CN111163057B - User identification system and method based on heterogeneous information network embedding algorithm - Google Patents

Abstract

The invention relates to a user identification system and method based on a heterogeneous information network embedding algorithm, comprising: a data processing module, a joint embedding module, and an evaluation analysis module; the invention is based on the idea of behavior analysis, and utilizes multi-source heterogeneous user behavior data A normal behavior model is constructed, and when the behavior data of a new time period arrives, user identification is performed by comparing the similarity between the current behavior and the normal behavior model. In the case of incorrect identification, the present invention will also provide suspicious behavior based on the dot product similarity calculation. sort. The present invention can be applied to detect potential internal threats in the enterprise intranet, and a more comprehensive and accurate behavior model can be obtained by combining two heterogeneous information network embedding algorithms, and the user identification accuracy rate can be improved by about 10%. In addition, the present invention will also provide Event-level traceability clues for further analysis by security monitoring personnel.

Description

A user identification system and method based on heterogeneous information network embedding algorithm

technical field

The invention relates to a user identification system and method based on a heterogeneous information network embedding algorithm, which belongs to the technical field of information security detection and is used in an enterprise intranet environment.

Background technique

Today's most damaging security threats come not from outsiders or malware, but from trusted insiders. Members of an organization obtain certain access control rights according to their responsibilities. Effective identity authentication is an important way to defend against internal attacks. However, the identity authentication mechanism mainly includes account password, fingerprint recognition, etc., which are only valid when logging in, and there are still many security risks. Existing research usually builds a user's normal behavior model based on behavior analysis, so as to obtain continuous and effective user identity monitoring after login. Because no matter what form of internal attack, it will show a certain degree of behavior deviation. By comparing the similarity between the current behavior and the historical normal model, the identity of the user can be identified, and then abnormal operations can be found.

User identification based on behavior analysis can be divided into two categories: single-domain behavior analysis and multi-domain behavior analysis. User identification based on single-domain behavior analysis refers to using a single type of behavior data to model normal behavior, such as file behavior, email behavior, and so on. The existing problem is that the data source used is single, it is difficult to describe a comprehensive normal behavior model, and a simple machine learning classifier is usually used, and the user recognition rate is not high. The user identification method based on multi-domain behavior analysis draws on the idea of multi-source data fusion, and tries to build a comprehensive behavior model by combining various behavior types. However, in terms of ideas, either by comparing workflow similarity, or using feature engineering to extract multi-source behavior features, the association between multiple behavior data is not considered.

In this context, the present invention converts multi-source heterogeneous behavior data into a heterogeneous information network, creating conditions for analyzing behavior associations, and using local embedding algorithm and global embedding algorithm to extract local features and global features respectively, so as to construct a comprehensive Behavior model, and can capture the correlation information between behaviors. In the case of model identification errors, it can further provide a ranking of suspicious behaviors based on similarity calculation for security personnel to analyze and trace the source.

SUMMARY OF THE INVENTION

The technology of the present invention solves the problem: solves the problem of the difficulty of multi-source heterogeneous behavior data association modeling in the existing user identification method based on behavior analysis, and the present invention provides a user identification system and method based on a heterogeneous information network embedding algorithm , can build a more comprehensive behavior model, greatly improve the user identification accuracy, and can analyze suspicious situations and provide event-level suspicious operation sorting.

The technical solution of the present invention: a user identification system based on a heterogeneous information network embedding algorithm, characterized in that: the heterogeneous information network embedding algorithm refers to a local embedding algorithm based on neural network and a global embedding based on meta-path. Algorithm, the user identification refers to identifying potential operating users based on the multi-source heterogeneous audit log data collected by each host in the enterprise intranet, and the system includes a data processing module, a joint embedding module and an evaluation and analysis module, wherein:

Data processing module: There are two functions: the first function is to extract standardized audit log data from the historical behavior database, and these log data will be used as a training set to build a heterogeneous information network G; the second function is to The original multi-source heterogeneous audit log data newly collected in the network host is preprocessed; whether it is the normalized audit log data in the historical behavior database or the newly collected original audit log data, there are five types of multi-source heterogeneous audit log data. The five types of log data are login log data, file log data, mail log data, HTTP log data and device log data. These data record the user's login behavior, file behavior, email behavior, WEB behavior and external device connection respectively. behavior; the preprocessing of the original multi-source heterogeneous audit log data refers to standardizing each log data, and using a log parser to extract key information based on predefined fields, the predefined fields include subject, device , object and timestamp four parts, the subject refers to the user ID, the device refers to the host ID, the object is determined according to different log data types, and is used to identify the specific behavior of a specific log data type; in the log of the file type In the data, the object adopts the combination of file path and file name; the timestamp is the occurrence time of the log data; the newly collected log data after analysis will be used as the test set; the heterogeneous information network G uses the standardized log data. The information extracted based on the predefined fields in the data is regarded as the node identification, in which the host identification is used as the central node, and the user identification and behavior identification are used as the neighbor nodes of the host identification. The constructed heterogeneous information network follows the network mode shown in Figure 2;

Joint Embedding Module: Using the heterogeneous information network G constructed in the data processing module as input, train a model that reflects the operation mode of each host, called the user predictor, and the user predictor will perform user prediction on the test set, and finally get the corresponding The potential operation user ranking of log data in the test set; the process of training the user predictor refers to learning the vector representation of nodes in the heterogeneous information network G and the parameters of the model. In order to enable the learned node vector to retain the network structure information and the similarity information between nodes, the joint embedding module adopts two heterogeneous information network embedding algorithms, called local embedding algorithm and global embedding algorithm. The local embedding algorithm is used for learning The interaction between each host and its neighbor nodes embeds the normal behavior pattern information; the global embedding algorithm uses the semantics defined by the meta-path to embed the association information between different types of nodes; finally, the two embedding algorithms are combined for iterative training through the joint objective function;

The evaluation and analysis module evaluates the prediction results obtained in the joint embedding module, and determines whether the actual operating user of the host is consistent with the prediction results; in the joint embedding module, the prediction results A given by the log data model in the test set are obtained, The result is a sequence. The ranking in the sequence represents the probability that the behaviors in the test set belong to a certain user. If the actual operation users corresponding to the behaviors in the test set appear in the top K in the prediction sequence, the recognition is considered correct, otherwise , it means that the user behavior in the test set deviates from the normal behavior pattern in the training set, which is called suspicious situation; for such suspicious situations, through similarity-based anomaly analysis, the final result is a suspicious situation that causes errors in user identification results Sequence of behaviors, so that security analysts or relevant staff can conduct traceability verification based on the clues given by the system.

In the data processing module, the process of constructing a heterogeneous information network is as follows: based on the log data that has been standardized in the historical database, using the extracted hosts, users, and behavior identifiers as nodes to construct a heterogeneous information network G, where the host identifiers are used. As a central node, the user ID and behavior ID are used as neighbor nodes for the host ID.

In the joint embedding module, the local embedding algorithm is implemented based on a neural network, and the specific process is as follows:

(1) First, map all nodes in the heterogeneous information network G to a latent space, that is, randomly initialize the vector representations of all nodes to form an embedding vector table V;

方法是将每种类型包含的所有行为标识邻居节点向量v_n取平均；(2) Given a host p, aggregate the host vector V _p in two steps. In the first step, calculate the node type vector of each type of behavior of the host p to identify the neighbor nodes

The method is to take the average of all behavior identification neighbor node vectors v _n contained in each type;

代表主机p包含的第t种类型的行为标识邻居节点集合；in,

Represents the set of t-th type of behavior identification neighbor nodes contained in host p;

的加权组合获得主机向量V_p；In the second step, the node type vector is calculated

The weighted combination of to obtain the host vector V _p ;

Wherein w _t represents the weight of the t-th type node type vector. In the present invention, there are 5 types of neighbor nodes for behavior identification, so the value of t is 1 to 5, representing the login node type, file node type, mail node type, HTTP Node type, device node type;

(3) Based on the host vector V _p , calculate the dot product similarity between the host and the user, and perform a potential operation user ranking, where v _u represents the user vector;

(4) Use stochastic gradient descent (SGD) to update the embedding vector table V, and learn the weight w _t of each type of node type vector using the max-margin objective function as the loss function, the loss function is defined as:

max(0, f(p, u')-f(p, u)+ε)

Among them, u is the real operating user of the host p, that is, the positive sample, u' is the negative sample, ε is the boundary value, if the difference between f(p, u) and f(p, u') is if Less than ε, a loss penalty occurs.

In the specific implementation of the joint embedding module, the global embedding algorithm is implemented based on the meta-path, and the implementation process is as follows:

(1) Meta-paths define higher-order semantic associations between different types of nodes. Higher-order semantic associations refer to the association information that cannot be captured by edges in the original network; given a set of meta-paths R, the global embedding algorithm based on meta-paths first Conditional neighbor distribution modeling of nodes, in the heterogeneous information network G, there are many kinds of meta-paths from node i, so the neighbor distribution of nodes depends not only on node i, but also on a given meta-path r, conditional neighbors The distribution function is defined as follows:

Among them, v _i and v _j represent the vector representation of nodes i and j, and DST(r) represents the set of all possible nodes of node i on the target side of meta-path r;

(2) The number of nodes contained in the set of all possible nodes DST(r) on the target side of the meta-path r is huge. In order to reduce the computational burden, the approximate solution is obtained by the following formula using the negative sampling strategy. The left side of the formula represents the response to the previous formula approximation;

表示是对公式取得近似解，j′是从为元路径r预定义的噪声分布

中采样的负节点，每个节点i采样k个负节点，偏置项br用来调整不同元路径的密度；

represents an approximate solution to the formula, j' is derived from the noise distribution predefined for the meta-path r

The negative nodes sampled in , each node i samples k negative nodes, and the bias term br is used to adjust the density of different meta-paths;

(3) Use stochastic gradient descent (SGD) to learn the embedding _vector table V and parameter br , with the goal of maximizing the likelihood function.

In the specific implementation of the joint embedding module, the purpose of the joint objective function is to effectively combine the local features captured by the local embedding algorithm with the global features captured by the global embedding algorithm, which is defined as follows:

where ω∈[0, 1] is a predefined parameter used to balance the importance of the model for tuning, adding a regularization term to prevent overfitting; where Z _united represents the objective function of the joint embedding model, and Z _global represents the The objective function of the global embedding model, Z _local represents the objective function of the local embedding model, and λ is the regularization parameter;

The iterative training process using the joint objective function is as follows:

(1) Sampling one of a local embedding algorithm and a global embedding algorithm based on a Bernoulli distribution with parameter ω;

(2) If the local embedding algorithm is sampled, train the embedding vector table V according to the operation steps of the local embedding algorithm and learn the weight _wt of each type of node type vector. Similarly, if the global embedding algorithm is sampled, follow the global embedding algorithm. The operation step trains the embedding vector table V and learns the parameter _br , and the embedding vector table V is shared for the two embedding algorithms;

(3) Repeat steps (1) and (2) until the model converges and a user predictor is obtained.

The analysis process for suspicious situations in the evaluation analysis module is:

The suspicious situation is caused by the deviation between the user behavior in the test set and the normal behavior pattern in the training set. In the evaluation and analysis module, for suspicious situations, the dot product of the host’s behavior identification neighbor node and the host’s actual operating user node is calculated in turn as an abnormal reference. , the lower the number of points, the lower the similarity between the two entities, the higher the abnormal risk, and finally the suspicious behaviors are sorted according to the abnormal risk from high to low:

Among them, L _p represents the finally obtained suspicious behavior sequence, E _p represents the behavior identification neighbor node set of host p, v _i represents the vector representation of node i, and u _p represents the vector representation of the real operating users of host p.

The determination of the meta-path set R needs to go through a meta-path selection process, which is as follows:

(1) Calculate the recognition accuracy after adding each meta-path one by one, and sort them to obtain the influence of each meta-path on the recognition effect when used alone;

(2) Gradually add meta-paths according to the obtained ranking, and finally greedily select the combination that can achieve the highest user identification accuracy as the optimal meta-path set R according to the change of the recognition accuracy.

A kind of user identification method based on heterogeneous information network embedding algorithm of the present invention, the steps are as follows:

Step (1) Data processing: collect the audit log data of a host in the intranet for a period of time. The audit log types include login logs, file logs, mail logs, HTTP logs and device logs; use a log parser to analyze each type of log. Parse the logs one by one and extract predefined key fields. The key fields include subject, object, device and timestamp. For a file log, the extracted subject is the user account, and the object is the combination of the file path and file name. is the host number, and the timestamp is the access time of the log record. The parsed log data will be used as the test set. In addition, the standardized log data in a time window in the historical behavior database is used as the training set to construct the heterogeneous information network G ;

Step (2) Heterogeneous information network construction: use the training set to construct a heterogeneous information network G, and regard the information extracted based on predefined fields in the log data standardized in the historical behavior database as a node identifier, in which the host identifier is used as the central node, and the user The identity and behavior identity are used as the neighbor nodes of the host. For each host p, all the behavior identity neighbor nodes related to it are composed of a set _Ep , and the real operation user is expressed as u _p . Each independent behavior identity can be associated with multiple If the two hosts p and q have log records with the mail entity e, the mail entity e will be the neighbor node of the two hosts p and q at the same time;

Step (3) Joint embedding: After obtaining the heterogeneous information network G, the vector representation of each node will be iteratively learned. First, the embedding vector table V is randomly initialized, and then the local embedding algorithm and the global embedding algorithm are sampled based on the parameter ω in the joint objective function. One of them; if the local embedding algorithm is sampled, the embedding vector table V is trained according to the operation steps of the local embedding algorithm and the weight _wt of each type of node type vector is learned; if the global embedding algorithm is sampled, the operation steps of the global embedding algorithm are followed Train the embedding vector table V and learn the parameters b _r , repeat this iterative training process until the model converges, at which time a trained model is obtained, which is called a user predictor;

Step (4) User prediction: The user predictor contains the node embedding vector table V after training and the respective parameters of the local embedding algorithm and the global embedding algorithm, and then performs the user prediction task on the test set, that is, given the host p to be predicted, Predict which operating user the log data on host p belongs to. The prediction result is a sequence. The ranking in the sequence represents the probability that the log data in the test set belongs to a certain user. The sorting is based on the similarity of the dot product of the host vector and the user vector. sex score;

Step (5) Evaluation and analysis: For the prediction results obtained in step (4), if the actual operation users corresponding to the behaviors in the test set appear in the top K in the prediction sequence, the identification is considered correct; otherwise, it means that the test set is correct. The user behavior deviates from the normal behavior pattern in the training set, which is called suspicious situation. For such suspicious situations, the abnormal analysis based on similarity will finally get the ranking of suspicious behaviors that cause errors in the user identification results for security analysis. Teachers or relevant staff can conduct traceability verification based on the clues given by the system.

The advantages of the present invention compared with the prior art are:

(1) The key to defending against internal attacks lies in user rights management, and an effective way to manage user rights is to continuously monitor user identities based on behavior analysis. Traditional user identification methods do not make full use of multi-source and heterogeneous behavior data, and are difficult to model. complex associations between data. The invention cleverly uses heterogeneous information network to express the structured audit log data into a graph structure, thereby creating conditions for analyzing data association;

(2) The present invention automatically learns the vector representation of nodes by combining two heterogeneous information network embedding algorithms, which is an innovative attempt to apply the heterogeneous information network embedding method to the security field, and solves the problem that the traditional method relies on artificial experience knowledge to extract features. The two embedding algorithms focus on local behavior pattern features and network global correlation features respectively. The advantage is that they can describe comprehensive user behavior patterns, which greatly improves the accuracy of user identification.

(3) For suspicious situations with wrong predictions, the present invention can also sort potential abnormal operations according to the similarity between entities, and provide event-level suspicious behavior clues. Security analysts can conduct traceability verification based on valid clues at these event levels;

(4) In general, the present invention proposes a user identification system based on a heterogeneous information network embedding algorithm. The core advantage is that it can model comprehensive user behavior characteristics, improve user identification accuracy, and provide fine-grained Exception analysis.

Description of drawings

Fig. 1 is the realization block diagram of the system of the present invention;

Fig. 2 is the network mode of heterogeneous information network in the present invention;

FIG. 3 is the framework of the local embedding algorithm in the present invention.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

The present invention mainly solves how to identify potential operating users based on multi-source heterogeneous host audit logs, and provides instructive abnormal analysis for suspicious situations of identification errors.

As shown in FIG. 1 , the system of the present invention includes a data processing module, a joint embedding module, and an evaluation and analysis module. The data processing module parses and processes the original multi-source heterogeneous host audit log data, retains predefined key fields, and uses standardized historical log data to build a heterogeneous information network; the joint embedding module uses two heterogeneous information The network embedding algorithm learns the operation mode of a single host and captures the global correlation of the network respectively. The two heterogeneous information network embedding algorithms are called the local embedding algorithm and the global embedding algorithm, and the two are combined iteratively trained through the joint function to obtain User predictor; evaluation analysis module, which evaluates the user recognition effect, and provides a ranking of suspicious behaviors through similarity-based anomaly analysis for suspicious situations of recognition errors.

The specific implementation of the data processing module is as follows:

(1) Data processing: collect audit log data of a host in the intranet for a period of time. The audit log types include login logs, file logs, mail logs, HTTP logs and device logs; use log parser to analyze each type of log. Logs are parsed one by one, and predefined key fields are extracted. The key fields include subject, object, device, and timestamp. For a file log, the extracted subject is the user account, the object is the combination of the file path and file name, and the device is the The host number, timestamp is the access time of the log record, and the parsed log data will be used as the test set. In addition, the normalized log data within a time window in the historical behavior database is used as the training set for constructing the heterogeneous information network G in the next step.

(2) Construction of heterogeneous information network: use the training set to build a heterogeneous information network G, and regard the information extracted based on predefined fields in the log data standardized in the historical behavior database as node identifiers, in which the host identifier is used as the central node, and the user identifier is used as the central node. and behaviors identify neighbor nodes as hosts, and the constructed heterogeneous information network follows the network model shown in Figure 2. In this network mode, six types of nodes are mainly involved, namely PC, user, login, file, mail, HTTP, device, among which PC is the super node connecting the other five types of nodes; the types of edges involved include "PC access"File","PC Send Mail", etc. For each host p, the neighbor nodes of all behavior identifiers related to it are formed into a set _Ep , and its real operating user is represented as up _p . Each independent behavior identifier can be associated with multiple hosts. If two hosts p, q Both have log records with the mail entity e, then the mail entity e will be the neighbor node of the two hosts p and q at the same time;

The specific implementation of the joint embedding module is as follows:

Traditional methods often use feature engineering to manually extract high-dimensional features, which requires artificial experience knowledge. The present invention automatically extracts feature vectors containing rich structural and semantic associations for representing users and entities. Then based on the trained user predictor, the operating users of the log data in the test set are predicted. Proceed as follows:

(1) Initialization: First, initialize the embedding vector table V randomly, V represents the vector representation of all nodes in the constructed heterogeneous information network G;

(2) Iterative training: Next, the iterative training process is performed, and one of the local embedding algorithm and the global embedding algorithm is sampled based on the parameter ω in the joint objective function; if the local embedding algorithm is sampled, follow the execution steps of the local embedding model. Carry out training, update the embedding vector table V and the weight _wt of each type of node type vector; if the sampling is a global embedding algorithm, perform training according to the execution steps of the global embedding model, update the embedding _vector table V and parameter br , Repeat this iterative training process until the model converges, at which time a trained model is obtained, which is called the user predictor;

(3) User prediction: Input the test set into the trained user predictor, and the user predictor predicts potential operating users based on the standardized log data in the test set. The prediction result is a sequence, and the ranking in the sequence represents the data in the test set The probability that the log data belongs to a certain user, the sorting is based on the similarity score of the dot product between the host vector and the user vector;

As shown in Figure 3, the execution steps of the local embedding algorithm are as follows:

方法是将每种类型包含的所有行为标识邻居节点向量v_n取平均；(1) Given a host p, aggregate the host vector V _p in two steps. In the first step, calculate the node type vector of each type of behavior of the host p that identifies the neighbor nodes

The method is to take the average of all behavior identification neighbor node vectors v _n contained in each type;

代表主机p包含的第t种类型的行为标识邻居节点集合；in,

Represents the set of t-th type of behavior identification neighbor nodes contained in host p;

的加权组合获得主机向量V_p；In the second step, the node type vector is calculated

The weighted combination of to obtain the host vector V _p ;

Wherein, w _t represents the weight of the t-th type node type vector. In the present invention, there are 5 types of neighbor node types for behavior identification, so the value of t is 1 to 5, representing the login node type, file node type, mail node type, HTTP node type, device node type;

(2) Based on the host vector V _p , calculate the dot product similarity between the host and the user, and sort the potential operation users, where v _u represents the user vector;

(3) Use stochastic gradient descent (SGD) to update the embedding vector table V, and learn the weight w _t of each type of node type vector using the max-margin objective function as the loss function, and the loss function is defined as:

max(0, f(p, u')-f(p, u)+ε)

Among them, u is the real operating user of the host p, that is, the positive sample, u' is the negative sample, ε is the boundary value, if the difference between f(p, u) and f(p, u') is if Less than ε, a loss penalty occurs.

The execution steps of the global embedding algorithm are as follows:

(1) Meta-paths define higher-order semantic associations between different types of nodes. Higher-order semantic associations refer to the association information that cannot be captured by edges in the original network; given a set of meta-paths R, the global embedding algorithm based on meta-paths first Conditional neighbor distribution modeling of nodes, in the heterogeneous information network G, there are many kinds of meta-paths from node i, so the neighbor distribution of nodes depends not only on node i, but also on a given meta-path r, conditional neighbors The distribution function is defined as follows:

Among them, v _i and v _j represent the vector representation of nodes i and j, and DST(r) represents the set of all possible nodes of node i on the target side of meta-path r;

(2) The number of nodes contained in the set of all possible nodes DST(r) on the target side of the meta-path r is huge. In order to reduce the computational burden, the approximate solution is obtained by the following formula using the negative sampling strategy. The left side of the formula represents the response to the previous formula approximation;

表示是对公式取得近似解，j′是从为元路径r预定义的噪声分布

中采样的负节点，每个节点i采样k个负节点，偏置项b_r用来调整不同元路径的密度；

represents an approximate solution to the formula, j' is derived from the noise distribution predefined for the meta-path r

Negative nodes sampled in , each node _i samples k negative nodes, and the bias term br is used to adjust the density of different meta-paths;

(3) Use stochastic gradient descent (SGD) to learn the embedding _vector table V and parameter br , with the goal of maximizing the likelihood function.

The specific implementation of the evaluation and analysis module is as follows:

(1) Evaluation: Evaluate the prediction results obtained in the joint embedding module, and determine whether the real operating users of the host are consistent with the prediction results. In the joint embedding module, the prediction result A given by the log data model in the test set is obtained. The result is a sequence, and the ranking in the sequence represents the probability that the behavior in the test set belongs to a certain user. If the real operation users corresponding to the behaviors in the test set appear in the top K in the prediction sequence, the identification is considered correct, otherwise, it is called "suspicious situation".

(2) Analysis: The model believes that the "suspicious situation" is caused by the deviation of the user behavior in the test set and the normal behavior pattern in the training set. In the evaluation analysis module, for suspicious situations, the host behavior will be calculated in turn to identify neighbor nodes and hosts. The dot product of the real operating user is used as an abnormal reference. The lower the number of dot points, the lower the similarity between the two entities, and the higher the abnormal risk. Finally, suspicious behaviors are sorted according to the abnormal risk from high to low:

Among them, L _p represents the finally obtained suspicious behavior sequence, E _p represents the behavior identification neighbor node set of host p, v _i represents the vector representation of node i, and u _p represents the vector representation of the real operating users of host p.

Claims (8)

1. a user identification system based on heterogeneous information network embedding algorithm, is characterized in that: described heterogeneous information network embedding algorithm refers to the local embedding algorithm realized based on neural network and the global embedding algorithm realized based on meta-path, described User identification refers to identifying potential operating users based on multi-source heterogeneous audit log data collected by each host in the enterprise intranet. The system includes a data processing module, a joint embedding module and an evaluation and analysis module, wherein: Data processing module: There are two functions: the first function is to extract standardized audit log data from the historical behavior database, and these log data will be used as a training set to build a heterogeneous information network G; the second function is to The original multi-source heterogeneous audit log data newly collected in the network host is preprocessed; whether it is the normalized audit log data in the historical behavior database or the newly collected original audit log data, there are five types of multi-source heterogeneous audit log data. The five types of log data are login log data, file log data, mail log data, HTTP log data and device log data. These data record the user's login behavior, file behavior, email behavior, WEB behavior and external device connection respectively. behavior; the preprocessing of the original multi-source heterogeneous audit log data refers to standardizing each log data, and using a log parser to extract key information based on predefined fields, the predefined fields include subject, device , object and timestamp four parts, the subject refers to the user ID, the device refers to the host ID, the object is determined according to different log data types, and is used to identify the specific behavior of a specific log data type; in the log of the file type In the data, the object adopts the combination of file path and file name; the timestamp is the occurrence time of the log data; the newly collected log data after analysis will be used as the test set; the heterogeneous information network G uses the standardized log data. The information extracted based on the predefined fields in the data is regarded as the node identification, in which the host identification is used as the central node, and the user identification and behavior identification are regarded as the neighbor nodes of the host identification; Joint Embedding Module: Using the heterogeneous information network G constructed in the data processing module as input, train a model that reflects the operation mode of each host, called the user predictor, and the user predictor will perform user prediction on the test set, and finally get the corresponding The ranking of potential operating users based on the log data in the test set; the process of training the user predictor refers to learning the vector representation of nodes in the heterogeneous information network G and the parameters of the model; in order to enable the learned node vector to retain network structure information and inter-node The joint embedding module adopts two heterogeneous information network embedding algorithms, called local embedding algorithm and global embedding algorithm. The local embedding algorithm is used to learn the interaction between each host and its neighbor nodes and embed normal behavior pattern information; The global embedding algorithm uses the semantics defined by the meta-path to embed the association information between different types of nodes; finally, the two embedding algorithms are combined for iterative training through the joint objective function; The evaluation and analysis module evaluates the prediction results obtained in the joint embedding module, and determines whether the actual operating user of the host is consistent with the prediction results; in the joint embedding module, the prediction results A given by the log data model in the test set are obtained, The result is a sequence. The ranking in the sequence represents the probability that the behaviors in the test set belong to a certain user. If the actual operation users corresponding to the behaviors in the test set appear in the top K in the prediction sequence, the recognition is considered correct, otherwise , it means that the user behavior in the test set deviates from the normal behavior pattern in the training set, which is called suspicious situation; for such suspicious situations, through similarity-based anomaly analysis, the final result is a suspicious situation that causes errors in user identification results Sequence of behaviors, so that security analysts or relevant staff can conduct traceability verification based on the clues given by the system. 2. The user identification system based on a heterogeneous information network embedding algorithm according to claim 1, wherein: in the data processing module, the process of constructing a heterogeneous information network is: based on the standardization process in the historical database Log data, using the extracted hosts, users, and behavior IDs as nodes to construct a heterogeneous information network G, where the host ID is used as the central node, and the user ID and behavior ID are used as neighbor nodes of the host ID. 3. the user identification system based on heterogeneous information network embedding algorithm according to claim 1, is characterized in that: in described joint embedding module, local embedding algorithm is realized based on neural network, and concrete process is as follows: (1) First, map all nodes in the heterogeneous information network G to a latent space, that is, randomly initialize the vector representations of all nodes to form an embedding vector table V; (2) Given a host p, aggregate the host vector V _p in two steps. In the first step, calculate the node type vector of each type of behavior of the host p to identify the neighbor nodes

The method is to take the average of all behavior identification neighbor node vectors v _n contained in each type;

in,

Represents the set of t-th type of behavior identification neighbor nodes contained in host p; In the second step, the node type vector is calculated

The weighted combination of to obtain the host vector V _p ;

Wherein, w _t represents the weight of the t-th type node type vector. In the present invention, there are 5 types of neighbor node types for behavior identification, so the value of t is 1 to 5, representing the login node type, file node type, mail node type, HTTP node type, device node type; (3) Based on the host vector V _p , calculate the dot product similarity between the host and the user, and perform a potential operation user ranking, where v _u represents the user vector;

(4) Use stochastic gradient descent (SGD) to update the embedding vector table V, and learn the weight w _t of each type of node type vector using the max-margin objective function as the loss function, the loss function is defined as: max(0, f(p, u')-f(p, u)+ε) Among them, u is the real operating user of the host p, that is, the positive sample, u' is the negative sample, ε is the boundary value, if the difference between f(p, u) and f(p, u') is if Less than ε, a loss penalty occurs. 4. the user identification system based on heterogeneous information network embedding algorithm according to claim 1, is characterized in that: in the concrete realization of described joint embedding module, global embedding algorithm is realized based on meta-path, and realization process is as follows: (1) Meta-paths define higher-order semantic associations between different types of nodes. Higher-order semantic associations refer to the association information that cannot be captured by edges in the original network; given a set of meta-paths R, the global embedding algorithm based on meta-paths first Conditional neighbor distribution modeling of nodes, in the heterogeneous information network G, there are many kinds of meta-paths from node i, so the neighbor distribution of nodes depends not only on node i, but also on a given meta-path r, conditional neighbors The distribution function is defined as follows:

Among them, v _i and v _j represent the vector representation of nodes i and j, and DST(r) represents the set of all possible nodes of node i on the target side of meta-path r; (2) The number of nodes contained in the set of all possible nodes DST(r) on the target side of the meta-path r is huge. In order to reduce the computational burden, the approximate solution is obtained by the following formula using the negative sampling strategy. The left side of the formula represents the response to the previous formula approximation;

represents an approximate solution to the formula, j' is derived from the noise distribution predefined for the meta-path r

The negative nodes sampled in , each node _i samples k negative nodes, and the bias term br is the bias term of the neural network training, which is used to adjust the density of different meta-paths; (3) Use stochastic gradient descent (SGD) to learn the embedding _vector table V and the parameter bias term br , with the goal of maximizing the likelihood function. 5. the user identification system based on heterogeneous information network embedding algorithm according to claim 1, is characterized in that: in the concrete realization of described joint embedding module, the purpose of joint objective function is to combine the local feature captured by local embedding algorithm with the local feature captured by local embedding algorithm. The global features captured by the global embedding algorithm are effectively combined and defined as follows:

where ω∈[0, 1] is a predefined parameter used to balance the importance of the model for tuning, adding a regularization term to prevent overfitting; where Z _united represents the objective function of the joint embedding model, and Z _global represents the The objective function of the global embedding model, Z _local represents the objective function of the local embedding model, and λ is the regularization parameter; The iterative training process using the joint objective function is as follows: (1) Sampling one of a local embedding algorithm and a global embedding algorithm based on a Bernoulli distribution with parameter ω; (2) If the local embedding algorithm is sampled, train the embedding vector table V according to the operation steps of the local embedding algorithm and learn the weight _wt of each type of node type vector. Similarly, if the global embedding algorithm is sampled, follow the global embedding algorithm. The operation steps train the embedding _vector table V and learn the parameter br , where the parameter _br is used to adjust the density of different meta-paths; The embedding vector table V is shared for the two embedding algorithms; (3) Repeat steps (1) and (2) until the model converges and a user predictor is obtained. 6. the user identification system based on heterogeneous information network embedding algorithm according to claim 1, is characterized in that: in the described evaluation analysis module, the analysis process for suspicious situation is: The suspicious situation is caused by the deviation between the user behavior in the test set and the normal behavior pattern in the training set. In the evaluation and analysis module, for suspicious situations, the dot product of the host’s behavior identification neighbor node and the host’s actual operating user node is calculated in turn as an abnormal reference. , the lower the number of points, the lower the similarity between the two entities, the higher the abnormal risk, and finally the suspicious behaviors are sorted according to the abnormal risk from high to low:

Among them, L _p represents the finally obtained suspicious behavior sequence, E _p represents the behavior identification neighbor node set of host p, v _i represents the vector representation of node i, and u _p represents the vector representation of the real operating users of host p. 7. The user identification system based on a heterogeneous information network embedding algorithm according to claim 4, wherein the determination of the meta-path set R needs to go through a meta-path selection process, which is specifically as follows: (1) Calculate the recognition accuracy after adding each meta-path one by one, and sort them to obtain the influence of each meta-path on the recognition effect when used alone; (2) Gradually add meta-paths according to the obtained ranking, and finally greedily select the combination that can achieve the highest user identification accuracy as the optimal meta-path set R according to the change of the recognition accuracy. 8. A user identification method based on a heterogeneous information network embedding algorithm, characterized in that the steps are as follows: Step (1) Data processing: collect the audit log data of a host in the intranet for a period of time. The audit log types include login logs, file logs, mail logs, HTTP logs and device logs; use a log parser to analyze each type of log. Parse the logs one by one and extract predefined key fields. The key fields include subject, object, device and timestamp. For a file log, the extracted subject is the user account, and the object is the combination of the file path and file name. is the host number, the timestamp is the access time of the log record, and the parsed log data will be used as the test set. In addition, the standardized log data in a time window in the historical behavior database is used as the training set to construct the heterogeneous information network G ; Step (2) Heterogeneous information network construction: use the training set to construct a heterogeneous information network G, and regard the information extracted based on predefined fields in the log data standardized in the historical behavior database as a node identifier, in which the host identifier is used as the central node, and the user The identity and behavior identity are used as the neighbor nodes of the host. For each host p, all the behavior identity neighbor nodes related to it are composed of a set _Ep , and the real operation user is expressed as u _p . Each independent behavior identity can be associated with multiple If the two hosts p and q have log records with the mail entity e, the mail entity e will be the neighbor node of the two hosts p and q at the same time; Step (3) Joint embedding: After obtaining the heterogeneous information network G, the vector representation of each node will be iteratively learned. First, the embedding vector table V is randomly initialized, and then the local embedding algorithm and the global embedding algorithm are sampled based on the parameter ω in the joint objective function. One of them; if the local embedding algorithm is sampled, the embedding vector table V is trained according to the operation steps of the local embedding algorithm and the weight _wt of each type of node type vector is learned; if the global embedding algorithm is sampled, the operation steps of the global embedding algorithm are followed Train the embedding vector table V and learn the parameters b _r , repeat this iterative training process until the model converges, at which time a trained model is obtained, which is called a user predictor; Step (4) User prediction: The user predictor contains the node embedding vector table V after training and the respective parameters of the local embedding algorithm and the global embedding algorithm, and then performs the user prediction task on the test set, that is, given the host p to be predicted, Predict which operating user the log data on host p belongs to. The prediction result is a sequence. The ranking in the sequence represents the probability that the log data in the test set belongs to a certain user. The sorting is based on the similarity of the dot product of the host vector and the user vector. sex score; Step (5) Evaluation and analysis: For the prediction results obtained in step (4), if the actual operation users corresponding to the behaviors in the test set appear in the top K in the prediction sequence, the identification is considered correct; otherwise, it means that the test set is correct. The user behavior deviates from the normal behavior pattern in the training set, which is called suspicious situation. For such suspicious situations, the abnormal analysis based on similarity will finally get the ranking of suspicious behaviors that cause errors in the user identification results for security analysis. Teachers or relevant staff can conduct traceability verification based on the clues given by the system.

Images