A method, device, and computer-readable storage medium for identifying abnormal user behavior

Abstract

The invention discloses a user abnormal behavior identification method, device and computer-readable storage medium, belonging to the technical field of computers. The method includes: obtaining the time series data and space series data associated with the user's behavior; according to the actual values ​​of multiple indicators before the preset time point in the time series data, predicting the user's index confidence interval at the preset time point through the ARIMA model ;Compare the actual value of the user's index at the preset time point with the corresponding index confidence interval to obtain the first detection result for the user's behavior; according to the spatial sequence data, anomaly detection is performed through the pre-trained SOM neural network model , to obtain a second detection result for the user's behavior; according to the first detection result and the second detection result, abnormality identification is performed on the user's behavior. The embodiments of the present invention can realize accurate and reliable identification of abnormal user behaviors.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a method, device, and computer-readable storage medium for identifying abnormal user behavior. Background technique [0002] Information security is an increasingly prominent topic. Theft of commonly used network and app accounts may cause information leakage, transfer of funds, or be used as a springboard for a series of attacks on important assets. Many industries have no clear identification and tracking methods, so the biggest victims are often the users themselves. Due to the difference in account permissions, it is difficult to simply judge how much activity is considered to be a violation. Due to the complexity of the business, it is also difficult to accurately determine whether the account is in a normal state or an abnormal state. An abnormal state is a phenomenon or event produced by various abnormal activities that does not conform to the user's routine. ...

AI Technical Summary

Problems solved by technology

[0003] At present, the identification of abnormal user behavior usually uses K-Means clustering, an unsupervised machine learning algorithm, but the K-Means algorithm needs to determine the number of classes (k) in advance, and find the most similar one for each input data. After the class, only the parameters of this class are updated, so the results are unstable each time due to the influence of the initial value and the noise data, which makes it impossible to accurately and reliably identify risk users

Images