A method and system for managing enterprise online behavior based on multi-dimensional feature extraction and clustering

Abstract

This invention discloses a method and system for enterprise internet access behavior management based on multidimensional feature extraction and clustering. The method includes the following steps: real-time traffic collection; a feature extraction module extracts multidimensional features from the traffic and converts them into behavior vectors; a core intelligent analysis module uses a CNN+LSTM hybrid model to classify and identify known behaviors, outputting access type labels and risk scores, and supplementing this with the DBSCAN clustering algorithm to detect unknown abnormal behaviors; a policy engine module dynamically generates access control rules based on the intelligent analysis results and a preset policy library, and sends these rules to network devices for execution via a northbound API; finally, an execution feedback module collects execution logs and sends them back to the intelligent analysis module to trigger online incremental training, forming a two-way adaptive closed loop between the policy and the model. This invention, through deep learning and a closed-loop feedback mechanism, achieves intelligent, precise, and real-time internet access behavior management, significantly improving the efficiency and response speed of enterprise network security management.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for intelligent analysis, control and response to the online behavior of employees within an enterprise. Background Technology

[0002] With the development of internet technology and the deepening of enterprise digital transformation, it has become commonplace for employees to conduct work via the internet. However, the open internet environment also brings many security risks and management challenges, such as accessing malicious websites, leaking sensitive data, abusing network resources, and being infected with viruses and Trojans. Therefore, effective management of enterprise internet behavior is crucial.

[0003] Traditional enterprise internet access management technologies mainly rely on the following methods: URL / IP Blacklist Database: This method involves maintaining a large blacklist of malicious websites or IP addresses to match and block employee access requests. While simple and direct, it has significant drawbacks: the blacklist is often outdated and cannot cover newly generated malicious websites; and for HTTPS encrypted traffic, the URL cannot be obtained without decryption, rendering it ineffective.

[0004] Application Layer Protocol Identification (DPI / DFI): This method uses Deep Packet Inspection (DPI) or Deep Flow Inspection (DFI) techniques to identify the application (such as video, games, social media, etc.) to which network traffic belongs. This approach is effective for unencrypted or known protocol applications, but the accuracy drops significantly for proprietary protocols, encrypted traffic, or new applications.

[0005] Static rule policies: Administrators preset fixed access control policies, such as "block access to certain types of websites" or "limit bandwidth for certain applications." This type of policy lacks flexibility, cannot be adjusted according to dynamic changes in user behavior and actual risks, and is prone to misjudgments and omissions, resulting in low management efficiency.

[0006] In summary, existing technologies generally suffer from low identification accuracy, weak processing capabilities for encrypted traffic and new applications, static and rigid policies, and delayed responses, making it difficult to meet the needs of modern enterprises for refined, intelligent, and real-time network security management. Therefore, a more advanced and intelligent enterprise internet behavior management solution is urgently needed. Summary of the Invention

[0007] The main objective of this invention is to overcome the shortcomings of existing technologies and provide a method and system for enterprise internet behavior management based on multidimensional feature extraction and clustering, so as to solve the problems of low recognition rate, slow response, rigid policies, and inability to adapt to dynamic network threat environments in traditional internet behavior management technologies.

[0008] A method for managing enterprise internet access behavior based on multidimensional feature extraction and clustering includes the following steps: Step S1. Real-time traffic collection: Collect real-time traffic data, and perform real-time capture and preprocessing of HTTP / HTTPS, DNS, and TCP / IP packets in the network without being noticed; Step S2. Behavioral Feature Extraction: Perform session reorganization on the preprocessed traffic data, and extract multi-dimensional features for the traffic data corresponding to each top-level domain, including session duration, access frequency, communication quintuple information, data packet size distribution, and DNS query pattern. Transform the multi-dimensional features into a high-dimensional behavioral vector corresponding to each top-level domain. Step S3. Intelligent Analysis: The high-dimensional behavior vector is input into a pre-trained intelligent analysis model, which includes a CNN+LSTM hybrid model and a DBSCAN clustering model. The CNN+LSTM hybrid model classifies the input high-dimensional behavior vector, outputting access type labels, risk scores, and confidence levels. If the confidence level of a behavior vector is lower than a preset threshold, it is classified as a low-confidence behavior vector and fed into the DBSCAN model. If the confidence level is higher than or equal to the preset threshold, it is classified as a high-confidence behavior vector, and its access type label and risk score are input into the policy engine module. The DBSCAN clustering model clusters the low-confidence behavior vectors, determining whether there are any outliers that do not belong to any cluster. If so, it indicates the presence of unknown abnormal behavior, triggers an alarm for the abnormal behavior, and implements network isolation for the associated IP or account. Step S4. Dynamic policy execution: The policy engine module receives the access type label and risk score of the behavior vector, combines it with the enterprise's preset policy library, dynamically generates access control rules that allow, rate limit, alarm or block, and sends the rules to network devices such as edge firewalls or smart gateways for execution through the northbound API interface. Step S5. Closed-loop feedback and adaptation: The execution feedback module collects the execution logs of network devices on access control rules and sends the feedback information containing the execution results back to the intelligent analysis model, triggering the online incremental training of the intelligent analysis model to achieve bidirectional adaptive optimization of the strategy and the model.

[0009] Furthermore, in step S1, the traffic acquisition module acquires traffic through a bypass mirroring method.

[0010] Furthermore, in step S2, the communication quintuple information includes the source IP address, destination IP address, source port, destination port, and transport layer protocol; the DNS query mode includes the frequency of domain name queries, the distribution of domain name types, and the query response time.

[0011] Furthermore, in step S3, in the CNN+LSTM hybrid model, the convolutional neural network (CNN) is used to extract local spatial features from the sequence of behavior vectors, and the long short-term memory network (LSTM) is used to capture the dependence and dynamic change patterns of behavior in the time dimension.

[0012] Furthermore, in step S3, the intelligent analysis model is pre-trained using collected large-scale enterprise actual traffic data.

[0013] Furthermore, in step S4, the policy engine module supports integration with the existing identity authentication system, binding access control rules to specific users or user groups.

[0014] Furthermore, step S6, Visual Reports and Alerts, is also included: The system generates visual reports containing risk distribution, event trends, and user behavior profiles daily based on the results of intelligent analysis and the implementation of strategies, and pushes high-risk event alerts to the security team via email, SMS, or instant messaging tools.

[0015] An enterprise internet access behavior management system based on multidimensional feature extraction and clustering includes: The traffic acquisition module is deployed on the bypass port of the enterprise's core switch to capture HTTP / HTTPS, DNS, and TCP / IP packets in real time. The feature extraction module, connected to the traffic acquisition module, is used to extract multi-dimensional features from traffic data and convert them into behavior vectors. The intelligent analysis module, connected to the feature extraction module, incorporates a CNN+LSTM hybrid model and a DBSCAN clustering model to classify behavior vectors and detect anomalies, and outputs access type labels and risk scores. The strategy engine module, connected to the intelligent analysis module, is used to generate dynamic access control rules based on the intelligent analysis results and the preset strategy library. An execution interface module, connected to the policy engine module, is used to distribute access control rules to network devices via the northbound API; The execution feedback module, connected to the execution interface module and the intelligent analysis module, is used to collect execution logs and send them back to the intelligent analysis module to trigger its online incremental training.

[0016] Furthermore, it also includes a visualization report module, which is connected to the intelligent analysis module and the execution feedback module, for generating visualization reports and pushing early warning information.

[0017] Furthermore, the system adopts a modular design, which can seamlessly connect with existing network devices and identity authentication systems.

[0018] The present invention has the following beneficial effects: High-precision identification: Employing a CNN+LSTM hybrid model, it can deeply mine the complex features of traffic data in the spatial and temporal dimensions. Combined with the DBSCAN clustering algorithm, it not only has an identification rate of over 99% for known applications and risky behaviors, but also effectively discovers unknown and potential abnormal behaviors, significantly reducing the false negative rate and false positive rate.

[0019] Real-time response and adaptation: The entire process from traffic collection to policy execution is highly automated, reducing response time to minutes. More importantly, through a closed-loop feedback mechanism, the system can perform online incremental learning based on the execution results, enabling intelligent models and management policies to dynamically adapt to changes in the network environment and threats, achieving adaptive evolution that "gets smarter with use."

[0020] Seamless deployment and strong compatibility: Adopting a bypass deployment mode, it requires no changes to the existing network topology, resulting in "zero intrusion and zero impact" on the business network. Its modular design enables seamless integration with mainstream firewalls, gateways, and identity authentication systems, protecting existing enterprise investments.

[0021] Intelligent and Visualized Features: Deeply integrated with internet behavior analysis, this feature frees administrators from tedious rule maintenance. Rich visualization reports and early warning mechanisms provide a clear overview of the security situation, offering strong data support for management decisions.

[0022] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the architecture of an enterprise internet behavior management system based on multidimensional feature extraction and clustering, provided by an embodiment of the present invention; Figure 2 This is a flowchart of an enterprise internet behavior management method based on multidimensional feature extraction and clustering provided by an embodiment of the present invention. Detailed Implementation

[0024] In the description of this invention, it should also be noted that, unless otherwise expressly specified and limited, these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0025] Reference Figure 1This embodiment provides an enterprise internet access behavior management system based on multidimensional feature extraction and clustering. The system adopts a modular design and includes a traffic collection module 101, a feature extraction module 102, an intelligent analysis module 103, a policy engine module 104, an execution interface module 105, an execution feedback module 106, and a visualization report module 107.

[0026] The traffic acquisition module 101 is deployed in a bypass mirroring mode on the mirror port (or TAP device) of the enterprise core switch. This module has high-performance packet capture capabilities, capable of capturing all HTTP / HTTPS, DNS, TCP / IP, and other protocol packets flowing through the core network with a time accuracy of 0.01 seconds, without any loss or interference. The captured raw packets undergo preliminary preprocessing, such as checksum verification and fragmentation reassembly, before being sent to the feature extraction module 102.

[0027] The feature extraction module 102 receives traffic data from the traffic acquisition module 101. This module first performs session reassembly on the data packets, aggregating packets belonging to the same network connection. Then, it extracts multi-dimensional behavioral features from the reassembled sessions, specifically including: Session characteristics: total session duration, average packet interval, and active / inactive time periods.

[0028] Statistical characteristics: Access frequency, total number of connections, and number of failed connections per unit time.

[0029] Five-tuple information: source IP, destination IP, source port, destination port, protocol type.

[0030] Traffic characteristics: Uplink / downlink packet size distribution, total traffic, average packet length.

[0031] DNS characteristics: Query domain name, query type (A record, CNAME record, etc.), query frequency, and response time.

[0032] These features are structured and transformed into a high-dimensional digital vector, or "behavior vector," for subsequent intelligent analysis.

[0033] The intelligent analysis module 103 is the core of the entire system, and it has two key models built in: a CNN+LSTM hybrid model and a DBSCAN clustering model.

[0034] CNN+LSTM Hybrid Model: This model is trained on large-scale, real-world enterprise traffic data. Upon receiving a behavior vector, the Convolutional Neural Network (CNN) layer first extracts local spatial correlation features within the vector (e.g., a combination of a specific port range and a specific packet size). Then, the Long Short-Term Memory (LSTM) layer processes these feature sequences to capture dynamic patterns of user behavior over time (e.g., a user frequently accessing different domains within a short period may indicate data crawling). Finally, the model outputs a classification result, such as access type labels like "normal office work," "video streaming," "social media," and "potential data breach," along with a risk score between 0 and 100. It also outputs a category probability distribution (e.g., softmax output P=[P1,……Px]), with a confidence level of max(P). If this value is less than the threshold (0.6), the behavior vector is considered low-confidence and is fed into the DBSCAN model. If the value is greater than or equal to 0.6, the behavior vector is considered high-confidence and is input into the policy engine module 104. DBSCAN Clustering Model: For behavioral vectors with low confidence output from the CNN+LSTM model, the system feeds them into the DBSCAN model. DBSCAN is a density-based clustering algorithm that clusters these "unknown" behavioral vectors into dense clusters. Vectors far from any cluster are marked as outliers, thus discovering network behaviors of new attacks or unknown malware. If an outlier exists that does not belong to any cluster, it is determined that there is unknown abnormal behavior, triggering an alarm and implementing network isolation for the associated IP or account. The strategy engine module 104 receives access type tags and risk scores output by the intelligent analysis module 103. Internally, this module maintains an enterprise-configurable strategy library, which defines the management actions corresponding to different tags and scores. For example: ("Normal office work", score < 20) -> Allow (Social Media, rating 20-50) -> Speed ​​limited to 1Mbps (Potential data breach, score > 80) -> Alert and block (“Unknown anomaly”, marked with DBSCAN) -> Issue an alert and report to the security team. The policy engine module also supports integration with existing enterprise identity authentication systems such as AD / LDAP, mapping IP addresses to specific users to achieve precise user-based management.

[0035] The execution interface module 105 communicates with the enterprise's network devices (such as next-generation firewalls, internet behavior management gateways, and SDN controllers) through standardized northbound APIs (such as RESTful APIs). It converts the specific rules generated by the policy engine module (such as source IP is xxx, destination port is xxx, and action is blocking) into instructions that the devices can recognize and then issues them.

[0036] The execution feedback module 106 is responsible for collecting the result logs of network devices after executing rules, such as "blocking successful" and "rate limiting has taken effect." These logs, especially those showing results after manual intervention by the administrator (such as adding a mistakenly blocked website to the whitelist), are extremely valuable annotation data. This module processes this feedback information in a structured manner and then sends it back to the intelligent analysis module 103.

[0037] The visualization reporting module 107 periodically (e.g. daily) retrieves data from the intelligent analysis module 103 and the execution feedback module 106, and displays the risk situation of the entire network, the ranking of high-risk events, user behavior profiles, and the effect of strategy execution to the security team through charts, dashboards, and other forms. It also pushes real-time alerts through email, WeChat Work, and other means.

[0038] Reference Figure 2 This embodiment also provides a method for managing internet access behavior based on the above system, the specific process of which is as follows: Step S201: The traffic acquisition module 101 begins to capture network traffic in real time.

[0039] Step S202: Feature extraction module 102 extracts features from the captured traffic and generates behavior vectors.

[0040] Step S203: The CNN+LSTM model of the intelligent analysis module 103 performs preliminary classification of the behavior vectors.

[0041] Step S204: Determine whether the classification confidence level is higher than the threshold. If yes, proceed to step S206; if no, proceed to step S205.

[0042] Step S205: The DBSCAN model of the intelligent analysis module 103 performs cluster analysis on low-confidence vectors to identify unknown anomalies.

[0043] Step S206: The policy engine module 104 matches the policy library with the intelligent analysis results (tags and scores) and generates access control rules.

[0044] Step S207: The execution interface module 105 sends the rules to the network devices for execution.

[0045] Step S208: The execution feedback module 106 collects the execution log and sends it back to the intelligent analysis module 103.

[0046] Step S209: The intelligent analysis module 103 performs online incremental training based on feedback to optimize model parameters.

[0047] Step S210: The visualization report module 107 generates reports and alerts.

[0048] The above process forms a continuous closed loop, enabling the entire management system to continuously optimize and evolve itself.

[0049] The above description provides examples of the preferred embodiments of the present invention. Parts not detailed herein are common knowledge to those skilled in the art. The scope of protection of the present invention is determined by the claims. Any equivalent modifications based on the technical teachings of the present invention are also within the scope of protection of the present invention.

Claims

1. A method for managing enterprise internet access behavior based on multidimensional feature extraction and clustering, characterized in that, Includes the following steps: Step S1. Real-time traffic collection: Collect real-time traffic data, and perform real-time capture and preprocessing of HTTP / HTTPS, DNS, and TCP / IP packets in the network without being noticed; Step S2. Behavioral Feature Extraction: Perform session reorganization on the preprocessed traffic data, and extract multi-dimensional features for the traffic data corresponding to each top-level domain, including session duration, access frequency, communication quintuple information, data packet size distribution, and DNS query pattern. Transform the multi-dimensional features into a high-dimensional behavioral vector corresponding to each top-level domain. Step S3. Intelligent Analysis: The high-dimensional behavior vector is input into a pre-trained intelligent analysis model, which includes a CNN+LSTM hybrid model and a DBSCAN clustering model. The CNN+LSTM hybrid model classifies the input high-dimensional behavior vector, outputting access type labels, risk scores, and confidence levels. If the confidence level of a behavior vector is lower than a preset threshold, it is classified as a low-confidence behavior vector and fed into the DBSCAN model. If the confidence level is higher than or equal to the preset threshold, it is classified as a high-confidence behavior vector, and its access type label and risk score are input into the policy engine module. The DBSCAN clustering model clusters the low-confidence behavior vectors, determining whether there are any outliers that do not belong to any cluster. If so, it indicates the presence of unknown abnormal behavior, triggers an alarm for the abnormal behavior, and implements network isolation for the associated IP or account. Step S4. Dynamic policy execution: The policy engine module receives the access type label and risk score of the behavior vector, combines it with the enterprise's preset policy library, dynamically generates access control rules that allow, rate limit, alarm or block, and sends the rules to network devices such as edge firewalls or smart gateways for execution through the northbound API interface. Step S5. Closed-loop feedback and adaptation: The execution feedback module collects the execution logs of network devices on access control rules and sends the feedback information containing the execution results back to the intelligent analysis model, triggering the online incremental training of the intelligent analysis model to achieve bidirectional adaptive optimization of the strategy and the model.

2. The enterprise internet behavior management method based on multidimensional feature extraction and clustering according to claim 1, characterized in that, In step S1, the traffic acquisition module acquires traffic through a bypass mirroring method.

3. The enterprise internet behavior management method based on multidimensional feature extraction and clustering according to claim 1, characterized in that, In step S2, the communication quintuple information includes the source IP address, destination IP address, source port, destination port, and transport layer protocol; the DNS query mode includes the frequency of domain name queries, the distribution of domain name types, and the query response time.

4. The enterprise internet behavior management method based on multidimensional feature extraction and clustering according to claim 1, characterized in that, In step S3, in the CNN+LSTM hybrid model, the convolutional neural network (CNN) is used to extract local spatial features from the sequence of behavior vectors, and the long short-term memory network (LSTM) is used to capture the dependence and dynamic change patterns of behavior in the time dimension.

5. The enterprise internet behavior management method based on multidimensional feature extraction and clustering according to claim 1, characterized in that, In step S3, the intelligent analysis model is pre-trained using large-scale enterprise actual traffic data.

6. The enterprise internet behavior management method based on multidimensional feature extraction and clustering according to claim 1, characterized in that, In step S4, the policy engine module supports integration with the existing identity authentication system, binding access control rules to specific users or user groups.

7. The enterprise internet behavior management method based on multidimensional feature extraction and clustering according to claim 1, characterized in that, It also includes step S6. Visualized Reports and Alerts: The system generates visualized reports containing risk distribution, event trends, and user behavior profiles daily based on the results of intelligent analysis and the implementation of strategies, and pushes high-risk event alerts to the security team via email, SMS, or instant messaging tools.

8. A corporate internet behavior management system based on multidimensional feature extraction and clustering, characterized in that, include: The traffic acquisition module is deployed on the bypass port of the enterprise's core switch to capture HTTP / HTTPS, DNS, and TCP / IP packets in real time. The feature extraction module, connected to the traffic acquisition module, is used to extract multi-dimensional features from traffic data and convert them into behavior vectors. The intelligent analysis module, connected to the feature extraction module, incorporates a CNN+LSTM hybrid model and a DBSCAN clustering model to classify behavior vectors and detect anomalies, and outputs access type labels and risk scores. The strategy engine module, connected to the intelligent analysis module, is used to generate dynamic access control rules based on the intelligent analysis results and the preset strategy library. An execution interface module, connected to the policy engine module, is used to distribute access control rules to network devices via the northbound API; The execution feedback module, connected to the execution interface module and the intelligent analysis module, is used to collect execution logs and send them back to the intelligent analysis module to trigger its online incremental training.

9. The system according to claim 8, characterized in that, It also includes a visualization report module, which is connected to the intelligent analysis module and the execution feedback module, and is used to generate visualization reports and push early warning information.

10. The system according to claim 8, characterized in that, The system adopts a modular design and can be seamlessly integrated with existing network devices and identity authentication systems.

Images