Anomaly detection method and related device

Abstract

The application discloses an abnormality detection method and related equipment, and relates to the technical field of data processing, and comprises the following steps: in response to an abnormality detection instruction, obtaining multi-source log data corresponding to a decryption behavior, performing a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set, performing two-stage abnormality detection based on a preset dynamic threshold set and the fusion feature set to obtain an abnormality detection result, the preset dynamic threshold set is constructed based on a behavior baseline, and the behavior baseline is constructed based on historical decryption behavior data. Based on the historical decryption behavior, the behavior baseline is constructed from multiple dimensions, the dynamic threshold set is generated based on the behavior baseline, the abnormality detection is performed based on the dynamic threshold set, and the accurate abnormality detection result is obtained.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to anomaly detection methods and related equipment. Background Technology

[0002] In the field of data security auditing, anomaly detection in decryption behavior is a crucial step in ensuring the security of enterprise data assets. Related technologies primarily employ two approaches: single static rule detection or pure machine learning models. The former uses fixed thresholds (such as call frequency) to determine anomalies, while the latter trains models to identify behavioral patterns. However, with the explosive growth of enterprise data, decryption logs exhibit high concurrency, high throughput, and diverse behaviors. Furthermore, there are significant differences between manual operations and machine calls in decryption behavior (manual operations are characterized by randomness, low frequency, and small data volume, while machine calls are characterized by regularity, high frequency, and large data volume). Traditional detection technologies reveal the following shortcomings: First, static thresholds do not differentiate between human and machine behavior, leading to a high false positive rate for high-frequency manual operations and a high false negative rate for low-frequency machine abnormal operations. Second, single detection models struggle to balance real-time performance and detection depth; rule-based detection cannot identify complex behavioral deviations, and model-based inference is time-consuming. Third, the detection system lacks self-evolution capabilities and cannot adapt to dynamic behavioral changes. Fourth, feature fusion is insufficient, resulting in a single dimension for anomaly judgment. Therefore, a method for accurately detecting anomalies in decryption behavior is urgently needed. Summary of the Invention

[0003] The main purpose of this application is to provide an anomaly detection method and related equipment, aiming to solve the technical problem of how to accurately detect anomalies in decryption behavior.

[0004] To achieve the above objectives, this application proposes an anomaly detection method, which includes: In response to anomaly detection commands, obtain multi-source log data corresponding to the decryption behavior; Perform a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; Anomaly detection is performed in two stages based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

[0005] In one embodiment, the step of performing a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set further includes: Based on TraceID hash partitioning and Flink Interval Join, the multi-source log data is correlated in real time to obtain the full-link information of each decryption behavior; Static feature extraction and dynamic feature extraction operations are performed on all the full-link information to obtain the static features, dynamic quantization features and dynamic sequence features corresponding to the full-link information. A fusion feature set is constructed based on the static features, the dynamic quantization features, and the dynamic sequence features.

[0006] In one embodiment, the step of performing two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results further includes: Based on preset dynamic thresholds and fused feature sets, real-time initial screening is performed to identify suspicious decryption behaviors; Based on a preset multi-model fusion architecture, the suspicious decryption behavior is analyzed in depth to perform anomaly monitoring and obtain anomaly detection results.

[0007] In one embodiment, the preset multi-model fusion architecture includes an LSTM behavior sequence model and a BERT contextual semantic model. The step of performing deep analysis on the suspicious decryption behavior based on the preset multi-model fusion architecture to perform anomaly detection and obtain anomaly detection results further includes: The LSTM behavioral sequence model is used to perform dynamic feature analysis on the suspicious decryption behavior in order to identify anomalies in the deviation of the behavior pattern and obtain the first inference result. The BERT contextual semantic model is used to perform business logic behavior analysis on the suspicious decryption behavior in order to identify abnormal business logic behavior and obtain a second inference result. Based on preset dynamic weights, the first inference result and the second inference result are weighted and fused to obtain a weighted fusion result; Based on the weighted fusion result, anomaly detection is performed to obtain the anomaly detection result.

[0008] In one embodiment, before the step of performing two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain the anomaly detection result, the method further includes: Obtain historical decryption behavior data; Based on the aforementioned historical decryption behavior data, a behavioral baseline is constructed; Based on the aforementioned behavioral baseline and 3σ statistical principle, a preset dynamic threshold set is constructed.

[0009] In one embodiment, the step of constructing a preset dynamic threshold set based on the behavioral baseline and the 3σ statistical principle further includes: Determine the historical fusion feature set corresponding to the historical decryption behavior data, and determine the client type corresponding to the historical decryption behavior data; Based on the client type, a clustering operation is performed on the historical fusion feature set to calculate the mean μ and standard deviation σ of the dynamic quantization features corresponding to different client types; Based on the mean μ, the standard deviation σ, the behavioral baseline, and the 3σ statistical principle, a preset dynamic threshold set is constructed.

[0010] Furthermore, to achieve the above objectives, this application also proposes an anomaly detection device, which includes: The acquisition module is used to acquire multi-source log data corresponding to the decryption behavior in response to an anomaly detection command; The feature extraction module is used to perform a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; An anomaly detection module is used to perform two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

[0011] In addition, to achieve the above objectives, this application also proposes an anomaly detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the anomaly detection method as described above.

[0012] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the anomaly detection method described above.

[0013] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the anomaly detection method described above.

[0014] One or more technical solutions proposed in this application have at least the following technical effects: This application discloses an anomaly detection method and related equipment, relating to the field of data processing technology. In related technologies, with the explosive growth of enterprise data volume, decryption logs exhibit high concurrency, high throughput, and diverse behavior characteristics. Furthermore, the decryption behavior of manual operations and machine calls differs significantly (manual operations are characterized by randomness, low frequency, and small data volume, while machine calls are characterized by regularity, high frequency, and large data volume). Traditional detection technologies reveal the following shortcomings: First, static thresholds do not distinguish between human and machine behavior, leading to a high false alarm rate for high-frequency manual operations and a high false negative rate for low-frequency machine abnormal operations; second, a single detection mode is difficult to balance real-time performance and detection depth. The previous methods failed to identify complex behavioral deviations and had a high inference time. Furthermore, the detection system lacked self-evolution capabilities and could not adapt to dynamic behavioral changes. Additionally, feature fusion was insufficient, resulting in a single dimension for anomaly detection. In contrast, this application first responds to an anomaly detection command by acquiring multi-source log data corresponding to the decryption behavior. Then, it performs a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set. Finally, based on a preset dynamic threshold set and the fusion feature set, it performs two-stage anomaly detection to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

[0015] Understandably, this application constructs a behavioral baseline from multiple dimensions based on historical decryption behavior, generates a dynamic threshold set based on the behavioral baseline, and performs anomaly detection based on the dynamic threshold set to obtain accurate anomaly detection results. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the anomaly detection method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the anomaly detection method of this application; Figure 3 This is a flowchart illustrating Embodiment 3 of the anomaly detection method of this application; Figure 4 This is a schematic diagram of the module structure of the anomaly detection device according to an embodiment of this application; Figure 5This is a schematic diagram of the device structure of the hardware operating environment involved in the anomaly detection method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution in this application's embodiments is: In this embodiment, for ease of description, the following description uses an anomaly detection device as the execution subject.

[0023] Due to the explosive growth of enterprise data, decryption logs exhibit high concurrency, high throughput, and diverse behaviors. Furthermore, there are significant differences between manual and machine-initiated decryption behaviors (manual operations are characterized by randomness, low frequency, and small data volume, while machine initiations are characterized by regularity, high frequency, and large data volume). Traditional detection technologies reveal the following shortcomings: First, static thresholds do not differentiate between human and machine behavior, leading to a high false alarm rate for high-frequency manual operations and a high false negative rate for low-frequency abnormal machine operations. Second, a single detection mode struggles to balance real-time performance and detection depth; rule-based detection cannot identify complex behavioral deviations, and model-based inference is time-consuming. Third, the detection system lacks self-evolution capabilities and cannot adapt to dynamic behavioral changes. Fourth, feature fusion is insufficient, resulting in a single dimension for anomaly judgment.

[0024] This application provides a solution in which: first, in response to an anomaly detection command, multi-source log data corresponding to decryption behavior is acquired; then, a fusion feature extraction operation is performed on the multi-source log data to obtain a fusion feature set; finally, based on a preset dynamic threshold set and the fusion feature set, a two-stage anomaly detection is performed to obtain an anomaly detection result. The preset dynamic threshold set is constructed based on a behavior baseline, and the behavior baseline is constructed based on historical decryption behavior data.

[0025] Understandably, this application constructs a behavioral baseline from multiple dimensions based on historical decryption behavior, generates a dynamic threshold set based on the behavioral baseline, and performs anomaly detection based on the dynamic threshold set to obtain accurate anomaly detection results.

[0026] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or anomaly detection device capable of performing the above functions. The following description uses an anomaly detection device as an example to illustrate this embodiment and the subsequent embodiments.

[0027] Based on this, embodiments of this application provide an anomaly detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the anomaly detection method of this application.

[0028] In this embodiment, the anomaly detection method includes steps S10 to S30: Step S10: In response to the anomaly detection command, obtain the multi-source log data corresponding to the decryption behavior; It should be noted that the anomaly detection command refers to the start signal or request that triggers the decryption behavior audit anomaly detection process.

[0029] Decryption refers to the specific actions of decrypting encrypted data, such as API calls and data decryption.

[0030] Multi-source log data refers to log records from different sources, including decryption logs, application logs, and TraceID logs.

[0031] In this embodiment, upon receiving an anomaly detection command, the multi-source log association module is activated. This module uses TraceID hash partitioning combined with Flink Interval Join technology to perform real-time association of decryption logs, application logs, and TraceID logs. To address log out-of-order issues, a 5-minute time deviation tolerance is set; simultaneously, RocksDB is used as the state backend, and a 1-hour TTL (Time To Live) is set to automatically clean up expired states to prevent memory overflow. Finally, the associated end-to-end decryption behavior log is output.

[0032] Understandably, this step enables real-time and accurate correlation of multi-source logs, completes the full-link information of each decryption action (such as domain, time, interface, client type, TraceID, decryption data volume, etc.), provides complete and reliable basic data for subsequent feature extraction, and ensures the stability and resource efficiency of the system through out-of-order tolerance and state cleanup mechanisms.

[0033] Step S20: Perform a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; It should be noted that fusion feature extraction refers to the process of simultaneously extracting static inherent features and dynamic behavioral features from the correlated log data and then merging the two to form a comprehensive feature set.

[0034] A fusion feature set refers to a comprehensive feature set that includes static features, dynamic quantitative features, and dynamic sequence features, and is classified and labeled according to client type (human / machine).

[0035] In this embodiment, the human / machine behavior fusion feature extraction module is activated to process the associated end-to-end decryption behavior log output in step S10: Extract static features: client type (human / iOS / browser / machine API), interface-specific tags (human interface / machine interface), and domain information.

[0036] Extract dynamic quantitative features: interface call frequency per unit time, number of decrypted data entries per TraceID, rate of change of decrypted data volume, and number of cross-domain operations.

[0037] Extract dynamic sequence features: API call time series, decryption behavior time period, and time interval of continuous decryption operations.

[0038] The above features are constructed into a fusion feature set, and then classified and labeled according to client type (human / machine) before being output.

[0039] Understandably, this step achieves deep fusion of human / machine behavioral features, organically combining static labels with dynamic behavioral patterns, overcoming the shortcomings of traditional solutions with their single feature dimension. The fused feature set provides multi-dimensional judgment criteria for subsequent differential dynamic threshold generation and two-stage detection, significantly improving the accuracy and coverage of anomaly detection.

[0040] Specifically, the step of performing a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set further includes steps S21 to S23: Step S21: Based on TraceID hash partitioning and Flink Interval Join, the multi-source log data is correlated in real time to obtain the full-link information of each decryption behavior; It should be noted that TraceID hash partitioning refers to a mechanism that calculates a hash value based on the TraceID field in the log record using a hash function, and allocates log data with the same hash value to the same partition for processing. This is used to ensure that logs related to the same decryption behavior can be processed centrally.

[0041] Flink Interval Join is a streaming data association operation based on time intervals, used to connect records in two or more data streams whose timestamps are within a certain deviation range, thereby achieving real-time data association.

[0042] Real-time correlation refers to the near-instantaneous matching and merging of multi-source logs after data is generated, outputting complete correlation results.

[0043] Full-link information refers to the complete context data of each decryption action from triggering to completion, including fields such as domain, time, interface, client type, TraceID, and decrypted data volume.

[0044] In this embodiment, the system uses TraceID as the primary key for real-time processing of multi-source log data (decryption logs, application logs, and TraceID logs). First, a TraceID hash partitioning strategy is employed to distribute log records with the same TraceID to the same compute node. Then, using the Flink stream processing framework's Interval Join operation, log records belonging to the same TraceID from different data sources are joined within an allowed 5-minute time deviation. To prevent memory overflow, RocksDB is used as the state backend, and a 1-hour TTL (Time To Live) is set to automatically clean up expired states. Finally, the system outputs the complete link information associated with each decryption action.

[0045] Understandably, this step enables efficient real-time correlation of multi-source logs, providing complete cross-system context information for each decryption action. The design of hash partitioning and time interval concatenation solves the problems of log out-of-order delivery and inconsistent arrival times of data from different sources, ensuring the accuracy and real-time nature of the correlation. Simultaneously, a state cleanup mechanism ensures that the system does not exhaust resources when processing massive amounts of logs.

[0046] Step S22: Perform static feature extraction and dynamic feature extraction operations on all the full-link information to obtain the static features, dynamic quantization features and dynamic sequence features corresponding to the full-link information; It should be noted that static feature extraction refers to the process of extracting inherent attributes from end-to-end information that do not change or change very slowly over time.

[0047] Dynamic feature extraction refers to the process of extracting statistical attributes and pattern features that change dynamically over time or behavioral sequences from information across the entire link.

[0048] Static features refer to fixed attributes that describe the subject of the decryption action, including client type (human / iOS / browser / machine API), interface-specific tags (human interface / machine interface), and domain information.

[0049] Dynamic quantification features refer to quantifiable behavioral statistics, including the frequency of interface calls per unit time, the number of data entries decrypted by a single TraceID, the rate of change of decrypted data volume, and the number of cross-domain operations.

[0050] Dynamic sequence features refer to the sequential patterns and interval characteristics of decryption behavior in the time dimension, including the time sequence of interface calls, the time period in which decryption behavior occurs, and the time interval between consecutive decryption operations.

[0051] In this embodiment, the following operations are performed on each piece of end-to-end information output in step S21: Extract static features: parse the client type field, interface tag field, and domain information field in the full-link information to directly obtain their category values.

[0052] Extract dynamic quantitative features: Based on the current decryption behavior and its historical behavior data within the recent time window, calculate the interface call frequency (such as the number of calls in the past minute), the number of decrypted data entries for the current TraceID, the rate of change of the amount of decrypted data relative to the previous time window, and the cumulative number of cross-domain operations.

[0053] Extract dynamic sequence features: record the timestamp of the current decryption action, the position of the interface call sequence, the time interval since the last decryption operation, and the current time period (such as early morning, working hours, etc.) to form time-series related features.

[0054] Finally, the static features, dynamic quantization features, and dynamic sequence features corresponding to this full-link information are obtained.

[0055] Understandably, this step transforms raw logs into structured, multi-dimensional features, covering three dimensions: static attributes of the behavioral subject, statistical quantification of behavior, and time-series patterns. Static features ensure accurate differentiation between human and machine behavior, dynamic quantification features support quantitative threshold determination, and dynamic sequence features provide the foundation for subsequent sequence model analysis. This multi-level feature extraction method lays the data foundation for constructing fusion feature sets and generating personalized dynamic thresholds.

[0056] Step S23: Construct a fusion feature set based on the static features, the dynamic quantization features, and the dynamic sequence features.

[0057] It should be noted that the fusion feature set refers to a unified feature vector set formed by combining and integrating static features, dynamic quantitative features, and dynamic sequence features, and is classified and labeled according to client type (human / machine).

[0058] In this embodiment, the static features, dynamic quantization features, and dynamic sequence features extracted in step S22 are concatenated and integrated according to a preset feature template. Specifically, the static features are used as the base label (indicating whether the behavior belongs to a human client or a machine client), and then the dynamic quantization features and dynamic sequence features are appended as auxiliary feature vectors to form a complete feature record. For multiple decryption behaviors of the same client type, their feature records are classified into the same category, and the final output is a fused feature set labeled by human / machine classification, which is used for subsequent dynamic threshold matching and anomaly detection.

[0059] Understandably, this step organically integrates features of different dimensions and properties into a whole, overcoming the limitations of traditional methods that rely solely on single-dimensional features. The fused feature set retains static information distinguishing between humans and machines while also encompassing quantitative statistics such as frequency and data volume, as well as pattern information such as time series data. This provides a comprehensive basis for subsequent personalized dynamic threshold generation and two-stage anomaly detection, significantly improving the accuracy and robustness of anomaly detection.

[0060] Step S30: Based on the preset dynamic threshold set and the fused feature set, perform two-stage anomaly detection to obtain anomaly detection results. The preset dynamic threshold set is constructed based on the behavioral baseline, which is constructed based on historical decryption behavior data.

[0061] It should be noted that the preset dynamic threshold set refers to a personalized dynamic threshold set generated for human behavior and machine behavior respectively. It includes thresholds such as the call frequency per unit time, the number of decrypted data entries per TraceID, and the number of cross-domain operations, and is used to replace the traditional global static threshold.

[0062] It should be noted that the two-stage anomaly detection consists of a layered detection architecture, which is divided into a first-stage lightweight rule engine for real-time initial screening and a second-stage large-scale model for in-depth analysis.

[0063] A behavioral baseline is a behavioral benchmark formed by statistically analyzing the mean (μ) and standard deviation (σ) of each dynamic quantitative feature based on historical decryption behavior data and according to client type (human / machine).

[0064] Historical decryption behavior data refers to the accumulated and archived decryption behavior logs and their characteristic data.

[0065] In this embodiment, a two-stage detection is performed based on a preset dynamic threshold set and the fused feature set output in step S20: Phase 1 (Real-time Initial Screening by a Lightweight Rule Engine): Loads dynamic threshold rules differentiated between humans and machines, performing millisecond-level real-time detection on the fused feature set. Rule Example: For human clients, traffic is considered suspicious if the call frequency per unit time exceeds the human dynamic threshold, the number of decrypted data entries per TraceID is greater than 50, or high-frequency decryption occurs during non-working hours (2-4 AM). For machine clients, traffic is considered suspicious if the call frequency exceeds the machine dynamic threshold, the number of cross-domain operations exceeds the machine dynamic threshold, or the machine interface exhibits random time-series characteristics of human operation. Normal traffic is allowed to pass directly, while suspicious traffic and its abnormal feature markers are pushed to Phase 2.

[0066] The second phase (large-scale model in-depth analysis): For the suspicious traffic identified in the first phase, a multi-model fusion architecture is used for in-depth analysis. Specifically, the LSTM behavioral sequence model analyzes interface call time series and decryption operation intervals to identify anomalies deviating from historical human / machine behavior patterns (such as continuous decryption during manual data dragging); the BERT contextual semantic model analyzes interface call logic and cross-domain operation context to identify abnormal business logic behavior (such as unauthorized interface decryption calls and logical conflicts in cross-domain decryption). The inference results from the two models are weighted and fused (weights can be adjusted according to the audit scenario), and a comprehensive judgment is made as either "identified as anomaly" or "excluded as suspicious."

[0067] The final output includes anomaly detection results, such as anomaly type and feature details.

[0068] Understandably, replacing global static thresholds with dynamic thresholds differentiated between humans and machines solves the problem of false positives for high-frequency human operations and missed detections for low-frequency abnormal machine operations. The first-stage rule engine achieves millisecond-level initial screening to ensure real-time performance; the second-stage large-scale model deeply analyzes complex behavioral patterns to ensure detection accuracy, achieving an optimal balance between the two. The dynamic threshold is updated in real-time based on historical baselines, possessing adaptive capabilities. By integrating LSTM sequence analysis and BERT semantic analysis, complex anomalies are identified from both behavioral pattern and time series dimensions, compensating for the shortcomings of single-rule detection.

[0069] This application discloses an anomaly detection method and related equipment, relating to the field of data processing technology. In related technologies, with the explosive growth of enterprise data volume, decryption logs exhibit high concurrency, high throughput, and diverse behavior characteristics. Furthermore, the decryption behavior of manual operations and machine calls differs significantly (manual operations are characterized by randomness, low frequency, and small data volume, while machine calls are characterized by regularity, high frequency, and large data volume). Traditional detection technologies reveal the following shortcomings: First, static thresholds do not distinguish between human and machine behavior, leading to a high false alarm rate for high-frequency manual operations and a high false negative rate for low-frequency machine abnormal operations; second, a single detection mode is difficult to balance real-time performance and detection depth. The previous methods failed to identify complex behavioral deviations and had a high inference time. Furthermore, the detection system lacked self-evolution capabilities and could not adapt to dynamic behavioral changes. Additionally, feature fusion was insufficient, resulting in a single dimension for anomaly detection. In contrast, this application first responds to an anomaly detection command by acquiring multi-source log data corresponding to the decryption behavior. Then, it performs a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set. Finally, based on a preset dynamic threshold set and the fusion feature set, it performs two-stage anomaly detection to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

[0070] Understandably, this application constructs a behavioral baseline from multiple dimensions based on historical decryption behavior, generates a dynamic threshold set based on the behavioral baseline, and performs anomaly detection based on the dynamic threshold set to obtain accurate anomaly detection results.

[0071] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 The step of performing two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results further includes steps A10 to A20: Step A10: Based on the preset dynamic threshold and fused feature set, perform real-time preliminary screening to identify suspicious decryption behaviors; It should be noted that real-time initial screening refers to the first-level detection operation in which lightweight rules are used to quickly determine each decryption behavior in milliseconds during data stream processing, dividing the traffic into two branches: normal and suspicious.

[0072] Suspicious decryption behavior refers to decryption behavior that exceeds the preset dynamic threshold or triggers specific abnormal rules in the initial screening stage, requiring in-depth analysis in the second stage.

[0073] In this embodiment, a lightweight rule engine detection module is activated, loading a pre-built preset dynamic threshold set (containing dynamic thresholds differentiated by both human and machine). The fused feature set output in step S23 is automatically matched with the corresponding human or machine dynamic threshold rules based on its static features (client type), performing millisecond-level real-time determination. The specific determination logic includes: For manual clients: If the call frequency per unit time exceeds the manual dynamic threshold, or the number of decrypted data entries per TraceID is greater than 50, or high-frequency decryption occurs during non-working hours (such as 2-4 am), it will be marked as suspicious decryption behavior.

[0074] For machine clients: If the call frequency per unit time exceeds the machine dynamic threshold, or the number of cross-domain operations exceeds the machine dynamic threshold, or the machine interface exhibits random time sequence characteristics that are only present in manual operations, then it is marked as suspicious decryption behavior.

[0075] For decryption attempts that do not trigger any thresholds, they are directly marked as normal traffic and allowed to pass without further in-depth analysis.

[0076] Ultimately, normal traffic is allowed to pass directly, while suspicious decryption attempts, along with their abnormal characteristics, are pushed to the second stage.

[0077] Understandably, this step enables rapid traffic redirection for anomaly detection. Through lightweight rules and differentiated dynamic thresholds, it filters out the vast majority of normal traffic within milliseconds, significantly reducing the amount of data requiring in-depth analysis. Compared to traditional pure model-based detection schemes, it significantly reduces overall system computational overhead and response latency. Compared to purely static rule-based schemes, the human / machine differentiated thresholds reduce false alarms for normal, high-frequency human operations while increasing the likelihood of detecting low-frequency abnormal machine behavior, thus preserving the most noteworthy suspicious traffic for the second-stage in-depth analysis.

[0078] Step A20: Based on a preset multi-model fusion architecture, perform in-depth analysis on the suspicious decryption behavior to detect anomalies and obtain anomaly detection results.

[0079] Specifically, the preset multi-model fusion architecture includes an LSTM behavior sequence model and a BERT contextual semantic model. The step of performing deep analysis on the suspicious decryption behavior based on the preset multi-model fusion architecture to perform anomaly detection and obtain anomaly detection results further includes steps A21 to A24: Step A21: Use the LSTM behavioral sequence model to perform dynamic feature analysis on the suspicious decryption behavior to identify anomalies in the behavioral pattern and obtain the first inference result; Step A22: Use the BERT contextual semantic model to perform business logic behavior analysis on the suspicious decryption behavior in order to identify abnormal business logic behavior and obtain the second inference result; Step A23: Based on preset dynamic weights, the first inference result and the second inference result are weighted and fused to obtain a weighted fusion result; Step A24: Based on the weighted fusion result, perform anomaly detection to obtain anomaly detection results.

[0080] It should be noted that the pre-defined multi-model fusion architecture refers to a pre-defined analysis framework composed of multiple different types of machine learning models. In this solution, the LSTM behavioral sequence model and the BERT contextual semantic model are included, and the inference results of the two are weighted and fused.

[0081] Deep analysis refers to using complex models to deeply identify the time-series patterns and contextual semantic logic of behavior based on the initially screened suspicious traffic, in order to determine whether there are subtle or complex anomalies that the rule engine cannot detect.

[0082] Anomaly monitoring refers to the final determination of decryption behavior, outputting results that confirm anomalies or eliminate suspicious ones, and can further provide details of the anomaly type and characteristics.

[0083] In this embodiment, the second-stage large-model deep analysis module is initiated, receiving the suspicious decryption behaviors and their fusion feature sets output from step A10. Parallel analysis is performed using a preset multi-model fusion architecture: LSTM behavioral sequence model analysis: Inputting dynamic sequence features of suspicious decryption behaviors (such as interface call time series, time intervals between consecutive decryption operations, etc.), the LSTM network captures long-term dependencies and temporal patterns in the sequence to identify whether there are significant deviations from the historical behavioral patterns of humans / machines. For example, it was found that human clients exhibited highly regular and short-interval consecutive decryption sequences in the early morning, consistent with the abnormal "data dragging" pattern.

[0084] BERT Contextual Semantic Model Analysis: By analyzing the contextual semantic features of suspicious decryption behaviors (such as the logical order of API calls, the sequential relationship of cross-domain operations, and authorization matching between the API and the client), the BERT model is used to understand the business semantics between behaviors and identify logical conflicts or unauthorized anomalies. For example, it might detect that an API is a commonly used interface, but the cross-domain decryption business logic is unauthorized.

[0085] Weighted fusion judgment: The output results (such as anomaly probability or anomaly score) of LSTM and BERT models are weighted and fused. The weights can be dynamically adjusted according to the audit scenario (such as focusing more on time series anomalies or logical anomalies). If the combined score after fusion exceeds a preset threshold, it is judged as "definitely anomaly"; otherwise, it is marked as "excluded from suspicion".

[0086] The final output includes the anomaly detection results, including the anomaly type (such as high-frequency calls, pattern deviation, cross-domain anomalies, etc.), behavioral feature details (client type, interface, domain, amount of decrypted data, etc.), and the corresponding TraceID full-link information.

[0087] Understandably, this step complements the deep anomaly detection capabilities that rule engines cannot reach. By capturing complex time-series behavioral deviations using an LSTM model and understanding semantic anomalies at the business logic level using a BERT model, the weighted fusion of these two methods can identify complex anomalies that are difficult to define using traditional rules, such as "data dragging" and "cross-domain anomaly decryption." Simultaneously, because only a small amount of suspicious traffic enters this stage, the high latency and resource consumption caused by full-traffic deep inference are avoided, maintaining the real-time performance of the overall system while ensuring detection depth. The final anomaly detection results have multi-dimensional feature details, facilitating subsequent alerts and manual review.

[0088] Based on the first and second embodiments of this application, in the third embodiment of this application, the content that is the same as or similar to that in embodiments one and two above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Before the step of performing two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain the anomaly detection result, steps B10 to B30 are also included: Step B10: Obtain historical decryption behavior data; It should be noted that historical decryption behavior data refers to archived decryption behavior-related logs and feature data accumulated over a period of time, including full-link information after multi-source log association, as well as static features, dynamic quantitative features, and dynamic sequence features extracted from the data.

[0089] In this embodiment, the system reads decryption behavior records that have undergone association and feature extraction from the log storage system or data warehouse in batches according to a preset time range (such as the past 30 days, 90 days, etc.). This data needs to be categorized and organized according to client type (human / machine) to ensure that different categories of behavioral characteristics can be statistically analyzed separately during subsequent baseline construction. The acquired data should include the raw statistical values ​​of various dynamic quantitative characteristics (such as the frequency of interface calls per unit time, the number of decrypted data entries per TraceID, the rate of change in decrypted data volume, the number of cross-domain operations, etc.).

[0090] Understandably, this step provides the foundational data source for constructing behavioral baselines. By acquiring a sufficiently large amount of historical data, the sufficiency of the sample for subsequent statistical analysis and the representativeness of the baseline results are ensured, laying the data foundation for generating human / machine differential dynamic thresholds.

[0091] Step B20: Based on the historical decryption behavior data, construct a behavior baseline; It should be noted that the behavioral baseline refers to the behavioral benchmark formed by statistically analyzing the mean (μ) and standard deviation (σ) of each dynamic quantitative feature based on historical decryption behavior data and according to client type (human / machine), and is used to describe the data distribution range of normal behavior.

[0092] In this embodiment, based on the historical decryption behavior data obtained in step B10, clustering is performed according to client type (human client and machine client). For each client type, statistical indicators of its various dynamic quantitative characteristics are calculated: Calculate the mean (μ) and standard deviation (σ) of each dynamic quantification feature (such as the frequency of interface calls per unit time) for this type of client over a historical period.

[0093] For example, by statistically analyzing the "interface call frequency per unit time" data of all human clients, we can obtain μ_man and σ_man for the human call frequency; similarly, by statistically analyzing the corresponding metrics of machine clients, we can obtain μ_machine and σ_machine.

[0094] For other dynamic quantification features (number of decrypted data entries per TraceID, rate of change of decrypted data volume, number of cross-domain operations, etc.), μ and σ for human and machine are calculated respectively.

[0095] Ultimately, human behavior baselines and machine behavior baselines are formed, with each baseline containing (μ, σ) parameter pairs for each dynamic quantization feature under that category.

[0096] Understandably, this step enables differentiated modeling of human / machine behavior, overcoming the shortcomings of traditional solutions that use the same statistical benchmark for all clients. By constructing separate baselines for human and machine behavior, it accurately characterizes the randomness, low frequency, and small data volume of human operations, and the regularity, high frequency, and large data volume of machine calls, providing precise statistical basis for the subsequent generation of personalized dynamic thresholds.

[0097] Step B30: Based on the behavioral baseline and the 3σ statistical principle, construct a preset dynamic threshold set.

[0098] Specifically, the step of constructing a preset dynamic threshold set based on the behavioral baseline and the 3σ statistical principle further includes steps B31 to B33: Step B31: Determine the historical fusion feature set corresponding to the historical decryption behavior data, and determine the client type corresponding to the historical decryption behavior data; Step B32: Based on the client type, perform a clustering operation on the historical fusion feature set to calculate the mean μ and standard deviation σ of the dynamic quantization features corresponding to different client types; Step B33: Based on the mean μ, the standard deviation σ, the behavioral baseline, and the 3σ statistical principle, construct a preset dynamic threshold set.

[0099] It should be noted that the 3σ statistical principle states that, in statistics, for data following a normal distribution, approximately 99.7% of the samples will fall within the range of the mean (μ) plus or minus three standard deviations (σ). This scheme utilizes this principle to consider behaviors exceeding the range of μ ± 3σ as statistically significant anomalies, thereby generating a dynamic threshold.

[0100] The preset dynamic threshold set refers to a personalized dynamic threshold set generated for both human clients and machine clients based on behavioral baselines and the 3σ principle. It includes the upper and lower limits of thresholds for various dynamic quantification features, such as the threshold for human interface call frequency, the threshold for machine interface call frequency, and the threshold for cross-domain operation count.

[0101] In this embodiment, based on the behavioral baseline constructed in step B20 (including μ and σ for both human and machine), and combined with the 3σ statistical principle, the dynamic thresholds of various dynamic quantification features are calculated: For features that need to be detected as abnormally high (such as API call frequency, number of decrypted data entries per TraceID, number of cross-domain operations, etc.), set an upper limit threshold = μ + 3σ.

[0102] For features that need to be detected as abnormally low (such as an abnormal decrease in the amount of decrypted data), a lower threshold can be set to μ-3σ (the specific threshold can be selected according to the audit requirements).

[0103] Differentiation example: Human interface call frequency threshold = μ_man + 3σ_man, Machine interface call frequency threshold = μ_machine + 3σ_machine.

[0104] The latest decryption behavior data is collected in real time, and the μ and σ of the historical baseline are updated on a rolling basis, thereby achieving dynamic adaptive adjustment of the threshold and avoiding threshold rigidity.

[0105] The final output is a set of preset dynamic thresholds categorized by human / machine, which is used by the first-stage lightweight rule engine for loading.

[0106] Understandably, this step generates a personalized dynamic threshold set that replaces the traditional global static threshold. By applying the 3σ principle, the thresholds are linked to the actual distribution characteristics of behavioral data, ensuring that threshold settings have a statistically sound basis. The human / machine differentiated design significantly reduces the false alarm rate for high-frequency human operations and the false negative rate for abnormal low-frequency machine operations. Simultaneously, through a real-time rolling update mechanism, the thresholds can adaptively follow changes in business and behavioral patterns, solving the problems of rigid thresholds and inability to adapt to dynamic changes in traditional solutions.

[0107] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the anomaly detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0108] It should be noted that all user-related data involved in this application were obtained with the user's permission or consent; that is, when this application is applied to specific products or technologies, user permission is required to obtain and process the relevant data, and the processing of the relevant data must comply with the relevant laws, regulations and regulatory standards of the relevant countries and regions.

[0109] This application also provides an anomaly detection device; please refer to [reference needed]. Figure 4 The anomaly detection device includes: Acquisition module 10, the acquisition module is used to acquire multi-source log data corresponding to the decryption behavior in response to an anomaly detection command; Feature extraction module 20, which is used to perform fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; Anomaly detection module 30 is used to perform two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

[0110] The anomaly detection device provided in this application, employing the anomaly detection method in the above embodiments, can solve the technical problem of anomaly detection. Compared with related technologies, the beneficial effects of the anomaly detection device provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and other technical features in the anomaly detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0111] This application provides an anomaly detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the anomaly detection method in Embodiment 1 above.

[0112] The following is for reference. Figure 5 The diagram illustrates a structural schematic suitable for implementing an anomaly detection device in the embodiments of this application. The anomaly detection device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The anomaly detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0113] like Figure 5 As shown, the anomaly detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the anomaly detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the anomaly detection device to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show anomaly detection devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0114] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0115] The anomaly detection device provided in this application, employing the anomaly detection method described in the above embodiments, can solve the technical problem of anomaly detection. Compared with related technologies, the beneficial effects of the anomaly detection device provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and other technical features of this anomaly detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0116] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0117] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0118] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the anomaly detection method in the above embodiments.

[0119] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0120] The aforementioned computer-readable storage medium may be included in the anomaly detection device; or it may exist independently and not be assembled into the anomaly detection device.

[0121] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the anomaly detection device, cause the anomaly detection device to: In response to anomaly detection commands, obtain multi-source log data corresponding to the decryption behavior; Perform a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; Anomaly detection is performed in two stages based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

[0122] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0124] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0125] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described anomaly detection method, thereby solving the technical problem of anomaly detection. Compared with related technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and will not be repeated here.

[0126] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the anomaly detection method described above.

[0127] The computer program product provided in this application can solve the technical problem of anomaly detection. Compared with related technologies, the beneficial effects of the computer program product provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and will not be repeated here.

[0128] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. An anomaly detection method, characterized in that, The anomaly detection method includes: In response to anomaly detection commands, obtain multi-source log data corresponding to the decryption behavior; Perform a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; Anomaly detection is performed in two stages based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

2. The anomaly detection method as described in claim 1, characterized in that, The step of performing fusion feature extraction on the multi-source log data to obtain a fusion feature set further includes: Based on TraceID hash partitioning and Flink Interval Join, the multi-source log data is correlated in real time to obtain the full-link information of each decryption behavior; Static feature extraction and dynamic feature extraction operations are performed on all the full-link information to obtain the static features, dynamic quantization features and dynamic sequence features corresponding to the full-link information. A fusion feature set is constructed based on the static features, the dynamic quantization features, and the dynamic sequence features.

3. The anomaly detection method as described in claim 1, characterized in that, The step of performing two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results further includes: Based on preset dynamic thresholds and fused feature sets, real-time initial screening is performed to identify suspicious decryption behaviors; Based on a preset multi-model fusion architecture, the suspicious decryption behavior is analyzed in depth to perform anomaly monitoring and obtain anomaly detection results.

4. The anomaly detection method as described in claim 3, characterized in that, The preset multi-model fusion architecture includes an LSTM behavior sequence model and a BERT contextual semantic model. The step of performing deep analysis on the suspicious decryption behavior based on the preset multi-model fusion architecture to detect anomalies and obtain anomaly detection results further includes: The LSTM behavioral sequence model is used to perform dynamic feature analysis on the suspicious decryption behavior in order to identify anomalies in the deviation of the behavior pattern and obtain the first inference result. The BERT contextual semantic model is used to perform business logic behavior analysis on the suspicious decryption behavior in order to identify abnormal business logic behavior and obtain a second inference result. Based on preset dynamic weights, the first inference result and the second inference result are weighted and fused to obtain a weighted fusion result; Based on the weighted fusion result, anomaly detection is performed to obtain the anomaly detection result.

5. The anomaly detection method as described in claim 1, characterized in that, Before the step of performing two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain the anomaly detection result, the method further includes: Obtain historical decryption behavior data; Based on the aforementioned historical decryption behavior data, a behavior baseline is constructed; Based on the aforementioned behavioral baseline and 3σ statistical principle, a preset dynamic threshold set is constructed.

6. The anomaly detection method as described in claim 5, characterized in that, The step of constructing a preset dynamic threshold set based on the behavioral baseline and the 3σ statistical principle further includes: Determine the historical fusion feature set corresponding to the historical decryption behavior data, and determine the client type corresponding to the historical decryption behavior data; Based on the client type, a clustering operation is performed on the historical fusion feature set to calculate the mean μ and standard deviation σ of the dynamic quantization features corresponding to different client types; Based on the mean μ, the standard deviation σ, the behavioral baseline, and the 3σ statistical principle, a preset dynamic threshold set is constructed.

7. An anomaly detection device, characterized in that, The anomaly detection device includes: The acquisition module is used to acquire multi-source log data corresponding to the decryption behavior in response to an anomaly detection command; The feature extraction module is used to perform a fusion feature extraction operation on the multi-source log data to obtain a fusion feature set; An anomaly detection module is used to perform two-stage anomaly detection based on a preset dynamic threshold set and a fused feature set to obtain anomaly detection results. The preset dynamic threshold set is constructed based on a behavioral baseline, which is constructed based on historical decryption behavior data.

8. An anomaly detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the anomaly detection method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the anomaly detection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the anomaly detection method as described in any one of claims 1 to 6.

Images