A machine learning based safety monitoring system and method thereof

Abstract

The application discloses a kind of security monitoring system and method based on machine learning, it is related to network security monitoring technical field.The security monitoring method includes: under the distributed bypass deployment architecture of several probes, through several probes, mirror collection and session restoration are carried out to service traffic, obtain the service flow session data at several probes.The present application carries out graph embedding learning to the service operation feature map by graph attention network, in the embedding learning process, for each current node, the attention coefficient between the current node and its each neighbor node is calculated, the feature representation of each neighbor node is weighted and aggregated based on the attention coefficient, and the graph embedding representation is generated, the environment-independent service operation representation vector at each probe is composed of the graph embedding representation of all nodes, effectively suppresses the semantic drift problem caused by network environment difference, significantly reduces the false alarm rate of security monitoring.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring technology, specifically to a security monitoring system and method based on machine learning. Background Technology

[0002] As business systems continue to expand and distributed architectures are widely used, business operations often need to be completed across multiple network regions. To ensure the secure operation of business systems, real-time monitoring and anomaly detection of business operations have become a key focus in the field of network security.

[0003] For example, patent publication number "CN113824725A", entitled "A Network Security Monitoring and Analysis Method and System Based on Causal Machine Learning", includes preprocessing a feature set P of a training dataset of network traffic; deleting non-causal noise features from the preprocessed feature set P to obtain a causal feature set V; selecting M-type attack labels that are close to the monitoring data from the causal feature set V using machine learning methods; calculating the expected value of the abnormal features of the M-type attack labels in counterfactual analysis using a counterfactual diagnostic method, and selecting the attack label that maximizes the expected value as the final network intrusion detection result of the detection data. The above invention can reduce the computational complexity of the counterfactual method and improve the accuracy of the monitoring system while ensuring monitoring performance.

[0004] The above method only performs causal reasoning on a single data source and does not consider the differences in the network environment of each probe in a multi-probe distributed deployment scenario. When the same business operation generates different traffic characteristics in different network areas, the above method cannot identify the feature variation caused by environmental differences, misjudging the feature fluctuations caused by the environment as causal features or noise features, resulting in the feature selection results deviating with changes in network topology and affecting the stability of subsequent classification. To address this, a security monitoring system and method based on machine learning have been invented. Summary of the Invention

[0005] The purpose of this invention is to provide a security monitoring system and method based on machine learning to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a security monitoring method based on machine learning, the security monitoring method comprising: in a distributed bypass deployment architecture of several probes, mirroring and reconstructing service traffic through several probes to obtain service flow session data at several probes; extracting a minimum observable feature set from the service flow session data at several probes according to the granularity of service operations; constructing a service operation feature map at several probes using features in the minimum observable feature set as nodes and the relationships between features as edges; performing graph embedding learning on the service operation feature map at several probes through a graph attention network to obtain environment-independent service operation representation vectors at several probes; performing cluster analysis on the environment-independent service operation representation vectors at several probes to obtain local service semantic vectors and local service category labels at several probes; and performing domain adaptive mapping. The network maps local service semantic vectors at several probes to a global common low-dimensional semantic space, obtaining cross-probe common semantic vectors at several probes. An adversarial alignment network is used to perform cross-probe semantic alignment on these cross-probe common semantic vectors. Based on the aligned cross-probe common semantic vectors, the semantic distance between cross-probe common semantic vectors at different probes is calculated. Service operations corresponding to cross-probe common semantic vectors with a semantic distance less than a preset threshold for determining the same service are identified as the same service entity. Based on the cross-probe service entity identity determination results, service operations at different probes identified as the same service entity are associated and mapped. The associated and mapped service operations observed by several probes are then integrated in chronological order to obtain a cross-probe service operation link. Anomaly detection is performed on the cross-probe service operation link, and a security monitoring alarm is output when an abnormal operation is detected.

[0007] Furthermore, the mirroring and session reconstruction of business traffic through several probes includes bypassing several probes to access the business network through the traffic mirroring port of the data center switch, obtaining traffic mirroring data at several probes, and performing TCP stream reassembly and application layer protocol parsing on the traffic mirroring data to obtain business flow session data containing a complete request-response interaction sequence at several probes. The relationships between features include the temporal relationships and co-occurrence relationships between features as edges, and the joint frequency of features in business operations as edge weights.

[0008] Furthermore, the features in the minimum observable feature set include the temporal structure features of request-response pairs, the fixed occurrence pattern features of protocol fields, and traffic statistical distribution features. The temporal structure features of request-response pairs include the arrival time interval between adjacent requests, the time delay between requests and responses, and the temporal pattern of the response return sequence. The fixed occurrence pattern features of protocol fields include the frequency of occurrence of specific business identifier fields in protocol data units, the distribution ratio of request method types, and the co-occurrence relationship of key fields in HTTP headers. The traffic statistical distribution features include the distribution of packet length, connection duration, and transmission byte rate.

[0009] Furthermore, the graph embedding learning of the business operation feature map through the graph attention network includes the graph attention network calculating the attention coefficient between the current node and its neighboring nodes for each current node during the embedding learning process, and performing weighted aggregation of the feature representations of the neighboring nodes based on the attention coefficients to generate the graph embedding representation of the current node. The graph embedding representations of all nodes constitute the environment-independent business operation representation vectors at several probes.

[0010] Furthermore, the clustering analysis based on environment-independent business operation representation vectors includes performing clustering analysis on the environment-independent business operation representation vectors at several probes using a density clustering algorithm, aggregating density-reachable representation vectors into the same business cluster, using the cluster center vector as the local business semantic vector at several probes, and using the cluster identifier of the business cluster output by the density clustering algorithm as the local business category label at several probes.

[0011] Furthermore, the local business semantic vector represents the business semantics obtained by several probes independently modeling, and the cross-probe common semantic vector represents the business semantics of several probes in a unified semantic space after global mapping.

[0012] Furthermore, the adversarial alignment network includes a probe discriminator and a semantic aligner. The probe discriminator performs source probe discrimination on the input cross-probe common semantic vector and outputs a probe source prediction probability distribution. The semantic aligner generates parameter adjustment gradients based on the probe source prediction probability distribution and performs semantic adjustment on the cross-probe common semantic vector. The parameters of the probe discriminator are updated by fixing the parameters of the semantic aligner to minimize the probe source discrimination loss. The parameters of the semantic aligner are updated by fixing the parameters of the probe discriminator to minimize the source probe discrimination accuracy of the probe discriminator on the cross-probe common semantic vector. The probe discriminator and the semantic aligner are iteratively optimized alternately.

[0013] Furthermore, during the iterative optimization process, based on the semantic similarity between the local business category labels of several probes and the corresponding local business semantic vectors, a cross-probe business category correspondence is established. According to the cross-probe business category correspondence, intra-class convergence constraints are applied to cross-probe common semantic vectors belonging to the same business category to increase their cosine similarity, and inter-class distance constraints are applied to cross-probe common semantic vectors belonging to different business categories to increase their semantic distance, until the accuracy of the probe discriminator in identifying the source probe of the cross-probe common semantic vector is lower than a preset discrimination lower limit, thus obtaining the cross-probe semantically aligned cross-probe common semantic vector.

[0014] Furthermore, the anomaly detection includes performing multi-dimensional anomaly detection on the cross-probe business operation link using an anomaly detection model for detecting deviations in business operation behavior. The multi-dimensional anomaly detection includes operation sequence timing anomaly detection, operation permission overrun detection, and sensitive data access pattern anomaly detection. When an abnormal operation is detected, a security monitoring alarm is output.

[0015] A machine learning-based security monitoring system employs the aforementioned machine learning-based security monitoring method. Furthermore, the security monitoring system includes: a data acquisition and session restoration module: under a distributed bypass deployment architecture of several probes, the system performs mirror acquisition and session restoration of business traffic through several probes to obtain business flow session data at several probes; Feature map construction and graph embedding learning module: Extract the minimum observable feature set from the business flow session data at several probes according to the granularity of business operations. Use the features in the minimum observable feature set as nodes and the correlation between features as edges to construct business operation feature maps at several probes. Perform graph embedding learning on the business operation feature maps at several probes through a graph attention network to obtain environment-independent business operation representation vectors at several probes. The cross-probe semantic alignment and link construction module performs cluster analysis on the environment-independent business operation representation vectors at several probes to obtain local business semantic vectors and local business category labels at several probes. It then maps these local business semantic vectors to a global common low-dimensional semantic space using a domain adaptive mapping network to obtain cross-probe common semantic vectors at several probes. An adversarial alignment network is then used to perform cross-probe semantic alignment on these cross-probe common semantic vectors. Based on the cross-probe common semantic vectors after alignment, the semantic distance between cross-probe common semantic vectors at different probes is calculated. Business operations corresponding to cross-probe common semantic vectors with semantic distances less than a preset threshold for determining the same business are identified as the same business entity. Based on the cross-probe business entity identity determination results, business operations at different probes identified as the same business entity are associated and mapped. Finally, the business operations observed by several probes after the association mapping are integrated in chronological order to obtain the cross-probe business operation link. Anomaly detection module: performs anomaly detection on the cross-probe service operation link, and outputs a security monitoring alarm when an anomaly operation is detected.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This machine learning-based security monitoring system and method uses a graph attention network to perform graph embedding learning on the feature graph of business operations. During the embedding learning process, the graph attention network calculates the attention coefficient between each current node and its neighboring nodes. Based on the attention coefficient, the feature representations of each neighboring node are weighted and aggregated to generate a graph embedding representation. The graph embedding representations of all nodes form the environment-independent business operation representation vector at each probe, which effectively suppresses the semantic drift problem caused by differences in network environment and significantly reduces the false alarm rate of security monitoring.

[0017] Meanwhile, after obtaining local business semantic vectors and local business category labels by independently modeling local business semantics using density clustering algorithms, the local business semantic vectors of each probe are mapped to the global common low-dimensional semantic space through a domain adaptive mapping network to obtain cross-probe common semantic vectors. Then, cross-probe semantic alignment is performed on the cross-probe common semantic vectors at each probe through an adversarial alignment network. The parameters of the probe discriminator are updated by fixing the parameters of the semantic aligner to minimize the probe source discrimination loss, and the parameters of the semantic aligner are updated by fixing the parameters of the probe discriminator to maximize the probe source discrimination loss. The probe discriminator and semantic aligner are iteratively optimized alternately. This effectively solves the technical problem that the same business operation generates completely different traffic fingerprints at different probes in the multi-probe distributed deployment scenario, which makes it impossible to determine whether the operation observed by each probe belongs to the same business entity in subsequent multi-probe association analysis. This significantly reduces the false negative rate of security monitoring.

[0018] By employing a closed-loop machine learning architecture of "local modeling – global constraints – iterative alignment," the multi-probe architecture is transformed from the traditional sequential model of "independent modeling followed by aggregation" to a closed-loop model where the local models of each probe are collaboratively optimized with global semantic constraints. In this closed-loop model, each probe first independently performs local business semantic modeling using a density clustering algorithm to obtain local business semantic vectors and local business category labels. Then, a domain adaptive mapping network maps the local business semantic vectors to a global common low-dimensional semantic space to obtain cross-probe common semantic vectors. Finally, an adversarial alignment network performs cross-probe semantic alignment. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the monitoring system of the present invention; Figure 2 This is a flowchart of the feature map construction and graph embedding learning process of the present invention; Figure 3 This is a flowchart of the training and optimization process of the adversarial alignment network of the present invention; Figure 4 This is an interface diagram of the monitoring system of the present invention; Figure 5 This is an interface diagram of the abnormal alarm of the present invention; Figure 6 This is an interface diagram of the probe status detection method of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] like Figure 1 - Figure 6As shown, this invention provides a technical solution: a security monitoring method based on machine learning. The security monitoring method includes: in a distributed bypass deployment architecture with several probes, mirroring and reconstructing service traffic using several probes to obtain service flow session data at several probes; extracting a minimum observable feature set from the service flow session data at the service operation granularity; constructing a service operation feature map at several probes using features in the minimum observable feature set as nodes and the relationships between features as edges; performing graph embedding learning on the service operation feature map at several probes using a graph attention network to obtain environment-independent service operation representation vectors at several probes; performing cluster analysis on the environment-independent service operation representation vectors at several probes to obtain local service semantic vectors and local service category labels at several probes; and using a domain adaptive mapping network to integrate the various... The local business semantic vector at the probe is mapped to the global common low-dimensional semantic space to obtain cross-probe common semantic vectors at several probes. Cross-probe semantic alignment is performed on the cross-probe common semantic vectors at several probes through an adversarial alignment network. Based on the cross-probe common semantic vectors after cross-probe semantic alignment, the semantic distance between cross-probe common semantic vectors at different probes is calculated. The business operations corresponding to the cross-probe common semantic vectors with a semantic distance less than a preset threshold for the same business are judged as the same business entity. Based on the cross-probe business entity identity judgment result, the business operations at different probes that are judged as the same business entity are associated and mapped. The business operations observed by several probes after the association mapping are associated and integrated in chronological order to obtain the cross-probe business operation link. Anomaly detection is performed on the cross-probe business operation link. When an abnormal operation is detected, a security monitoring alarm is output.

[0022] The process of mirroring and reconstructing business traffic using multiple probes involves bypassing multiple probes to access the business network through the traffic mirroring port of a data center switch, obtaining traffic mirroring data at multiple probes, and performing TCP stream reassembly and application layer protocol parsing on the traffic mirroring data to obtain business flow session data containing a complete request-response interaction sequence at multiple probes. The relationships between features include the temporal relationships and co-occurrence relationships between features as edges, and the joint frequency of features in business operations as edge weights.

[0023] The features in the minimum observable feature set include the temporal structure features of request-response pairs, the fixed occurrence pattern features of protocol fields, and the traffic statistics distribution features. The temporal structure features of request-response pairs include the arrival time interval between adjacent requests, the time delay between requests and responses, and the temporal pattern of the response return sequence. The fixed occurrence pattern features of protocol fields include the frequency of occurrence of specific business identifier fields in protocol data units, the distribution ratio of request method types, and the co-occurrence relationship of key fields in HTTP headers. The traffic statistics distribution features include the distribution of packet length, connection duration, and transmission byte rate.

[0024] The graph embedding learning of the business operation feature map through graph attention network includes the following steps: For each current node, the attention coefficient between the current node and its neighboring nodes is calculated. Based on the attention coefficient, the feature representations of the neighboring nodes are weighted and aggregated to generate the graph embedding representation of the current node. The graph embedding representations of all nodes constitute the environment-independent business operation representation vectors at several probes.

[0025] Clustering analysis based on environment-independent business operation representation vectors involves using density clustering algorithms to cluster environment-independent business operation representation vectors at several probes. Density-reachable representation vectors are aggregated into the same business cluster. The cluster center vector is used as the local business semantic vector at several probes, and the cluster identifier of the business cluster output by the density clustering algorithm is used as the local business category label at several probes.

[0026] Local business semantic vectors represent the business semantics obtained by several probes through independent modeling, while cross-probe common semantic vectors represent the business semantics of several probes in a unified semantic space after global mapping.

[0027] The adversarial alignment network consists of a probe discriminator and a semantic aligner. The probe discriminator identifies the source probes of the input cross-probe common semantic vector and outputs the probe source prediction probability distribution. The semantic aligner generates parameter adjustment gradients based on the probe source prediction probability distribution and performs semantic adjustment on the cross-probe common semantic vector. The parameters of the probe discriminator are updated by fixing the parameters of the semantic aligner to minimize the probe source discrimination loss. The parameters of the semantic aligner are updated by fixing the parameters of the probe discriminator to minimize the accuracy of the probe discriminator in identifying the source probes of the cross-probe common semantic vector. The probe discriminator and the semantic aligner are iteratively optimized alternately.

[0028] During the iterative optimization process, based on the semantic similarity between the local business category labels of several probes and the corresponding local business semantic vectors, a cross-probe business category correspondence is established. According to the cross-probe business category correspondence, intra-class convergence constraints are applied to cross-probe common semantic vectors belonging to the same business category to increase their cosine similarity, and inter-class distance constraints are applied to cross-probe common semantic vectors belonging to different business categories to increase their semantic distance, until the accuracy of the probe discriminator in judging the source probe of the cross-probe common semantic vector is lower than the preset discrimination lower limit, and the cross-probe semantically aligned cross-probe common semantic vector is obtained.

[0029] Anomaly detection includes multi-dimensional anomaly detection of cross-probe business operation links using anomaly detection models to detect deviations in business operation behavior. Multi-dimensional anomaly detection includes operation sequence timing anomaly detection, operation permission overrun detection, and sensitive data access pattern anomaly detection. When an abnormal operation is detected, a security monitoring alarm is output.

[0030] A machine learning-based security monitoring system employs the aforementioned machine learning-based security monitoring method. The security monitoring system includes: a data acquisition and session restoration module: under a distributed bypass deployment architecture of several probes, the system performs mirror acquisition and session restoration of business traffic through several probes to obtain business flow session data at several probes. Feature map construction and graph embedding learning module: Extract the minimum observable feature set at the business operation granularity from the business flow session data at several probes. Use the features in the minimum observable feature set as nodes and the relationships between features as edges to construct business operation feature maps at several probes. Perform graph embedding learning on the business operation feature maps at several probes through a graph attention network to obtain environment-independent business operation representation vectors at several probes. The cross-probe semantic alignment and link construction module performs cluster analysis on the environment-independent business operation representation vectors at several probes to obtain local business semantic vectors and local business category labels at several probes. Through a domain adaptive mapping network, the local business semantic vectors at several probes are mapped to a global common low-dimensional semantic space to obtain cross-probe common semantic vectors at several probes. Through an adversarial alignment network, the cross-probe common semantic vectors at several probes are aligned across probes. Based on the cross-probe common semantic vectors after alignment, the semantic distance between the cross-probe common semantic vectors at different probes is calculated. The business operations corresponding to the cross-probe common semantic vectors with semantic distance less than a preset threshold for the same business are judged as the same business entity. Based on the cross-probe business entity identity judgment results, the business operations at different probes that are judged as the same business entity are associated and mapped. The business operations observed by several probes after the association mapping are associated and integrated in chronological order to obtain the cross-probe business operation link. Anomaly detection module: Performs anomaly detection on cross-probe service operation links, and outputs security monitoring alarms when an anomaly operation is detected.

[0031] like Figure 1 As shown, in a distributed bypass deployment architecture with several probes, traffic mirroring data is obtained by bypassing the business network through each probe. Business flow session data is obtained through TCP flow reassembly and application layer protocol parsing. The minimum observable feature set is extracted from the session data and a business operation feature map is constructed. Graph embedding learning is performed through a graph attention network to obtain environment-independent business operation representation vectors. Density clustering analysis is performed on the representation vectors to obtain local business semantic vectors and category labels. Then, a domain adaptive mapping network is used to map the local semantics to a global common low-dimensional semantic space to obtain cross-probe common semantic vectors. Cross-probe semantic alignment is performed through an adversarial alignment network to make the semantic vectors of the same business operation at different probes tend to be consistent and the semantic vectors of different business operations are effectively separated. Based on the aligned semantic vectors, the semantic distance is calculated to determine the same business entity. The operations of the same business entity across probes are integrated into cross-probe business operation links according to time association. Finally, multi-dimensional anomaly detection is performed on the cross-probe business operation links to output security monitoring alarms.

[0032] Security monitoring refers to the real-time monitoring and anomaly detection of business operations completed across multiple network regions in a distributed business system. The monitoring content includes: whether the complete flow trajectory of business operations in the cross-domain network environment deviates from the normal behavior pattern, whether the time sequence of business operations conforms to the preset time sequence constraints, whether the permissions of the business operation subject match the sensitivity level of the object being operated, and whether the access behavior to sensitive data deviates from the normal spatiotemporal pattern distribution. Through the above multi-dimensional monitoring, complex cross-regional and cross-stage security threats that cannot be identified by single probe local observation can be identified.

[0033] Bypass deployment connects monitoring devices to the network in parallel. Service traffic does not pass directly through the monitoring devices; instead, a copy of the traffic is forwarded to the monitoring devices via the mirroring function provided by the switch. "Probe" is a specialized term in network security and monitoring, referring to an independent hardware or software node deployed in the network for data collection and detection tasks. A traffic mirroring port is a special port configuration supported by a switch that can completely copy traffic from a specified source port or VLAN to a mirror port for analysis by external devices without affecting the original traffic's forwarding path. TCP stream reassembly refers to the process of reordering and reassembling application layer data packets according to TCP sequence numbers to restore a complete application layer data stream, as TCP may segment application layer data into multiple packets during transmission, and these packets may arrive out of order due to network path differences. Application layer protocol parsing refers to extracting structured information such as protocol header fields, request methods, Uniform Resource Identifiers, status codes, and payload content from the reassembled TCP stream according to the standardized formats of application layer protocols such as HTTP, HTTPS, FTP, and SMTP.

[0034] In a distributed network architecture, business operations typically need to be completed across multiple network areas. For example, a user terminal's request may pass through multiple network nodes such as office area switches, branch office routers, and data center firewalls. A distributed bypass deployment architecture independently deploys probes in each network area, acquiring local observation data through traffic mirroring. The traffic data at each probe is then reconstructed from TCP streams to restore a complete TCP connection stream. This is followed by application layer protocol parsing to extract structured protocol information, ultimately forming business flow session data containing a complete request-response interaction sequence. This data serves as structured input for subsequent feature extraction at the business operation granularity. Through bypass deployment, probes acquire traffic data without affecting the normal operation of the business system; through TCP stream reconstructing and application layer protocol parsing, the original data packets are restored to business flow session data with complete semantics.

[0035] A business operation unit refers to a complete business interaction process, with the request-response interaction in the application layer protocol as the basic boundary. For example, an HTTP request and its corresponding HTTP response constitute a business operation unit. The minimum observable feature set refers to the smallest set of distinguishable features that can be extracted from network layer and application layer protocol data when relying only on network traffic mirroring data and not on internal interfaces of the business system in a bypass deployment scenario. Temporal correlation refers to the chronological order of features appearing in a business operation unit. For example, the request arrival time interval feature appears before the response time delay feature. Co-occurrence relationship is the association between two features appearing simultaneously in the same business operation unit. For example, the co-occurrence relationship between the appearance of a specific protocol field and the appearance of a specific request method type. Joint occurrence frequency refers to the ratio of the number of times two features appear simultaneously in the same business operation unit to the total number of business operation units within a statistical period.

[0036] In bypass deployment scenarios, traffic data at each probe is significantly affected by network environment factors. Packet length distribution may vary due to differences in path MTU (Maximum Transmission Unit), connection duration may vary due to differences in network round-trip latency, and protocol field content may vary due to middleware rewriting. This application transforms numerical features into graph structure representations: features are used as nodes to retain distinguishable information of business operations, temporal associations and co-occurrence relationships between features are used as edges to retain structural pattern information of business operations, and joint occurrence frequency is used as edge weights to quantify the stability of structural relationships. The core characteristic of graph structure representation is that the numerical attributes of the nodes themselves may fluctuate due to environmental changes, but the topological connections between nodes are invariant to local numerical changes, thereby achieving environment-independent representation of business operations.

[0037] like Figure 2As shown, graph embedding learning is the process of mapping nodes, edges, or the entire graph in graph structure data to a low-dimensional vector space, so that the structural similarity of the original graph is preserved in the vector space. Graph attention networks adaptively learn the importance weights between nodes through an attention mechanism, so that feature associations that contribute more to the distinguishability of business operations receive higher attention coefficients, while accidental associations caused by environmental noise receive lower attention coefficients. Multi-layer iterative aggregation makes the embedding representation of each node incorporate the structural information of multi-hop neighbors. Local numerical fluctuations are diluted in the multi-hop propagation process, and the global structural pattern is strengthened. The similarity measurement of graph embedding vectors is based on distance calculation in the vector space. Business operations with isomorphic graph structures are close in distance in the embedding space, thus achieving invariance to differences in the network environment. The core idea of ​​graph attention networks is to provide different neighbors with important weights when aggregating neighbor node information. Different weight coefficients are assigned so that neighbors more closely associated with the current node contribute more information. The attention coefficient is a normalized weight value that measures the strength of the association between the current node and a neighboring node. It is calculated through learnable parameters and satisfies the constraint that the sum of the attention coefficients of all neighboring nodes is 1. In the weighted aggregation, the attention coefficient is used as the weight to linearly weight and sum the feature vectors of neighboring nodes to obtain the updated feature representation of the current node. The graph embedding representation is the low-dimensional dense vector obtained by each node after iterative aggregation through a multi-layer graph attention network. This vector encodes the node's own attributes and the structural information of its multi-hop neighbors. Through multi-layer iterative aggregation, the multi-layer nonlinear transformation of the machine learning model makes the embedding representation of each node incorporate the structural information of multi-hop neighbors. Local numerical fluctuations are diluted in the multi-hop propagation process, and the global structural pattern is strengthened.

[0038] As a machine learning model, the graph attention network takes as input the business operation feature map (node ​​feature matrix and adjacency matrix) at each probe and outputs the low-dimensional graph embedding vector of each node. Its network parameters (including attention weight matrix and feature transformation matrix) are learned through end-to-end training. In the embedding space, nodes with similar graph structures are close to each other, while nodes with large differences in graph structure are far apart. The training process of this machine learning model is as follows: input the business operation feature map into the graph attention network, obtain the node embedding representation through forward propagation of the network, calculate the similarity loss of node pairs in the embedding space, update the network parameters through backpropagation algorithm, and iterate until convergence. The graph attention network adaptively learns the importance weights between nodes through machine learning.

[0039] Density clustering is an unsupervised machine learning algorithm for pattern discovery based on data density distribution. It divides high-density regions into clusters and treats low-density regions as noise or boundaries. As an unsupervised machine learning model, density clustering takes as input a set of environment-independent business operation representation vectors at each probe and outputs the clustered business clusters and cluster center vectors. The algorithm parameters (neighborhood radius, minimum number of samples) are adaptively determined based on the data distribution characteristics or set by preset empirical values. In density clustering, if there exists a sample sequence such that the distance between adjacent samples in the sequence does not exceed the preset neighborhood radius, and the neighborhood of each sample in the sequence contains no less than the preset minimum number of other samples, then the samples at the beginning and end of the sequence are density-reachable. A business cluster is a set of samples connected by density reachability relationships, corresponding to a business operation type. The local business semantic vector is the cluster center vector obtained by independent clustering at each probe, representing the semantic center of a certain business operation type within the local observation range of the probe. The local business category label is a cluster identifier independently assigned at each probe.

[0040] Each probe performs density clustering independently because the differences in network environment at different probes may cause the representation vector of the same business operation to show different numerical distribution ranges at different probes. As an unsupervised machine learning algorithm, density clustering does not require pre-specifying the number of clusters and can automatically discover business clusters of arbitrary shapes. By performing clustering analysis through density clustering algorithm based on machine learning, local business semantic vectors and local business category labels that reflect the local business patterns of each probe are obtained, providing a local semantic foundation for subsequent cross-probe semantic mapping.

[0041] The global common low-dimensional semantic space is a vector space with the same or lower dimension as the local semantic spaces of each probe. Serving as a unified coordinate system for cross-probe semantic comparison, the domain adaptive mapping network (DAN) is a supervised machine learning model based on neural networks. It learns the mapping relationship from the source domain (the local semantic spaces of each probe) to the target domain (the global common semantic space), aiming to minimize the distribution difference between the source and target domains. As a machine learning model, the DNA takes the local business semantic vectors of each probe as input and outputs the mapped cross-probe common semantic vector. Network parameters (including weight matrices and bias vectors at each layer) are learned through training. The cross-probe common semantic vector is the representation of the business semantics of each probe in the unified semantic space after transformation by the mapping function learned by the DNA. The local business semantic vectors of each probe reside in different vector spaces, and the physical meaning of their coordinate axes differs due to variations in the probe environment. The DNA learns a nonlinear mapping function through machine learning, ensuring that the mapped cross-probe common semantic vector maintains the relative relationship of the local semantic structure in the unified space. By optimizing the objective through machine learning, it minimizes the difference between the mapped distribution of each probe and the global distribution, achieving alignment of the cross-probe semantic space.

[0042] like Figure 3 As shown, the adversarial alignment network is a deep learning architecture based on the idea of ​​generative adversarial networks (GANs). It consists of two adversarial machine learning sub-networks. The probe discriminator is a multi-classification machine learning model based on a neural network. Its input is a cross-probe common semantic vector, and its output is the predicted probability distribution of the vector from each probe. Its optimization objective is to distinguish the source probe of the semantic vector as accurately as possible. The semantic aligner is a feature transformation machine learning model based on a neural network. Its input is a cross-probe common semantic vector, and its output is an adjusted semantic vector. Its optimization objective is to generate a semantic vector that the probe discriminator cannot distinguish from the source probe. Alternating iterative optimization refers to the optimization strategy in which the two machine learning sub-networks alternately update their parameters during training. The adversarial alignment network achieves this through... The adversarial game between two machine learning sub-networks drives the semantic aligner to learn and extract feature representations that are independent of the probe environment and only related to business semantics. During adversarial training, intra-class convergence constraints and inter-class divergence constraints are applied to ensure that semantic alignment maintains the distinguishability of business semantics while eliminating probe environment information. When the discriminator's accuracy in distinguishing the source probe is lower than the preset lower limit, it indicates that the probe environment information in the semantic vector has been sufficiently eliminated. By training the machine learning-based adversarial alignment network, cross-probe common semantic vectors after cross-probe semantic alignment are obtained, making the semantic vectors of the same business operation highly similar at different probes in the same space, effectively separating the semantic vectors of different business operations, and eliminating the impact of probe environment differences on semantic consistency.

[0043] The adversarial alignment network drives the semantic aligner to learn and extract feature representations that are independent of the probe environment and only relevant to business semantics through adversarial game between two machine learning sub-networks. During adversarial training, intra-class convergence constraints and inter-class divergence constraints are applied to ensure that semantic alignment maintains the discriminativeness of business semantics while eliminating probe environment information. When the accuracy of the probe discriminator in distinguishing source probes falls below a preset lower limit, it indicates that the probe environment information in the semantic vector has been sufficiently eliminated.

[0044] Semantic distance is a metric such as Euclidean distance or Manhattan distance between two semantic vectors in the cross-probe common semantic space. The same business threshold is a semantic distance threshold used to determine whether two business operations belong to the same business entity. The common semantic space after cross-probe semantic alignment has eliminated probe environment differences, and semantic distance only reflects the semantic similarity of the business operations themselves. The identity determination based on semantic distance is not affected by environmental factors such as probe deployment location, network topology, and protocol encapsulation. Based on the common semantic vectors after cross-probe semantic alignment, the identity of cross-probe business entities can be accurately determined, providing entity association basis for the construction of cross-probe business operation links.

[0045] Association mapping refers to establishing the correspondence between business operations identified as the same business entity at different probes. Association integration sorts the cross-probe business operations after association mapping according to their occurrence timestamps at each probe. The cross-probe business operation link is a complete behavioral trajectory formed by the sequential connection of the observed operations of the same business entity at multiple probes. In distributed business systems, the operational behavior of a single business entity is usually dispersed across multiple network areas. By determining the identity of the cross-probe business entity, the dispersed local fragments are associated as components of the same business entity. By integrating in chronological order, the complete flow trajectory of the business entity in the cross-domain network environment is restored. By constructing the cross-probe business operation link, the operational behavior of the same business entity dispersed at different probes is connected into a complete behavioral trajectory along the time dimension, providing a data foundation for security analysis based on a global behavioral view.

[0046] The anomaly detection model is a machine learning model trained on cross-probe business operation link data. It is used to identify operations that deviate from the normal business behavior pattern. In the operation sequence timing anomaly detection, the anomaly detection model is used to analyze whether the time sequence of each operation in the cross-probe business operation link conforms to the timing constraints of the normal business process. The operation subject's permissions and the sensitivity level of the operation object in the business operation link are compared to determine whether the operation exceeds the authorized scope. It also identifies whether the access frequency, access time, and access path of sensitive data deviate from the normal pattern.

[0047] Machine learning-based anomaly detection models can learn the pattern distribution of normal business behavior from a complete behavioral view of cross-probe business operation links and identify abnormal behaviors that deviate from the pattern. Operation sequence temporal anomaly detection utilizes the anomaly detection model to learn the temporal transition probability matrix of normal business processes and identify low-probability temporal transitions as temporal anomalies. Operation permission overreach detection utilizes the anomaly detection model to learn the joint probability distribution of operation subject-operation object-operation permission and identify low-probability permission combinations as overreach anomalies. Sensitive data access pattern anomaly detection utilizes the anomaly detection model to learn the spatiotemporal pattern distribution of sensitive data access and identify access behaviors that deviate from normal patterns. By performing multi-dimensional anomaly detection across cross-probe business operation links using machine learning-based anomaly detection models, it is possible to discover complex cross-regional and cross-stage security threats that cannot be identified by single-probe local observations, thereby improving the coverage and detection accuracy of security monitoring.

[0048] like Figure 4 and Figure 5As shown, the interface displays business traffic and reports alarm events in real time, with each alarm event accompanied by a corresponding event. It also provides statistics on these alarm events, aggregating key operational metrics of the distributed probe system: the online status of the three probes, the number of alarms that day, the business identification accuracy rate (93.6%), and the cumulative number of monitored sessions. The interface also uses visual charts to display the business traffic trend over the past 24 hours and the distribution ratio of the three types of alarms (time-sequence anomalies / permission violations / sensitive data access). Figure 5 The interface displays detailed descriptions of abnormal events and rates their severity to facilitate subsequent handling. It categorizes abnormal events into three types: operation sequence time-series anomalies (based on a time-series transition probability matrix), operation permission violations (based on a subject-object-permission joint probability distribution), and sensitive data access pattern anomalies (based on spatiotemporal pattern distribution learning). The top of the interface displays statistics on the number of unprocessed alarms and the cumulative detection volume of the three types of anomalies. The middle section shows the 24-hour alarm distribution using a bar chart and the F1 score optimization trend using a line chart. Below is a complete list of alarms, each containing a unique ID, anomaly type, risk level (critical / high / medium / low), processing status (unprocessed / processing / resolved), involved cross-probe business entities, timestamp, and source probe. It also supports filtering by type and level. Figure 6 As shown, the probe status is monitored in real time, displaying the real-time status (online / offline), IP address, runtime, bandwidth, packet rate, and other network parameters for each probe, as well as CPU / memory resource usage. Clicking on a probe card opens a details panel, including the activation status of six functional modules (TCP flow reassembly, protocol parsing, feature extraction, feature graph construction, GAT graph embedding, and density clustering analysis). The interface also provides a line chart of traffic collection trends for the three probes, a six-dimensional capability radar chart (identification accuracy, entity determination rate, processing speed, resource efficiency, stability, and synchronization accuracy), and a complete distributed bypass deployment architecture topology diagram from the business network to the data center switch and then to the three probes.

[0049] The control group experiment (traditional multi-probe independent modeling method) uses the traditional multi-probe independent modeling method, in which each probe independently extracts traffic statistical features (including numerical features such as average packet length, average packet arrival interval, and connection duration), identifies services through independent support vector machine classifiers, and then performs cross-probe association through simple feature vector cosine similarity.

[0050] The experimental environment was set up as follows: one probe was deployed in each of three network areas (office area, branch office, and data center) to simulate an enterprise distributed network environment. The three probes were labeled P1 (office area), P2 (branch office), and P3 (data center). Each probe bypassed the business network through the traffic mirroring port of the data center switch, collecting business traffic data for 30 consecutive days, covering five types of business operations: login, query, transfer, download, and upload, totaling approximately 12,847 business flow session data. Known types of anomalous operations were injected into the experimental data as test samples, including 126 instances of permission violations, 98 instances of timing-related anomalous operations, and 74 instances of anomalous access to sensitive data.

[0051] The specific implementation process of the control group is as follows: Each probe independently extracts traffic statistical feature vectors from the traffic mirroring data. Each business operation corresponds to a 6-dimensional feature vector (mean packet length, standard deviation of packet length, mean packet arrival interval, connection duration, request method type encoding, and mean HTTP status code). Each probe independently trains a support vector machine classifier to identify five types of business operations (login, query, transfer, download, and upload). The support vector machine uses the RBF kernel function, and the kernel parameters are optimized through grid search. In the cross-probe association stage, the same business entity is determined by calculating the cosine similarity of feature vectors at different probes. The cosine similarity threshold is set to 0.7. Based on the cross-probe association results, a business operation link is constructed, and anomaly detection is performed using a threshold-based rule method.

[0052] Comparative Experiment 1 (Cross-Probe Method Based on Deep Autoencoder) employs a cross-probe feature alignment method based on a deep autoencoder. Each probe independently extracts the same traffic statistics features as the control group, performs feature dimensionality reduction and alignment using a deep autoencoder, and then performs cross-probe association using the dimensionality-reduced features. The experimental environment is identical to the control group. The deep autoencoder uses a three-layer encoder and three-layer decoder structure, with an encoder output dimension of 64. During training, data from all three probes are used for joint training, and the loss function is the mean squared reconstruction error.

[0053] The specific implementation process of the comparative experiment is as follows: Each probe extracts the same 6-dimensional traffic statistics feature vector as the control group. The data of all probes are used to jointly train a deep autoencoder. The encoder compresses the 6-dimensional feature vector into a 64-dimensional hidden layer representation. Each probe obtains the 64-dimensional hidden layer representation through the trained encoder, which serves as the cross-probe semantic vector. The same business entity is determined by calculating the Euclidean distance between the hidden layer representations at different probes. The distance threshold is determined by the validation set. Based on the cross-probe association results, a business operation link is constructed and anomaly detection is performed.

[0054] Comparative Experiment 2 (Cross-Probe Method Based on Transfer Learning): Comparative Experiment 2 adopts a cross-probe method based on transfer learning, that is, one probe is used as the source domain and the other probes are used as the target domain. Domain adaptation is performed by minimizing the maximum mean difference. The experimental environment is the same as the control group. The transfer learning method adopts the domain adaptation framework based on the maximum mean difference. The kernel function is a Gaussian kernel. The kernel bandwidth parameter is determined by the median of the Euclidean distance between all sample pairs.

[0055] The specific implementation process of Comparative Experiment 2 is as follows: Each probe extracts the same 6-dimensional traffic statistics feature vector as the control group. Probe P1 is selected as the source domain, and probes P2 and P3 are selected as the target domains. A domain adaptation model based on the maximum mean difference is constructed. This model uses a three-layer fully connected network as the feature extractor, with hidden layer dimensions of 128 and 64, and an output dimension of 32. The activation function is a linear rectified unit. During training, the maximum mean difference of the feature distribution between the source domain and the target domain is minimized while maintaining the accuracy of the business classification task in the source domain. This achieves feature distribution alignment from the source domain to the target domain. The maximum mean difference is calculated by a kernel function (using a Gaussian kernel, with the kernel bandwidth parameter determined by the median heuristic method) to calculate the mean difference after feature mapping between the source domain and the target domain. This is used as the domain adaptation loss term and jointly optimized with the classification loss term. The weight coefficient is set to 0.3. After training, each probe obtains a 32-dimensional aligned feature vector through the shared feature extractor. This 32-dimensional aligned feature vector is used as the cross-probe semantic vector. The same business entity is determined by calculating the Euclidean distance between the aligned feature vectors at different probes. The distance threshold is determined to be 0.25 through the validation set. A business operation chain is constructed based on the cross-probe association results, and anomaly detection is performed using the same threshold rule method as the support vector machine classifier.

[0056] This application's first embodiment employs a machine learning-based security monitoring method provided in this application, tested under the same experimental environment as the control group. The experimental parameters for this application's first embodiment are set as follows: the graph attention network uses two graph attention layers, each with 8 attention heads, an embedding dimension of 128, a random inactivation rate of 0.2, a neighborhood radius parameter for the density clustering algorithm of 0.5, a minimum number of neighborhood samples of 5, a domain adaptive mapping network using a three-layer fully connected network, hidden layer dimensions of 128 and 64, an output dimension of 64, and a linear rectified unit activation function. In the adversarial alignment network, both the probe discriminator and semantic aligner use two-layer fully connected networks, with the discriminator output dimension of 3 (corresponding to three probes) and the semantic aligner output dimension of 64. The number of alternating iterations is set to 200 rounds, and the lower limit of discrimination is set to 0.4. The threshold for the same business is set to 0.3. The anomaly detection model adopts a multi-dimensional anomaly detection model based on isolated forest. The random inactivation rate refers to the probability parameter of a random inactivation regularization mechanism introduced by the graph attention network during training to prevent the model from over-memorizing the training data. The linear rectified unit refers to the nonlinear activation function used in each fully connected layer of the domain adaptive mapping network.

[0057] The specific implementation process of Embodiment 1 of this application is as follows: One probe is deployed in each of the three network areas: the office area, the branch office, and the data center. Each probe bypasses the business network through the traffic mirroring port of the data center switch, acquires traffic mirroring data, and performs TCP stream reassembly and application layer protocol parsing to obtain business flow session data containing a complete request-response interaction sequence. From the business flow session data at each probe, the smallest observable feature set is extracted at the granularity of business operation units, including the temporal structure features of request-response pairs (arrival time interval between adjacent requests, time delay between requests and responses, temporal pattern of response return sequence), and fixed occurrence pattern of protocol fields. The system utilizes features (frequency of occurrence of specific business identifier fields, distribution ratio of request method types, co-occurrence relationship of key HTTP header fields) and traffic statistics distribution features (distribution of packet length, connection duration, and transmission byte rate). Using each feature in the minimum observable feature set as a node, and the temporal correlation and co-occurrence relationship between features as edges, with joint occurrence frequency as edge weights, a business operation feature map is constructed at each probe. A graph embedding learning process is then performed on the business operation feature map at each probe using a graph attention network. For each current node, the attention coefficient between the current node and its neighboring nodes is calculated. Based on the attention coefficient, the feature representations of each neighboring node are further refined. Row-weighted aggregation is used to generate graph embedding representations, obtaining environment-independent business operation representation vectors at each probe. Based on these representation vectors, density-based clustering is used to cluster density-reachable representation vectors into the same business cluster. The cluster center vector serves as the local business semantic vector, and the cluster identifier serves as the local business category label. A domain-adaptive mapping network maps the local business semantic vectors of each probe to a global common low-dimensional semantic space, obtaining cross-probe common semantic vectors. An adversarial alignment network is used for cross-probe semantic alignment. After 200 rounds of alternating iterative optimization, the probe discriminator accurately identifies the source probes of the cross-probe common semantic vectors. The accuracy rate dropped to 38.2%, which is lower than the preset discrimination limit of 0.4. Cross-probe common semantic vectors after cross-probe semantic alignment were obtained. Based on the cross-probe common semantic vectors after cross-probe semantic alignment, the semantic distance between semantic vectors at different probes was calculated. Business operations with a semantic distance of less than 0.3 were judged as the same business entity. Based on the identity judgment result, business operations at different probes that were judged as the same business entity were associated and mapped and integrated in chronological order to construct a cross-probe business operation link. Multi-dimensional anomaly detection was performed on the cross-probe business operation link to detect anomalies in the timing of operation sequences, out-of-bounds operation permissions, and abnormal access patterns of sensitive data, and output security monitoring alarms.

[0058] Single-probe service identification accuracy refers to the proportion of times a machine learning model correctly classifies service operation types within the local observation range of a single probe. For example, if probe P1 collects 100 login service operations, and the machine learning model correctly identifies 94 of them as login services, then the single-probe service identification accuracy of P1 is 94%. The average single-probe service identification accuracy refers to the arithmetic mean of the individual single-probe service identification accuracies of all probes. Cross-probe service entity identity determination accuracy refers to the proportion of times the machine learning system correctly determines whether service operations at different probes belong to the same service entity in the joint analysis of multiple probes. For example, a login operation is observed at probes P1 and P3. If the machine learning system correctly determines that these two observations belong to the same login business entity, the determination is correct; if it is misjudged as two different business entities, the determination is incorrect. The false positive rate refers to the proportion of normal business operations that the security monitoring system incorrectly classifies as abnormal operations and outputs alarms. If the system misjudges a normal query operation as a timing anomaly and triggers an alarm, it constitutes a false positive. The false negative rate refers to the proportion of real abnormal operations that are not detected in the security monitoring system. If an actual permission violation occurs and the system fails to identify and output an alarm, it constitutes a false negative. The F1 score is a commonly used comprehensive evaluation index in machine learning, which is the harmonic mean of precision and recall. Precision refers to the proportion of real anomalies among all alarms output by the system, reflecting the credibility of the alarms; recall refers to the proportion of real anomalies that are successfully detected by the system, reflecting the completeness of the detection. The F1 score takes into account both precision and recall. When both are high, the F1 score approaches 1; when either is low, the F1 score drops significantly.

[0059] The comprehensive comparison of the four sets of experimental data is shown in Table 1: Table 1. Comprehensive Comparison of Four Groups of Experiments

[0060] As shown in Table 1, by introducing a graph attention network for environment-independent representation learning and an adversarial alignment network for cross-probe semantic alignment, the technical problem of difficulty in determining the identity of cross-probe business entities in a multi-probe distributed bypass deployment scenario is effectively solved, and the accuracy and robustness of security monitoring are significantly improved.

[0061] In single-probe service identification, the average accuracy of Example 1 was 93.6%, an improvement of 14.8 percentage points compared to the control group, 10.9 percentage points compared to the deep autoencoder method, and 7.6 percentage points compared to the transfer learning method. This is attributed to the graph attention network learning the topological relationship structure between features through the attention mechanism, effectively suppressing the impact of environmental noise on service identification.

[0062] In terms of cross-probe business entity identity determination, the accuracy of Example 1 is 91.5%, which is 30.3 percentage points higher than the control group, 18.7 percentage points higher than the deep autoencoder method, and 13.0 percentage points higher than the transfer learning method. This is due to the adversarial alignment network, which effectively eliminates the impact of probe environment differences on semantic consistency through the adversarial game between the probe discriminator and the semantic aligner.

[0063] In terms of overall security monitoring performance, Example 1 has a false alarm rate of 4.2%, a false negative rate of 3.8%, and an F1 score of 0.928, all of which are significantly better than the three comparison methods. The false alarm rate is 19.3 percentage points lower than the control group, the false negative rate is 14.9 percentage points lower than the control group, and the F1 score is 0.316 higher than the control group. This is due to the "local modeling - global constraint - iterative alignment" closed-loop machine learning architecture of this application, which realizes the collaborative optimization of local business modeling and global semantic alignment.

[0064] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended embodiments and their equivalents.

Claims

1. A security monitoring method based on machine learning, characterized in that, The security monitoring method includes: In a distributed bypass deployment architecture with multiple probes, mirroring and reconstructing service traffic using multiple probes to obtain service flow session data at multiple probes; extracting a minimum observable feature set from the service flow session data at the service operation granularity; constructing a service operation feature map at multiple probes using features in the minimum observable feature set as nodes and relationships between features as edges; performing graph embedding learning on the service operation feature map at multiple probes using a graph attention network to obtain environment-independent service operation representation vectors at multiple probes; performing cluster analysis on the environment-independent service operation representation vectors at multiple probes to obtain local service semantic vectors and local service category labels at multiple probes; and using a domain adaptive mapping network to map the local service semantic vectors at multiple probes... Mapping to a global common low-dimensional semantic space, cross-probe common semantic vectors are obtained at several probe locations. An adversarial alignment network is used to perform cross-probe semantic alignment on these common semantic vectors. Based on the aligned cross-probe common semantic vectors, the semantic distance between them is calculated. Business operations corresponding to cross-probe common semantic vectors with a semantic distance less than a preset threshold for determining the same business are identified as the same business entity. Based on the cross-probe business entity identity determination results, business operations at different probe locations identified as the same business entity are associated and mapped. The business operations observed by the associated and mapped probes are then integrated in chronological order to obtain a cross-probe business operation link. Anomaly detection is performed on the cross-probe business operation link, and a security monitoring alarm is output when an abnormal operation is detected.

2. The security monitoring method based on machine learning according to claim 1, characterized in that: Mirroring and reconstructing business traffic using multiple probes involves bypassing multiple probes to access the business network through the traffic mirroring port of a data center switch, obtaining traffic mirroring data at multiple probes, and performing TCP stream reassembly and application layer protocol parsing on the traffic mirroring data to obtain business flow session data containing a complete request-response interaction sequence at multiple probes. The relationships between features include the temporal relationships and co-occurrence relationships between features as edges, and the joint frequency of features in business operations as edge weights.

3. The security monitoring method based on machine learning according to claim 1, characterized in that: The features in the minimum observable feature set include the temporal structure features of request-response pairs, the fixed occurrence pattern features of protocol fields, and the traffic statistics distribution features. The temporal structure features of request-response pairs include the arrival time interval between adjacent requests, the time delay between requests and responses, and the temporal pattern of the response return sequence. The fixed occurrence pattern features of protocol fields include the frequency of occurrence of specific business identifier fields in protocol data units, the distribution ratio of request method types, and the co-occurrence relationship of key fields in HTTP headers. The traffic statistics distribution features include the distribution of packet length, the distribution of connection duration, and the distribution of transmission byte rate.

4. The security monitoring method based on machine learning according to claim 1, characterized in that: The graph embedding learning of the business operation feature map through the graph attention network includes the following steps: for each current node, the graph attention network calculates the attention coefficient between the current node and its neighboring nodes, and performs weighted aggregation of the feature representations of the neighboring nodes based on the attention coefficient to generate the graph embedding representation of the current node. The graph embedding representations of all nodes constitute the environment-independent business operation representation vectors at several probes.

5. A security monitoring method based on machine learning according to claim 1, characterized in that: Clustering analysis based on environment-independent business operation representation vectors includes performing clustering analysis on the environment-independent business operation representation vectors at several probes using a density clustering algorithm, aggregating density-reachable representation vectors into the same business cluster, using the cluster center vector as the local business semantic vector at several probes, and using the cluster identifier of the business cluster output by the density clustering algorithm as the local business category label at several probes.

6. The security monitoring method based on machine learning according to claim 1, characterized in that: The local business semantic vector represents the business semantics obtained by several probes independently modeling, and the cross-probe common semantic vector represents the business semantics of several probes in a unified semantic space after global mapping.

7. A security monitoring method based on machine learning according to claim 6, characterized in that: The adversarial alignment network includes a probe discriminator and a semantic aligner. The probe discriminator identifies the source probes of the input cross-probe common semantic vector and outputs a probe source prediction probability distribution. The semantic aligner generates parameter adjustment gradients based on the probe source prediction probability distribution and performs semantic adjustment on the cross-probe common semantic vector. The parameters of the probe discriminator are updated by fixing the parameters of the semantic aligner to minimize the probe source discrimination loss. The parameters of the semantic aligner are updated by fixing the parameters of the probe discriminator to minimize the accuracy of the probe discriminator in identifying the source probes of the cross-probe common semantic vector. The probe discriminator and the semantic aligner are iteratively optimized alternately.

8. The security monitoring method based on machine learning according to claim 7, characterized in that: During the alternating iterative optimization process, based on the semantic similarity between the local business category labels of several probes and the corresponding local business semantic vectors, a cross-probe business category correspondence is established. According to the cross-probe business category correspondence, intra-class convergence constraints are applied to cross-probe common semantic vectors belonging to the same business category to increase their cosine similarity, and inter-class distance constraints are applied to cross-probe common semantic vectors belonging to different business categories to increase their semantic distance, until the accuracy of the probe discriminator in identifying the source probe of the cross-probe common semantic vector is lower than a preset discrimination lower limit, thus obtaining the cross-probe semantically aligned cross-probe common semantic vector.

9. A security monitoring method based on machine learning according to claim 1, characterized in that: The anomaly detection includes multi-dimensional anomaly detection of the cross-probe business operation link through an anomaly detection model used to detect deviations in business operation behavior. The multi-dimensional anomaly detection includes operation sequence timing anomaly detection, operation permission overrun detection, and sensitive data access pattern anomaly detection. When an abnormal operation is detected, a security monitoring alarm is output.

10. A security monitoring system based on machine learning, employing a security monitoring method based on machine learning as described in any one of claims 1-9, characterized in that: The security monitoring system includes: a data acquisition and session restoration module: under a distributed bypass deployment architecture of several probes, the system performs mirror acquisition and session restoration of business traffic through several probes to obtain business flow session data at several probes; Feature map construction and graph embedding learning module: Extract the minimum observable feature set from the business flow session data at several probes according to the granularity of business operations. Use the features in the minimum observable feature set as nodes and the correlation between features as edges to construct business operation feature maps at several probes. Perform graph embedding learning on the business operation feature maps at several probes through a graph attention network to obtain environment-independent business operation representation vectors at several probes. The cross-probe semantic alignment and link construction module performs cluster analysis on the environment-independent business operation representation vectors at several probes to obtain local business semantic vectors and local business category labels at several probes. It then maps these local business semantic vectors to a global common low-dimensional semantic space using a domain adaptive mapping network to obtain cross-probe common semantic vectors at several probes. An adversarial alignment network is then used to perform cross-probe semantic alignment on these cross-probe common semantic vectors. Based on the cross-probe common semantic vectors after alignment, the semantic distance between cross-probe common semantic vectors at different probes is calculated. Business operations corresponding to cross-probe common semantic vectors with semantic distances less than a preset threshold for determining the same business are identified as the same business entity. Based on the cross-probe business entity identity determination results, business operations at different probes identified as the same business entity are associated and mapped. Finally, the business operations observed by several probes after the association mapping are integrated in chronological order to obtain the cross-probe business operation link. Anomaly detection module: performs anomaly detection on the cross-probe service operation link, and outputs a security monitoring alarm when an anomaly operation is detected.

Images