An internal threat behavior detection method based on time-aware behavior evolution graph

Abstract

This invention relates to the field of insider threat detection technology, specifically to an insider threat behavior detection method based on a time-aware behavior evolution graph. The method involves acquiring and preprocessing user system behavior logs, dividing them into training and testing sets; dividing each long-cycle user behavior sequence into continuous time segments; learning time awareness on the training set to extract time-weighted key behavior patterns; constructing a behavior evolution graph by using the sequential connections between behavior patterns in adjacent time segments as edges in the graph; inputting the behavior evolution graph into a graph attention network to learn graph representations of the nodes and their transition relationships; and inputting the graph representation features into a classifier to output normal or abnormal insider threat detection results. This method can simultaneously characterize key behavior patterns, time-stage differences, and behavior transition links, effectively solving the problem that existing methods struggle to identify long-cycle insider threat evolution processes, and improving the accuracy and interpretability of insider threat detection.

Description

Technical Field

[0001] This invention relates to the field of insider threat detection technology, and in particular to an insider threat behavior detection method based on a time-aware behavior evolution graph. Background Technology

[0002] With the continuous advancement of digitalization, insider threats have gradually become a significant risk to information security management. Insider threats refer to the actions of internal users with legitimate access rights that pose a potential threat to information systems, data assets, or business operations during operations such as login, device use, file access, network access, and email communication. They are often hidden within a large number of legitimate daily operations, and traditional detection methods have significant limitations in identifying covert attacks disguised by legitimate identities. Early methods mostly employed statistical analysis or traditional machine learning methods, aggregating behavioral logs over fixed time periods into feature vectors for classification. While these methods are straightforward, they rely on manually constructed features and have weak generalization capabilities when facing complex and covert attack scenarios. In real-world insider threat scenarios, abnormal features are usually not limited to discrete abnormal operations at a single point in time, but rather manifest as a series of seemingly normal behavioral patterns evolving gradually and interconnected over time.

[0003] Therefore, existing methods generally have the following shortcomings: First, it is difficult to extract key behavioral patterns with discriminative value from long-term behavioral logs; second, it is difficult to fully characterize the dynamic evolution relationship between different behavioral patterns; and third, it is difficult to accurately identify the truly critical behavioral nodes and high-risk links for threat identification, resulting in high false positive and false negative rates. Summary of the Invention

[0004] The purpose of this invention is to provide an internal threat behavior detection method based on a time-aware behavior evolution graph, which aims to solve the problem that existing methods are difficult to identify long-term internal threat evolution processes.

[0005] To achieve the above objectives, this invention provides an internal threat behavior detection method based on a time-aware behavior evolution graph, comprising the following steps:

[0006] Acquire and preprocess user system behavior logs, and clean, format-align, feature-encode and standardize the raw log data, and divide it into training set and test set;

[0007] Each long-cycle user behavior sequence is divided into continuous time segments based on a preset time granularity.

[0008] Time awareness is learned on the training set to extract key behavioral patterns with time weights.

[0009] Using the aforementioned time perception as nodes, and the sequential connection relationship between behavioral patterns in adjacent time periods as edges in the graph, a behavioral evolution graph is constructed.

[0010] The behavior evolution graph is input into a graph attention network, and graph representation learning is performed on the nodes in the graph and their transition relationships to obtain graph representation features;

[0011] The graphical representation features are input into a classifier, which outputs either a normal or abnormal internal threat detection result.

[0012] The original logs are derived from the CERT multi-source log dataset, which includes various user operation records such as login behavior, email behavior, file operation behavior, and HTTP access behavior.

[0013] The time perception refers to a representative subsequence in a time series that has the ability to distinguish categories.

[0014] The evolution graph is a directed weighted graph, where nodes represent key behavioral patterns and edge weights represent the probability that a certain behavioral pattern is followed by another behavioral pattern.

[0015] The classifier uses XGBoost, which first performs graph-level aggregation on the graph representation to obtain the overall risk features, and then the classifier completes the internal threat behavior discrimination and outputs the detection results.

[0016] This invention discloses an internal threat behavior detection method based on a time-aware behavior evolution graph. The method acquires and preprocesses user system behavior logs, cleaning, formatting, encoding features, and standardizing the raw log data, and dividing it into training and testing sets. Each long-cycle user behavior sequence is divided into continuous time segments based on a preset time granularity. Time awareness is learned on the training set to extract key behavior patterns with time weights. Using the time awareness as nodes, the sequential connection relationships between behavior patterns in adjacent time periods are used as edges in the graph to construct a behavior evolution graph. The behavior evolution graph is input into a graph attention network to learn graph representations of the nodes and their transition relationships, obtaining graph representation features. These graph representation features are then input into a classifier to output normal or abnormal internal threat detection results. This method can simultaneously characterize key behavior patterns, time stage differences, and behavior transition links, effectively solving the problem that existing methods struggle to identify long-cycle internal threat evolution processes, and improving the accuracy and interpretability of internal threat detection.

[0017] Compared with existing technologies, this invention uses a time-aware shapelet to extract key behavioral patterns that reflect the characteristics of different time periods from long-term user behavior logs. While compressing redundant information in the original logs, it retains the stage differences and time attributes of the behavioral patterns, thereby improving the expressive power of key behavioral patterns. Furthermore, this invention constructs a behavioral evolution graph by using key behavioral patterns as graph nodes and pattern transition relationships in adjacent time stages as graph edges. This transforms the original linear behavioral sequence into a structured graph representation that can explicitly express the correlation and evolution path of behavioral patterns, thus more completely depicting the potential risk links in the formation process of internal threats. On this basis, a graph attention network is used to perform weighted learning on the nodes and their transition relationships in the behavioral evolution graph, automatically highlighting more critical behavioral nodes and high-risk links for threat identification, reducing the interference of irrelevant routine behaviors, thereby improving detection accuracy and enhancing the interpretability of results. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0019] Figure 1 This is a flowchart of an internal threat behavior detection method based on a time-aware behavior evolution graph provided by the present invention.

[0020] Figure 2 This is a schematic diagram of the architecture of an internal threat behavior detection method based on a time-aware behavior evolution graph.

[0021] Figure 3 This is a schematic diagram of the time-aware Shapelet extraction process.

[0022] Figure 4 This is a schematic diagram of the behavioral evolution diagram construction process.

[0023] Figure 5 This is a schematic diagram of the network architecture of the attention module.

[0024] Figure 6 This is a graph showing the change in F1 value under different time segment lengths.

[0025] Figure 7 The number of different Shapelets The F1 value variation curve is shown below.

[0026] Figure 8 This is a graph showing the change in F1-score under different plotting thresholds p.

[0027] Figure 9 This is a performance comparison chart of different methods. Detailed Implementation

[0028] The embodiments of the present invention are described in detail below. Examples of the embodiments are shown in the accompanying drawings. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, but should not be construed as limiting the present invention.

[0029] Please see Figures 1 to 9 This invention provides a method for detecting internal threat behaviors based on a time-aware behavior evolution graph, comprising the following steps:

[0030] S1 acquires and preprocesses user system behavior logs, and cleans, formats, encodes, and standardizes the raw log data, and divides it into training and test sets.

[0031] In this embodiment of the invention, multi-source user behavior logs in the information system are collected, and the raw log data is cleaned, formatted, feature-encoded, and standardized to ensure data integrity and consistency. The user behavior log sequences are then divided into training and testing sets to provide a data foundation for subsequent model training and performance evaluation.

[0032] The original logs are derived from the CERT multi-source log dataset, which includes various user operation records such as login behavior, email behavior, file operation behavior, and HTTP access behavior. The logs are then aggregated according to a uniform time granularity to form a behavior sequence input of uniform length.

[0033] Specifically, the first step is to acquire user system behavior log data and preprocess the raw data. The preprocessing process includes log format alignment, behavioral feature encoding, feature standardization, time aggregation, and input alignment. The experiment used 18 months of behavioral records from 1000 employees and attack behaviors from 70 malicious insiders. Log types included logon, device, file, http, email, psychometric, and LDAP, which could describe insider behavior from multiple dimensions such as login, device connection, file operations, web page access, email communication, and user attributes. The logs can be integrated into a unified behavioral sequence, then the operation order within a short time frame is retained using hours as the basic unit, and aggregated at the daily time granularity to form daily behavioral features, ultimately forming a model input feature tensor with a unified shape.

[0034] Processing procedure:

[0035] Set user The original log sequence is:

[0036]

[0037] in, Indicates the first A log entry, in its physical sense, represents a system operation performed by a user at a specific moment. Each log entry must contain at least the user identifier, timestamp, operation type, and operation target.

[0038] First, field alignment and invalid record removal are performed on logs from different sources. Then, each log entry is mapped to a behavioral feature vector:

[0039]

[0040] in, This represents a behavioral encoding function, whose purpose is to convert discrete log fields into a numerical vector of uniform dimensions. Numerical representations of behavioral events are used. Five core behavioral log categories—device, logon, email, file, and HTTP—are uniformly encoded, and user device affiliation is considered to differentiate between three operating environments: "personal primary computer," "shared computer," and "other computer." This ensures that the same behavior has different semantic representations in different device environments. Ultimately, a standardized user behavior sequence is obtained:

[0041]

[0042] Long-period behavior sequences are divided according to a preset time granularity or segment length. A continuous time segment:

[0043]

[0044] in:

[0045]

[0046] Indicates the first A time segment, This indicates the segment length. Physically, it means breaking down a user's long, continuous operation into several phased behavioral units, ensuring that each segment contains both local behavioral context and retains temporal phase differences.

[0047] This step is not a simple truncation, but rather provides staged input for subsequent time-aware shapelets. If the segment is too short, the behavioral context contained in a single segment is insufficient, and key patterns are easily over-segmented; if the segment is too long, the behavioral differences between different stages will be compressed, and the details of behavioral evolution are easily obscured. Variations in the length of the time segment cause the model performance to show an upward trend followed by a downward trend, indicating that an appropriate segment length helps to achieve a balance between local behavioral expression and global evolutionary relationships.

[0048] S2 divides each long-cycle user behavior sequence into continuous time segments based on a preset time granularity;

[0049] In this embodiment of the invention, each long-cycle user behavior sequence is divided into several continuous time segments according to a preset time granularity, transforming the original log sequence into staged behavior segments that can be used for key pattern learning. This division method allows for the simultaneous preservation of local behavioral features and staged change information during long-cycle behavior modeling, providing a foundation for subsequent key behavior pattern extraction.

[0050] S3 learns time awareness on the training set and extracts key behavioral patterns with time weights.

[0051] In this embodiment of the invention, a time-aware shapelet is learned on a training set to obtain key behavioral patterns and their time weights that can characterize behavioral features at different times. This module not only focuses on the local features of the behavioral segments themselves, but also considers their differences in importance at different time stages, so that the extracted key patterns can reflect both typical behavioral features and the changing characteristics of different periods. Through this step, the model can extract more representative and discriminative key behavioral patterns from the original discrete logs.

[0052] Specifically, a time-aware shapelet is learned on the training set to obtain key behavioral patterns and their corresponding time weights that can characterize behavioral features at different times. This step is used to mine key patterns with discriminative capabilities from long-term behavioral sequences, providing a node foundation for subsequent graph construction.

[0053] The input is a set of action segments from the training set:

[0054]

[0055] Shapelets represent representative subsequences in a time series that possess categorical discrimination capabilities. In this invention, shapelets are not used merely as ordinary local segments, but rather, local and global time factors are introduced to form time-aware shapelets.

[0056] First, candidate subsequences are extracted from the behavior sequence:

[0057]

[0058] in, Indicates candidate Shapelet, Indicates the starting position. Indicates the length of the subsequence. It represents a continuous pattern of user behavior, such as a segment of local operations consisting of consecutive logins, device connections, file access, and web page access.

[0059] Traditional Shapelet primarily evaluates its discriminative ability based on the distance difference between positive and negative samples and candidate subsequences.

[0060]

[0061] in, This represents the set of distances from threat samples to candidate Shapelets. This represents the set of distances from normal samples to candidate Shapelets. This represents a measure of the difference in distance distribution. The function of this expression is to determine whether the candidate fragment can distinguish between normal and threatening behavior.

[0062] To express the importance of different locations within a behavioral pattern, a local time factor is introduced. Let Shapelet... With time segment The alignment path between them is:

[0063]

[0064] in, Indicates the first element in Shapelet The position and time segment of the first Alignment of positions Indicates the length of the alignment path.

[0065] Define local weighted distance:

[0066]

[0067] in, Indicates the innermost element of Shapelet The importance weight of each behavioral position; This represents the difference between two behavioral features. The meaning of this formula is that when calculating the similarity of behavioral segments, different local behavioral actions contribute differently to threat identification, and the behavioral location with the larger weight has a greater impact on the final matching result.

[0068] By further introducing a global time factor, we obtain the time-aware distance:

[0069]

[0070] in, Indicates the first The global time weight of each time segment. This weight refers to the fact that the risk implications of the same behavioral pattern may differ when it occurs at different time stages. For example, a certain type of file access behavior may have a lower risk during normal office work periods, but may have a higher threat indication when it occurs consecutively during abnormal time periods.

[0071] To obtain a Shapelet with discriminative capabilities that does not overly rely on individual time points, an optimization objective is constructed:

[0072]

[0073] in, This represents the classification loss, which aims to make the learned Shapelet better able to distinguish between normal and threatening behaviors. and This represents the regularization coefficient, used to constrain the scale of local and global time factors, preventing the model from depending on only a few local locations or a few time stages.

[0074] The output is a collection of time-aware Shapelets:

[0075]

[0076] and the corresponding local time weights and global time weights This refers to the key behavioral patterns and their temporal importance information extracted from long-term behavioral logs. This module can compress redundant information from the original logs while preserving the phased differences and temporal attributes of behavioral patterns, providing a more compact and discriminative representation of pattern nodes for subsequent construction of behavioral evolution graphs. For example... Figure 3 As shown.

[0077] S4 uses the time perception as a node and the sequential connection relationship between behavioral patterns in adjacent time periods as edges in the graph to construct a behavioral evolution graph;

[0078] In this embodiment of the invention, the behavioral evolution graph is a directed weighted graph, where nodes represent key behavioral patterns and edge weights represent the probability that one behavioral pattern is followed by another. In this way, the original linear behavioral sequence is transformed into a structured graph representation that explicitly expresses the correlation and evolutionary path of behavioral patterns, which can more completely depict the formation process of the internal threat behavioral chain.

[0079] Specifically, based on the matching relationship between Shapelets and time segments, as well as the transition relationship between adjacent segments, a user behavior evolution graph and its adjacency matrix and node feature representation are constructed. This behavior evolution graph is a directed weighted graph, where nodes correspond to time-aware Shapelets, edges describe the transition process from one behavior pattern to another, and edge weights represent the probability of following. Using this graph structure, the original linear logs can be explicitly transformed into a structured behavior evolution representation.

[0080] The input is the time-aware shapelet set obtained in the previous step. Time factor , and collection of user behavior fragments .

[0081] First, map each time-aware Shapelet as a graph node:

[0082]

[0083] in, correspond .node The physical meaning of it is a key behavioral pattern in a user behavior sequence.

[0084] Then, calculate the first... The first time segment and the first Match strength between key behavioral patterns:

[0085]

[0086] in, Indicates time slice With key behavioral patterns The degree of matching. The smaller the distance, the stronger the match, indicating that the time segment is closer to the key behavioral pattern. Indicates the first The set of distances between a time segment and its candidate Shapelet set. Represents a time-aware Shapelet With fragments The weighted distance between them. The higher the probability, the stronger the current Shapelet's ability to represent that time segment.

[0087] Next, the pattern transition relationships between adjacent time segments are statistically analyzed. If the... The main matching nodes of each segment , No. The main matching nodes of each segment Then a directed edge is formed:

[0088]

[0089] This refers to the user's behavior state from key behavior patterns. Evolution to key behavioral patterns .

[0090] Further calculate the edge weights:

[0091]

[0092] in, Represents a node To the festival The transfer strength of a point refers to the degree of correlation between two key behavioral patterns that occur consecutively in adjacent time periods. If The larger the value, the more likely it is to indicate a behavioral pattern. Shift to behavioral patterns The more obvious the phenomenon, the better.

[0093] Normalize the edge weights to obtain the elements of the adjacency matrix:

[0094]

[0095] in, This indicates the next stage under the condition that the current behavior pattern is . Shift to behavioral model The relative strength of the expression. This value can be understood as the probability of behavioral state transition or the relative connection strength.

[0096] The final behavioral evolution diagram is as follows:

[0097]

[0098] in, Represents the set of key behavioral nodes. This represents the set of behavior transition edges.

[0099] The output is a user behavior evolution graph. This transforms a user's original one-dimensional linear log sequence into a structured representation that includes key behavioral states and state transition paths. Through this structure, the model can explicitly describe how multiple seemingly normal behavioral patterns gradually connect and form a potential threat chain. The process is as follows... Figure 4 As shown.

[0100] S5 inputs the behavior evolution graph into a graph attention network, performs graph representation learning on the nodes in the graph and their transition relationships, and obtains graph representation features;

[0101] In this embodiment of the invention, a graph attention mechanism automatically highlights behavioral nodes and high-risk links that are more critical for threat identification, while weakening the influence of irrelevant or weakly related information, thereby obtaining a more discriminative graph structure representation feature. This step not only improves the accuracy of internal threat detection but also enhances the interpretability of the detection results.

[0102] Specifically, the constructed behavior evolution graph is input into the multi-head graph attention network (GAT) for graph representation learning, which automatically highlights the behavioral nodes and their transition relationships that are more critical to threat discrimination, generating graph feature representations with greater discriminative power.

[0103] Let the nodes in the behavioral evolution graph be... The input features are ,in This represents the input feature dimension. First, it is achieved through a shared linear transformation matrix. Mapping node features to a new feature space yields:

[0104]

[0105] in, , This represents the transformed feature dimension. After the linear mapping, GAT computes the node's attention function. Its neighboring nodes The unnormalized correlation coefficient between them. This correlation coefficient is expressed as:

[0106]

[0107] in, For learnable attention vectors, This represents a vector concatenation operation. Used to measure neighboring nodes For nodes The importance of nodes. Since not all nodes in the behavioral evolution graph are directly related to the current node, only the nodes... neighborhood range The attention is calculated internally, and the correlation coefficient is normalized using the softmax function to obtain the attention weights.

[0108]

[0109] In the formula, Represents a node At the node The relative importance weights within the neighborhood are used. A larger weight indicates a stronger influence of the behavioral pattern and its transition relationships on updating the current node's representation. Subsequently, the features of nodes within the neighborhood are weighted and aggregated to obtain the node... The output representation is:

[0110]

[0111] in, Let represent a nonlinear activation function. Through equation (23), when updating its own representation, a node no longer simply aggregates neighbor information on an average basis, but selectively absorbs more important neighborhood features according to attention weights. This means that the model can automatically highlight more risky behavioral patterns and their transition relationships in the behavioral evolution graph, thereby more effectively identifying potential threat links.

[0112] To enhance the model's stability and expressive power, GAT employs a multi-head attention mechanism, which learns multiple attention heads and then concatenates or averages them. The advantage of this multi-head mechanism is that it improves model training stability and enhances feature representation. The multi-head attention outputs of the intermediate hidden layers are concatenated:

[0113]

[0114] in, Indicates the number of heads of attention. and They represent the first Each attention head corresponds to an attention weight and a linear transformation matrix. Eight attention heads are used in this invention. For the output layer, the results from multiple attention heads are typically fused using an averaging method to obtain a smoother final representation.

[0115]

[0116] Nodes represent sets as The information transmission process in a graph attention network is as follows: Figure 5 As shown.

[0117] S6 inputs the graphical representation features into the classifier and outputs the internal threat detection results as normal or abnormal.

[0118] In this embodiment of the invention, after graph representation learning is completed, the obtained graph structure representation features are input into a classifier for final discrimination to output a normal or abnormal detection result. By combining key behavior pattern extraction, behavior evolution graph representation, and graph attention learning, this invention completes the classification and identification of internal threat behaviors. Its method architecture is as follows: Figure 2 As shown.

[0119] Specifically, the graph representation extracted by GAT is input into the XGBoost classifier to complete the final classification and judgment of internal threat behavior, and output the detection results of normal or abnormal.

[0120] The input is the set of node representations output from the previous step. .

[0121] First, perform graph-level aggregation on all node representations:

[0122]

[0123] in, It can be average pooling, max pooling, or splicing aggregation; It represents the graph-level features of the entire user behavior evolution diagram, meaning the overall risk expression formed by the user's long-term behavior patterns and their transition relationships.

[0124] Then, the graph-level features are input into the classifier:

[0125]

[0126] in, This represents the trained classifier. In this implementation, the classifier is an XGBoost classifier. This indicates the detection result. 0 indicates that the user behavior sequence is judged as normal behavior; 1 indicates that the user behavior sequence is judged as insider threat behavior.

[0127] To better understand this technical solution, the following embodiments are provided for further illustration:

[0128] The examples analyze the experiments from three dimensions: experiments with different parameter selections, ablation experiments, and comparative experiments.

[0129] (1) Experiment on the selection of time segment length

[0130] In the time slice length experiment, the model performance initially increased and then decreased with the change in time slice length. When the slice length gradually increased from 14 to 28, the F1 score continuously improved, reaching 0.9630; however, performance decreased as the slice length continued to increase. This result indicates that excessively short time slices lead to over-segmentation of behavioral patterns, while excessively long time slices mask fine-grained details of behavioral evolution. A moderate time slice length better balances the representation of local behaviors and the characterization of global evolutionary relationships. Therefore, in this invention, 28 is used as the time slice length.

[0131] (2) Number of Shapelets Size selection experiment

[0132] In the experiment on the number of Shapelets, the model performance initially increased and then decreased as the number of Shapelets increased. Too few Shapelets lead to insufficient coverage of key behavioral patterns, while too many introduce redundant patterns and noisy nodes, increasing the complexity of the behavioral evolution graph and interfering with subsequent graph structure learning. This experiment demonstrates that a balance needs to be struck between the number of key behavioral patterns and the complexity of the graph structure. Therefore, in this invention, 75 is used as the number of Shapelets.

[0133] (3) Percentile threshold during graph construction Size selection experiment

[0134] Percentile threshold during graph construction In the selected experiments, the model performance also showed a trend of first increasing and then decreasing with the change of the mapping threshold. When the percentile threshold... As the value was gradually increased from 60 to 80, the model's F1-score continued to improve, and... The model achieves optimal performance when the threshold is set to 95; however, performance begins to decline as the threshold increases further to 95. This indicates that a low threshold retains too many weakly related edges in the behavior evolution graph. While this covers more behavior pattern transitions, it also introduces redundant and noisy edges, making the graph overly dense and interfering with subsequent GAT learning of key behavior chains. As the threshold is appropriately increased, weakly related transitions are gradually eliminated, while the main behavior evolution paths are preserved, resulting in a clearer graph structure and improved detection performance. However, when the threshold is too high, only a few high-intensity transition edges are retained in the behavior evolution graph, and some medium-intensity behavior transitions with discriminative value are also deleted, leading to an overly sparse graph structure and weakening the model's ability to represent complete internal threat behavior chains. This experiment demonstrates that a moderate percentile threshold is crucial. This invention achieves a balance between "preserving effective behavior transfer relationships" and "suppressing noise and side interference," thereby constructing a behavior evolution graph more suitable for graph attention network learning. Therefore, in its specific implementation, this invention uses 80 as the percentile threshold. size.

[0135] (4) Ablation test

[0136] Meanwhile, to further analyze the impact of each component module on the overall internal threat detection performance, an ablation experiment of the model components was designed. The proposed internal threat detection method mainly includes three key steps: time-aware shapelet extraction, behavior evolution graph construction, and graph attention learning. The experimental results are shown in Table 1.

[0137] Table 1. Impact of each component on performance in the model.

[0138]

[0139] The above experiments show that: after removing the time-aware mechanism, the F1-score decreased from 0.9630 to 0.8889, proving that time weights can enhance the ability to distinguish key behavioral patterns; after removing the behavioral evolution graph, the F1-score decreased to 0.8462, proving that relying solely on isolated key behavioral patterns is insufficient to characterize the threat formation process; after removing GAT, the F1-score decreased to 0.9231, proving that the attention mechanism can further distinguish the importance of different behavioral nodes and transition relationships.

[0140] (5) Comparative experiments with similar methods

[0141] To further verify the effectiveness of the proposed method in internal threat detection, five representative methods—LSTM-FCN, ModernTCN, GCN, XGBoost, and RCNN—were selected for comparative experiments. XGBoost represents a traditional machine learning method, LSTM-FCN, ModernTCN, and RCNN represent temporal modeling methods, and GCN represents a graph structure learning method. By comparing with these methods, the comprehensive advantages of the proposed method in internal threat behavior detection can be verified from different perspectives. The experimental results for each method are as follows: Figure 9 As shown.

[0142] The above-disclosed embodiments are merely preferred embodiments of an internal threat behavior detection method based on a time-aware behavior evolution graph, and should not be construed as limiting the scope of this application. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of this application still fall within the scope of this application.

Claims

1. A method for detecting internal threat behaviors based on a time-aware behavioral evolution graph, characterized in that, Includes the following steps: Acquire and preprocess user system behavior logs, and clean, format-align, feature-encode and standardize the raw log data, and divide it into training set and test set; Each long-cycle user behavior sequence is divided into continuous time segments based on a preset time granularity. Time awareness is learned on the training set to extract key behavioral patterns with time weights. Using the aforementioned time perception as nodes, and the sequential connection relationship between behavioral patterns in adjacent time periods as edges in the graph, a behavioral evolution graph is constructed. The behavior evolution graph is input into a graph attention network, and graph representation learning is performed on the nodes in the graph and their transition relationships to obtain graph representation features; The graphical representation features are input into a classifier, which outputs either a normal or abnormal internal threat detection result.

2. The internal threat behavior detection method based on time-aware behavioral evolution graph as described in claim 1, characterized in that, The original logs are derived from the CERT multi-source log dataset, which contains various user operation records, including login behavior, email behavior, file operation behavior, and HTTP access behavior.

3. The internal threat behavior detection method based on time-aware behavioral evolution graphs as described in claim 1, characterized in that, The time perception refers to a representative subsequence in a time series that has the ability to distinguish categories.

4. The internal threat behavior detection method based on time-aware behavioral evolution graph as described in claim 1, characterized in that, The evolution graph is a directed weighted graph, where nodes represent key behavioral patterns and edge weights represent the probability that a certain behavioral pattern is followed by another behavioral pattern.

5. The internal threat behavior detection method based on time-aware behavioral evolution graph as described in claim 1, characterized in that, The classifier uses XGBoost, which first performs graph-level aggregation on the graph representation to obtain the overall risk features, and then the classifier completes the internal threat behavior discrimination and outputs the detection results.

Images