Session Behavior Embedding for Accurate Host Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing abnormal behavior detection schemes in host intrusion detection systems suffer from low accuracy and high false positives due to the complexity of host commands and process sequences, particularly in real scenarios.
Innovation Solution
Collect behaviors within a preset time window, label each behavior with attribute information, map these label features into embedded features using a pre-trained model, and compare them with historical behaviors to determine abnormality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing abnormal behavior detection schemes use statistics, machine learning or deep learning methods on execution command sequence and system call sequence, then detection capability is provided, but accuracy is low and false positives are high
Solution Approach 1:
The patent introduces an intermediary processing layer between raw behavior data and detection algorithms. It extracts semantic features from execution commands and system calls, then maps them to a standardized feature space using pre-trained language models. This intermediary representation layer transforms complex, variable-length command sequences into fixed-dimensional semantic vectors, enabling more accurate and reliable anomaly detection while reducing false positives.
Solution Approach 2:
The patent transforms the detection parameters from raw execution commands and system call sequences into semantic feature representations. By changing the parameter space from symbolic command strings to continuous semantic vectors through pre-trained models, the system achieves better detection accuracy and lower false positive rates. The transformation involves mapping diverse command formats into a unified feature representation that captures semantic meaning.
2Measurement precision
If complex host commands and process sequences are analyzed directly, then behavior detection is performed, but the complexity reduces accuracy
Solution Approach 1:
The patent extracts essential semantic features from complex host commands and process sequences, separating the critical informational content from the syntactic complexity. It uses feature extraction techniques to identify and isolate key semantic elements from lengthy command sequences, then represents them in a simplified feature space. This extraction process removes unnecessary complexity while preserving the essential behavioral patterns needed for accurate detection.
Solution Approach 2:
The patent creates simplified copies of complex behavior data through semantic feature representations. Instead of processing the original complex command sequences directly, it generates compressed semantic vector copies that capture the essential meaning. These copied representations maintain the critical behavioral information while being much simpler to process, thereby improving recognition accuracy without the burden of original data complexity.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The present disclosure provides an abnormal behavior test method, an abnormal behavior test device, an electronic device, a non-transitory computer-readable storage medium, and a computer program product. The abnormal behavior test method comprises: acquiring a set of behaviors to be tested pertaining to a same session within a preset time window; adding a label to each behavior in the set of behaviors to be tested, and obtaining a label feature of the set of behaviors to be tested on the basis of the labels of all of the behaviors in the set of behaviors to be tested; on the basis of a preset embedded feature extraction model, mapping the label feature of the set of behaviors to be tested into an embedded feature; on the basis of the embedded feature of the set of behaviors to be tested and an embedded feature of a historical set of behaviors obtained in advance, determining whether the set of behaviors to be tested is abnormal.