Anomaly detection device and method utilizing data augmentation

Abstract

An anomaly detection device and an anomaly detection method using data augmentation are provided. [Solution] An anomaly detection device 100 using data augmentation includes a continuous data collection module and a processor. The processor performs the following steps: for the collected data records, using a plurality of activation functions associated with a plurality of behavior types to perform activation state determination on a plurality of behavioral information to generate a set of behavior types specific to each subject; for each subject, performing data augmentation by enumerating a plurality of mathematical combinations of the behavior types; training a machine learning model of a plurality of baseline behavioral features using the output of the data augmentation as input to a learning function; and detecting anomalies using new output of the data augmentation performed based on all new data records captured by the continuous data collection module from the test subjects within a defined time range as input to a prediction function.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more particularly to an anomaly detection device and method using data expansion.

Background Art

[0002] In the conventional field of information security, in addition to attacks by computer viruses and Trojan horse programs, there are various grey behaviors and greyware in various network environments, network programs, and processing systems. Grey behaviors and greyware refer to all behaviors that are not computer viruses or Trojan horse programs but may have an adverse impact on the effects of various network environments, network programs, and processing systems and may cause damage to information security, or software that performs suspicious behaviors.

Summary of the Invention

Problems to be Solved by the Invention

[0003] However, in the conventional field of information security, it has not been possible to effectively identify whether a subject or data having grey behaviors or greyware is benign or abnormal.

[0004] Furthermore, in a zero-trust environment, access to individual system software resources (e.g., software programs and firmware programs), systems used by users (e.g., network systems and wireless communication systems), and the company's assets themselves (e.g., the company itself, factories, aircraft, etc.) is verified, but it does not simply verify the ownership or location of access to individual system software resources, systems used by users, or the company's assets themselves. In other words, in a zero-trust environment, each user had to verify these individual access actions before accessing each of the company's resources. However, in the field of conventional information security, it was not possible to effectively identify or verify whether gray behavior or grayware in a zero-trust environment had passed verification.

[0005] This invention has been made in view of the circumstances described above, and one of its objectives is to solve the problems described above. Specifically, the present invention aims to provide an anomaly detection device and method that utilize data augmentation to significantly reduce human resources required for data collection and significantly improve the accuracy of anomaly detection in gray area behavior. [Means for solving the problem]

[0006] To achieve the above objective, an anomaly detection device utilizing data augmentation, which is one aspect of the present invention, A continuous data acquisition module positioned to capture multiple data records of multiple subjects in a training environment where supervision is provided to ensure normal operation, or in a normal work environment, wherein each data record includes time, subject, multiple behavior types, and multiple behavioral information corresponding to each of the multiple behavior types. It is configured to store machine learning models of multiple instructions and multiple baseline behavioral features, a) A learning function step that takes a set of behavior types of a predefined length N as input and adds the set to a plurality of baseline behavior features, b) A memory that performs a prediction function step that takes a new set of the aforementioned action types of the defined length N as input and outputs a match state, The continuous data acquisition module and the memory are connected, and for each of the data recordings, The process involves using multiple activation functions associated with multiple behavior types to perform activation status determination on multiple behavior information, combining all behavior types in the activated state for each subject, generating a set of behavior types specific to each subject, where each set represents multiple behavioral features of the corresponding subject, and Data augmentation is performed by enumerating all mathematical combinations of the predefined length N in the set of behavior types for each subject, based on the predefined length N used in the machine learning model of the multiple baseline behavior features, where each mathematical combination is a subset of the predefined length N of the multiple behavior features of the subject. In the aforementioned training environment, after data collection training is completed, the output of the data augmentation is used as input to the learning function, and during the model training period, the machine learning model of the multiple baseline behavioral features is trained. The system comprises a processor configured to execute a number of instructions, including the steps of: taking the new output of data augmentation performed by the continuous data acquisition module based on all new data records captured from the test subject within a defined time range in the normal working environment as input to the prediction function; and indicating as an abnormal event if the response of the prediction function indicates an abnormal match state.

[0007] To achieve the above objective, another aspect of the present invention, a method for detecting anomalies using data augmentation, is: In a training environment where supervision is provided to ensure that work is performed correctly, or in a normal work environment, a continuous data acquisition module captures multiple data records of multiple subjects, each data record including time, subject, multiple behavior types, and multiple behavioral information corresponding to each of the multiple behavior types, The processor performs a determination of the activation state for multiple behavior information using multiple activation functions associated with multiple behavior types for each data record, combines all behavior types in the activation state for each subject, generates a set of behavior types specific to each subject, and each set represents multiple behavioral characteristics of the corresponding subject. The processor performs data augmentation for each data record by enumerating all mathematical combinations of the defined length N in the set of behavior types for each subject, based on a defined length N used in a machine learning model of multiple baseline behavior features, wherein each mathematical combination is a subset of the defined length N of multiple behavior features of the subject. In the training environment, after completing data collection training, the processor uses the output of the data augmentation as input to a learning function, and during the model training period, trains the machine learning model of the multiple baseline behavioral features, the learning function takes the set of the behavioral types of the predefined length N as input, and adds the set to the multiple baseline behavioral features. In the normal working environment, the processor inputs a new output of data augmentation performed on the test subject by the continuous data acquisition module within a defined time range, into a prediction function, and if the response of the prediction function indicates an abnormal match condition, it indicates it as an abnormal event, and the prediction function inputs a new set of the action types of the defined length N into the prediction function and outputs the match condition. [Effects of the Invention]

[0008] As the present invention is configured as described above, it produces the following effects. Compared to related technologies, the technological benefits achieved by this disclosure are that by directly utilizing combinatorial processing to perform data augmentation, human resources required for data collection are significantly reduced, and the accuracy of detecting anomalies in gray behavior is greatly improved.

[0009] The following information will become clear from the description in the specification and drawings described later. [Brief explanation of the drawing]

[0010] [Figure 1] This is a block diagram showing an anomaly detection device utilizing data augmentation in some embodiments of the present disclosure. [Figure 2] This is a schematic diagram showing a baseline set in some embodiments of the present disclosure. [Figure 3] This is a schematic diagram showing a set of verifications in some embodiments of the present disclosure. [Figure 4] This flowchart shows an anomaly detection method utilizing data augmentation in some embodiments of the present disclosure. [Figure 5] This is a schematic diagram showing how to determine the startup state from multiple behavioral data in some embodiments of this disclosure. [Figure 6] This is a schematic diagram illustrating the generation of sets of mathematical combinations in some embodiments of the present disclosure. [Figure 7] A flowchart detailing the steps further included in an anomaly detection method utilizing data augmentation in some embodiments of this disclosure. [Figure 8] This block diagram shows an anomaly detection device utilizing data augmentation in some other embodiments of the present disclosure. [Figure 9] A flowchart detailing the steps further included in an anomaly detection method utilizing data augmentation in some other embodiments of this disclosure. [Modes for carrying out the invention]

[0011] Embodiments of the present invention will be described in detail below. However, the present invention is not limited thereto, and various modifications are possible within the scope described. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included within the technical scope of the present invention.

[0012] In traditional information security, identifying "gray area" behavior is extremely difficult. Furthermore, many benign subjects and data often exhibit gray area behavior, leading to misidentification as anomalies. Specifically, because it's difficult to determine whether gray area behavior generated by a subject is benign or malicious, information security systems often employ overly lenient or overly strict policies to identify it. However, if an information security system employs an overly lenient policy (e.g., a whitelist), benign behavior on the whitelist can be exploited as a loophole or transformed into malicious software used as a tool for network attacks. Conversely, if an information security system employs an overly strict policy, it often leads to a large number of false alarms, wasting system administrators time verifying them.

[0013] Furthermore, in traditional zero-trust architectures, information security systems reduce information security risks by verifying the subjects that generate gray-area behavior. However, the items that information security systems need to verify for gray-area behavior are often very complex. Moreover, if an information security system employs verification settings that are either too lax or too strict, it can become a weakness of the zero-trust architecture.

[0014] To solve the above problems, the anomaly detection device and method using data augmentation according to the present disclosure perform data augmentation using the concept of mathematical combination. Specifically, compared to focusing on individual gray behaviors, in the present disclosure, all data records of benign subjects at a specific time are collected, and a determination of the activation state is executed for all the behavior information of these data records. Then, based on all the behavior types in the activation state, all mathematical combinations are generated by means of a mathematical combination method, thereby performing data augmentation. By doing so, the anomaly detection device and method utilize an extremely large number of mathematical combinations to detect anomalies in a zero-trust environment, achieving the effect of accurately detecting whether a gray behavior is abnormal. In addition, this anomaly detection device and method further utilize the technical feature of detecting verification values to detect anomalies for a test subject, thereby achieving the effect of accurately detecting whether the test subject is abnormal.

[0015] [Embodiment of Anomaly Detection Device Using Data Augmentation] FIG. 1 is a block diagram showing an anomaly detection device 100 using data augmentation in some embodiments of the present disclosure. The anomaly detection device 100 may be implemented by any electronic device or server, etc. (for example, a processing device of an individual user or enterprise, a cloud device, a server, a cloud server, etc.). The anomaly detection device 100 may be connected to a network in a zero-trust environment. The anomaly detection device 100 includes a continuous data collection module 110, a processor 120, and a memory 130 (see FIG. 1). The processor 120 is connected to the continuous data collection module 110 and the memory 130.

[0016] In this embodiment, the continuous data acquisition module 110 is used to capture multiple data records d1-dM of multiple subjects in a supervised environment or a regular operation environment, where the system is supervised to ensure that operations are performed correctly. Each data record d1-dM includes time, subject, multiple behavior types, and multiple behavioral information corresponding to each of the multiple behavior types, with one behavior type containing multiple behavioral information simultaneously. The supervised environment is the environment used when collecting data for multiple data records d1-dM recognized as multiple benign subjects, while the regular operation environment is the environment used when detecting anomalies in test subjects whose benign or malignant status is unknown. Incidentally, M can be any positive integer, and there are no special restrictions.

[0017] Specifically, the continuous data acquisition module 110 is used solely to capture data records d1-dM in a training environment or a normal work environment where it is supervised to perform its duties correctly, and it does not have the ability to distinguish whether these data records d1-dM are benign or malicious. This disclosure enables the continuous data acquisition module 110 to operate correctly, be controllable, and continuously capture data records d1-dM in an environment where only benign subjects exist (i.e., the training environment where it is supervised to perform its duties correctly). In this way, all data records d1-dM captured by the continuous data acquisition module 110 belong to data related to gray behavior that has been identified as benign subject. In some embodiments, benign subject is a system-specific software resource (e.g., a software program or firmware program) that is free from anomalies (i.e., no malicious behavior), a system used by a user (e.g., a network system or wireless communication system), or the company's assets themselves (e.g., the company itself, a factory, an aircraft, etc.).

[0018] In some embodiments, the continuous data acquisition module 110 captures data records d1-dM from a sample database SD. In some embodiments, the time for each data record d1-dM is the time when this behavioral information was captured. In some embodiments, the subject for each data record d1-dM is the subject from which this behavioral information was generated. In some embodiments, each piece of behavioral information for each data record d1-dM is displayed as numerical data. In some embodiments, each behavioral type for each data record d1-dM is displayed as a gray behavioral policy (e.g., a policy jointly stored throughout the entire network), and the gray behavioral policy is used to generate this behavioral information. In some embodiments, each behavioral type for each data record d1-dM has a corresponding activation state after processing by the activation function described later, and the activation state for each behavioral type is displayed as a Boolean value.

[0019] In some embodiments, the sample database SD may be any database in which data records d1 to dM of multiple benign subjects are stored (for example, an open-source whitelist database in which behavioral characteristics of application programs or corporate assets are stored). In some embodiments, the continuous data collection module 110 is installed in an environment in which only benign subjects exist and pre-collects data records d1 to dM from multiple benign subjects and stores them in the sample database SD.

[0020] In some embodiments, the gray behavior policy may be a policy jointly stored across all networks to which the anomaly detection device 100 is connected (for example, the policy may be stored on all routers in the network), and the gray behavior policy may be a behavioral rule such as the number of times a user touches something in the last hour, the number of times a user opens a web page in a day, or the number of times a host has been continuously connected to the network. Multiple gray behavior policies may be used to identify the time, subject, multiple behavioral types, and multiple behavioral information corresponding to each of the multiple behavioral types in all data records from multiple benign subject operation behaviors (for example, touching the interface of a specific software program 5 times in the last hour at 10:00 on March 1, 2020). These behavioral information for each data record d1 to dM can be considered as a single feature vector.

[0021] For example, multiple behavioral data may include numerical data such as a user touching the device 10 times in an hour, a user opening 20 web pages in a day, or a host connecting to the network 80 times consecutively. These numerical data can be considered as a single feature vector. The time is the time when this numerical data was generated (e.g., 10:00 AM on March 1, 2020). The subject is the subject generated by this numerical data (e.g., a specific software program). Multiple behavioral types may also display gray behavioral policies such as the number of times a user touched the device in an hour, the number of times a user opened web pages in a day, and the number of times a host connected to the network consecutively.

[0022] In some embodiments, each piece of behavioral information corresponds to one gray behavior policy, and one gray behavior policy is used to generate the corresponding behavioral information.

[0023] For example, the multiple gray behavior policies include a first gray behavior policy for the number of times a user touches the device within one hour, a second gray behavior policy for the number of times a user opens a webpage in a day, and a third gray behavior policy for the number of times a host is continuously connected to the network. In the first embodiment, for example, two pieces of behavioral information in which a benign subject is detected include the user touching the device 30 times within one hour and the user opening a webpage 20 times in a day. That is, the behavior of this benign subject is related to the first and second gray behavior policies.

[0024] In the second embodiment, for example, other benign subjects are two other detected behavioral pieces of information, including a user opening web pages 50 times a day and a host connecting to the network 80 times consecutively. That is, the behavior of these benign subjects is related to the second gray behavior policy and the third gray behavior policy.

[0025] In this embodiment, memory 130 stores a machine learning model BM of multiple baseline behavioral features and multiple instructions, and the processor 120 executes the detailed steps described later based on these instructions. In some embodiments, the machine learning model BM can be considered to have multiple baseline behavioral features because it is trained to identify whether a gray behavior is abnormal based on multiple baseline behavioral features. The machine learning model BM of multiple baseline behavioral features and these instructions may also be corresponding software or firmware instruction programs. In some embodiments, these instructions may also be software or firmware instruction programs for a gray behavior resident program, and the software or firmware instruction programs for a gray behavior resident program may be built into an operating system hook. In some embodiments, the machine learning model BM of multiple baseline behavioral features may be any machine learning model (e.g., an artificial neural network model or a convolutional neural network model).

[0026] In some embodiments, memory 130 has a verification database AD, which stores multiple baseline behavioral features (not shown), and among the multiple baseline behavioral features, there are multiple sets (hereinafter referred to as baseline sets) each containing multiple behavioral types detected from multiple other benign subjects (i.e., other subjects that have already been determined not to be abnormal), and each baseline set detects a set of behavioral types generated by one of the other benign subjects based on a set of predetermined gray behavioral policies. Specifically, the continuous data acquisition module 110 pre-captures multiple other data records of multiple other benign subjects, and these other data records also include time, subject, multiple behavioral types, and multiple behavioral information corresponding to each of the multiple behavioral types. Next, the processor 120 sets the multiple behavioral types of each of the other data records into a single baseline set. In some embodiments, the other benign subjects are also system-specific software resources that are not abnormal, systems used by users, or the company's assets themselves. In some embodiments, the other benign subjects are the same as or different from the benign subjects described above.

[0027] [First example of a baseline set of baseline behavioral features] The baseline set will be explained below with actual examples. Figure 2 is a schematic diagram showing a baseline set rc in some embodiments of this disclosure. As shown in Figure 2, the baseline set rc includes multiple behavior types rf1 to rf20. Behavior types rf1 to rf20 represent multiple corresponding gray behavior policies.

[0028] In some embodiments, multiple baseline sets each have a validation set. In some embodiments, each validation set each has multiple validation values. In some embodiments, the multiple validation values ​​for each validation set may be determined by performing detections for other benign subjects corresponding to each baseline set based on multiple validation policies. For example, a management server or distributed management server in the network may perform detections for other benign subjects to generate a single validation set based on multiple validation policies, generate detection results, and generate multiple validation values ​​for that single validation set based on the detection results.

[0029] In some embodiments, the verification policy may also be a policy for managing and verifying a subject, such as whether the subject has a trusted digital signature, whether the subject was built at a specific time, or whether an administrator has logged into the subject's management console. Thus, the verification value may be a Boolean value whose logical value is true or false (the verification value is either "logical truth" or "logical fault").

[0030] [Second example of a baseline set of baseline behavioral features] The following describes the validation set with actual examples. Figure 3 is a schematic diagram showing the validation set VC in some embodiments of this disclosure. As shown in Figure 3, the baseline set rc further comprises the validation set VC, and the multiple reference validation values ​​of the validation set VC are generated by performing detections for other benign subjects corresponding to the baseline set based on multiple validation policies.

[0031] Returning to Figure 1, in this embodiment, memory 130 executes the learning function and prediction function using the machine learning model BM. The learning function trains the machine learning model BM by taking a set of behavior types of a predefined length N as input for known subjects and adding the set to multiple baseline behavior features. The prediction function determines whether the behavior of an unknown test subject is abnormal by taking a new set of behavior types of a predefined length N as input and outputting a match state. In some embodiments, N may be less than or equal to the number of behavior types in the data record, and this disclosure uses the predefined length N to augment the data by enumerating the behavior types of subjects. The learning function and prediction function will be further described in the following paragraphs, so their description is omitted here.

[0032] In some embodiments, the continuous data acquisition module 110 may be any data capture software, firmware, hardware, or a combination thereof. For example, the continuous data acquisition module 110 may be one or a combination thereof of a network interface for continuously monitoring the network, a network card driver program, a network application program, a transmission circuit, an A / D converter, a D / A converter, a low-noise amplifier, a mixer, a filter, an impedance matcher, a transmission code, a power amplifier, one or more antenna circuits, and a local storage media element, and the present invention is not limited thereto. In some embodiments, the continuous data acquisition module 110 may continuously observe and record gray behavior of any subject during an activity period.

[0033] In some embodiments, the memory 130 may be implemented by a memory unit, flash memory, read-only memory, hard disk, or an equivalent storage kit, and the present invention is not limited thereto. In some embodiments, the processor 120 may be implemented by a central processing unit (CPU), microcontroller unit (MCU), programmable logic controller (PLC), system on chip (SoC), or field programmable gate array (FPGA), and the present invention is not limited thereto.

[0034] [Examples of anomaly detection methods using data augmentation] Figure 4 is a flowchart showing an anomaly detection method utilizing data augmentation in some embodiments of this disclosure. This anomaly detection method is applied to the anomaly detection device 100 shown in Figure 1.

[0035] As shown in Figure 4, the anomaly detection method includes steps S410 to S450. First, in step S410, the continuous data collection module 110 captures data records d1 to dM of multiple subjects in a training environment or a normal work environment where supervision is provided to ensure that work is performed correctly. In this embodiment, as described above, data records d1 to dM each include time, subject, multiple behavior types, and multiple behavior information corresponding to each of the multiple behavior types. In a training environment where supervision is provided to ensure that work is performed correctly, the continuous data collection module 110 captures data records d1 to dm of the sample database SD or data records d1 to dM of benign subjects in order to train the machine learning model BM. In a normal work environment, the continuous data collection module 110 captures data records d1 to dM of unknown subjects in order to detect whether the behavior of unknown subjects is anomaly.

[0036] In step S420, for each captured data record, the processor 120 uses multiple activation functions associated with multiple behavior types (i.e., one behavior type is associated with one activation function) to perform activation status determination on multiple behavior information, and combines all behavior types in the activated state for each subject to generate a set of behavior types specific to each subject. In this embodiment, each set represents multiple behavioral features of the corresponding subject. In other words, all behavior types in the activated state for each data record can form a set of behavior types specific to the subject corresponding to each data record. In some embodiments, each activation function is used to perform activation status determination (i.e., one-to-one activation status determination) on behavior information corresponding to the associated behavior type.

[0037] In some embodiments, the activation function may be any type of activation function (e.g., a unit step function, a rectified linear unit (ReLU), a Softmax function, or a behavioral feature comparison function (i.e., fitting a predetermined behavioral feature means fitting an activation state)). In other words, the activation function may be a function that compares thresholds, or a function that compares whether a behavior fits a predetermined behavioral feature (e.g., 10 activations). It should be noted that the activation function acts to transform the numerical data of observed gray behaviors (different gray behaviors have a numerical distribution of heterogeneity) into a way that makes the homogeneity of the set of behavioral types visible.

[0038] For example, if the behavior information states that the user touches the screen 10 times within one hour, and the activation function is a unit step function that assigns 1 to values ​​greater than 5 and 0 to values ​​less than 5, then this behavior information is processed by this unit step function and converted to 1. Therefore, the behavior type corresponding to this behavior information (i.e., the number of times the user touches the screen within one hour) is considered to be in an activated state (i.e., the activated state of a behavior type is represented by a Boolean value with a logical value of 1) and is included in the set. In another example, if the behavior information states that the user opens a web page twice a day, and the activation function is a unit step function that assigns 1 to values ​​greater than 3 and 0 to values ​​less than 3, then this behavior information is processed by this unit step function and converted to 0. Therefore, the behavior type corresponding to this behavior information (i.e., the number of times the user opens a web page a day) is considered to be in an inactive state (i.e., the activated state of a behavior type is represented by a Boolean value with a logical value of 0) and is not included in the set. In other examples, if the activation function is a behavior feature comparison function, this behavior feature comparison function compares a default behavior feature with behavior information. If the default behavior feature matches the behavior information, the behavior type corresponding to this behavior information can be considered to be in an activated state and is included in the set. Conversely, if the default behavior feature does not match the behavior information, the behavior type corresponding to this behavior information can be considered to be in an inactive state and is not included in the set.

[0039] The following describes the relationship between behavioral information and a set of behavioral types specific to a single subject, using actual examples. Figure 5 is a schematic diagram showing how to determine the startup state from multiple behavioral information bf1 to bf20 in some embodiments of this disclosure. As shown in Figure 5, when the startup state is determined using multiple startup functions, the processor 120 obtains behavioral types tf2, tf8, tf10, and tf17 to tf18 that are in the startup state from the multiple behavioral information bf1 to bf20, and behavioral types tf2, tf8, tf10, and tf17 to tf18 correspond to behavioral information bf2, bf8, bf10, and bf17 to bf18, respectively. In other words, the 15 action types corresponding to the action information bf1, bf3-bf7, bf9, bf11-bf16, and bf19-bf20 are removed by their respective activation functions, and the action types tf2, tf8, tf10, and tf17-tf18 become a set of action types specific to the subject. That is, the set includes the five action types tf2, tf8, tf10, tf17, and tf18 that are in the activated state.

[0040] Returning to Figure 4, in step S430, for each data record, the processor 120 performs data augmentation by enumerating all mathematical combinations of the predefined length N in the set of behavior types for each subject, based on the predefined length N used in the machine learning model BM of multiple baseline behavior features. In this embodiment, each mathematical combination is a subset of the predefined length N of multiple behavior features of the subject. In some embodiments, N is any positive integer greater than or equal to 1. For example, if the set of behavior types includes five behavior types and the predefined length N is 3, the processor 120 selects all mathematical combinations of any three behavior types from the five behavior types in the active state (i.e., the number of all mathematical combinations is 5C3).

[0041] In some embodiments, all mathematical combinations can be considered as a single hybrid combination, that is, it can be directly inferred that gray behavior will occur in any order in the future and that fragments of gray behavior may be observed. In some embodiments, the processor 120 updates a plurality of baseline behavior features by adding all of the aforementioned mathematical combinations. In some embodiments, the processor 120 updates a plurality of baseline behavior features by adding mathematical combinations different from those of the plurality of baseline behavior features.

[0042] It should be noted that the larger the defined length N, the greater the similarity between all behavior types in the new data record and data records d1-dM must be in subsequent stages for it to be determined that there is no abnormality (if the defined length N is appropriate in subsequent abnormality detection, the detection rate will improve and the false alarm rate will decrease). The smaller the defined length N, the less similarity there is between all behavior types in the new data record and data records d1-dM, and it is still possible to determine that there is no abnormality (i.e., sensitivity).

[0043] In some embodiments, for each data record, the processor 120 performs data augmentation by enumerating each mathematical combination of the set of behavior types of the multiple predefined lengths N for each subject, based on the multiple predefined lengths N used in the machine learning model BM of the multiple baseline behavioral features. In some embodiments, the multiple predefined lengths N may be all positive integers in any single numerical interval (for example, the multiple predefined lengths N may be all positive integers less than 10, all positive integers less than the number of behavioral types greater than 2 and in all activated states, or all positive integers where the number to be selected is less than 10 and greater than 1).

[0044] It should be noted that the higher the upper limit of the numerical interval, the greater the similarity between all behavior types of the new data record and data records d1 to dM must be in subsequent stages to determine that there is no abnormality (if the upper limit is appropriate in subsequent abnormality detection, the detection rate will improve and the false alarm rate will decrease). The lower the lower limit of the numerical interval, the less similarity there is between all behavior types of the new data record and data records d1 to dM, and there is still a possibility that it will be determined that there is no abnormality (i.e., sensitivity). The process of enumerating the combinations described above is a conventional technique in the field of mathematics, so its explanation will be omitted here.

[0045] For example, if the numerical interval is all positive integers less than 4, and the number of all active behavior types is 5, then the processor 120 enumerates all mathematical combinations of 3 active behavior types from the 5 active behavior types as the first set (i.e., the number of mathematical combinations is 5C3). Next, the processor 120 enumerates all mathematical combinations of 2 active behavior types from the 5 active behavior types as the second set (i.e., the number of mathematical combinations is 5C2). Then, the processor 120 enumerates all mathematical combinations of 1 active behavior type from the 5 active behavior types as the third set (i.e., the number of mathematical combinations is 5C1). In this case, the total number of mathematical combinations (i.e., the multiple sets) is 25 (i.e., 5C3 + 5C2 + 5C1), and in subsequent anomaly detection, this selection method has the best detection rate and the lowest false alarm rate.

[0046] Another example is when the numerical interval is all positive integers less than 2, and the number of active action types is 5. In this case, processor 120 enumerates all mathematical combinations of one active action type from the five active action types as a single set (i.e., the number of mathematical combinations is 5C1). In this case, the total number of mathematical combinations of all active action types is 5 (i.e., 5C1). This selection method is similar in effect to a conventional whitelist.

[0047] [Examples of all mathematical combinations of a predefined length N] The following explains all mathematical combinations of a predefined length N, using practical examples. Figure 6 is a schematic diagram illustrating the generation of a set of mathematical combinations CS in some embodiments of the present disclosure. As shown in Figure 6, extending the example of Figure 5, and assuming a predefined length N is 3, the processor 120 enumerates 10 mathematical combinations bc1 to bc10 of the action types tf2, tf8, tf10, and tf17 to tf18 (i.e., the action types in the activated state) of the set of mathematical combinations cs by 3 / 5 mathematical combination processing (i.e., the following quantity is 5C3).

[0048] The mathematical combination of action types in the activated state bc1 includes action types tf2, tf8, and tf10, the mathematical combination of action types in the activated state bc2 includes action types tf2, tf8, and tf17, the mathematical combination of action types in the activated state bc3 includes action types tf2, tf10, and tf17, the mathematical combination of action types in the activated state bc4 includes action types tf8, tf10, and tf17, the mathematical combination of action types in the activated state bc5 includes action types tf2, and tf17~tf18, activated The mathematical combination of action types in a state bc6 includes action types tf8 and tf17~tf18, the mathematical combination of action types in an activated state bc7 includes action types tf10 and tf17~tf18, the mathematical combination of action types in an activated state bc8 includes action types tf2, tf10, and tf18, the mathematical combination of action types in an activated state bc9 includes action types tf8, tf10, and tf18, and the mathematical combination of action types in an activated state bc10 includes action types tf2, tf8, and tf18.

[0049] In some embodiments, these mathematical combinations also have a validation set, and the validation set of a mathematical combination includes multiple validation values, which are also generated by performing detection on the subject corresponding to all mathematical combinations (i.e., the corresponding benign subject) based on a validation policy. It should be noted that the generation of these validation values ​​for mathematical combinations is similar to the generation of these validation values ​​for baseline sets, and therefore, a detailed explanation is omitted here.

[0050] [Example of updating mathematical combinations in a verification database] Figure 7 illustrates a flowchart showing the execution of steps S710 to S720 after step S430 in some embodiments of the present disclosure. As shown in Figure 7, in step S710, the processor 120 adds mathematical combinations that do not fit into any of the baseline sets to the baseline sets. Specifically, if the processor 120 cannot find a mathematical combination that matches one baseline set in the validation database AD, the processor 120 makes this mathematical combination a new baseline set. In this way, the processor 120 saves the new baseline set and its multiple validation values ​​to the validation database AD. In this way, the processor 120 adds the new baseline set and its validation values ​​to the validation database AD. Conversely, if the processor 120 determines that the mathematical combination matches one of the saved baseline sets, the processor 120 updates the multiple validation values ​​of the matching baseline set in a subsequent step.

[0051] In step S720, the processor 120 performs a logical operation (e.g., an "AND" operation) on multiple validation values ​​of a mathematical combination that fits a baseline set and on multiple validation values ​​of the fitting baseline set to generate an operation result and set the operation result as multiple validation values ​​of the fitting baseline set. Specifically, each time the processor 120 finds a baseline set that matches a mathematical combination in the validation database AD, the processor 120 uses the multiple validation values ​​of this baseline set to perform a logical operation on the multiple validation values ​​of the mathematical combination to generate an operation result and sets this operation result as multiple validation values ​​of the baseline set. That is, based on inductive generalization, the processor uses the results of such logical operations to validate the "minimum and necessary" list of validation items for these subsets of gray behavior (i.e., subsets of multiple behavioral features of the subject of a predefined length N) based on the results.

[0052] In the aforementioned step, the anomaly detection device 100 further updates multiple validation values ​​of the baseline set by comparing all mathematical combinations with the baseline set. In this way, multiple baseline sets of multiple baseline behavioral features of the validation database AD perform further validation against the subject of the network in the zero-trust environment (i.e., access validation is completed).

[0053] [Examples of training machine learning models] Returning to Figure 4, in step S440, once the data collection training is complete in a supervised training environment, the processor 120 uses the output of the data augmentation as input to a learning function to train a machine learning model BM of multiple baseline behavioral features during the model training period. In other words, the entire training includes data collection training and model training. In some embodiments, after the training (i.e., the data collection and data augmentation) is complete, during the model training period, the processor 120 uses the learning function to use all the mathematical combinations generated by the data augmentation as multiple training samples, and uses these training samples to train a machine learning model BM of multiple baseline behavioral features. In this way, the processor 120 uses the trained machine learning model BM of multiple baseline behavioral features to identify whether the captured data (i.e., the new data records in subsequent stages) is abnormal. In other words, the trained machine learning model BM of multiple baseline behavioral features is used to identify whether the undetermined gray behavior is gray behavior belonging to a benign subject. In some embodiments, the model training period is the stage in which the collection of data records d1 to dM is stopped and the machine learning model BM is trained.

[0054] [Examples of using machine learning models] In step S450, under normal working conditions, the processor 120 takes the new output of data augmentation performed by the continuous data acquisition module 110 based on all new data records captured from the test subject within a defined time range (e.g., set by the user) as input to a prediction function, and if the response of the prediction function based on the new output indicates an abnormal match condition, it indicates it as an abnormal event (i.e., one new data record is data belonging to abnormal gray behavior, or there is an abnormality in the test subject). In some embodiments, the processor 120 uses a machine learning model BM of multiple baseline behavioral features to detect the test subject and provide abnormality alerts (e.g., alerts displayed audibly or informatively).

[0055] In some embodiments, the data-enhanced anomaly detection device 100 further includes a user interface 140. The user interface 140 is used to set a gray behavior policy and select a learning mode, detection mode, or offline mode as the operating mode of the processor 120 (i.e., to adjust the operation of the anomaly detection device 100).

[0056] In some embodiments, the user interface 140 allows the user to select offline mode as the operating mode, causing the processor 120 to stop operating. In other words, once the operating mode is switched to offline mode, the anomaly detection device 100 stops operating. In some embodiments, the user interface 140 allows the user to select learning mode or detection mode as the operating mode, causing the processor 120 to start the continuous data acquisition module 110.

[0057] In some embodiments, the user interface 140 indicates that selecting the learning mode as the operating mode means that the processor 120 is operating in a supervised training environment to ensure it is working correctly, and that training of a machine learning model BM of multiple baseline behavioral features has begun. In other words, when the learning mode is selected as the operating mode, the processor 120 operates in a supervised training environment to ensure it is working correctly (i.e., the user operates the anomaly detection device 100 in a supervised training environment to ensure it is working correctly), and training of the machine learning model BM begins.

[0058] In some embodiments, the user interface 140 indicates that changing the operating mode from learning mode to detection mode or offline mode signifies the completion of one data acquisition training, and the processor 120 uses the data recordings collected during the training period to perform data augmentation and train the machine learning model BM. In other words, when the operating mode is switched from learning mode to detection mode or offline mode, the processor 120 completes the data acquisition training (i.e., the processor 120 collects data recordings by the continuous data acquisition module 110) and trains the machine learning model BM during the model training period (i.e., starts training the machine learning model BM using the data augmentation data).

[0059] In some embodiments, the user interface 140 allows the user to select the detection mode as the operating mode, which indicates that the processor 120 will operate in a normal working environment, and the processor 120 will use the trained machine learning model BM to detect anomalies. In other words, when the detection mode is selected as the operating mode, the processor 120 starts operating in a normal working environment (i.e., the user operates the anomaly detection device 100 in a normal working environment), and uses the trained machine learning model BM to detect anomalies in new data records in a normal working environment. In some embodiments, the user interface 140 allows the user to select the learning mode as the operating mode again, and when the processor 120 performs new training, in the new training, the processor 120 adds new baseline behavioral features to a plurality of baseline behavioral features (i.e., accumulated in the machine learning model BM).

[0060] The detection of abnormal events will be explained below with reference to examples. Figure 8 is a block diagram showing an anomaly detection device 100 utilizing data augmentation in some other embodiments of the present disclosure. The anomaly detection device 100 in Figure 8 is the same as the anomaly detection device 100 in Figure 1, so its description is omitted here.

[0061] As shown in Figure 8, the continuous data acquisition module 110 can connect to multiple test subjects TS1 to TSm. In some embodiments, m may be any positive integer and there are no special restrictions. In this embodiment, in a normal working environment, the continuous data acquisition module 110 captures a new data record td from any one of the test subjects. In some embodiments, each test subject TS1 to TSm may be a system-specific software resource with or without anomalies, a system used by a user, or the company's assets themselves. It should be noted that the content base of the new data record td is similar to the content of data records d1 to dM, and their explanation is omitted here.

[0062] The embodiment in Figure 8 differs from the embodiment in Figure 1 in that Figure 8 is applied to an unspecified environment (for example, the normal working environment), and in this unspecified environment, both benign and malicious subjects may exist. In other words, test subjects TS1 to TSm are subjects whose abnormality or non-abnormality is undetermined; that is, test subjects TS1 to TSm may or may not exhibit aggressive behavior. Therefore, it is necessary to identify whether the behavior of these test subjects TS1 to TSm is abnormal by capturing new data records td.

[0063] In some embodiments, the processor 120 uses a prediction function to input a new data record td into a machine learning model BM of multiple baseline behavioral features to identify whether the new data record td is anomalous, and if the new data record td is anomalous, it generates an anomaly alarm. In other words, once the match state returned by the prediction function is anomalous, the processor 120 knows that the new data record td belongs to an anomalous gray behavior and issues an anomaly alarm to notify the user.

[0064] [Example of performing detection on a test subject] Figure 9 shows flowcharts of steps S910 to S920 performed after step S450 in some embodiments of the present disclosure. As shown in Figure 9, in step S910, the processor 120 selects a baseline set that fits the new data record td. In some embodiments, the processor 120 compares whether multiple behavior types of the new data record are the same as multiple behavior types of one baseline set. If multiple behavior types of the new data record are the same as multiple behavior types of one baseline set, the processor 120 determines that one baseline set fits the new data record. If multiple behavior types of the new data record are different from multiple behavior types of one baseline set, the processor 120 determines that the test subject that generated the new data record is a malicious subject.

[0065] In step S920, the processor 120 verifies whether the test subject is abnormal by using multiple validation values ​​from a baseline set that fits the new data record. In some embodiments, the processor 120 verifies the test subject using validation policies corresponding to validation values ​​for which the validation of the fitting baseline set is true (i.e., the validation value has a logical value of "true"). If at least one validation value generated from the test subject has a logical value of false, the processor 120 determines that the test subject is abnormal. Conversely, if all validation values ​​generated by the test subject have a logical value of true, the processor 120 determines that the test subject is not abnormal.

[0066] For example, if there are two true verification values, one for the first logic and one for the second logic, these two values ​​correspond to whether the subject has a trusted digital signature (i.e., the first verification policy) and whether the subject was constructed at a specific time (e.g., 10am) (i.e., the second verification policy), respectively. For instance, a true verification value for the first logic indicates that the subject has a trusted digital signature, and a true verification value for the second logic indicates that the subject was constructed at a specific time.

[0067] Therefore, the processor 120 determines, based on the first and second verification policies, whether the test subject has generated two true verification values. In other words, the processor 120 generates a first verification value by verifying whether the test subject has a trusted digital signature, and then generates a second verification value by verifying whether the test subject was constructed at a specific time. Next, if both the first and second verification values ​​are true, the processor 120 determines that the test subject conforms to the first true verification value and the first true verification value, and that there is nothing abnormal about the test subject. Conversely, if either the first or second verification value is not true, the processor 120 determines that the test subject does not conform to the first true verification value and the first true verification value, and that the test subject is abnormal.

[0068] In the aforementioned step, the anomaly detection device 100 further verifies whether the test subject is anomaly based on multiple validation values ​​from the baseline set (i.e., it determines whether it is a benign subject with no aggressive behavior, or a malicious subject with the potential to exhibit aggressive behavior). Thus, multiple validation values ​​from the baseline set of the validation database AD are used to perform further verification on the test subject in the zero-trust network environment. In this way, the accuracy of anomaly detection for subjects exhibiting gray-area behavior is significantly improved.

[0069] In summary, this disclosure achieves the objective of data augmentation by generating a very large number of mathematical combinations from a very small set of behavior types, by generating multiple mathematical combinations based on one or more active behavior types using a combinatorial processing method. In this way, this disclosure uses a very large number of mathematical combinations to detect anomalies in a zero-trust environment. Furthermore, in this disclosure, machine learning models of multiple baseline behavioral features are used to further validate data in a zero-trust network, and validation values ​​of multiple baseline behavioral features are used to further validate subjects in a zero-trust network. As described above, the anomaly detection device and method utilizing data augmentation in this disclosure significantly reduces the human resources required for data collection and significantly improves the accuracy of gray-area behavior anomaly detection.

[0070] The above description is for the purpose of explaining the present invention and should not be interpreted as limiting or narrowing the scope of the invention described in the claims. Furthermore, it goes without saying that the configuration of each part of the present invention is not limited to the above embodiments and can be modified in various ways within the technical scope described in the claims. [Explanation of Symbols]

[0071] 100 Anomaly detection device 110 Continuous Data Acquisition Module 120 processors 130 memory 140 User Interfaces SD Sample Database BM: A machine learning model of multiple baseline behavioral features AD Verification Database d1~dM Data Recording rc baseline set rf1~rf20 Behavioral Types tf1~tf20 Behavioral Types VC Verification Set BF1-BF20 Action Information bc1~bc10 Mathematical Combinations CS Set TS1~TSm Test Themes td New data record S410~S450 Step S710~S720 Step S910~S920 Step

Claims

1. A continuous data acquisition module positioned to capture multiple data records of multiple subjects in a training environment where supervision is provided to ensure normal operation, or in a normal work environment, wherein each data record includes time, subject, multiple behavior types, and multiple behavioral information corresponding to each of the multiple behavior types. It is configured to store machine learning models of multiple instructions and multiple baseline behavioral features, a) A learning function that takes a set of behavior types of a predefined length N as input and adds the set to a plurality of baseline behavior features, b) A memory that executes a prediction function that takes a new set of the aforementioned action types of the defined length N as input and outputs a match state, The continuous data acquisition module and the memory are connected, and for each of the data recordings, The process involves using multiple activation functions associated with multiple behavior types to determine the activation state for multiple behavior information, combining all behavior types in the activation state for each subject to generate a set of behavior types specific to each subject, where each set represents multiple behavioral characteristics of the corresponding subject, and Data augmentation is performed by enumerating all mathematical combinations of the defined length N in the set of behavior types for each subject, based on the defined length N used in the machine learning model of the multiple baseline behavior features, where each mathematical combination is a subset of the defined length N of the multiple behavior features of the subject. In the aforementioned training environment, after data collection training is completed, the output of the data augmentation is used as input to the learning function, and during the model training period, the machine learning model of the multiple baseline behavioral features is trained. An anomaly detection device utilizing data augmentation, comprising: a processor arranged to execute a plurality of instructions to take as input the new output of data augmentation performed by the continuous data acquisition module based on all new data records captured from the test subject within a defined time range in the normal working environment, and to indicate as an anomaly event if the response of the prediction function indicates an anomaly.

2. An anomaly detection device utilizing data augmentation according to claim 1, wherein the continuous data acquisition module is positioned to capture multiple data records of multiple benign subjects in a training environment supervised to perform the work correctly, and the multiple benign subjects are system-specific software resources without anomalies, systems used by users, or corporate assets.

3. An anomaly detection device utilizing data augmentation according to claim 1, characterized in that each of the aforementioned behavioral information is displayed as numerical data, each of the aforementioned behavioral types is displayed as a gray behavioral policy, the activation state of each of the aforementioned behavioral types is displayed as a Boolean value, and the gray behavioral policy is used to generate a plurality of the aforementioned behavioral information.

4. A user interface configured to set a gray behavior policy and to select a learning mode, detection mode, or offline mode as the operating mode of the processor, further comprising a user interface that, when the offline mode is selected as the operating mode, causes the processor to stop operating, When the user interface selects the learning mode or the detection mode as the operating mode, the processor starts the continuous data acquisition module. The operation by the user interface to select the learning mode as the operating mode indicates that the processor is operating in a training environment that is supervised to perform its duties correctly, and that training of the machine learning model of multiple baseline behavioral features has begun. The operation of changing the operating mode from the learning mode to the detection mode or the offline mode via the user interface indicates that one data acquisition training has been completed, and the processor uses the data recordings collected during the data acquisition training period to perform data augmentation and train the machine learning model. The operation of selecting the detection mode as the operating mode via the user interface indicates that the processor is operating in the normal working environment, and the processor uses the trained machine learning model to detect anomalies. An anomaly detection device utilizing data augmentation according to claim 1, characterized in that, when the user interface selects the learning mode again as the operating mode and the processor performs new training, the processor adds new baseline behavioral features to a plurality of baseline behavioral features during the new training.

5. In the step of using the new output of the data augmentation performed based on the new data record of the test subject as the input to the prediction function, and indicating as an abnormal event if the response of the prediction function indicates an abnormal match state, the processor: An anomaly detection device utilizing data augmentation according to claim 1, characterized in that it is configured to perform the steps of detecting the test subject and providing an anomaly alert using the machine learning model of a plurality of baseline behavioral features.

6. The plurality of baseline behavioral features have a plurality of baseline sets, and the processor, The steps of adding the mathematical combination that does not fit into the plurality of baseline sets to the plurality of baseline sets, An anomaly detection device utilizing data augmentation according to claim 1, further configured to perform a logical operation on a plurality of verification values ​​of a mathematical combination that fits one baseline set and a plurality of verification values ​​of the fitting baseline set to generate an operation result, and to set the operation result as a plurality of verification values ​​of the fitting baseline set.

7. The plurality of baseline behavioral features have a plurality of baseline sets, and the processor, The steps include selecting one baseline set that fits the new data record, An anomaly detection device utilizing data augmentation according to claim 1, further configured to perform the step of verifying whether the test subject is anomaly using a plurality of verification values ​​of the baseline set that conform to the new data record.

8. In a training environment where supervision is provided to ensure that work is performed correctly, or in a normal work environment, a continuous data acquisition module captures multiple data records of multiple subjects, each data record including time, subject, multiple behavior types, and multiple behavioral information corresponding to each of the multiple behavior types, The processor performs a determination of the activation state for multiple behavior information using multiple activation functions associated with multiple behavior types for each data record, combines all behavior types in the activation state for each subject, generates a set of behavior types specific to each subject, and each set represents multiple behavioral characteristics of the corresponding subject. The processor performs data augmentation on each data record by enumerating all mathematical combinations of the predefined length N in the set of behavior types for each subject, based on a predefined length N used in a machine learning model of multiple baseline behavioral features, wherein each mathematical combination is a subset of the predefined length N of multiple behavioral features of the subject. In the training environment, after completing data collection training, the processor uses the output of the data augmentation as input to a learning function, and during the model training period, trains the machine learning model of the multiple baseline behavioral features, the learning function takes the set of the behavioral types of the predefined length N as input, and adds the set to the multiple baseline behavioral features. An anomaly detection method utilizing data augmentation, characterized in that, in the normal working environment, the processor takes the new output of data augmentation performed on the test subject by the continuous data acquisition module within a defined time range as input to a prediction function, and if the response of the prediction function indicates an abnormal match state, it indicates it as an abnormal event, and the prediction function takes a new set of the action types of the defined length N as input and outputs the match state.

9. The anomaly detection method utilizing data augmentation according to claim 8, wherein the continuous data acquisition module is positioned to capture multiple data records of multiple benign subjects in a training environment supervised to perform the work correctly, and the multiple benign subjects are system-specific software resources without anomalies, systems used by users, or corporate assets.

10. An anomaly detection method using data augmentation according to claim 8, characterized in that each of the aforementioned behavioral information is displayed as numerical data, each of the aforementioned behavioral types is displayed as a gray behavioral policy, the activation state of each of the aforementioned behavioral types is displayed as a Boolean value, and the gray behavioral policy is used to generate a plurality of the aforementioned behavioral information.

11. The user interface includes the steps of setting a gray behavior policy and selecting a learning mode, detection mode, or offline mode as the operating mode of the processor for a plurality of baseline behavior features. When the user interface selects the offline mode as the operating mode, the processor stops operating. When the user interface selects the learning mode or the detection mode as the operating mode, the processor starts the continuous data acquisition module. The step of selecting the learning mode as the operating mode via the user interface includes indicating that the processor is operating in a training environment supervised to perform its duties correctly and that training of the machine learning model of the multiple baseline behavioral features has begun; The user interface, by which the operating mode is changed from the learning mode to the detection mode or the offline mode, indicates that one data acquisition training has been completed, and the processor performs data augmentation and training of the machine learning model using the data records collected during the data acquisition training period. The user interface, in the step of selecting the detection mode as the operating mode, indicates that the processor is operating in the normal working environment, and the processor performs anomaly detection using the trained machine learning model, An anomaly detection method using data augmentation according to claim 8, further comprising the steps of: selecting the learning mode as the operating mode again using the user interface, and when the processor performs new training, the processor adds new baseline behavioral features to a plurality of baseline behavioral features during the new training.

12. The step of using the new output of the data augmentation performed based on the new data records of the test subject as the input to the prediction function, and indicating as an abnormal event if the response of the prediction function indicates an abnormal match state, is: An anomaly detection method utilizing data augmentation according to claim 8, characterized in that the processor includes the step of detecting the test subject and providing an anomaly alert using the machine learning model of a plurality of baseline behavioral features.

13. The multiple baseline behavioral features have multiple baseline sets, and the anomaly detection method is The processor adds the mathematical combination that does not fit into the plurality of baseline sets to the plurality of baseline sets, An anomaly detection method using data augmentation according to claim 8, further comprising the step of the processor performing logical operations on a plurality of verification values ​​of the mathematical combination that fits one baseline set and a plurality of verification values ​​of the fitting baseline set to generate an operation result, and setting the operation result as a plurality of verification values ​​of the fitting baseline set.

14. The multiple baseline behavioral features have multiple baseline sets, and the anomaly detection method is The processor selects one baseline set that fits the new data record, An anomaly detection method utilizing data augmentation according to claim 8, further comprising the step of the processor verifying whether the test subject is anomaly by utilizing a plurality of verification values ​​of the baseline set that conform to the new data record.

Images