Research On Key Technologies For Cross-Network Domain Entity Anomalous Behavior Correlation Analysis And Prediction

With the rapid development of network technology,various online platforms such as social media,e-commerce,industrial internet,and the internet of things(IoT)have been widely applied,significantly impacting people’s daily lives,work methods,and social production.These platforms have become an indispensable part of the functioning of society.Every day,network platforms need to process a large amount of data that contains abnormal behavior patterns,such as DoS/DDoS attacks,network scanns,network frauds,rumor dissemination,and cyberbullying,posing many hidden dangers to network security.Therefore,as the main technical means for identity correlation,attack traceability,and security supervision,abnormal behavior analysis of network entities has become a research focus in the field of active defense for network security.Most existing studies have focused on the analysis methods of behavioral associations among entities within a single network domain,and there are limitations in selecting important features or introducing features across multiple network domains,discovering inter-domain relationships and event relationships.In cross-domain networks,implicit relationships between entities are complex.However,there has been little exploration in the discovery and correlation analysis of complex relationships between entities across multiple network domains.Therefore,this article aims to systematically study entity correlation analysis from two aspects:effective feature introduction and potential relationship discovery.Among them,effective feature introduction aims at cross-network entity identity correlation analysis,and important features and positional features play an important role in identity alignment.Potential relationships aim at cross-domain entity abnormal behavior detection and prediction analysis,which are divided into interdomain potential relationships and event-to-event potential relationships.This article has studied three research points:abnormal identity discovery and prediction,abnormal behavior detection,and abnormal behavior prediction in cross-domain scenarios,and has made the following innovative achievements:(1)A cross-domain entity identity correlation analysis and prediction method based on network representation learning is proposed.Existing crossdomain network entity identity alignment methods often use cross-network link identification and match users with similar features due to the heterogeneity of users and information missing in different networks,while ignoring the strong identity recognition characteristics of central nodes in structural properties.To address the limitations mentioned above,this method first performs structural property analysis on the relational network and finds that different nodes play different positioning roles.Nodes with larger degrees have stronger identity correlation positioning roles,and different adjacent nodes reflect different importance degrees of identity correlation.Moreover,a network representation learning method is designed to represent nodes using two groups of vectors,location features and importance features,reflecting spatiotemporal characteristics of cross-domain relationships.Secondly,this study proposes a supervised learning-based network entity identity correlation model that combines the importance feature of nodes to improve the accuracy of user identity correlation analysis in complex networks.Finally,experiments are conducted on real datasets.Experimental results show that this scheme effectively improves the accuracy of entity identity alignment in cross-domain scenarios.(2)A cross-domain network entity abnormal behavior correlation detection method is proposed.In large-scale cross-domain networks,it is a challenging problem to effectively characterize the complex spatiotemporal relationships among events and perform correlation analysis to provide robust detection algorithms for high-dimensional complex network entity abnormal behavior detection requirements.Existing studies have mostly focused on using Euclidean space to represent complex relationship data,which has limitations in capturing the spatiotemporal relationships of abnormal behaviors in complex networks.The method proposed in this paper is implemented from aspects such as building cross-domain behavior association graphs,crossdomain behavior relationship representation,and abnormal behavior detection.Firstly,to address the spatial pattern problem,based on building behavior association graphs,the single domain behavior association graph is embedded into hyperbolic representation space to capture the complex spatial relationships among event nodes and perform multi-domain behavior feature fusion.Secondly,to address the time series capture and utilization problem,behavioral features are enhanced in time series representation through attention mechanisms and recurrent neural networks.Then,a multi-layer perception is used to obtain the detection and prediction results of cross-domain spatiotemporal abnormal behavior.Finally,experiments on real datasets show that this scheme effectively improves the entity abnormal behavior detection results in cross-domain scenarios.(3)A cross-domain spatiotemporal network abnormal behavior correlation analysis and prediction method is proposed.Existing studies typically rely on the time relationship features between events and the spatial relationship features among hosts,without fully considering the spatial relationships between events and the characteristics of behavior cross-domain,resulting in poor practical performance.In addition,many existing methods are based on Euclidean space representation of spatial relationships,without fully considering the complexity of abnormal event relationship structures.The method proposed in this paper is implemented from three aspects:entity-level cross-domain event correlation and representation,complex spatiotemporal relationship representation,and abnormal behavior prediction.Firstly,the method takes the time sequence behavior sequence of entities as the target,divides local event sequences,and realizes the graph representation of multidomain event correlation relationships.Secondly,the method implements"representation learning" of complex event correlation relationships in mixed curvature space.Then,the method combines the mixed curvature vector representation of events and LSTM-ATT to capture the spatial and temporal correlation relationship features between cross-domain events and predict the abnormal behavior that may occur next.Finally,this paper conducts experiments on real datasets.Experimental results show that the multicurvature space representation of network events can preserve more spatial relationship features between events,achieving better performance than the single spatial representation,and effectively realizing the prediction of entity abnormalities under cross-domain scenarios.