Abnormal behavior test method, abnormal behavior test device, electronic device, non-transitory computer-readable storage medium, and computer program product

Abstract

The present disclosure provides an abnormal behavior test method, an abnormal behavior test device, an electronic device, a non-transitory computer-readable storage medium, and a computer program product. The abnormal behavior test method comprises: acquiring a set of behaviors to be tested pertaining to a same session within a preset time window; adding a label to each behavior in the set of behaviors to be tested, and obtaining a label feature of the set of behaviors to be tested on the basis of the labels of all of the behaviors in the set of behaviors to be tested; on the basis of a preset embedded feature extraction model, mapping the label feature of the set of behaviors to be tested into an embedded feature; on the basis of the embedded feature of the set of behaviors to be tested and an embedded feature of a historical set of behaviors obtained in advance, determining whether the set of behaviors to be tested is abnormal.

Description

Abnormal behavior detection method, abnormal behavior detection device, electronic device, non-transitory computer-readable storage medium, and computer program product

[0001] This application claims priority to Chinese Patent Application No. 202310988906.8 filed on August 7, 2023. The contents of the above-mentioned Chinese patent application disclosure are hereby incorporated by reference in their entirety as a part of this application. Technical Field

[0002] Embodiments of the present disclosure relate to an abnormal behavior detection method, an abnormal behavior detection device, an electronic device, a non-transitory computer-readable storage medium, and a computer program product. Background Art

[0003] Abnormal behavior detection is a key function of host intrusion detection systems (HIDs). It aims to detect unknown, abnormal behaviors that deviate from the baseline. HIDs can collect host data at various levels, including system calls, file creation, file reading and writing, command execution, and network connections.

[0004] Existing abnormal behavior detection solutions mainly rely on data such as execution command sequences, system call sequences, and process creation, using statistical, machine learning, or deep learning methods to detect anomalies. However, existing abnormal behavior detection solutions have low accuracy and are prone to false positives.

[0005] Summary of the Invention

[0006] In one aspect, one or more embodiments of the present disclosure provide a method for detecting abnormal behavior, comprising:

[0007] Collect the set of behaviors to be detected belonging to the same session within a preset time window;

[0008] Adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0009] Mapping the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0010] Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance, it is determined whether the behavior set to be detected has an anomaly.

[0011] In one aspect, one or more embodiments of the present disclosure provide an abnormal behavior detection device, comprising:

[0012] A collection unit configured to collect a set of behaviors to be detected belonging to the same session within a preset time window;

[0013] a label processing unit configured to add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0014] a mapping unit configured to map the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0015] The anomaly identification unit is configured to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set.

[0016] In one aspect, one or more embodiments of the present disclosure provide an electronic device, including:

[0017] at least one memory configured to store computer-executable instructions; and

[0018] at least one processor configured to execute computer-executable instructions stored in the memory,

[0019] Wherein, when the computer-executable instructions are executed by the at least one processor, the at least one processor executes the abnormal behavior detection method as described in the above aspects and various possible designs of each aspect.

[0020] On the one hand, one or more embodiments of the present disclosure provide a non-transitory computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the abnormal behavior detection method described in the above aspects and various possible designs of each aspect is implemented.

[0021] In one aspect, one or more embodiments of the present disclosure provide a computer program product, including computer-executable instructions, which, when executed by a processor, implement the abnormal behavior detection method described in the above aspects and various possible designs of each aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0023] FIG1 is a diagram illustrating an example scenario of an abnormal behavior detection method provided by an embodiment of the present disclosure;

[0024] FIG2 is a flow chart of an abnormal behavior detection method according to an embodiment of the present disclosure;

[0025] FIG3 is a flow chart of an abnormal behavior detection method provided by another embodiment of the present disclosure;

[0026] FIG4 is a schematic diagram of a tag feature distance provided by an embodiment of the present disclosure;

[0027] FIG5 is a flow chart of an abnormal behavior detection method provided by another embodiment of the present disclosure;

[0028] FIG6 is a schematic diagram of an embedded feature distance provided by an embodiment of the present disclosure;

[0029] FIG7 is a structural block diagram of an abnormal behavior detection device provided by an embodiment of the present disclosure; and

[0030] FIG8 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0032] Abnormal behavior detection is a key function of host intrusion detection systems (HIDs). It aims to detect unknown, abnormal behaviors that deviate from the baseline. HIDs can collect host data at various levels, including system calls, file creation, file reading and writing, command execution, and network connections.

[0033] Existing abnormal behavior detection solutions mainly rely on data such as execution command sequences, system call sequences, and process creation, and use statistical, machine learning, or deep learning methods for anomaly detection.

[0034] Among them, statistical-based solutions will specifically count the historical frequency of a certain behavior or combination of behaviors, and identify behaviors and behavior combinations with lower frequency as anomalies. Machine learning and deep learning-based solutions will first convert natural language data such as command sequences and process creation into feature vectors, and then perform clustering or classification, generally using unsupervised or self-supervised methods, for example:

[0035] Clustering the behavioral data using a clustering algorithm to obtain multiple clusters. The category with a larger number of samples is the normal behavior category, and the category with a smaller number of samples is the abnormal behavior category.

[0036] The behavior data is encoded and decoded using an autoencoder model. A loss function is set to ensure that the decoder output is as close as possible to the encoder input. Because the majority of behavior data collected in real production network environments is normal, the autoencoder model is more thoroughly trained for encoding and decoding normal behavior data, resulting in a smaller discrepancy between the model decoder output and the encoder input. However, with fewer abnormal behaviors, the autoencoder model is less thoroughly trained for encoding and decoding abnormal behavior data, resulting in a larger discrepancy between the model decoder output and the encoder input. Therefore, a threshold for the discrepancy between the model's input and output can be set to filter out abnormal behavior.

[0037] However, whether directly analyzing behavioral data for statistics or converting it into feature vectors for clustering or model training, there is a high risk of false positives due to the complex host command or process sequences in real-world scenarios. For example, a rare command parameter or file path may be identified as abnormal behavior when it is not. Strictly filtering and limiting the types of statistical data (for example, counting only a limited number of system calls) may result in the data being unable to fully describe and distinguish between the vast amount of complex normal behavior and unknown abnormal behavior.

[0038] In order to improve the accuracy of abnormal behavior detection and effectively avoid false alarms, the present disclosure provides an abnormal behavior detection method, which collects a set of behaviors to be detected that belong to the same session within a preset time window; adds a label to each behavior in the set of behaviors to be detected, and obtains the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; maps the label features of the set of behaviors to be detected to embedded features based on a preset embedded feature extraction model; and judges whether the set of behaviors to be detected has an abnormality based on the embedded features of the set of behaviors to be detected and the embedded features of the previously acquired historical behavior set. By using labels, each behavior in the set of behaviors to be detected is represented in natural language, which enhances the readability of the behavior data, and then quantifies the labels of all behaviors in the set of behaviors to be detected into label features, which are then mapped into embedded features, fully describing the characteristics of the set of behaviors to be detected, and having strong interpretability. Abnormal behavior recognition based on embedded features can improve recognition accuracy and reduce the occurrence of false alarms. It can be applied to abnormal behavior detection of massive behavior data in real scenarios.

[0039] The abnormal behavior detection method disclosed in the present invention is applied to electronic devices such as servers. As shown in FIG1 , a set of behaviors to be detected belonging to the same session within a preset time window can be obtained. Then, by adding labels, constructing label features, and extracting embedded features, it is determined whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the previously acquired historical behavior sets.

[0040] The abnormal behavior detection method disclosed in the present invention will be described in detail below with reference to specific embodiments.

[0041] Refer to Figure 2, which is a flow chart of an abnormal behavior detection method provided by an embodiment of the present disclosure. The method of this embodiment can be applied to electronic devices such as servers. The abnormal behavior detection method includes:

[0042] S201: Collect a set of behaviors to be detected that belong to the same session within a preset time window.

[0043] In this embodiment, behavioral data of the target host can be collected in real time, for example, by using a host-based intrusion detection system (HIDS) or other detection system. Furthermore, considering that behaviors in the same session have certain correlations, especially sessions with intrusion behaviors often also contain multiple other malicious behaviors, behavioral data within a preset time window (e.g., 60 minutes) is selected from the behavioral data of the same session on the same host to obtain a behavior set as the behavior set to be detected, and abnormal behavior detection is performed at the granularity of the behavior set.

[0044] In this embodiment, since a host-based intrusion detection system or other system may collect behaviors of multiple hosts and multiple sessions simultaneously, behaviors can be screened based on the host identifier and session identifier (Session_ID) and a preset time window to obtain a set of behaviors to be detected.

[0045] S202: Add a label to each behavior in the behavior set to be detected to identify attribute information of each behavior, and obtain label features of the behavior set to be detected based on the labels of all behaviors in the behavior set to be detected.

[0046] In this embodiment, the types of different target fields in each behavior in the behavior set to be detected can be identified, and each type corresponds to a label. Different target fields include but are not limited to program name fields (such as execve fields), source IP fields, destination IP fields, port fields, file path fields, file name fields, etc., so that multiple labels can be obtained for each behavior, and the attribute information of the behavior can be represented by multiple labels, and the behavior can be converted into a natural language representation, thereby enhancing the readability of the behavior data; and the labels of all behaviors in the behavior set to be detected can represent the behavior set to be detected, and then based on the labels of all behaviors in the behavior set to be detected, the label features of the behavior set to be detected can be constructed. For example, the labels of all behaviors in the behavior set to be detected can be counted, and a feature vector can be constructed as a label feature based on the statistical results to represent which labels the labels of all behaviors in the behavior set to be detected include and the number of times the included labels appear.

[0047] S203: Map the label features of the behavior set to be detected into embedded features according to a preset embedded feature extraction model.

[0048] In this embodiment, although the label features of the set of behaviors to be detected can distinguish abnormal behaviors from normal business behaviors, for a small number of normal business behaviors or special operation and maintenance behaviors, there may be a situation where their label features are relatively close to the label features of abnormal behaviors, which will cause certain false alarms. Therefore, this embodiment considers further processing of the label features.

[0049] An embedding feature extraction model can be pre-trained. This embedding feature extraction model can map the label features of any behavior set into embedding features. The input of the embedding feature extraction model can be the label features of any behavior set, and the output is the corresponding embedding features. Optionally, the embedding feature extraction model can use a deep neural network. For example, the embedding feature extraction model can use the encoder in the Transformer model, or other deep neural network models, which are not limited here. Through the embedding feature extraction model, high-dimensional label features can be converted into dense, low-dimensional embedding features. The embedding features integrate a large amount of valuable information, have stronger expressive power, and can better reflect the characteristics of the corresponding behavior set, so as to facilitate the identification of whether there are anomalies in the behavior set.

[0050] In this embodiment, after the label features of the behavior set to be detected are obtained, they can be input into the embedded feature extraction model. After being processed by the embedded feature extraction model, the embedded features of the behavior set to be detected are obtained.

[0051] S204: Determine whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set.

[0052] In this embodiment, after obtaining the embedded features of the behavior set to be detected, it is possible to determine whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set, where the embedded features of the previously acquired historical behavior set are also obtained using the same process as described above. Since the category of the historical behavior collection can be confirmed in advance, such as a normal behavior collection or an abnormal behavior collection, it is possible to determine whether the behavior set to be detected is abnormal by determining the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical behavior collection based on the embedded features of the historical behavior collection. Alternatively, other methods can be used to determine whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior collection.

[0053] Optionally, after confirming that the behavior set to be detected has an anomaly, an anomaly alarm may be issued. When issuing an alarm, labels of all behaviors in the behavior set to be detected may be given to assist in determining what operations have been performed in the behavior set to be detected.

[0054] The abnormal behavior detection method of this embodiment collects a set of behaviors to be detected that belong to the same session within a preset time window; adds a label to each behavior in the set of behaviors to be detected to identify the attribute information of each behavior, and obtains the label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; maps the label features of the set of behaviors to be detected to embedded features based on a preset embedded feature extraction model; and determines whether the set of behaviors to be detected has an abnormality based on the embedded features of the set of behaviors to be detected and the embedded features of the previously acquired historical behavior set. This embodiment uses labels to represent each behavior in the set of behaviors to be detected in natural language, which enhances the readability of the behavior data, and then quantifies the labels of all behaviors in the set of behaviors to be detected into label features, which are then mapped into embedded features, fully describing the characteristics of the set of behaviors to be detected, and has strong interpretability. Abnormal behavior recognition based on embedded features can improve recognition accuracy and reduce the occurrence of false alarms.

[0055] Based on any of the above embodiments, S202 adds a label to each behavior in the behavior set to be detected to identify attribute information of each behavior, and obtains label features of the behavior set to be detected based on the labels of all behaviors in the behavior set to be detected, which may specifically include:

[0056] S2021. According to a preset label set, labels are added to the multiple target fields in each behavior in the set of behaviors to be detected, to obtain a label corresponding to each behavior;

[0057] S2022. Obtain the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0058] S2023: Construct a label feature of the behavior set to be detected according to the number of times each label in the preset label set appears.

[0059] In this embodiment, the preset tag set is a pre-acquired tag set, which includes alternative tags corresponding to different target fields (which can constitute a tag subset). Different target fields include but are not limited to program name fields (such as execve fields), network-related fields such as source IP fields, destination IP fields, port fields, etc., and file-related fields such as file path fields, file name fields, etc. For each target field in each behavior in the set of behaviors to be detected, a tag can be added separately to obtain a tag corresponding to each behavior. Among them, a machine learning model (such as a neural network model such as a language model) can be used to implement tagging; tagging can also be implemented through matching rules, which can be implemented by writing scripts or stream processing engines (such as Flink). Specifically, according to the preset matching rules, any target field of any behavior can be matched with the tag subset corresponding to the target field to determine the target tag corresponding to the target field; or some target fields (such as the program name field) are labeled using a machine learning model, and other target fields are labeled using matching rules.

[0060] As an example, the tag subset of the program name field (execve field) may include, but is not limited to: file transfer, backup compression, file management, disk management, disk maintenance, system settings, system management, text processing, network communication, device management, email and newsgroups, applications, package management, other common commands, code-related, databases, etc. When adding tags to the program name field (execve field) of any behavior, if the execve field is "find", then add the tag "file management"; if the execve field is "nginx", then add the tag "network communication"; if the execve field is "systemd", then add the tag "system management"; if the execve field is "nginx", then add the tag "network communication"; if the execve field is "systemd", then add the tag "system management"; if the execve field is "dpkg", then add the tag "package management"; if the execve field is "ffmpeg", then add the tag "application", and so on. Optionally, if the program name field (execve field) of any action includes a file path, the prefix path can be extracted.

[0061] The label subset of the source IP field may include but is not limited to: IPV6 source IP, intranet source IP, loopback source IP, external source IP, reserved source IP, etc. When adding a label to the source IP field of any behavior, if the source IP field is an intranet IP address, add the label "intranet source IP"; if the source IP field is an external IP address, add the label "external source IP"; if the source IP field is a loopback IP, add the label "loopback source IP"; if the source IP field is a reserved IP address, add the label "reserved source IP"; if the source IP field is an IPV6 address, add the label "IPV6 source IP", and so on.

[0062] The label subset of the destination IP field may include, but is not limited to: IPV6 destination IP, intranet destination IP, loopback destination IP, extranet destination IP, reserved destination IP, etc. When adding a label to the destination IP field of any behavior, if the destination IP field is an intranet IP address, add the label "intranet destination IP"; if the destination IP field is an extranet IP address, add the label "extranet destination IP"; if the destination IP field is a loopback IP, add the label "loopback destination IP"; if the destination IP field is a reserved IP address, add the label "reserved destination IP"; if the destination IP field is an IPV6 address, add the label "IPV6 destination IP", and so on.

[0063] The tag subset of the source port field may include, but is not limited to, well-known source ports, registered source ports, etc. When adding tags to the source port field of any behavior, if the source port field is a well-known port number, the tag "well-known source port" is added; if the source port field is a registered port number, the tag "registered source port" is added, and so on.

[0064] The tag subset for the destination port field may include, but is not limited to, well-known destination ports, registered destination ports, etc. When adding tags to the destination port field of any action, if the destination port field is a well-known port number, the tag "well-known destination port" is added; if the destination port field is a registered port number, the tag "registered destination port" is added, and so on.

[0065] The label subset of the file path field may include but is not limited to: bin directory, dev directory, etc directory, home directory, lib directory, sbin directory, tmp directory, root directory, mnt directory, lost+found directory, proc directory, var directory, usr directory, opt directory, etc. When adding a label to the file path field of any behavior, if the path contains a bin directory, add the label "bin directory"; if the path contains a dev directory, add the label "dev directory"; if the path contains an etc directory, add the label "etc directory"; if the path contains a home directory, add the label "home directory"; if the path contains a home directory, add the label "home directory"; if the path contains a lib directory, add the label "lib directory"; if the path contains an sbin directory, add the label "sbin directory"; if the path contains a tmp directory, add the label "tmp directory"; if the path contains a root directory, add the label "root directory"; if the path contains an mnt directory, add the label "mnt directory"; if the path contains a lost+found directory, add the label "lost+found directory"; if the path contains a proc directory, add the label "proc directory"; if the path contains a var directory, add the label "var directory"; if the path contains a usr directory, add the label "usr directory"; if the path contains an opt directory, add the label "opt directory", and so on.

[0066] The tag subset of the file name field may include, but is not limited to: log files, py files, sh files, compressed files, web page files, configuration files, etc. When adding tags to the file name field of any behavior, if the file name contains "log", the tag "log file" is added; if the file name suffix is ​​"py", the tag "py file" is added; if the file name suffix is ​​"sh", the tag "sh file" is added; if the file name suffix is ​​"tar", "tgz", or "zip", the tag "compressed file" is added; if the file name suffix contains "php", "htm", "jsp", or "do", the tag "web page file" is added; if the file name contains "conf", the tag "configuration file" is added.

[0067] The above label settings are an example under the Linux operating system. If you are using the Windows operating system, you should make corresponding modifications.

[0068] Among them, there are many types of label subsets of program name fields, which can be learned based on historical behavior data. The labels corresponding to different program name fields can be used to build a label subset of program name fields, or a label knowledge base, which includes the mapping relationship between different program name fields and corresponding labels.

[0069] Optionally, as shown in FIG3 , multiple pieces of historical behavior data can be obtained, and the program name field (execve field) in the historical behavior data can be extracted. If the program name field (execve field) includes a file path, the prefix path can be taken out. The above process of extracting the program name field (execve field) in the historical behavior data can be automatically implemented by writing a code script, etc.; a preset language model is used to obtain the label corresponding to each program name field, and a label subset (label knowledge base) corresponding to the program name field is constructed. The preset language model can be any language model, such as ChatGPT, etc., as long as it performs well in question-and-answering in the field of host security. A prompt word can be constructed, and the prompt word is used to send a learning task for the label subset of the program name field to the preset language model. For example, the prompt word is constructed as follows:

[0070] "Determine which of the following categories the Linux command / process 'execve' belongs to, Category list: File transfer, backup compression, file management, disk management, disk maintenance, system settings, system administration, text processing, network communication, device management, email and newsgroups, applications, package management, code related, database;

[0071] If it is not in the above categories, please summarize the category of the Linux command and give it. If you cannot answer, the category name is unknown;

[0072] Please also provide a Chinese introduction to the command. If the specific circumstances of the command are unclear, please provide possible speculation and indicate uncertainty.

[0073] The answer should be in JSON format, where the 'class' field is the command category and the 'description' field is the command description. Do not answer any other information.

[0074] Furthermore, the program name field in the historical behavior data is traversed, and the specific name of the program name field is replaced with the "execve" in the prompt word. The prompt word is then input into the preset language model, which outputs the command category (i.e., label) and detailed information (command description) of the program name field based on its own knowledge base and stores them. Optionally, the data can be stored in a key-value format, where the key is the execve field, for easy retrieval. For example:

[0075] 1. {'class':'File Management','description':'The `find` command is used to find files and directories in a specified directory. It provides many options to help you specify search criteria, such as name, size, permissions, type, etc. The `find` command also supports the use of regular expressions to match the names of files and directories. The `find` command is very powerful and can help you quickly locate specific files or directories.',

[0076] 'execve':'find'}

[0077] 2. {'class':'Application','description':'`dash` is a shell program for Unix / Linux operating systems, a lightweight version of the Bourne shell. It is characterized by fast execution, low memory usage, and concise code. `dash` executes scripts faster than other shells like Bash, offering advantages in startup and script execution speed. `dash` is typically used as the default / bin / sh interpreter and is also included as one of the default shell interpreters in some Linux distributions.

[0078] '

[0079] ,

[0080] 'execve':'dash'}

[0081] Through the above process, we can fully utilize the host security professional domain knowledge implicit in the language model and reduce the cost of manual labeling.

[0082] On the basis of the above embodiment, after obtaining the label corresponding to each behavior in the set of behaviors to be detected, the number of times each label in the preset label set appears in the label of each behavior in the set of behaviors to be detected can be obtained. If it does not appear, the number is recorded as 0. The label feature of the set of behaviors to be detected is further constructed based on the number of times each label in the preset label set appears. For example, the number of times each label in the preset label set appears is directly sorted according to the preset label order to obtain a first sequence (array), and the first sequence is directly used as the label feature of the set of behaviors to be detected.

[0083] In order to facilitate the processing of the embedded feature extraction model, the number of times each label appears can be quantified, that is, discretized, and the number of times can be mapped to a specific value through a preset mapping relationship. For example, the preset mapping relationship can be as follows:

[0084] Based on the preset mapping relationship, each value in the first sequence can be mapped to obtain a second sequence, and the second sequence is used as the label feature of the set of behaviors to be detected.

[0085] For example, taking the preset tag set in the above example, it includes 50 tags, each tag corresponds to a position, and records the number of times the tag appears in the tag of each behavior in the set of behaviors to be detected. It is initialized to a 50-bit array of all zeros. Assuming that the "file transfer" tag appears 120 times in the tags of each behavior in the set of behaviors to be detected, the "intranet source IP" appears 10 times, and the "extranet destination IP" appears 10 times, then the second sequence is obtained. The second sequence is used as the tag feature (i.e., feature vector) of the set of behaviors to be detected. The number of times each behavior appears in the tag is as follows:

[0086] [3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0].

[0087] Through the above quantization process, the label of each behavior in the set of behaviors to be detected can be quantified reasonably and efficiently.

[0088] Furthermore, although the label features of the set of behaviors to be detected can distinguish abnormal behaviors from normal business behaviors, for a small number of special business behaviors or special operation and maintenance behaviors, their label features may be relatively close to the label features of abnormal behaviors, which may cause certain false positives. That is, in the feature space of label features, the distance between the label features of a small number of special business behaviors / special operation and maintenance behaviors and the label features of normal business behaviors is greater than the distance between the label features of abnormal behaviors and the label features of normal business behaviors. As shown in Figure 4, for example:

[0089] The number of occurrences (first sequence) of each behavior in the label of a certain mining behavior (abnormal behavior) set is as follows:

[0090] [1,0,169,1,0,99,334,666,26,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,49,0,0,1,0,0,0,0,0];

[0091] The quantified label features are:

[0092] [1,0,3,1,0,2,3,3,2,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,2,0,0,1,0,0,0,0,0];

[0093] The label characteristics of another small number of normal business behaviors or special operation and maintenance behaviors are:

[0094] [0,0,3,2,0,1,3,3,2,0,0,0,0,0,0,0,0,1,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,3,0,0,0,0,3,0,0,1,0,0,0,0,0];

[0095] As can be seen, the label characteristics of this mining behavior set are similar. To clearly distinguish the label characteristics of these two behavior sets, it is necessary to assign greater weights to certain specific labels. For example, since mining behavior sets generally involve file transfers, the file transfer tag bit should be assigned a greater weight. Different weights can also be assigned to other different tag bits. Manually setting the weights for different tag bits is difficult to adapt to all situations. Dynamically adjusting feature weights through the model is more appropriate.

[0096] In order to achieve the above purpose, embedded features can be extracted and an embedded feature extraction model can be trained.

[0097] Specifically, as shown in FIG5 , multiple historical behavior sets of different categories can be obtained, such as HIDS alarm data (including real red and blue confrontation data) in real business collected by the same host-type intrusion detection system, HIDS alarm data on the honeypot (including various types of mining, Trojan backdoors, etc.), normal business behavior data, etc. The above data are divided into the granularity of behavior sets, that is, the behavior data within a preset time window (such as 60 minutes) is selected from the behavior data of the same session on the same host to obtain multiple historical behavior sets. The alarm type is used as the category of HIDS alarm data, and the specific business name is used as the category of real business behavior data. Then, the method in the above embodiment is used to obtain the label features of each historical behavior set for multiple different categories of historical behavior sets, and the label features of multiple historical behavior sets are used as training data. Furthermore, the embedded feature extraction model is trained based on the training data.

[0098] First, an initial embedding feature extraction model can be constructed. The embedding feature extraction model can use the encoder in the Transformer model (of course, other deep neural networks can also be used) to map the label features of each training data into embedding features. Based on the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is back-propagated to adjust the model parameters of the embedding feature extraction model. The triplet loss loss is used to make the embedding features of the same category of training data similar, and the embedding features of normal business and abnormal behavior differ greatly. The triplet loss loss function is expressed as:

[0099] L=max(d(a,p)–d(a,n)+mergin,0)

[0100] Where d is the distance metric function, typically cosine distance or Euclidean distance; a is the anchor point, that is, the current sample selected from the training data set each time; p is a sample of the same category as the anchor point sample; n is a sample of a different category from the anchor point sample; and mergin is a manually set hyperparameter with a default value of 1. The goal of minimizing L is to make the feature distance d(a,p) between a and p close to 0, and the feature distance d(a,n) between a and n greater than d(a,p) + mergin. After training using this scheme, the deep neural network can convert label features into embedding features. In the feature space of the embedding features, the feature distance of a small number of special business / special operation and maintenance behaviors from normal business is smaller than the feature distance between abnormal behavior and normal business behavior, as shown in Figure 6, thus distinguishing abnormal behavior.

[0101] In this embodiment, after obtaining the label features of the behavior set to be detected, they can be input into the embedded feature extraction model. After being processed by the embedded feature extraction model, the embedded features of the behavior set to be detected are obtained. For example, the label features are:

[0102] [1,0,3,1,0,2,3,3,2,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,2,0,0,1,0,0,0,0,0];

[0103] After being processed by the embedding feature extraction model, the embedded features are:

[0104] [0.68,0,0.012,0.24……]

[0105] In an optional embodiment, determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set in S204 may specifically include:

[0106] For the embedded features of the behavior set to be detected, incremental clustering is performed using a preset clustering model based on the clustering results of the embedded features of the historical behavior set, wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0107] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0108] In this embodiment, multiple historical behavior sets can be collected in advance. For example, multiple historical behavior sets within a predetermined period of time in the past (the predetermined period of time can be determined based on the amount of data and resource conditions, for example, 1-7 days can be selected), and the method in the above embodiment can be used to obtain the embedded features of each historical behavior collection respectively, and clustering is performed according to the embedded features of each historical behavior collection. For example, a singlepass clustering algorithm or a DBSCAN clustering algorithm can be used to cluster the embedded features of each historical behavior collection, and the clustering results are used as basic categories, wherein the categories with less than a preset sample number threshold in the clustering results are regarded as abnormal behavior categories, and the categories with not less than the preset sample number threshold are regarded as normal behavior categories. After obtaining the embedded features of the behavior set to be detected, incremental clustering can be performed based on the clustering results of the embedded features of the historical behavior set, that is, the same clustering algorithm is continued to be used to determine whether the embedded features of the behavior set to be detected can be classified into any category in the above clustering results. If the embedded features of the behavior set to be detected are classified into the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0109] In another optional embodiment, determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set in S204 may specifically include:

[0110] An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain the output results, where the autoencoder model is trained using the embedded features of the historical behavior set;

[0111] Based on the error between the output result and the embedded features of the behavior set to be detected, it is determined whether the behavior set to be detected is abnormal.

[0112] In this embodiment, the autoencoder model (AutoEncoder) is an unsupervised neural network model that can learn the implicit features of the input data, which is called encoding, and can reconstruct the original input data using the learned new features, which is called decoding.

[0113] In this embodiment, multiple historical behavior sets can be collected in advance. For example, multiple historical behavior sets within a predetermined period of time in the past (the predetermined period of time can be determined based on the amount of data and resource conditions, for example, 1-7 days can be selected), and the method in the above embodiment can be used to obtain the embedded features of each historical behavior set respectively. When training the autoencoder model based on the embedded features of multiple historical behavior sets, since the number of normal behavior sets is greater than the number of abnormal behavior sets, that is, the number of embedded features of normal behavior sets in the embedded features of multiple historical behavior sets is greater than the number of embedded features of abnormal behavior sets, the autoencoder model is fully trained for normal behavior during training, and the difference between the output result and the embedded features of the input normal behavior set is small; however, since the number of embedded features of the abnormal behavior set is small, the autoencoder model is not fully trained for abnormal behavior, and the difference between the output result and the embedded features of the input abnormal behavior set is large.

[0114] After obtaining the embedded features of the behavior set to be detected, they are input into the trained autoencoder model for encoding and decoding. If the error between the output result and the embedded features of the behavior set to be detected is small and does not exceed the preset error threshold, the behavior set to be detected can be determined to be a normal behavior set; if the error between the output result and the embedded features of the behavior set to be detected is large and exceeds the preset error threshold, the behavior set to be detected can be determined to be an abnormal behavior set.

[0115] In another optional embodiment, the embedded features of the historical behavior set include embedded features of at least one historical abnormal behavior set. The historical abnormal behavior set may be an abnormal behavior set that has been manually confirmed (such as an intrusion behavior or other malicious behavior), or an abnormal behavior set determined by other methods. The embedded features of the historical abnormal behavior set may be used as index items. Accordingly, S204 determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance. Specifically, the following may be included:

[0116] Obtain the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical abnormal behavior set; and determine whether the behavior set to be detected is abnormal based on the similarity.

[0117] In this embodiment, the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical abnormal behavior set can be calculated. If the similarity exceeds a preset similarity threshold, it means that the similarity between the behavior set to be detected and the historical abnormal behavior set is very high, and it can be confirmed that there is an abnormality in the behavior set to be detected, and an alarm can be issued, wherein the relevant information of the historical abnormal behavior set can also be given when the alarm is issued. In this embodiment, if there are multiple embedded features of historical abnormal behavior sets, and the embedded features of the historical abnormal behavior sets are used as index items, the similarity between the embedded features of the behavior set to be detected and the embedded features of each historical abnormal behavior set can be calculated based on the index items, and it is determined whether the maximum similarity exceeds the preset similarity threshold. Optionally, the above process can be implemented using a stream processing engine (such as flink). If the abnormal behavior set is a malicious behavior set (such as an intrusion behavior set, or other malicious behavior set), the method of this embodiment can be used to determine whether the behavior set to be detected is a malicious behavior set.

[0118] In addition, it is possible to trace back the historical behavior set over a period of time in the past and calculate the similarity between the embedded features of the historical behavior set and the embedded features of the historical abnormal behavior set, thereby realizing threat hunting and determining whether any behavior with a high similarity to the historical abnormal behavior set has occurred in the past period of time.

[0119] It should be noted that the above optional embodiments can also be combined without conflict, and the judgment results of multiple embodiments can be integrated to finally confirm whether the set of behaviors to be detected has anomalies, thereby improving accuracy and avoiding false alarms.

[0120] Corresponding to the abnormal behavior detection method described in the preceding embodiment, Figure 7 is a block diagram of the abnormal behavior detection device provided in the present embodiment. For ease of illustration, only the portions relevant to the present embodiment are shown. Referring to Figure 7 , abnormal behavior detection device 700 includes a collection unit 701, a label processing unit 702, a mapping unit 703, and an anomaly identification unit 704.

[0121] The collecting unit 701 is used to collect a set of behaviors to be detected belonging to the same session within a preset time window;

[0122] The label processing unit 702 is used to add a label to each behavior in the behavior set to be detected to identify the attribute information of each behavior, and obtain the label features of the behavior set to be detected based on the labels of all behaviors in the behavior set to be detected;

[0123] A mapping unit 703 is configured to map the label features of the behavior set to be detected into embedded features according to a preset embedded feature extraction model;

[0124] The anomaly identification unit 704 is configured to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set.

[0125] In one or more embodiments of the present disclosure, the label processing unit 702 adds a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtains label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected, and is configured to:

[0126] According to the preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected to obtain labels corresponding to each behavior;

[0127] Obtain the number of times each tag in the preset tag set appears in the tags of each behavior in the behavior set to be detected;

[0128] The label features of the behavior set to be detected are constructed according to the number of times each label appears in the preset label set.

[0129] In one or more embodiments of the present disclosure, when constructing the tag features of the set of behaviors to be detected based on the number of times each tag in the preset tag set appears, the tag processing unit 702 is configured to:

[0130] Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence;

[0131] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0132] In one or more embodiments of the present disclosure, when determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set, the anomaly identification unit 704 is configured to:

[0133] For the embedded features of the behavior set to be detected, a preset clustering model is used to perform incremental clustering based on the clustering results of the embedded features of the historical behavior set, where the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than the preset sample number threshold;

[0134] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0135] In one or more embodiments of the present disclosure, when determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set, the anomaly identification unit 704 is configured to:

[0136] An autoencoder model is used to encode and decode the embedded features of the set of behaviors to be detected to obtain the output results, where the autoencoder model is trained using the embedded features of the historical behavior set;

[0137] Based on the error between the output result and the embedded features of the behavior set to be detected, it is determined whether the behavior set to be detected is abnormal.

[0138] In one or more embodiments of the present disclosure, the embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set; when the abnormality identification unit 704 determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set, it is configured to:

[0139] Obtain the similarity between the embedded features of the behavior set to be detected and the embedded features of the historical abnormal behavior set;

[0140] Determine whether the behavior set to be detected is abnormal based on the similarity.

[0141] In one or more embodiments of the present disclosure, the preset label set includes label subsets corresponding to different target fields. Accordingly, when labeling multiple target fields in each behavior in the set of behaviors to be detected based on the preset label set, the label processing unit 702 is configured to:

[0142] According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

[0143] In one or more embodiments of the present disclosure, the target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

[0144] In one or more embodiments of the present disclosure, the tag processing unit 702 is further configured to:

[0145] Obtain multiple pieces of historical behavior data and extract the program name field in the historical behavior data;

[0146] A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

[0147] In one or more embodiments of the present disclosure, the embedded feature extraction model is trained through the following process:

[0148] Obtain multiple historical behavior sets of different categories, obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data;

[0149] The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. According to the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is back-propagated to adjust the model parameters of the embedding feature extraction model, and finally the trained embedding feature extraction model is obtained.

[0150] In one or more embodiments of the present disclosure, the embedding feature extraction model adopts the encoder in the Transformer model.

[0151] The abnormal behavior detection device provided in this embodiment can be used to implement the technical solution of the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0152] Referring to FIG8 , a schematic diagram of the structure of an electronic device 800 suitable for implementing an embodiment of the present disclosure is shown. The electronic device 800 may be a terminal device or a server. The terminal device may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Portable Android Devices, PADs), portable multimedia players (PMPs), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), and fixed terminals such as digital TVs and desktop computers. The electronic device shown in FIG8 is merely an example and should not limit the functionality and scope of use of the embodiments of the present disclosure.

[0153] As shown in Figure 8, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. Various programs and data required for the operation of the electronic device 800 are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0154] Typically, the following devices may be connected to the I / O interface 805: an input device 806 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 808 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 809. The communication device 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. Although FIG8 shows an electronic device 800 having various devices, it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0155] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication device 809, or installed from the storage device 808, or installed from the ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0156] It should be noted that the computer-readable medium described above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0157] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0158] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0159] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider).

[0160] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0161] The units involved in the embodiments described in this disclosure may be implemented in software or hardware. In some cases, the name of a unit does not limit the unit itself. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses."

[0162] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0163] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0164] In one aspect, according to one or more embodiments of the present disclosure, a method for detecting abnormal behavior is provided, comprising:

[0165] Collect the set of behaviors to be detected belonging to the same session within a preset time window;

[0166] Adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0167] Mapping the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0168] Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance, it is determined whether the behavior set to be detected has an anomaly.

[0169] According to one or more embodiments of the present disclosure, the step of adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected, includes:

[0170] According to the preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected to obtain labels corresponding to each behavior;

[0171] Obtaining the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0172] The label features of the set of behaviors to be detected are constructed according to the number of times each label in the preset label set appears.

[0173] According to one or more embodiments of the present disclosure, constructing the label features of the set of behaviors to be detected based on the number of times each label in the preset label set appears includes:

[0174] Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence;

[0175] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0176] According to one or more embodiments of the present disclosure, determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set includes:

[0177] For the embedded features of the set of behaviors to be detected, incremental clustering is performed using a preset clustering model based on the clustering results of the embedded features of the historical behavior set, wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0178] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0179] According to one or more embodiments of the present disclosure, determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set includes:

[0180] Encoding and decoding the embedded features of the set of behaviors to be detected using an autoencoder model to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors;

[0181] Whether the behavior set to be detected is abnormal is determined based on an error between the output result and the embedded features of the behavior set to be detected.

[0182] According to one or more embodiments of the present disclosure, the embedded features of the historical behavior set include embedded features of at least one historical abnormal behavior set; and determining whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set obtained in advance includes:

[0183] Obtaining similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0184] It is determined whether the set of behaviors to be detected is abnormal based on the similarity.

[0185] According to one or more embodiments of the present disclosure, the preset label set includes label subsets corresponding to different target fields; accordingly, labeling multiple target fields in each behavior in the set of behaviors to be detected based on the preset label set includes:

[0186] According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

[0187] According to one or more embodiments of the present disclosure, the target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

[0188] According to one or more embodiments of the present disclosure, the method further includes:

[0189] Acquire multiple pieces of historical behavior data, and extract the program name field in the historical behavior data;

[0190] A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

[0191] According to one or more embodiments of the present disclosure, the embedded feature extraction model is trained through the following process:

[0192] Obtain multiple historical behavior sets of different categories, obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data;

[0193] The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. According to the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is back-propagated to adjust the model parameters of the embedding feature extraction model, and finally the trained embedding feature extraction model is obtained.

[0194] According to one or more embodiments of the present disclosure, the embedded feature extraction model adopts the encoder in the Transformer model.

[0195] In one aspect, according to one or more embodiments of the present disclosure, there is provided an abnormal behavior detection device, comprising:

[0196] A collection unit configured to collect a set of behaviors to be detected belonging to the same session within a preset time window;

[0197] a label processing unit configured to add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected;

[0198] a mapping unit configured to map the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model;

[0199] The anomaly identification unit is configured to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set.

[0200] According to one or more embodiments of the present disclosure, when the label processing unit adds a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtains label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected, it is configured to:

[0201] According to the preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected to obtain labels corresponding to each behavior;

[0202] Obtaining the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected;

[0203] The label features of the set of behaviors to be detected are constructed according to the number of times each label in the preset label set appears.

[0204] According to one or more embodiments of the present disclosure, when constructing the label features of the set of behaviors to be detected based on the number of occurrences of each label in the preset label set, the label processing unit is configured to:

[0205] Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence;

[0206] Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

[0207] According to one or more embodiments of the present disclosure, when the anomaly identification unit determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set, it is configured to:

[0208] For the embedded features of the set of behaviors to be detected, incremental clustering is performed using a preset clustering model based on the clustering results of the embedded features of the historical behavior set, wherein the clustering results of the embedded features of the historical behavior set include normal behavior categories and abnormal behavior categories, and the number of samples in the abnormal behavior category is less than a preset sample number threshold;

[0209] If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

[0210] According to one or more embodiments of the present disclosure, when the anomaly identification unit determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the pre-acquired historical behavior set, it is configured to:

[0211] Encoding and decoding the embedded features of the set of behaviors to be detected using an autoencoder model to obtain an output result, wherein the autoencoder model is trained using the embedded features of the set of historical behaviors;

[0212] Whether the behavior set to be detected is abnormal is determined based on an error between the output result and the embedded features of the behavior set to be detected.

[0213] According to one or more embodiments of the present disclosure, the embedded features of the historical behavior set include embedded features of at least one historical abnormal behavior set; when the abnormality identification unit determines whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the previously acquired historical behavior set, the unit is configured to:

[0214] Obtaining similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors;

[0215] It is determined whether the set of behaviors to be detected is abnormal based on the similarity.

[0216] According to one or more embodiments of the present disclosure, the preset label set includes label subsets corresponding to different target fields; accordingly, when the label processing unit adds labels to multiple target fields in each behavior in the set of behaviors to be detected according to the preset label set, it is configured to:

[0217] According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

[0218] According to one or more embodiments of the present disclosure, the target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

[0219] According to one or more embodiments of the present disclosure, the label processing unit is further configured to:

[0220] Acquire multiple pieces of historical behavior data, and extract the program name field in the historical behavior data;

[0221] A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

[0222] According to one or more embodiments of the present disclosure, the embedded feature extraction model is trained through the following process:

[0223] Obtain multiple historical behavior sets of different categories, obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data;

[0224] The training data is input into the embedding feature extraction model to obtain the embedding features corresponding to each training data. According to the embedding features corresponding to each training data and the triplet loss function, the embedding feature extraction model is back-propagated to adjust the model parameters of the embedding feature extraction model, and finally the trained embedding feature extraction model is obtained.

[0225] According to one or more embodiments of the present disclosure, the embedded feature extraction model adopts the encoder in the Transformer model.

[0226] In one aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device comprising: at least one memory configured to store computer-executable instructions; and

[0227] at least one processor configured to execute computer-executable instructions stored in the memory,

[0228] Wherein, when the computer-executable instructions are executed by the at least one processor, the at least one processor executes the abnormal behavior detection method as described in the above aspects and various possible designs of each aspect.

[0229] On the one hand, according to one or more embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the abnormal behavior detection method described in the above aspects and various possible designs of each aspect is implemented.

[0230] In one aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, comprising computer-executable instructions. When a processor executes the computer-executable instructions, the abnormal behavior detection method described in the above aspects and various possible designs of each aspect is implemented.

[0231] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0232] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0233] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A method for detecting abnormal behavior, comprising: Collect a set of behaviors to be detected that belong to the same session within a preset time window; Adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; According to a preset embedding feature extraction model, the label features of the set of behaviors to be detected are mapped into embedding features; Based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance, it is determined whether the behavior set to be detected is abnormal.

2. The method according to claim 1, wherein: The step of adding a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtaining label features of the set of behaviors to be detected according to the labels of all behaviors in the set of behaviors to be detected, includes: According to a preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, so as to obtain a label corresponding to each behavior; Obtain the number of times each tag in the preset tag set appears in the tag of each behavior in the set of behaviors to be detected; The label features of the to-be-detected behavior set are constructed according to the number of times each label in the preset label set appears.

3. The method according to claim 2, wherein: The step of constructing the label features of the set of behaviors to be detected according to the number of times each label in the preset label set appears includes: Sort the number of times each tag in the preset tag set appears according to the preset tag order to obtain a first sequence; Each value in the first sequence is mapped according to a preset mapping relationship to obtain a second sequence, and the second sequence is used as a label feature of the set of behaviors to be detected.

4. The method according to any one of claims 1 to 3, wherein: The determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the set of historical behaviors acquired in advance includes: For the embedded features of the set of behaviors to be detected, incremental clustering is performed based on the clustering results of the embedded features of the set of historical behaviors using a preset clustering model, wherein the historical behaviors The clustering result of the embedded features of the set includes a normal behavior category and an abnormal behavior category, and the number of samples in the abnormal behavior category is less than a preset sample number threshold; If the embedded features of the behavior set to be detected are added to the abnormal behavior category, or the embedded features of the behavior set to be detected do not belong to any category, it is determined that the behavior set to be detected is abnormal.

5. The method according to any one of claims 1 to 3, wherein: The determining whether the set of behaviors to be detected is abnormal based on the embedded features of the set of behaviors to be detected and the embedded features of the set of historical behaviors acquired in advance includes: Using an autoencoder model to encode and decode the embedded features of the set of behaviors to be detected to obtain an output result, wherein the autoencoder model is trained by the embedded features of the set of historical behaviors; Whether the set of behaviors to be detected is abnormal is determined according to an error between the output result and the embedded features of the set of behaviors to be detected.

6. The method according to any one of claims 1 to 3, wherein: The embedded features of the historical behavior set include at least one embedded feature of a historical abnormal behavior set; judging whether the behavior set to be detected is abnormal based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance includes: Obtaining the similarity between the embedded features of the set of behaviors to be detected and the embedded features of the set of historical abnormal behaviors; It is determined whether the set of behaviors to be detected is abnormal according to the similarity.

7. The method according to claim 2 or 3, wherein: The preset label set includes label subsets corresponding to different target fields; accordingly, according to the preset label set, labels are added to multiple target fields in each behavior in the set of behaviors to be detected, including: According to the preset matching rules, any target field of any behavior is matched with the label subset corresponding to the target field to determine the target label corresponding to the target field.

8. The method according to claim 7, wherein: The target field includes one or more of the following: a program name field, a source IP field, a destination IP field, a port field, a file path field, and a file name field.

9. The method according to claim 8, further comprising: Acquire multiple pieces of historical behavior data, and extract a program name field from the historical behavior data; A preset language model is used to obtain the label corresponding to each program name field, and a label subset corresponding to the program name field is constructed.

10. The method according to any one of claims 1 to 9, wherein: The embedding feature extraction model is trained through the following process: Acquire multiple historical behavior sets of different categories, and obtain label features of each historical behavior set, and use the label features of the multiple historical behavior sets as training data; The training data is input into the embedded feature extraction model to obtain the embedded features corresponding to each of the training data; according to the embedded features corresponding to each of the training data and the triplet loss function, the embedded feature extraction model is back-propagated to adjust the model parameters of the embedded feature extraction model to finally obtain the trained embedded feature extraction model.

11. The method according to any one of claims 1 to 10, wherein: The embedding feature extraction model uses the encoder in the Transformer model.

12. An abnormal behavior detection device, comprising: A collection unit, configured to collect a set of behaviors to be detected belonging to the same session within a preset time window; a label processing unit configured to add a label to each behavior in the set of behaviors to be detected to identify attribute information of each behavior, and obtain label features of the set of behaviors to be detected based on the labels of all behaviors in the set of behaviors to be detected; A mapping unit, configured to map the label features of the set of behaviors to be detected into embedded features according to a preset embedded feature extraction model; The anomaly identification unit is configured to determine whether the behavior set to be detected has an anomaly based on the embedded features of the behavior set to be detected and the embedded features of the historical behavior set acquired in advance.

13. An electronic device, comprising: at least one memory configured to store computer-executable instructions; and at least one processor configured to execute computer-executable instructions stored in the memory, Wherein, when the computer-executable instructions are executed by the at least one processor, the at least one processor executes the method according to any one of claims 1-11.

14. A non-transitory computer-readable storage medium storing computer-executable instructions, wherein: When the computer-executable instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 11.

15. A computer program product comprising computer executable instructions, wherein: When the computer-executable instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 11.

Images