A network abnormal behavior recognition method and system based on a deep neural network

Abstract

The application relates to the field of network security and discloses a network abnormal behavior recognition method and system based on a deep neural network. The method collects network traffic records and security log data of a network to be monitored, forms sliding time window data through time alignment, constructs a flow sequence tensor for the network traffic records, constructs a host communication time sequence diagram with asset identification as nodes and the network traffic records as directed edges, generates a behavior representation vector through a sequence encoder, a graph encoder and a fusion layer, pretrains the sequence view and the graph view through self-supervision comparison by using unlabeled data, fine-tunes the model based on labeled abnormal samples, and obtains an abnormal behavior recognition model. In online recognition, the model outputs an abnormal behavior recognition result, can reject unknown abnormalities in combination with uncertainty and category prototype distance, and further realizes continuous recognition and audit linkage through concept drift detection, adaptive updating and evidence bag generation.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a method and system for identifying abnormal network behavior based on deep neural networks. Background Technology

[0002] With the increasing number of business systems in enterprise networks, data center networks, and cloud-edge collaborative environments, network communication relationships are characterized by high concurrency, multiple protocols, cross-regional operations, and dynamic changes. Network anomaly behavior identification is typically used to detect security risks such as port scanning, brute-force attacks, lateral movement, command and control communication, and data leakage. Existing network anomaly behavior identification methods mainly include rule-based matching, statistical feature analysis, and machine learning or deep neural network-based methods. Rule-based matching methods rely on pre-set feature libraries or security policies to quickly match known attack behaviors; statistical feature analysis methods typically extract statistical fields such as byte count, packet count, connection duration, and port distribution from traffic records for anomaly judgment; and deep neural network-based methods obtain anomaly behavior classification results by encoding and training traffic features.

[0003] However, existing methods for identifying network anomaly behavior based on deep neural networks still primarily rely on single traffic records or individual session features as input, typically focusing on the characteristics of message fields, session statistics, or the traffic sequence itself. For anomalies such as lateral movement, low-frequency scanning, phased command and control communication, and slow data transmission, the anomalies are not necessarily concentrated in a single traffic record, but rather manifested in the communication relationships between multiple assets, temporal relationships, and the correlation changes between edge traffic. Relying solely on the statistical or sequence characteristics of a single traffic record can easily overlook the contextual information in the inter-host communication links, leading to insufficient identification of highly concealed and continuous anomalies.

[0004] Furthermore, the number of anomalous samples in cybersecurity scenarios is typically limited, and the distribution of samples among different anomaly types is uneven. Traditional supervised training methods rely on a large number of labeled anomalous samples. When new attack behaviors have not yet formed stable labels, the model is prone to misclassifying unknown anomalies as existing categories or normal behavior. At the same time, network traffic distribution drifts with changes over time, service deployment, access policies, and attack methods. Fixed-train recognition models are prone to threshold mismatch, increased false positives, or increased false negatives during long-term operation. Even if existing methods can identify anomaly categories, they usually lack retrospective representations of key traffic segments, key communication edges, and behavioral links, making it difficult to establish a stable connection between the identification results and subsequent audit review and coordinated handling. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for identifying abnormal network behavior based on deep neural networks, thereby solving the technical problems existing in the prior art.

[0006] The above-mentioned technical objective of the present invention is achieved through the following technical solution: A method for identifying abnormal network behavior based on deep neural networks includes the following steps: S1: Collect network traffic records and security log data of the network to be monitored, align them according to a unified time base, and form a time window dataset based on a sliding time window; S2: For each network traffic record in the time window dataset, construct a flow sequence feature in chronological order and encode the flow sequence feature into a fixed-length flow sequence tensor; S3: Within each sliding time window, construct a host communication time sequence graph with asset identifiers as nodes and network traffic records as directed edges, and configure edge attributes for the directed edges, including the flow sequence feature statistics and timestamps corresponding to the network traffic records. S4: Construct a deep neural network model, which includes a sequence encoder, a graph encoder, and a fusion layer, where: Input the stream sequence tensor into the sequence encoder and output the stream embedding vector; Input the host communication timing diagram into the graph encoder and output the graph context embedding vector that corresponds one-to-one with the directed edges in the host communication timing diagram. Input the flow embedding vector and the corresponding graph context embedding vector into the fusion layer to output the behavior representation vector; S5: During the pre-training phase, the deep neural network model is trained using self-supervised contrastive learning on an unlabeled time window dataset. The self-supervised contrastive learning training includes: For the same network traffic record, construct sequence view samples and graph view samples. The sequence view samples are obtained by sequence enhancement from the stream sequence tensor. Sequence enhancement includes at least one of mask enhancement and time jitter enhancement. The graph view samples are obtained by neighborhood enhancement from the neighborhood subgraph of the corresponding directed edge in the host communication time sequence graph. Neighborhood enhancement includes at least one of edge sampling and time window pruning. The sequence view sample is input into the sequence encoder to obtain the first embedding vector, and the graph view sample is input into the graph encoder to obtain the second embedding vector. The first embedding vector and the second embedding vector corresponding to the same network traffic record form a positive sample pair, and the embedding vectors corresponding to different network traffic records form a negative sample pair. The contrastive loss function is calculated based on positive and negative sample pairs, and the parameters of the deep neural network model are updated by backpropagation based on the contrastive loss function to obtain the pre-trained model. S6: In the fine-tuning stage, the pre-trained model is trained under supervision based on the labeled known abnormal behavior samples, and a classification head is set at the output of the fusion layer. The classification head takes the behavior representation vector as input and outputs the probability distribution of the known abnormal behavior type to obtain the abnormal behavior recognition model. S7: In the online recognition stage, the sequence encoder, graph encoder and fusion layer of the abnormal behavior recognition model are called on the data within the current sliding time window to obtain the current behavior representation vector, and the current behavior representation vector is input into the classification head to output the recognition result.

[0007] Preferably, S1 and S2 include: The collected network traffic records are segmented into sessions based on 5-tuples and time intervals to obtain session-level traffic sequences. Extract the direction bit sequence, packet length sequence, arrival interval sequence, transport layer flag digest sequence, and session phase sequence from each session-level traffic sequence. The session phase sequence includes the handshake phase identifier, data phase identifier, and termination phase identifier. Bucket quantization is performed on the packet length sequence and arrival interval sequence. The quantization results are then concatenated with the direction bit sequence, transport layer flag digest sequence and session phase sequence in chronological order to form stream sequence features. The features of the stream sequence are encoded into a fixed-length stream sequence tensor by truncation and padding, and the stream sequence tensor is normalized.

[0008] Preferably, S3 includes: A host communication sequence graph is constructed using source asset identifiers and destination asset identifiers as nodes, and each network traffic record is used as a directed edge. Set the edge attributes of the directed edges to an edge attribute vector that includes timestamp, session duration, number of uplink bytes, number of downlink bytes, number of uplink packets, number of downlink packets, retransmission count, and port class code; Within the same sliding time window, multiple directed edges between the same pair of nodes are sorted by timestamp to form an edge sequence, and the time difference between adjacent edges in the edge sequence is written into the edge attribute vector. When the security log data includes domain name resolution logs, the domain name identifier is written as an auxiliary node into the host communication sequence diagram, and the resolution relationship from the asset identifier to the domain name identifier is written as a resolution edge into the host communication sequence diagram. The edge attributes of the resolution edge include the resolution timestamp and the resolution result category code.

[0009] Preferably, the sequence encoder, graph encoder, and fusion layer in S4 satisfy the following: The sequence encoder is an attention sequence network that includes positional encoding. It outputs position-wise hidden states for the tensor of the streaming sequence and obtains the streaming embedding vector through time-dimensional pooling. The graph encoder is a temporal graph neural network that performs multi-layer neighborhood message passing for the host communication temporal graph. Time encoding is introduced in the message passing to represent the occurrence time of directed edges, and the graph context embedding vector corresponding to each directed edge is output. The fusion layer uses a gated fusion method to generate gate coefficients. The gate coefficients are calculated by the flow embedding vector and the corresponding graph context embedding vector. The flow embedding vector and the graph context embedding vector are then weighted and fused based on the gate coefficients to output the behavior representation vector.

[0010] Preferably, the self-supervised contrastive learning training in S5 includes: For the same network traffic record, a sequence view sample and a graph view sample are constructed. The sequence view sample is obtained by performing masking enhancement and time jitter enhancement on the flow sequence tensor. The graph view sample is obtained by performing edge sampling and time window pruning on the neighborhood subgraph of the corresponding directed edge in the host communication time sequence graph. The sequence view sample is input into the sequence encoder to obtain the first embedding vector, the graph view sample is input into the graph encoder to obtain the second embedding vector, and the first embedding vector and the second embedding vector form a positive sample pair; Negative sample pairs are formed from the embedding vectors corresponding to different network traffic records within the same batch, and the embedding vectors of historical batches are written into the comparison queue as a set of negative samples. The comparison queue is a queue cache that stores the embedding vectors of historical batches. The contrastive loss function, which includes the temperature coefficient, is calculated based on positive and negative sample pairs, and the parameters of the deep neural network model are updated by backpropagation based on the contrastive loss function. In the self-supervised contrastive learning training, a mask reconstruction task is performed simultaneously. The mask reconstruction task is used to reconstruct the packet length bucket value and arrival interval bucket value corresponding to the masked position, and the mask reconstruction loss and contrastive loss are weighted and summed as the training loss.

[0011] Preferably, the known abnormal behavior types in S6 include port scanning behavior, brute-force attack behavior, lateral movement behavior, command and control communication behavior, and data transmission behavior, and the fine-tuning phase includes: The classification head is trained based on the behavior representation vector to output the probability distribution of each known abnormal behavior type; To address the imbalance of sample classes, class weights or focus loss are introduced to supervise the training of the classification head. For each known abnormal behavior type, the arithmetic mean of the behavior representation vector corresponding to that type is taken to obtain the category prototype, and the category prototype and the classification head are written together into the parameters of the abnormal behavior recognition model.

[0012] Preferably, the online identification stage in S7 includes unknown anomaly rejection judgment, which includes: The entropy value is calculated based on the probability distribution output by the classification head as the first uncertainty; Calculate the cosine distance between the current behavior representation vector and the prototypes of each category, and take the minimum cosine distance as the second uncertainty. When the first uncertainty is greater than the first threshold or the second uncertainty is greater than the second threshold, the identification result will be marked as an unknown anomaly and a mark to be judged will be output. The first threshold is the value corresponding to the preset quantile of the first uncertainty in the validation set, and the second threshold is the value corresponding to the preset quantile of the second uncertainty in the validation set. The preset quantile is determined by the preset quantile ratio, which is between zero and one.

[0013] Preferably, the method further includes concept drift detection and adaptive updating, wherein concept drift detection and adaptive updating include: Within each sliding time window, the behavioral representation vector set is aggregated, and the distribution difference between the behavioral representation vector set and the historical reference set is calculated using the maximum mean difference or the Jensen-Shannon divergence. The historical reference set is obtained by performing an exponential sliding update on the set of behavioral representation vectors within the historical sliding time window; When the distribution difference is greater than the third threshold, an adaptive update is triggered. The adaptive update includes filtering samples with confidence greater than the fourth threshold from the sliding time window that triggers the drift and writing them into the replay cache, and writing unknown abnormal samples into the unknown sample pool. Incremental training of the abnormal behavior recognition model is performed based on the replay cache and the unknown sample pool. Distillation constraints are introduced in the incremental training. The distillation constraints include using the probability distribution of the model's output on historical samples before incremental training as soft labels, constructing the distillation loss with the difference between the soft labels and the model's output during incremental training, and adding the distillation loss to the training loss of incremental training. The first and second thresholds are updated synchronously.

[0014] Preferably, the method further includes evidence package generation and coordinated processing, which includes: The key sequence position index is determined based on the attention weights of the sequence encoder or fusion layer. The key sequence position index is the first preset number of positions with the largest attention weights, and the preset number is a positive integer. The key directed edge identifier is determined by calculating the attention weight of each directed edge based on the graph encoder. The key directed edge identifier is the first preset number of directed edges with the largest attention weight. The time-ordered path containing the key directed edge is extracted from the host communication time sequence graph as evidence of the behavior chain. Write the network traffic record identifier, time window identifier, key sequence location index, key directed edge identifier, behavior chain evidence, model version number and threshold version number into the evidence package, and calculate and record the hash verification value of the evidence package based on the hash function; Based on the mapping between the identification results and the preset handling strategies, the linked handling instructions are output. The linked handling instructions include speed limit instructions, blocking instructions, isolation instructions, and secondary verification instructions.

[0015] A network anomaly behavior recognition system based on deep neural networks, comprising: The data acquisition and alignment module is used to collect network traffic records and security log data, perform time alignment, and output a time window dataset. The stream sequence encoding module, whose input is connected to the output of the data acquisition and alignment module, is used to perform session segmentation and stream sequence feature construction on the time window dataset and output a stream sequence tensor. The timing diagram construction module, whose input is connected to the output of the data acquisition and alignment module, is used to construct and output the host communication timing diagram. The behavior representation module includes a sequence encoder, a graph encoder, and a fusion layer. The input of the sequence encoder is connected to the output of the stream sequence encoding module to output a stream embedding vector. The input of the graph encoder is connected to the output of the temporal graph construction module to output a graph context embedding vector. The input of the fusion layer is connected to the stream embedding vector and the graph context embedding vector to output a behavior representation vector. The training module includes a self-supervised contrastive learning pre-training sub-module and a supervised fine-tuning sub-module. The self-supervised contrastive learning pre-training sub-module is used to calculate the contrast loss based on sequence view samples and graph view samples and update the model parameters of the sequence encoder, graph encoder and fusion layer. The supervised fine-tuning sub-module is used to set the classification head on the behavior representation vector and train the abnormal behavior recognition model based on the labeled samples. The online recognition module, whose input is connected to the output of the behavior representation module, is used to input the current behavior representation vector into the abnormal behavior recognition model and output the recognition result.

[0016] In summary, the present invention has the following main beneficial effects: This application constructs network traffic records simultaneously as flow sequence tensors and host communication temporal graphs, and forms behavioral representation vectors through sequence encoders, graph encoders, and fusion layers. This allows the temporal characteristics of a single network traffic record, such as packet length, arrival interval, direction bit, transport layer flags, and session stage, to participate in identification in conjunction with their corresponding asset communication relationships, edge attributes, and temporal adjacency relationships within a sliding time window. Therefore, this application does not simply rely on the statistical characteristics or message fields of a single traffic entry for anomaly detection, but rather establishes a correspondence between the traffic's own behavior and the inter-host communication context. This enables a more complete characterization of continuous, covert, and correlated network anomalies such as port scanning, brute-force attacks, lateral movement, command and control communication, and data outflow.

[0017] In the pre-training phase, this application uses the same network traffic record as the alignment benchmark to construct sequence view samples and graph view samples respectively. It uses the two types of embedding vectors corresponding to the same network traffic record as positive sample pairs and the embedding vectors corresponding to different network traffic records as negative sample pairs for self-supervised contrastive learning training. This approach allows the model to first learn the correspondence between flow sequence behavior and graph context behavior from unlabeled network data, and then use a small number of labeled known anomalous behavior samples for supervised fine-tuning. This reduces the dependence on a large number of manually labeled anomalous samples and alleviates the problem of unstable model representation caused by a small number of anomalous samples and an imbalanced class distribution.

[0018] This application combines the probability distribution output by the classification head and the distance between the behavior representation vector and the category prototype during the online identification stage to perform unknown anomaly rejection judgment. When a drift in the behavior representation distribution is detected, the abnormal behavior identification model is adaptively updated through replay caching, an unknown sample pool, and distillation constraints. This mechanism can avoid forcibly classifying novel, unseen abnormal behaviors into existing categories, and maintain the model's ability to identify existing abnormal behaviors and adapt to new traffic distributions when network traffic, access patterns, or attack methods change. Furthermore, this application generates an evidence package containing key sequence location indexes, key directed edge identifiers, and behavior chain evidence, enabling the identification results to be traced back to the corresponding traffic segments and communication paths, facilitating subsequent auditing, review, and coordinated handling. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1 refer to Figure 1 A method for identifying abnormal network behavior based on deep neural networks includes the following steps: S1: Collect network traffic records and security log data of the network to be monitored, align them according to a unified time base, and form a time window dataset based on a sliding time window; S2: For each network traffic record in the time window dataset, construct a flow sequence feature in chronological order and encode the flow sequence feature into a fixed-length flow sequence tensor; S3: Within each sliding time window, construct a host communication time sequence graph with asset identifiers as nodes and network traffic records as directed edges, and configure edge attributes for the directed edges, including the flow sequence feature statistics and timestamps corresponding to the network traffic records. S4: Construct a deep neural network model, which includes a sequence encoder, a graph encoder, and a fusion layer, where: Input the stream sequence tensor into the sequence encoder and output the stream embedding vector; Input the host communication timing diagram into the graph encoder and output the graph context embedding vector that corresponds one-to-one with the directed edges in the host communication timing diagram. Input the flow embedding vector and the corresponding graph context embedding vector into the fusion layer to output the behavior representation vector; S5: During the pre-training phase, the deep neural network model is trained using self-supervised contrastive learning on an unlabeled time window dataset. The self-supervised contrastive learning training includes: For the same network traffic record, construct sequence view samples and graph view samples. The sequence view samples are obtained by sequence enhancement from the stream sequence tensor. Sequence enhancement includes at least one of mask enhancement and time jitter enhancement. The graph view samples are obtained by neighborhood enhancement from the neighborhood subgraph of the corresponding directed edge in the host communication time sequence graph. Neighborhood enhancement includes at least one of edge sampling and time window pruning. The sequence view sample is input into the sequence encoder to obtain the first embedding vector, and the graph view sample is input into the graph encoder to obtain the second embedding vector. The first embedding vector and the second embedding vector corresponding to the same network traffic record form a positive sample pair, and the embedding vectors corresponding to different network traffic records form a negative sample pair. The contrastive loss function is calculated based on positive and negative sample pairs, and the parameters of the deep neural network model are updated by backpropagation based on the contrastive loss function to obtain the pre-trained model. S6: In the fine-tuning stage, the pre-trained model is trained under supervision based on the labeled known abnormal behavior samples, and a classification head is set at the output of the fusion layer. The classification head takes the behavior representation vector as input and outputs the probability distribution of the known abnormal behavior type to obtain the abnormal behavior recognition model. S7: In the online recognition stage, the sequence encoder, graph encoder and fusion layer of the abnormal behavior recognition model are called on the data within the current sliding time window to obtain the current behavior representation vector, and the current behavior representation vector is input into the classification head to output the recognition result.

[0022] Network traffic records are structured records of network communication behavior, including at least the source asset identifier, destination asset identifier, source port, destination port, transport layer protocol, start timestamp, end timestamp, uplink byte count, downlink byte count, uplink packet count, downlink packet count, and transport layer flag statistics or summary. The asset identifier can be formed by combining the asset device identifier and the network address, and is used to uniquely identify the node object throughout the entire process.

[0023] A session-level traffic sequence is a session object formed by a sequence of segments that share the same 5-tuple and satisfy a preset time interval condition. A flow sequence tensor is a fixed-length tensor representation that maps a session-level traffic sequence.

[0024] The host communication timing graph is a graph structure built with asset identifiers as nodes and network traffic records as directed edges. Multiple directed edges in the same or opposite directions can exist within the same sliding time window. The graph context embedding vector is the context representation output by the graph encoder for each directed edge, ensuring a one-to-one correspondence with each directed edge. The behavior representation vector is the representation obtained by combining the fusion layer's fused flow embedding vector and the graph context embedding vector, ensuring a one-to-one correspondence with each network traffic record.

[0025] The classification head is a classification network set at the output of the fusion layer, used to output the probability distribution of known anomalous behavior types. The comparison queue is a queue cache that stores historical batch embedding vectors, using a first-in-first-out update method. The replay cache is a cache set that stores high-confidence samples, and the unknown sample pool is a set that stores unknown anomalous samples.

[0026] Network packets are collected at network egress points, core switch mirror ports, or bypass probes. Collection methods can include packet capture at the mirror port or kernel observation. The collection probe maintains a local session buffer, recording the segment length and arrival timestamp for packets within the same session in chronological order of arrival time, thus forming the original data source for packet length sequences and arrival interval sequences.

[0027] When the upstream device only provides aggregated flow records, the acquisition probe still retains the segment length and arrival time information in the session cache, and uses the five-tuple and time range of the aggregated flow record as an index to associate the session cache, generating a session-level traffic sequence to ensure that a flow sequence tensor can be formed later.

[0028] Security log data should include at least security audit logs, which may come from authentication systems, host audits, perimeter protection devices, or alarm platforms. They should include at least the event timestamp, event type, asset identifiers involved, and target address or target domain name.

[0029] When conditions permit, further collect domain name resolution logs. The domain name resolution logs should include at least the resolution timestamp, the initiating asset identifier, the domain name identifier, and the resolution result category.

[0030] Time alignment is performed on network traffic records and security log data. Time alignment can be accomplished using a unified clock source or a preset offset correction table. After alignment, the data is divided into time window datasets by a sliding time window. The sliding time window is determined by the window length and the sliding step size. The window length and step size are preset values ​​and can be configured from several seconds to several minutes according to the event density. The step size is less than or equal to the window length.

[0031] The collected network traffic records are segmented into sessions based on a 5-tuple and a time interval. The time interval is a preset threshold used to determine whether adjacent segments belong to the same session-level traffic sequence. The session-level traffic sequence is obtained after session segmentation.

[0032] Extract traffic from each session-level traffic sequence in chronological order: Direction bit sequence, used to represent the direction of a message segment; Packet length sequence, which is a sequence of message segment lengths; Arrival interval sequence is a sequence of arrival time differences between adjacent segments; The transport layer flag digest sequence is a combination or statistical encoding of transport layer flag bits. The session phase sequence includes the handshake phase identifier, the data phase identifier, and the termination phase identifier.

[0033] For connection-oriented protocols, the phase identifier can be determined based on the segment flag and the state machine. For non-connection-oriented protocols or sessions that cannot parse handshakes and terminations, the handshake phase identifier and termination phase identifier are set to preset default values, and only the data phase identifier is retained to ensure the consistency of the tensor dimension of the stream sequence.

[0034] The packet length sequence and arrival interval sequence are binned and quantized. The bin boundaries can be equal-width bins or quantized bins based on historical sample statistics. The quantization results, along with the direction bit sequence, transport layer flag summary sequence, and session phase sequence, are concatenated in chronological order to form the stream sequence features.

[0035] The features of the stream sequence are encoded into a fixed-length stream sequence tensor by truncation and padding. Truncation and padding are performed in the time dimension, and the padding positions use preset padding values. Subsequently, the stream sequence tensor is normalized. The normalization statistics are estimated from historical samples in the pre-training stage and remain consistent in the fine-tuning and online recognition stages.

[0036] Within each sliding time window, the source asset identifier and the destination asset identifier are used as nodes, and each network traffic record is used as a directed edge, with the direction of the directed edge pointing from the source asset identifier to the destination asset identifier.

[0037] Each directed edge is configured with an edge attribute vector, which includes at least a timestamp, session duration, number of uplink bytes, number of downlink bytes, number of uplink packets, number of downlink packets, retransmission count, and port category code. The port category code is determined by a pre-established encoding table. For example, commonly used service ports are encoded as the first category, temporary port ranges are encoded as the second category, and unknown ports are encoded as the third category. The encoding table remains consistent during the pre-training, fine-tuning, and online recognition phases.

[0038] Within the same sliding time window, multiple directed edges between the same pair of nodes are sorted by timestamp to form an edge sequence. The time difference between adjacent edges in the edge sequence is written into the edge attribute vector to characterize the temporal relationship of the communication pair within the window.

[0039] When security log data includes domain name resolution logs, the domain name identifier is written as an auxiliary node into the host communication sequence diagram, and the resolution relationship from asset identifier to domain name identifier is written as a resolution edge into the host communication sequence diagram. The edge attributes of the resolution edge include the resolution timestamp and the resolution result category code. The resolution result category code can encode the resolution result as an internal network address, an external network address, and an unresolvable address into different categories.

[0040] The sequence encoder is an attention sequence network that incorporates positional encoding, taking a stream sequence tensor as input. The sequence encoder outputs position-wise hidden states, which are then pooled over time to obtain the stream embedding vector. During attention computation, the sequence encoder outputs attention weight vectors corresponding to each time position. These attention weight vectors are stored in a one-to-one correspondence with the time position indices of the stream sequence tensor, for use in subsequent evidence packet generation.

[0041] The graph encoder is a temporal graph neural network, and its input is a host communication temporal graph. The graph encoder performs multi-layer neighborhood message passing on the host communication temporal graph. Temporal encoding is introduced in the message passing to represent the occurrence time of directed edges, and the output is a graph context embedding vector that corresponds one-to-one with the directed edges in the host communication temporal graph.

[0042] In one implementation, the graph encoder uses an attention-based neighborhood aggregation method, outputting the attention coefficients of directed edges in each message pass, and storing the directed edge identifiers and attention coefficients in a one-to-one correspondence for use in the generation of subsequent evidence packets.

[0043] The fusion layer uses a gated fusion method to generate gating coefficients. These coefficients are obtained by concatenating the flow embedding vector and the graph context embedding vector, then inputting them into the fully connected layer, and constraining them to a preset range using an activation function. The fusion layer performs a weighted fusion of the flow embedding vector and the graph context embedding vector based on the gating coefficients, outputting a behavior representation vector. This behavior representation vector corresponds one-to-one with network traffic records.

[0044] In this embodiment, an unlabeled time window dataset is used to train a deep neural network model during the pre-training stage. The training samples are aligned with network traffic records to ensure that the sequence view and the graph view are strongly bound to the same object.

[0045] Sequence augmentation is performed on the flow sequence tensor corresponding to the same network traffic record to obtain a sequence view sample. Sequence augmentation includes at least one of masking augmentation and temporal jitter augmentation. Masking augmentation sets preset mask values ​​at several positions in the time dimension, with a preset mask ratio. Temporal jitter augmentation applies a limited-amplitude perturbation to the arrival interval sequence or its quantization result. The perturbation range is limited by a preset upper limit and does not change the sequence order.

[0046] For the same network traffic record, find its corresponding directed edge in the host communication time sequence graph, and extract the neighborhood subgraph centered on this directed edge to form the base subgraph of the graph view sample. The hop count of the neighborhood subgraph is a preset value, and the timestamps of the directed edges within the neighborhood subgraph are limited to fall within the current sliding time window.

[0047] Neighborhood enhancement is performed on the neighborhood subgraph to obtain a graph view sample. Neighborhood enhancement includes at least one of edge sampling and time window clipping. Edge sampling retains some directed edges within the neighborhood subgraph according to a preset sampling ratio. Time window clipping truncates the directed edges within the neighborhood subgraph into continuous sub-intervals within a window based on timestamps.

[0048] Input the sequence view sample into the sequence encoder to obtain the first embedding vector, and input the graph view sample into the graph encoder to obtain the second embedding vector.

[0049] The first and second embedding vectors corresponding to the same network traffic record constitute a positive sample pair. The combinations of embedding vectors corresponding to different network traffic records constitute a negative sample pair.

[0050] To expand the negative sample set, historical batch embedding vectors are written to the comparison queue. The comparison queue is a queue cache that stores historical batch embedding vectors. It has a preset capacity limit and uses a first-in-first-out (FIFO) strategy for enqueueing and dequeueing.

[0051] For ease of explanation, the symbols are defined as follows: Indicates the first The first embedding vector output by the sequence encoder from the sequence view sample of the network traffic records; Indicates the first The second embedding vector is output by the graph encoder from the view graph sample of the network traffic record; This represents the similarity function; in this embodiment, cosine similarity is used. This represents the temperature coefficient, and is a positive number. This indicates the number of samples participating in the comparison calculation. Negative samples can come from the current batch and the comparison queue.

[0052] The contrast loss in the sequence view to graph view direction is: ; The contrast loss in the direction from the graphical view to the sequence view is: ; The overall batch loss is averaged in two directions: ; After calculating the contrastive loss, backpropagation is performed on the parameters of the deep neural network model to update them, resulting in a pre-trained model.

[0053] In the self-supervised contrastive learning training, a mask reconstruction task is performed simultaneously. This task reconstructs the packet length bucket value and arrival interval bucket value corresponding to the masked location. The mask reconstruction loss and the contrastive loss are weighted and summed according to preset weights to serve as the training loss, and the model parameters are updated accordingly.

[0054] Known abnormal behavior types include port scanning, brute-force attacks, lateral movement, command and control communication, and data transmission. A pre-trained model is trained under supervision based on labeled known abnormal behavior samples. A classification head is added to the output of the fusion layer. This classification head takes the behavior representation vector as input and outputs the probability distribution of the known abnormal behavior types, thus obtaining the abnormal behavior recognition model.

[0055] To address the imbalance of sample classes, class weights or focus loss are introduced to supervise the training of the classification head. The class weights are obtained by statistically analyzing the number of classes in the training set.

[0056] For each known abnormal behavior type, the arithmetic mean of the behavior representation vector corresponding to that type is taken to obtain the category prototype. The category prototype and the classification head are then written into the parameters of the abnormal behavior recognition model. The category prototype is calculated and fixed after the fine-tuning phase; it can be recalculated and updated after subsequent incremental training.

[0057] During the online recognition phase, the sequence encoder, graph encoder, and fusion layer of the abnormal behavior recognition model are called on the data within the current sliding time window to obtain the current behavior representation vector, and the current behavior representation vector is input into the classification head to output the recognition result.

[0058] Unknown anomaly rejection criteria include: The entropy value is calculated based on the probability distribution output by the classification head as the first uncertainty; Calculate the cosine distance between the current behavior representation vector and the prototypes of each category, and take the minimum cosine distance as the second uncertainty. When the first uncertainty is greater than the first threshold or the second uncertainty is greater than the second threshold, the identification result will be marked as an unknown anomaly and a pending judgment mark will be output.

[0059] The first and second thresholds are determined by the validation set, specifically by the values ​​corresponding to the preset quantiles of the uncertainty in the validation set. The preset quantiles are determined by the preset quantile ratio, which is between zero and one. The thresholds are fixed before deployment and are updated synchronously by adaptive updates.

[0060] Within each sliding time window, a set of behavioral representation vectors is aggregated, and the distributional dissimilarity between the behavioral representation vector set and the historical reference set is calculated using either the maximum mean difference or the Jensen-Shannon divergence. The historical reference set is obtained by performing an exponential sliding update on the behavioral representation vector set within the historical sliding time window, with the update coefficient of the exponential sliding update being a preset positive number.

[0061] The third threshold is determined by the statistical distribution of the distribution difference of the historical normal time window, and the fourth threshold is determined by the statistical distribution of the probability of the largest category of the classification head in the validation set. Both can be set according to the preset quantile ratio and fixed before deployment.

[0062] An adaptive update is triggered when the distribution dissimilarity exceeds a third threshold. The adaptive update involves selecting samples with a confidence level greater than a fourth threshold from the sliding time window that triggered the drift and writing them into the replay buffer, while adding unknown outlier samples to the unknown sample pool. The confidence level is determined by the maximum class probability output by the classification head.

[0063] Sample labels in the unknown sample pool can be obtained in the following ways: First, unknown samples are back-labeled by combining alarm events and handling results in the security audit log; Secondly, unknown samples are labeled and confirmed based on the results of blocking, isolation, or secondary verification triggered by preset handling strategies; Third, when the label cannot be confirmed, the unknown sample only participates in the unsupervised consistency constraint training and does not participate in the supervised loss calculation, so as to ensure that the incremental training process can be implemented.

[0064] Key Formulas for Incremental Training and Distillation Constraints Incremental training of the abnormal behavior recognition model is performed based on replay caching and an unknown sample pool. Distillation constraints are introduced in incremental training. The distillation constraints include using the probability distribution of the model's output on historical samples before incremental training as soft labels, constructing a distillation loss based on the difference between the soft labels and the model's output during incremental training, and adding the distillation loss to the training loss of incremental training.

[0065] For ease of explanation, the symbols are defined as follows: This indicates the model's performance on samples before incremental training. Output of the category probability distribution; This indicates the current model's understanding of samples during incremental training. Output of the category probability distribution; Indicates a category index; This represents the weight of distillation loss and is a non-negative number. The distillation loss is: ; The total loss during incremental training is: ; in To monitor the loss, samples are derived from existing labels in the replay cache and confirmed label samples in the unknown sample pool. After incremental training is completed, the first and second thresholds are updated synchronously.

[0066] The key sequence position index is determined based on the attention weights of the sequence encoder or fusion layer. The key sequence position index is the top preset number of positions with the largest attention weights, where the preset number is a positive integer. There is a one-to-one correspondence between the attention weights and the temporal position indices of the stream sequence tensor, allowing direct backtracking to the corresponding message segment position.

[0067] The key directed edge identifier is determined by calculating the attention weight of each directed edge based on the graph encoder. The key directed edge identifier is the first preset number of directed edges with the largest attention weight, and the directed edge identifier corresponds one-to-one with the attention weight.

[0068] In the host communication timing graph, time-ordered paths containing key directed edges are extracted as behavioral chain evidence. The extraction rule is to use key directed edges as path anchors, expand adjacent reachable edges forward and backward within a preset time span, with the path length not exceeding a preset upper limit, and output the time-ordered paths in ascending order of timestamps to form behavioral chain evidence.

[0069] Write the network traffic record identifier, time window identifier, key sequence location index, key directed edge identifier, behavior chain evidence, model version number, and threshold version number into the evidence package, and calculate and record the hash verification value of the evidence package based on the hash function.

[0070] Based on the mapping between the identification results and preset handling strategies, coordinated handling commands are output. These commands include rate-limiting commands, blocking commands, isolation commands, and secondary verification commands. The handling strategy mapping table is pre-configured by security policies and can be configured with different handling actions according to asset importance and anomaly type.

[0071] Example 2 Network Anomaly Recognition System Based on Deep Neural Network The system includes: Data Acquisition and Alignment Module: This tool is used to collect network traffic records and security log data, perform time alignment, and output a time window dataset. This output is then connected to the stream sequence encoding module and the time sequence graph construction module, respectively.

[0072] Stream sequence encoding module: Its input connects to the output of the data acquisition and alignment module, used for session segmentation, stream sequence feature construction, bucketing quantization, truncation and padding, and normalization of the time window dataset, outputting a stream sequence tensor. This output connects to the input of the sequence encoder in the behavior representation module.

[0073] Sequence diagram construction module: Its input is connected to the output of the data acquisition and alignment module, used to construct a host communication timing graph with asset identifiers as nodes and network traffic records as directed edges, and to configure edge attributes, outputting the host communication timing graph. This output is connected to the input of the graph encoder in the behavior representation module.

[0074] Behavioral representation module: It includes a sequence encoder, a graph encoder, and a fusion layer. The sequence encoder outputs a stream embedding vector, the graph encoder outputs a graph context embedding vector that corresponds one-to-one with each directed edge, and the fusion layer receives the stream embedding vector and the graph context embedding vector and outputs a behavior representation vector. The behavior representation vector output is connected to the training module and the online recognition module.

[0075] Training module: The system comprises a self-supervised contrastive learning pre-training submodule and a supervised fine-tuning submodule. The self-supervised contrastive learning pre-training submodule constructs sequence view samples and graph view samples, calculates the contrastive loss, and updates the model parameters of the sequence encoder, graph encoder, and fusion layer. The supervised fine-tuning submodule sets a classification head on the behavior representation vector and trains the abnormal behavior recognition model based on labeled samples. The output of the training module is connected to the online recognition module to provide the abnormal behavior recognition model parameters.

[0076] Online recognition module: Its input is connected to the output of the behavior representation module, which is used to input the current behavior representation vector into the abnormal behavior recognition model and output the recognition result. It can also perform unknown anomaly rejection judgment, concept drift detection and adaptive update, evidence package generation and linkage processing.

[0077] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for identifying abnormal network behavior based on deep neural networks, characterized in that, Includes the following steps: S1: Collect network traffic records and security log data of the network to be monitored, align them according to a unified time base, and form a time window dataset based on a sliding time window; S2: For each network traffic record in the time window dataset, construct a flow sequence feature in chronological order and encode the flow sequence feature into a fixed-length flow sequence tensor; S3: Within each sliding time window, construct a host communication time sequence graph with asset identifiers as nodes and network traffic records as directed edges, and configure edge attributes for the directed edges, including the flow sequence feature statistics and timestamps corresponding to the network traffic records. S4: Construct a deep neural network model, which includes a sequence encoder, a graph encoder, and a fusion layer, where: Input the stream sequence tensor into the sequence encoder and output the stream embedding vector; Input the host communication timing diagram into the graph encoder and output the graph context embedding vector that corresponds one-to-one with the directed edges in the host communication timing diagram. Input the flow embedding vector and the corresponding graph context embedding vector into the fusion layer to output the behavior representation vector; S5: During the pre-training phase, the deep neural network model is trained using self-supervised contrastive learning on an unlabeled time window dataset. The self-supervised contrastive learning training includes: For the same network traffic record, construct sequence view samples and graph view samples. The sequence view samples are obtained by sequence enhancement from the stream sequence tensor. Sequence enhancement includes at least one of mask enhancement and time jitter enhancement. The graph view samples are obtained by neighborhood enhancement from the neighborhood subgraph of the corresponding directed edge in the host communication time sequence graph. Neighborhood enhancement includes at least one of edge sampling and time window pruning. The sequence view sample is input into the sequence encoder to obtain the first embedding vector, and the graph view sample is input into the graph encoder to obtain the second embedding vector. The first embedding vector and the second embedding vector corresponding to the same network traffic record form a positive sample pair, and the embedding vectors corresponding to different network traffic records form a negative sample pair. The contrastive loss function is calculated based on positive and negative sample pairs, and the parameters of the deep neural network model are updated by backpropagation based on the contrastive loss function to obtain the pre-trained model. S6: In the fine-tuning stage, the pre-trained model is trained under supervision based on the labeled known abnormal behavior samples, and a classification head is set at the output of the fusion layer. The classification head takes the behavior representation vector as input and outputs the probability distribution of the known abnormal behavior type to obtain the abnormal behavior recognition model. S7: In the online recognition stage, the sequence encoder, graph encoder and fusion layer of the abnormal behavior recognition model are called on the data within the current sliding time window to obtain the current behavior representation vector, and the current behavior representation vector is input into the classification head to output the recognition result.

2. The method for identifying abnormal network behavior based on a deep neural network according to claim 1, characterized in that, S1 and S2 include: The collected network traffic records are segmented into sessions based on 5-tuples and time intervals to obtain session-level traffic sequences. Extract the direction bit sequence, packet length sequence, arrival interval sequence, transport layer flag digest sequence, and session phase sequence from each session-level traffic sequence. The session phase sequence includes the handshake phase identifier, data phase identifier, and termination phase identifier. Bucket quantization is performed on the packet length sequence and arrival interval sequence. The quantization results are then concatenated with the direction bit sequence, transport layer flag digest sequence and session phase sequence in chronological order to form stream sequence features. The features of the stream sequence are encoded into a fixed-length stream sequence tensor by truncation and padding, and the stream sequence tensor is normalized.

3. The method for identifying abnormal network behavior based on a deep neural network according to claim 2, characterized in that, S3 includes: A host communication sequence graph is constructed using source asset identifiers and destination asset identifiers as nodes, and each network traffic record is used as a directed edge. Set the edge attributes of the directed edges to an edge attribute vector that includes timestamp, session duration, number of uplink bytes, number of downlink bytes, number of uplink packets, number of downlink packets, retransmission count, and port class code; Within the same sliding time window, multiple directed edges between the same pair of nodes are sorted by timestamp to form an edge sequence, and the time difference between adjacent edges in the edge sequence is written into the edge attribute vector. When the security log data includes domain name resolution logs, the domain name identifier is written as an auxiliary node into the host communication sequence diagram, and the resolution relationship from the asset identifier to the domain name identifier is written as a resolution edge into the host communication sequence diagram. The edge attributes of the resolution edge include the resolution timestamp and the resolution result category code.

4. The method for identifying abnormal network behavior based on a deep neural network according to claim 3, characterized in that, The sequence encoder, graph encoder, and fusion layer in S4 satisfy the following: The sequence encoder is an attention sequence network that includes positional encoding. It outputs position-wise hidden states for the tensor of the streaming sequence and obtains the streaming embedding vector through time-dimensional pooling. The graph encoder is a temporal graph neural network that performs multi-layer neighborhood message passing for the host communication temporal graph. Time encoding is introduced in the message passing to represent the occurrence time of directed edges, and the graph context embedding vector corresponding to each directed edge is output. The fusion layer uses a gated fusion method to generate gate coefficients. The gate coefficients are calculated by the flow embedding vector and the corresponding graph context embedding vector. The flow embedding vector and the graph context embedding vector are then weighted and fused based on the gate coefficients to output the behavior representation vector.

5. The method for identifying abnormal network behavior based on a deep neural network according to claim 4, characterized in that, The self-supervised contrastive learning training in S5 includes: For the same network traffic record, a sequence view sample and a graph view sample are constructed. The sequence view sample is obtained by performing masking enhancement and time jitter enhancement on the flow sequence tensor. The graph view sample is obtained by performing edge sampling and time window pruning on the neighborhood subgraph of the corresponding directed edge in the host communication time sequence graph. The sequence view sample is input into the sequence encoder to obtain the first embedding vector, the graph view sample is input into the graph encoder to obtain the second embedding vector, and the first embedding vector and the second embedding vector form a positive sample pair; Negative sample pairs are formed from the embedding vectors corresponding to different network traffic records within the same batch, and the embedding vectors of historical batches are written into the comparison queue as a set of negative samples. The comparison queue is a queue cache that stores the embedding vectors of historical batches. The contrastive loss function, which includes the temperature coefficient, is calculated based on positive and negative sample pairs, and the parameters of the deep neural network model are updated by backpropagation based on the contrastive loss function. In the self-supervised contrastive learning training, a mask reconstruction task is performed simultaneously. The mask reconstruction task is used to reconstruct the packet length bucket value and arrival interval bucket value corresponding to the masked position, and the mask reconstruction loss and contrastive loss are weighted and summed as the training loss.

6. The method for identifying abnormal network behavior based on a deep neural network according to claim 5, characterized in that, The known abnormal behavior types in S6 include port scanning behavior, brute-force attack behavior, lateral movement behavior, command and control communication behavior, and data outgoing behavior, and the fine-tuning phase includes: The classification head is trained based on the behavior representation vector to output the probability distribution of each known abnormal behavior type; To address the imbalance of sample classes, class weights or focus loss are introduced to supervise the training of the classification head. For each known abnormal behavior type, the arithmetic mean of the behavior representation vector corresponding to that type is taken to obtain the category prototype, and the category prototype and the classification head are written together into the parameters of the abnormal behavior recognition model.

7. The method for identifying abnormal network behavior based on a deep neural network according to claim 6, characterized in that, The online identification stage in S7 includes unknown anomaly rejection judgment, which includes: The entropy value is calculated based on the probability distribution output by the classification head as the first uncertainty; Calculate the cosine distance between the current behavior representation vector and the prototypes of each category, and take the minimum cosine distance as the second uncertainty. When the first uncertainty is greater than the first threshold or the second uncertainty is greater than the second threshold, the identification result will be marked as an unknown anomaly and a mark to be judged will be output. The first threshold is the value corresponding to the preset quantile of the first uncertainty in the validation set, and the second threshold is the value corresponding to the preset quantile of the second uncertainty in the validation set. The preset quantile is determined by the preset quantile ratio, which is between zero and one.

8. The method for identifying abnormal network behavior based on a deep neural network according to claim 7, characterized in that, The method further includes concept drift detection and adaptive updating, wherein concept drift detection and adaptive updating include: Within each sliding time window, the behavioral representation vector set is aggregated, and the distribution difference between the behavioral representation vector set and the historical reference set is calculated using the maximum mean difference or the Jensen-Shannon divergence. The historical reference set is obtained by performing an exponential sliding update on the set of behavioral representation vectors within the historical sliding time window; When the distribution difference is greater than the third threshold, an adaptive update is triggered. The adaptive update includes filtering samples with confidence greater than the fourth threshold from the sliding time window that triggers the drift and writing them into the replay cache, and writing unknown abnormal samples into the unknown sample pool. Incremental training of the abnormal behavior recognition model is performed based on the replay cache and the unknown sample pool. Distillation constraints are introduced in the incremental training. The distillation constraints include using the probability distribution of the model's output on historical samples before incremental training as soft labels, constructing the distillation loss with the difference between the soft labels and the model's output during incremental training, and adding the distillation loss to the training loss of incremental training. The first and second thresholds are updated synchronously.

9. The method for identifying abnormal network behavior based on a deep neural network according to claim 8, characterized in that, The method also includes evidence package generation and coordinated processing, which includes: The key sequence position index is determined based on the attention weights of the sequence encoder or fusion layer. The key sequence position index is the first preset number of positions with the largest attention weights, and the preset number is a positive integer. The key directed edge identifier is determined by calculating the attention weight of each directed edge based on the graph encoder. The key directed edge identifier is the first preset number of directed edges with the largest attention weight. The time-ordered path containing the key directed edge is extracted from the host communication time sequence graph as evidence of the behavior chain. Write the network traffic record identifier, time window identifier, key sequence location index, key directed edge identifier, behavior chain evidence, model version number and threshold version number into the evidence package, and calculate and record the hash verification value of the evidence package based on the hash function; Based on the mapping between the identification results and the preset handling strategies, the linked handling instructions are output. The linked handling instructions include speed limit instructions, blocking instructions, isolation instructions, and secondary verification instructions.

10. A network anomaly behavior recognition system based on deep neural networks, applicable to the network anomaly behavior recognition method based on deep neural networks as described in any one of claims 1-9, characterized in that, include: The data acquisition and alignment module is used to collect network traffic records and security log data, perform time alignment, and output a time window dataset. The stream sequence encoding module, whose input is connected to the output of the data acquisition and alignment module, is used to perform session segmentation and stream sequence feature construction on the time window dataset and output a stream sequence tensor. The timing diagram construction module, whose input is connected to the output of the data acquisition and alignment module, is used to construct and output the host communication timing diagram. The behavior representation module includes a sequence encoder, a graph encoder, and a fusion layer. The input of the sequence encoder is connected to the output of the stream sequence encoding module to output a stream embedding vector. The input of the graph encoder is connected to the output of the temporal graph construction module to output a graph context embedding vector. The input of the fusion layer is connected to the stream embedding vector and the graph context embedding vector to output a behavior representation vector. The training module includes a self-supervised contrastive learning pre-training sub-module and a supervised fine-tuning sub-module. The self-supervised contrastive learning pre-training sub-module is used to calculate the contrast loss based on sequence view samples and graph view samples and update the model parameters of the sequence encoder, graph encoder and fusion layer. The supervised fine-tuning sub-module is used to set the classification head on the behavior representation vector and train the abnormal behavior recognition model based on the labeled samples. The online recognition module, whose input is connected to the output of the behavior representation module, is used to input the current behavior representation vector into the abnormal behavior recognition model and output the recognition result.

Images