed by maximizing the consistency of positive sample pairs and minimizing the similarity of negative sample pairs.

[0035] Furthermore, this invention also provides an internal threat detection system based on feature mask reconstruction and contrast enhancement, comprising: a sample collection module, a network training module, and a target detection module, wherein...

[0036] The sample collection module is used to construct a user directed heterogeneous graph sequence based on the collected raw logs, and to perform random masking and graph augmentation processing on the directed heterogeneous graph sequence to obtain the corresponding masked graph representation and the enhanced multi-view representation data. The directed heterogeneous graph is used to describe the interaction topology between users and network entities.

[0037] A network training module is used to train the detection network using masked graph representation and multi-view representation data to obtain a threat detection target model. The detection network includes a hybrid encoder and a discriminator network. The hybrid encoder consists of a graph attention network and a gated recurrent unit. During the training process of the detection network, the hybrid encoder and decoder are used to perform spatiotemporal mask reconstruction on the masked graph representation to determine the graph reconstruction loss; the hybrid encoder is used to perform contrastive reinforcement learning on the multi-view data to determine the contrast loss; and the detection network parameters are optimized based on the graph reconstruction loss and the contrast loss using a backpropagation algorithm.

[0038] The target detection module is used to perform directed heterogeneous graph modeling on the user's original logs in the target network environment to obtain a directed heterogeneous graph sequence of real-time interactions between the user and the target network entity. The directed heterogeneous graph sequence of real-time interactions is input into the threat detection target model, which is used to determine whether there are any abnormalities in the user's interaction behavior in the target network.

[0039] The beneficial effects of this invention are:

[0040] This invention constructs heterogeneous graph sequences from multi-source logs according to time windows to characterize the interaction relationships between users and business resource entities. A hybrid encoder composed of a graph attention network and a gated recurrent unit is used to extract spatial topological features and temporal variation features, achieving deep coupling in the spatiotemporal dimensions. Based on a mask reconstruction mechanism, the features and edge structures of masked nodes are recovered through neighborhood context, and neighborhood association patterns are mined to improve the detection capability of hidden abnormal behaviors, effectively identifying such behaviors. A multi-view contrastive learning mechanism is used to construct enhanced view constraints to ensure semantic consistency of the same user's cross-view representation and increase the representation distance between different users, learning stable behavioral representations, effectively mitigating overfitting to specific behavioral patterns, and improving robustness to malicious behavior identification. Furthermore, the robustness is theoretically analyzed, and a temporal decay mechanism is used to suppress disturbance accumulation, which enhances robustness to structural defects. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the internal threat detection process based on feature mask reconstruction and contrast enhancement in the embodiment;

[0042] Figure 2 This is a schematic diagram of the TGMC internal threat detection algorithm architecture in this embodiment;

[0043] Figure 3 This is a schematic diagram of the spatiotemporal mask reconstruction process in the embodiment;

[0044] Figure 4 This is a schematic diagram of the comparison view perturbation strategy in the embodiment. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0046] To address the shortcomings of existing internal user behavior anomaly detection methods, such as weak spatiotemporal correlation representation capabilities, difficulty in identifying concealed abnormal behaviors, and weak robustness to normal business fluctuations, this invention provides an embodiment, see [link to embodiment]. Figure 1 As shown, an internal threat detection method based on feature mask reconstruction and contrast enhancement is provided, comprising:

[0047] S101. Construct a user directed heterogeneous graph sequence based on the collected raw logs, and perform random masking and graph augmentation processing on the directed heterogeneous graph sequence to obtain the corresponding masked graph representation and the enhanced multi-view representation data. The directed heterogeneous graph is used to describe the interaction topology between users and network entities.

[0048] Specifically, the user-directed heterogeneous graph sequence can be designed to include:

[0049] Collect users, terminals, network domains, and email domains in the network environment and form a heterogeneous node set;

[0050] Discretize continuous time into a fixed-length time window;

[0051] The data flow within a time window in the network environment is abstracted into several event sequences, where each event represents a user interacting with an entity at a corresponding time with a corresponding operation type;

[0052] The set of interaction edges within a time window is obtained based on the time series, and the features and adjacency matrix of each node are extracted. The weight of the interaction edge is obtained by aggregating its interaction frequency under the corresponding edge.

[0053] Based on the node set, interaction edge set, node features, adjacency matrix, and interaction edge weights, construct a directed heterogeneous graph of users under the corresponding time window.

[0054] In the node feature extraction process, for user behaviors under each operation type, frequency statistics and time-domain anomaly features are extracted in the corresponding time window. The frequency statistics feature is described by the cumulative number of times the user behavior occurs in the corresponding time window, and the time-domain anomaly feature is described by the frequency of the user behavior during non-working time periods in the corresponding time window.

[0055] like Figure 2 As shown, let the set of data sources in the internal network environment be... The data stream is abstracted into a sequence of events. , where each event Represented as a quadruple This indicates that the user At any moment By operation type With entity The interactions performed. User-centric behavior aggregation, which aggregates different discrete events based on user... To link and integrate.

[0056] Discretize continuous time into a fixed-length time window. Because user behavior exhibits cyclical patterns, the data can be sliced ​​by day and placed into a window. The subset of events within is denoted as .

[0057] To quantify user behavior patterns and capture potential anomalies, a time window is used. Each user within Extract the feature vector. First, define the working time indicator function:

[0058]

[0059] It mainly includes two types of key statistical features:

[0060] Frequency statistics: For different user behaviors, the daily cumulative occurrence frequency is calculated separately. High-frequency operation peaks often indicate the risk of data theft or deliberate sabotage. For any operation type... :

[0061]

[0062] Temporal anomaly characteristics: By introducing working time as a benchmark, we distinguish between standard working time and non-working time operations, and statistically analyze the frequency of occurrence of various behaviors during non-working time periods.

[0063]

[0064] To capture the complex interaction topology between users and network entities, structured log data can be transformed into a series of directed heterogeneous graphs generated daily. Given... ,in, This indicates that it is by the user. ,terminal Network domain name and email domain A heterogeneous set of nodes; This is the set of interaction edges for the day, containing The three relationship types correspond to user-terminal, user-domain, and user-email domain interactions, respectively. The node feature matrix; This represents a static adjacency matrix, which indicates the adjacency relationship between any two nodes in the network.

[0065] For any user node With resource nodes In relation Edge weights below Obtained by aggregating interaction frequency, it can intuitively reflect the degree of user dependence on or access intensity of specific resources, i.e.

[0066]

[0067] Through the above construction, the diagram It also encapsulates the user's statistical attributes and the topology of their activities, providing a complete data representation for downstream anomaly detection.

[0068] In this process, a random mask is applied to the directed heterogeneous graph sequence. For the node feature vectors in the directed heterogeneous graph, a subset of benign nodes is randomly sampled proportionally. The numerical features in the benign node subset are replaced with learnable mask vectors while keeping the node type embedding unchanged, resulting in the feature vector representation after node masking.

[0069] like Figure 3 As shown, a self-supervised task of "masking-reconstruction" is employed to learn the latent representations of nodes. A random masking strategy is used for the input feature matrix. , No. Feature vectors of each node proportional Randomly sample a subset of benign nodes Replace its numerical features with learnable special vectors Meanwhile, the node type embedding remains unchanged, and the masked features are denoted as... For each node The features behind the mask are defined as follows:

[0070]

[0071] S102. The detection network is trained using masked graph representation and multi-view representation data to obtain a threat detection target model. The detection network includes a hybrid encoder and a discriminator network. The hybrid encoder consists of a graph attention network and a gated recurrent unit. During the training process of the detection network, the hybrid encoder and decoder are used to perform spatiotemporal mask reconstruction on the masked graph representation to determine the graph reconstruction loss. The hybrid encoder is used to perform contrastive reinforcement learning on the multi-view data to determine the contrast loss. The detection network parameters are optimized based on the graph reconstruction loss and the contrast loss and through the backpropagation algorithm.

[0072] Specifically, spatiotemporal mask reconstruction of the mask image representation using a hybrid encoder and decoder can be designed to include:

[0073] A multi-head attention mechanism is used to capture the topology of the mask graph, and the graph attention network is used to perform weighted aggregation of the information of the multi-head neighbor nodes to obtain the spatiotemporal representation of the nodes output by the graph attention network.

[0074] The spatiotemporal representation of nodes is modeled temporally using gated cyclic units to obtain the temporal evolution characteristics of nodes. The temporal modeling dynamically regulates the retention of historical information and the fusion of the current node representation through update gates and reset gates.

[0075] The temporal evolution features of nodes are aggregated to obtain the neighborhood context aggregation representation, which is then used to reconstruct the feature matrix of the mask map using the decoder.

[0076] Among them, spatiotemporal mask reconstruction of the mask image is performed using a hybrid encoder and decoder, and the graph reconstruction loss is determined, which may include:

[0077] Scaling cosine error is used to measure the difference between the original node features and the reconstructed features of the mask image to obtain the feature reconstruction loss;

[0078] Binary cross-entropy is used to constrain the prediction of edges in the mask graph in order to obtain the edge reconstruction loss.

[0079] The feature reconstruction loss and edge reconstruction loss are weighted and summed based on a preset balance coefficient to obtain the graph reconstruction loss.

[0080] To simultaneously capture spatial topology and temporal dependencies, a hybrid encoder consisting of a graph attention network (GAT) and a gated recurrent unit (GRU) is used for feature extraction. The GAT is leveraged to weighted aggregate information from multi-hop neighborhood nodes, thereby learning a node representation with structure awareness. For any node... and its neighboring nodes Attention coefficient is The attention coefficients are normalized using the Softmax function to obtain the final normalized weights. :

[0081]

[0082] Then, the topological structure is captured using a multi-head attention mechanism.

[0083] Assume there is a total Each attention head, then the node Spatial aggregation is represented as

[0084]

[0085] in, For the first A linear transformation matrix of size, ( ) is a non-linear activation function. Based on this mechanism, even when some node features are masked, GAT can still infer node semantics using neighborhood context, thereby capturing the topological structure and neighbor information within the graph snapshot. GAT encoding is:

[0086]

[0087] Building upon this, GRU is introduced to perform temporal modeling of node representations. Update and reset gates dynamically regulate the retention of historical information and its fusion with the current input. The output of GAT at the current time is then used. and the hidden state of the previous moment As the current input, generate the updated hidden state. :

[0088]

[0089] The decoder maps the encoded output back to the original feature space to reconstruct the masked node features and graph structure. Based on a graph neural network architecture, it aggregates neighborhood context information. :

[0090]

[0091] Based on the aggregated representation And the current graph structure, the reconstructed feature matrix :

[0092]

[0093] To measure the difference between the original node features and the reconstructed features, a feature reconstruction loss is defined. for

[0094]

[0095] in, and They are nodes The original features and reconstructed features, is the scaling factor. This loss takes into account the importance of directional consistency in the high-dimensional feature space, and uses Scaled Cosine Error (SCE) to address the data imbalance problem, thus better capturing the semantic orientation of the feature vectors.

[0096] In addition, an edge reconstruction loss is introduced to explicitly preserve the graph's topology. The edges in the graph are predicted using a binary cross-entropy (BCE) constraint model.

[0097]

[0098] in, Denotes the existence of an edge, with a real edge denoted as . The pseudo-negative edge obtained through negative sampling is If and only if hour ,otherwise ; Indicates the prediction node and The probability of connections between them.

[0099] Based on the above definition, the total loss function of this mechanism is a weighted sum of the feature reconstruction loss and the edge reconstruction loss, and can be expressed as:

[0100]

[0101] in, and This is a balancing coefficient used to adjust the relative contributions of different loss terms. It can be appropriately increased when the node characteristic noise is high. To improve the robustness of semantic representation; in scenarios with sparse user interaction behavior, the size can be appropriately increased. This enhances the learning of topological structures. In summary, through the self-supervised spatiotemporal mask reconstruction task, the model gains a holistic understanding of node semantics and graph topology, laying the foundation for subsequent anomaly detection.

[0102] To enhance the model's adaptation to normal fluctuations in user behavior and alleviate the overfitting problem to statistical features, a multi-view contrast enhancement mechanism can be used. This mechanism requires that the same node maintains a semantically consistent representation under different views generated by random perturbation, while the representations of different nodes should have sufficient distinguishability in the latent space.

[0103] Specifically, for the same image Construct two random augmented views and .like Figure 4 As shown, each view employs two random perturbation strategies:

[0104] 1) Feature masking: Randomly set some elements in the input feature matrix to zero to simulate feature loss or noise.

[0105] 2) Random edge removal: Randomly remove a certain proportion of edges from the graph, with probability. From the set of edges Randomly discard some edges to obtain two sets of edge indices and edge attributes. , This enhances the model's robustness to structural incompleteness.

[0106] Specifically, using a hybrid encoder to perform contrastive reinforcement learning on multi-view data and determining the contrastive loss can include:

[0107] The enhanced view data is input into the hybrid encoder with shared parameters to obtain the corresponding node representation;

[0108] The projection head, composed of a multilayer sensing mechanism, maps the node representation to the contrast learning space. In the contrast learning space, positive sample pairs are constructed based on the projection representation of the same node in different views, and negative sample pairs are constructed based on the projection representation of different nodes in different views.

[0109] Based on cosine similarity and using a temperature coefficient to score the similarity of sample pairs, a contrastive learning loss function is constructed by maximizing the consistency of positive sample pairs and minimizing the similarity of negative sample pairs.

[0110] The two enhanced views are input into a hybrid encoder with shared parameters to obtain the corresponding node representations, which are then mapped onto the contrast learning space through a projection head composed of a multilayer perceptron (MLP). Let the first... Each node in the view With View The projections in the figures are respectively and For each node, Forming positive sample pairs, while with other nodes The representation of constitutes a negative sample pair.

[0111] During training, by maximizing the consistency of positive sample pairs and minimizing the similarity with negative sample pairs, the representations of the same node under different perturbed views are brought closer together while distancing them from the representations of other nodes, thus obtaining a more discriminative representation space. In scenarios where the proportion of outliers is low, this consistency constraint prompts the model to fully utilize the complementary view information of a large number of benign nodes to learn stable representations, thereby reducing the impact of class imbalance on representation learning. Contrastive learning is synchronized with model parameter updates to ensure that node representations remain stable across different views while maintaining necessary discriminability between different nodes. The projection results of the two views are denoted as... and The temperature coefficient is Define similarity score:

[0112]

[0113] The loss function is defined as follows:

[0114]

[0115] Similarly, define a view The loss is Finally, the comparative loss is calculated. The formula is:

[0116]

[0117] By minimizing this loss, the model can effectively filter out noise caused by fluctuations in legitimate behavior, allowing normal behavior patterns to cluster in the latent space and highlighting real anomalies as outliers, thereby significantly enhancing sample separability, reducing false alarm rate, and improving the accuracy of anomaly detection.

[0118] S103. Perform directed heterogeneous graph modeling on the user's original logs in the target network environment to obtain a directed heterogeneous graph sequence of real-time interactions between the user and the target network entity. Input the directed heterogeneous graph sequence of real-time interactions into the threat detection target model and use the threat detection target model to determine whether there are any abnormalities in the user interaction behavior in the target network.

[0119] The trained and optimized threat detection target model is deployed to the target network environment to detect abnormal user behavior in real time.

[0120] Furthermore, based on the above method, this embodiment of the invention also provides an internal threat detection system based on feature mask reconstruction and contrast enhancement, comprising: a sample collection module, a network training module, and a target detection module, wherein,

[0121] The sample collection module is used to construct a user directed heterogeneous graph sequence based on the collected raw logs, and to perform random masking and graph augmentation processing on the directed heterogeneous graph sequence to obtain the corresponding masked graph representation and the enhanced multi-view representation data. The directed heterogeneous graph is used to describe the interaction topology between users and network entities.

[0122] A network training module is used to train the detection network using masked graph representation and multi-view representation data to obtain a threat detection target model. The detection network includes a hybrid encoder and a discriminator network. The hybrid encoder consists of a graph attention network and a gated recurrent unit. During the training process of the detection network, the hybrid encoder and decoder are used to perform spatiotemporal mask reconstruction on the masked graph representation to determine the graph reconstruction loss; the hybrid encoder is used to perform contrastive reinforcement learning on the multi-view data to determine the contrast loss; and the detection network parameters are optimized based on the graph reconstruction loss and the contrast loss using a backpropagation algorithm.

[0123] The target detection module is used to perform directed heterogeneous graph modeling on the user's original logs in the target network environment to obtain a directed heterogeneous graph sequence of real-time interactions between the user and the target network entity. The directed heterogeneous graph sequence of real-time interactions is input into the threat detection target model, which is used to determine whether there are any abnormalities in the user's interaction behavior in the target network.

[0124] To verify the effectiveness of the proposed solution, the robustness of the solution will be analyzed from a theoretical perspective below:

[0125] Definition 1 (Lipschitz Continuity) Function Called -Lipschitz continuous, if for any ,satisfy

[0126] .

[0127] Lemma 1. Let the Lipschitz constant of GAT be... The GRU hidden states satisfy contraction stability, meaning they have a forgetting factor. If the feature perturbation and structural perturbation of the input graph sequence respectively satisfy... and Then at time The hidden state perturbation should satisfy:

[0128]

[0129] in, is the structural propagation coefficient.

[0130] Prove by the Lipschitz continuity of GAT, for any time... Spatial encoding output perturbation has

[0131]

[0132] remember Due to the contractile stability of the GRU, for any perturbation... and have

[0133]

[0134] time Input perturbation at time The effect decays to Expanding the recurrence relation and summing the results, we get:

[0135]

[0136] Substitution , can be obtained

[0137]

[0138] In the equation, the left side represents the output perturbation of the timing encoder, and the right side represents the cumulative bound of the input perturbation after Lipschitz propagation and timing decay, ensuring stability under long-term timing dependencies. Q.E.D.

[0139] Lemma 2: Let the feature occlusion rate of multi-view contrast enhancement be... The edge dropping rate is The encoder Lipschitz constant is If the occlusion matrix Each element in After setting the edges to zero and deleting them, the adjacency matrix is: Then the node represents the expected deviation from the enhanced perturbation, which satisfies:

[0140]

[0141] in, For the original representation, To enhance the view representation.

[0142] After feature masking, there is ,in This represents element-wise product. Because... Each element is independently and identically distributed, and From Jensen's inequality, we can obtain:

[0143]

[0144] Similarly, the structural perturbation caused by random edge deletion satisfies:

[0145]

[0146] From the encoder's Lipschitz continuity, we can obtain:

[0147] In the formula, the left side represents the expected deviation between the enhanced view and the original representation, and the right side represents the upper bound of the perturbation controlled by the occlusion rate and the edge deletion rate. Once the contrastive loss converges, the model... and It remains stable even under magnitude-level perturbations. Q.E.D.

[0148] As shown in Lemmas 1 and 2, the representation perturbation of the proposed algorithm TGMC is linearly controllable with respect to input features and structural perturbations, and decays exponentially during time-series recursion. Furthermore, contrast enhancement further improves stability under conditions of missing features and structural changes, providing theoretical support for the robustness of TGMC.

[0149] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0150] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0151] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0152] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0153] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An internal threat detection method based on feature mask reconstruction and contrast enhancement, characterized in that, Include: Based on the collected raw logs, a user directed heterogeneous graph sequence is constructed, and random masking and graph augmentation processing are performed on the directed heterogeneous graph sequence to obtain the corresponding masked graph representation and the enhanced multi-view representation data. The directed heterogeneous graph is used to describe the interaction topology between users and network entities. A threat detection target model is obtained by training a detection network using masked graph representation and multi-view representation data. The detection network includes a hybrid encoder and a discriminator network. The hybrid encoder consists of a graph attention network and a gated recurrent unit. During the training process, the hybrid encoder and decoder are used to perform spatiotemporal mask reconstruction on the masked graph representation to determine the graph reconstruction loss. The hybrid encoder is used to perform contrastive reinforcement learning on the multi-view data to determine the contrast loss. Based on the graph reconstruction loss and the contrast loss, the detection network parameters are optimized using a backpropagation algorithm. Directed heterogeneous graph modeling is performed on the raw user logs in the target network environment to obtain a sequence of directed heterogeneous graphs of real-time interactions between users and entities in the target network. The sequence of directed heterogeneous graphs of real-time interactions is then input into the threat detection target model, which is used to determine whether there are any anomalies in user interaction behavior in the target network.

2. The internal threat detection method based on feature mask reconstruction and contrast enhancement according to claim 1, characterized in that, Construct a sequence of user-directed heterogeneous graphs, including: Collect users, terminals, network domains, and email domains in the network environment and form a heterogeneous node set; Discretize continuous time into a fixed-length time window; The data flow within a time window in the network environment is abstracted into several event sequences, where each event represents a user interacting with an entity at a corresponding time with a corresponding operation type; The set of interaction edges within a time window is obtained based on the time series, and the features and adjacency matrix of each node are extracted. The weight of the interaction edge is obtained by aggregating its interaction frequency under the corresponding edge. Based on the node set, interaction edge set, node features, adjacency matrix, and interaction edge weights, construct a directed heterogeneous graph of users under the corresponding time window.

3. The internal threat detection method based on feature mask reconstruction and contrast enhancement according to claim 2, characterized in that, Extract node features, including: For user behaviors under each operation type, frequency statistics and time-domain anomaly features are extracted under the corresponding time window. The frequency statistics feature is described by the cumulative number of times the user behavior occurs under the corresponding time window, and the time-domain anomaly feature is described by the frequency of the user behavior during non-working time periods under the corresponding time window.

4. The internal threat detection method based on feature mask reconstruction and contrast enhancement according to claim 1, characterized in that, Randomly masking a sequence of directed heterogeneous graphs yields a masked graph representation, which includes: For the node feature vectors in a directed heterogeneous graph, a subset of benign nodes is randomly sampled proportionally. The numerical features in the benign node subset are replaced with learnable mask vectors while keeping the node type embedding unchanged, resulting in the feature vector representation after node masking.

5. The internal threat detection method based on feature mask reconstruction and contrast enhancement according to claim 1 or 4, characterized in that, Spatiotemporal mask reconstruction of the mask graph representation using a hybrid encoder and decoder includes: A multi-head attention mechanism is used to capture the topology of the mask graph, and the graph attention network is used to perform weighted aggregation of the information of the multi-head neighbor nodes to obtain the spatiotemporal representation of the nodes output by the graph attention network. The spatiotemporal representation of nodes is modeled temporally using gated cyclic units to obtain the temporal evolution characteristics of nodes. The temporal modeling dynamically regulates the retention of historical information and the fusion of the current node representation through update gates and reset gates. The temporal evolution features of nodes are aggregated to obtain the neighborhood context aggregation representation, which is then used to reconstruct the feature matrix of the mask map using the decoder.

6. The internal threat detection method based on feature mask reconstruction and contrast enhancement according to claim 1 or 4, characterized in that, Spatiotemporal mask reconstruction of the masked graph is performed using a hybrid encoder and decoder, and the graph reconstruction loss is determined, including: Scaling cosine error is used to measure the difference between the original node features and the reconstructed features of the mask image to obtain the feature reconstruction loss; Binary cross-entropy is used to constrain the prediction of edges in the mask graph in order to obtain the edge reconstruction loss. The feature reconstruction loss and edge reconstruction loss are weighted and summed based on a preset balance coefficient to obtain the graph reconstruction loss.

7. The internal threat detection method based on feature mask reconstruction and contrast enhancement according to claim 1, characterized in that, Contrast reinforcement learning is performed on multi-view data using a hybrid encoder to determine the contrast loss, including: The enhanced view data is input into the hybrid encoder with shared parameters to obtain the corresponding node representation; The projection head, composed of a multilayer sensing mechanism, maps the node representation to the contrast learning space. In the contrast learning space, positive sample pairs are constructed based on the projection representation of the same node in different views, and negative sample pairs are constructed based on the projection representation of different nodes in different views. Based on cosine similarity and using a temperature coefficient to score the similarity of sample pairs, a contrastive learning loss function is constructed by maximizing the consistency of positive sample pairs and minimizing the similarity of negative sample pairs.

8. An internal threat detection system based on feature mask reconstruction and contrast enhancement, characterized in that, It includes: a sample collection module, a network training module, and an object detection module, among which, The sample collection module is used to construct a user directed heterogeneous graph sequence based on the collected raw logs, and to perform random masking and graph augmentation processing on the directed heterogeneous graph sequence to obtain the corresponding masked graph representation and the enhanced multi-view representation data. The directed heterogeneous graph is used to describe the interaction topology between users and network entities. A network training module is used to train the detection network using masked graph representation and multi-view representation data to obtain a threat detection target model. The detection network includes a hybrid encoder and a discriminator network. The hybrid encoder consists of a graph attention network and a gated recurrent unit. During the training process of the detection network, the hybrid encoder and decoder are used to perform spatiotemporal mask reconstruction on the masked graph representation to determine the graph reconstruction loss; the hybrid encoder is used to perform contrastive reinforcement learning on the multi-view data to determine the contrast loss; and the detection network parameters are optimized based on the graph reconstruction loss and the contrast loss using a backpropagation algorithm. The target detection module is used to perform directed heterogeneous graph modeling on the user's original logs in the target network environment to obtain a directed heterogeneous graph sequence of real-time interactions between the user and the target network entity. The directed heterogeneous graph sequence of real-time interactions is input into the threat detection target model, which is used to determine whether there are any abnormalities in the user's interaction behavior in the target network.

9. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 7.

Images