An Abnormal User Identification Method Based on Email Data Analysis

Abstract

The invention discloses an abnormal user identification method based on mail data analysis, which can obtain the mail address, mail sending and receiving address and sending and receiving time in the mail communication network; establish the mail communication network model, the node represents the mailbox, and the connection represents the communication relationship; and the node characteristics Extraction; modeling of node behavior; abnormal detection of node behavior to identify abnormal users. The method of the present invention extracts the local structural features of the nodes in the time series network and the topological structure features of the ego network centered on it as the comprehensive features of the nodes; then builds a node evolution model based on hidden variables, and integrates three different The anomaly detection method of the present invention performs real-time discovery of anomalies in multi-dimensional time series, making the method of the present invention more robust and open to integration.

Description

technical field [0001] The invention belongs to the field of abnormal identification in data processing, and in particular relates to an abnormal user identification method based on email data analysis. Background technique [0002] With the rapid development of social networks, the scale of many online social networks such as Facebook, Twitter, and QQ continues to expand. In some internal networks, e-mail is still a very important way of exchanging information and documents. Real-time monitoring of these e-mail networks, whether many abnormal events or abnormal users can be found, will help regulators to grasp more and more in-depth Case. In the communication between emails, in many cases, even the supervisor does not necessarily know the specific communication content, because these contents may often be encrypted or involve privacy, and the supervisor can only obtain the data of the communication behavior, that is, who and whom happened when Information about communicat...

AI Technical Summary

Problems solved by technology

In addition, there may be different types of abnormal user behaviors in reality, and a single anomaly detection method in the prior art cannot detect different types of anomalies

Images