Illegal behavior identification method and device, computer equipment and storage medium

Abstract

The invention discloses an illegal behavior identification method and device, computer equipment and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: building an alarm model based on a preset alarm rule, and obtaining alarm data of a business system based on the alarm model; based on a K-means clustering algorithm, dividing the alarm data into a plurality of clusters to obtain a clustering result; based on the clustering result and a historical violation sample of the business system, training a preset artificial intelligence model to generate a corresponding violation identification model; and based on the violation identification model, identifying the violation behavior of the business system. Through the method provided by the invention, the illegal behaviors can be automatically, quickly, comprehensively and accurately identified, so that the security risk of a service system can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, computer equipment and non-volatile computer-readable storage medium for identifying illegal behavior. Background Art

[0002] At present, with the vigorous development of the financial industry, the number of office terminals and business systems of financial institutions has increased dramatically, and the scale of information assets has continued to expand, which has brought unprecedented security risk challenges. Traditional manual management methods can no longer meet the growing security needs. Therefore, financial institutions need to invest a lot of resources every year to purchase various security products to maintain the security of office assets and business systems.

[0003] However, with the increase in the number of maintained products and systems, the volume of system alarm logs is increasing day by day, and the types of employee operation behaviors are becoming increasingly diverse. This not only brings tremendous work pressure to the company's security personnel and operation and maintenance personnel, but also poses a serious threat to business security. At present, traditional security monitoring methods mainly rely on setting alarm rules for violation scenarios, issuing alarms and manual spot checks through risk control platforms to identify and confirm security risks. However, this method has obvious limitations. It is difficult to quickly and comprehensively identify violations, and it is prone to omissions and false alarms; specifically:

[0004] 1. Efficiency issue: Traditional alarm rule setting and manual spot check methods are inefficient when processing massive logs and cannot meet the needs of real-time monitoring;

[0005] 2. Accuracy issues: Methods that rely solely on preset rules may fail to identify new or variant violations, resulting in missed reports. At the same time, due to the imprecision of the rules, false positives are also common;

[0006] 3. Resource consumption: Manual verification of alarm logs requires a lot of human resources, which increases the operating costs of financial institutions;

[0007] 4. Response time: From the discovery of alarms to manual verification and final confirmation, the entire process takes a long time, which is not conducive to rapid response to security incidents.

[0008] Based on this, how to provide a violation identification method, device, computer equipment and non-volatile computer-readable storage medium that can automatically, quickly, comprehensively and accurately identify violations to reduce the security risks of business systems is a problem that urgently needs to be solved by technical personnel in this field. Summary of the invention

[0009] In view of the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a method, apparatus, computer equipment and non-volatile computer-readable storage medium for identifying violations that can be used in financial technology or other related fields, aiming to solve the problem of how to automatically, quickly, comprehensively and accurately identify violations to reduce the security risks of business systems.

[0010] In order to achieve the above object, the present invention adopts the following technical solutions:

[0011] A method for identifying illegal behavior, comprising:

[0012] An alarm model is constructed based on preset alarm rules, and alarm data of the business system is obtained based on the alarm model;

[0013] Based on the K-means clustering algorithm, the alarm data is divided into multiple clusters to obtain a clustering result;

[0014] Based on the clustering results and the historical violation samples of the business system, a preset artificial intelligence model is trained to generate a corresponding violation identification model;

[0015] Based on the violation identification model, the violation behavior of the business system is identified.

[0016] In a further technical solution, the method for identifying illegal behavior, wherein the alarm model is constructed based on a preset alarm rule, and the alarm data of the business system is obtained based on the alarm model, includes:

[0017] Predefine and set alarm rules in business systems for detecting violations;

[0018] An alarm model is constructed based on the alarm rules;

[0019] The business system is monitored using the alarm model to obtain alarm data of the business system.

[0020] In a further technical solution, the method for identifying illegal behavior, wherein the alarm data is divided into multiple clusters based on the K-means clustering algorithm to obtain clustering results, includes:

[0021] Preprocessing the warning data;

[0022] The preprocessed alarm data is divided into a predetermined number of clusters using a K-means clustering algorithm to obtain corresponding clustering results.

[0023] In a further technical solution, the method for identifying illegal behaviors, wherein the preset artificial intelligence model is trained based on the clustering results and the historical illegal samples of the business system to generate a corresponding illegal identification model, comprises:

[0024] Based on the clustering results and the historical violation samples of the business system, a corresponding training data set is obtained;

[0025] The training data set is used to train the preset artificial intelligence model to generate a corresponding violation recognition model.

[0026] In a further technical solution, the method for identifying illegal behaviors, wherein the identifying illegal behaviors of the business system based on the illegal behavior identification model comprises:

[0027] Deploying the violation identification model into the business system;

[0028] The business system is monitored in real time through the violation identification model to automatically identify violations.

[0029] In a further technical solution, the method for identifying illegal behaviors, wherein after the business system is monitored in real time by the illegal behavior identification model to automatically identify illegal behaviors, further comprises:

[0030] Based on the monitoring results of the violation identification model, corresponding response measures are automatically triggered.

[0031] In a further technical solution, the method for identifying illegal behavior, wherein the alarm model is constructed based on the preset alarm rules, and the alarm data of the business system is obtained based on the alarm model, wherein:

[0032] The alarm data includes: alarm time, user information, device information, risk type, risk level, risk event name, hit rule, and risk score.

[0033] A device for identifying illegal behavior, comprising:

[0034] A construction module, used to construct an alarm model based on preset alarm rules, and obtain alarm data of the business system based on the alarm model;

[0035] A clustering module, used to divide the alarm data into multiple clusters based on a K-means clustering algorithm to obtain a clustering result;

[0036] A generation module, used to train a preset artificial intelligence model based on the clustering results and historical violation samples of the business system to generate a corresponding violation identification model;

[0037] An identification module is used to identify illegal behaviors of the business system based on the illegal identification model.

[0038] A computer device, wherein the computer device comprises at least one processor; and

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores a computer program that can be executed by the at least one processor. When the computer program is executed by the at least one processor, the violation identification method as described in any one of the above items can be implemented.

[0041] A non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, it can implement any of the above-mentioned violation identification methods.

[0042] Compared with the prior art, the present invention provides a method, device, computer equipment and non-volatile computer-readable storage medium for identifying violations, wherein the method includes: constructing an alarm model based on preset alarm rules, and obtaining alarm data of the business system based on the alarm model; dividing the alarm data into multiple clusters based on the K-means clustering algorithm to obtain clustering results; training a preset artificial intelligence model based on the clustering results and historical violation samples of the business system to generate a corresponding violation identification model; and identifying violations of the business system based on the violation identification model. In this way, the method of the present invention can automatically, quickly, comprehensively and accurately identify violations, thereby reducing the security risks of the business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A flowchart of a method for identifying illegal behavior provided by an embodiment of the present invention.

[0045] Figure 2 A schematic diagram of functional modules of a device for identifying illegal behavior provided in an embodiment of the present invention.

[0046] Figure 3A schematic diagram of the hardware structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0048] In the description of the present invention, the terms "include", "including", "have", "contain", etc. are all open terms, which mean including but not limited to. The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", etc. mean that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. The order of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the order of steps therein is not limited and can be appropriately adjusted as needed.

[0049] Various non-limiting embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0050] At present, with the vigorous development of the financial industry, the number of office terminals and business systems of financial institutions has increased dramatically, and the scale of information assets has continued to expand, which has brought unprecedented security risk challenges. Traditional manual management methods can no longer meet the growing security needs. Therefore, financial institutions need to invest a lot of resources every year to purchase various security products to maintain the security of office assets and business systems.

[0051] However, with the increase in the number of maintained products and systems, the volume of system alarm logs is increasing day by day, and the types of employee operation behaviors are becoming increasingly diverse. This not only brings tremendous work pressure to the company's security personnel and operation and maintenance personnel, but also poses a serious threat to business security. At present, traditional security monitoring methods mainly rely on setting alarm rules for violation scenarios, issuing alarms and manual spot checks through risk control platforms to identify and confirm security risks. However, this method has obvious limitations. It is difficult to quickly and comprehensively identify violations, and it is prone to omissions and false alarms; specifically:

[0052] 1. Efficiency issue: Traditional alarm rule setting and manual spot check methods are inefficient when processing massive logs and cannot meet the needs of real-time monitoring;

[0053] 2. Accuracy issues: Methods that rely solely on preset rules may fail to identify new or variant violations, resulting in missed reports. At the same time, due to the imprecision of the rules, false positives are also common;

[0054] 3. Resource consumption: Manual verification of alarm logs requires a lot of human resources, which increases the operating costs of financial institutions;

[0055] 4. Response time: From the discovery of alarms to manual verification and final confirmation, the entire process takes a long time, which is not conducive to rapid response to security incidents.

[0056] Based on this, how to provide a violation identification method, device, computer equipment and non-volatile computer-readable storage medium that can automatically, quickly, comprehensively and accurately identify violations to reduce the security risks of business systems is a problem that urgently needs to be solved by technical personnel in this field.

[0057] Therefore, to solve the above problem, please refer to Figure 1 The embodiment of the present invention provides a method for identifying illegal behaviors, wherein the method comprises the steps of:

[0058] S100, constructing an alarm model based on preset alarm rules, and obtaining alarm data of the business system based on the alarm model;

[0059] S200, based on the K-means clustering algorithm, dividing the alarm data into multiple clusters to obtain a clustering result;

[0060] S300, based on the clustering results and the historical violation samples of the business system, training a preset artificial intelligence model to generate a corresponding violation identification model;

[0061] S400: Identify illegal behaviors of the business system based on the illegal identification model.

[0062] Furthermore, in the method for identifying illegal behaviors, the step S100, constructing an alarm model based on a preset alarm rule, and obtaining alarm data of a business system based on the alarm model, includes:

[0063] Predefine and set alarm rules in business systems for detecting violations;

[0064] An alarm model is constructed based on the alarm rules;

[0065] The business system is monitored using the alarm model to obtain alarm data of the business system.

[0066] In the specific implementation, in this embodiment, the alarm rules for detecting illegal behaviors in the business system are predefined and set, an alarm model is constructed based on the alarm rules, the business system is monitored using the alarm model, and the alarm data of the business system is obtained, wherein the specific implementation process is as follows:

[0067] 1) Define and set alarm rules

[0068] Demand analysis: Work with business departments to understand business processes and potential security risk points, and determine the types of violations that need to be monitored;

[0069] Rule formulation: Based on the results of demand analysis, security experts formulate specific alarm rules; these rules may include abnormal login behavior, unauthorized data access, suspicious transaction patterns, etc.

[0070] Parameter setting: set thresholds and conditions for each alarm rule, such as the number of failed logins, data access frequency, transaction amount limit, etc.

[0071] 2) Build an alarm model

[0072] Data collection: Collect relevant logs and data from the business system. These data will be used to build the alarm model and subsequent monitoring;

[0073] Feature engineering: extracting features from the collected data that can help identify violations, such as user behavior features, transaction features, etc.

[0074] Model design: Design the architecture of the alarm model and select appropriate algorithms or rule engines to implement automatic detection of alarm rules to obtain the alarm model;

[0075] 3) Monitor business systems and collect alarm data

[0076] Real-time monitoring: deploy the alarm model to the business system, analyze business activities in real time, and monitor whether there are any violations of the preset alarm rules;

[0077] Alarm triggering: When the characteristics or behaviors in business activities meet the conditions of the alarm rules, the alarm model will trigger the alarm and generate an alarm event;

[0078] Data recording: Record detailed information of alarm events, including alarm time, user information, behavior details, risk level, etc., to form an alarm data set;

[0079] Through the above process, an effective alarm model can be constructed to timely discover and record violations and related information by real-time monitoring of business activities of the business system to form alarm data.

[0080] Furthermore, in the method for identifying illegal behaviors, in step S100, an alarm model is constructed based on a preset alarm rule, and alarm data of a business system is obtained based on the alarm model, wherein:

[0081] The alarm data includes: alarm time, user information, device information, risk type, risk level, risk event name, hit rule, and risk score.

[0082] In the specific implementation, in this embodiment, the alarm data generated by the constructed alarm model is a key component of security monitoring. The following is a brief introduction to each data item:

[0083] 1) Alarm time

[0084] Indicates the specific date and time when the violation was detected, which is critical for tracking and analyzing security incidents;

[0085] 2) User Information

[0086] This includes the user account, name, user ID, etc. associated with the violation, which is used to identify the individual involved in the violation;

[0087] 3) Device information

[0088] Describe the device used by the user to perform the illegal operation, which may include IP address, MAC address, device type, operating system, etc.

[0089] 4) Risk Type

[0090] Define the category to which the violation belongs, such as account risk, data leakage risk, access control risk, etc.

[0091] 5) Risk level

[0092] Assess the risk level of the violation based on its severity, usually divided into three levels: high, medium and low;

[0093] 6) Risk event name

[0094] Provide a clear name or description for the violation, such as "Unauthorized access attempt", "Sensitive data download", etc.

[0095] 7) Hit Rules

[0096] Indicate the specific rule name or ID that triggered the alert, which helps to quickly locate the type of violation detected;

[0097] 8) Risk Scoring

[0098] Quantify the risk level of the violation based on a preset algorithm, with a higher score indicating a greater risk;

[0099] These alert data items together constitute a comprehensive description of the violation. They can not only help the security team quickly identify and respond to security incidents, but are also necessary for subsequent security analysis, audits, and compliance checks. Through in-depth analysis of these data, potential security vulnerabilities and threat patterns can be discovered, thereby improving the overall security of the business system.

[0100] Furthermore, in the method for identifying illegal behaviors, the step S200, based on the K-means clustering algorithm, divides the warning data into multiple clusters to obtain clustering results, including:

[0101] Preprocessing the warning data;

[0102] The preprocessed alarm data is divided into a predetermined number of clusters using a K-means clustering algorithm to obtain corresponding clustering results.

[0103] In the specific implementation, in this embodiment, the alarm data is preprocessed, and the preprocessed alarm data is divided into a predetermined number of clusters using a K-means clustering algorithm to obtain corresponding clustering results, wherein the specific implementation process is as follows:

[0104] 1) Preprocessing of alarm data

[0105] Data cleaning: remove invalid records, duplicate records, or data points containing obvious errors in the alarm data;

[0106] Data formatting: ensuring that all data follows a unified format, such as date and time formats, standardized representation of device information, etc.

[0107] Missing value handling: Identify and handle missing data, possibly by filling in the mean, median, mode, or using a predictive model to estimate missing values;

[0108] Feature selection: Select features useful for cluster analysis from the original alarm data and remove irrelevant or redundant features;

[0109] Feature scaling: Standardize or normalize selected features to eliminate the effects of different dimensions and magnitudes;

[0110] 2) Use K-means clustering algorithm to divide data

[0111] Determine the K value: Choose the appropriate number of clusters (K value), which can be determined by methods such as elbow rule and silhouette coefficient analysis;

[0112] Initialize the centroid: Randomly select K data points as the initial cluster centroids, or use algorithms such as K-means++ to intelligently select the initial centroids;

[0113] Assign data points: Assign each alarm data point to the cluster represented by the nearest centroid to form a preliminary cluster division;

[0114] Update the centroid: recalculate the centroid of each cluster, usually the mean of all points in the cluster;

[0115] Iterative optimization: Repeat the steps of assigning data points and updating the centroid until the position of the centroid no longer changes significantly or the preset number of iterations is reached;

[0116] Clustering result evaluation: Evaluate the quality of clustering results, check whether the data points in the cluster are tightly clustered, and whether the separation between clusters is obvious, so as to obtain the corresponding optimal clustering results;

[0117] Through the above process, different behavior patterns or abnormal patterns can be identified from the alarm data, providing a basis for further security analysis and violation identification.

[0118] Furthermore, in the method for identifying illegal behaviors, the step S300, based on the clustering results and the historical illegal samples of the business system, trains a preset artificial intelligence model to generate a corresponding illegal behavior identification model, including:

[0119] Based on the clustering results and the historical violation samples of the business system, a corresponding training data set is obtained;

[0120] The training data set is used to train the preset artificial intelligence model to generate a corresponding violation recognition model.

[0121] In the specific implementation, in this embodiment, based on the clustering results and the historical violation samples of the business system, a corresponding training data set is obtained, and the training data set is used to train the preset artificial intelligence model to generate a corresponding violation recognition model, wherein the specific implementation process is as follows:

[0122] 1) Obtain training data set based on clustering results and historical violation samples

[0123] Clustering result analysis: Review the clusters obtained by the K-means clustering algorithm, especially those that may represent abnormal or irregular behavior;

[0124] Cluster marking: Based on business logic and historical data, some clusters are marked as normal behavior clusters, while other clusters may be marked as abnormal or illegal behavior clusters;

[0125] Sample selection:

[0126] Select samples from the clusters marked as violations as positive examples (i.e., violation samples);

[0127] Select samples from the cluster marked as normal behavior as negative examples (i.e., non-violating samples);

[0128] Historical violation data integration: Add known historical violation samples to the positive example set to enhance the model's ability to identify violations;

[0129] Data balance: Dealing with class imbalance can be achieved by oversampling the minority class or undersampling the majority class;

[0130] Feature processing: extract features and perform necessary preprocessing on the selected samples, such as normalization and encoding;

[0131] 2) Train the AI ​​model to generate a violation identification model

[0132] Model selection: Select appropriate machine learning models based on data characteristics and business requirements, such as decision trees, support vector machines, neural networks, etc.;

[0133] Data partitioning: Divide the prepared training data set into training subset and validation subset;

[0134] Model training: The model is trained using the training subset, and the model learns the mapping from features to violation categories;

[0135] Hyperparameter tuning: Adjust the model's hyperparameters through cross-validation, grid search, and other methods to obtain the best model performance;

[0136] Performance evaluation: Use the validation subset to evaluate the model's accuracy, recall, F1 score and other indicators to ensure the model's generalization ability;

[0137] Model optimization: Iteratively optimize the model based on the evaluation results, which may include adjusting the model structure, training strategy, etc.

[0138] Model verification: Model performance can be verified on an independent test set to ensure the effectiveness of the model in practical applications and obtain the corresponding violation identification model;

[0139] Through the above process, an artificial intelligence model can be built that can automatically identify violations in the business system to enhance the security and responsiveness of the business system.

[0140] Furthermore, in the method for identifying illegal behaviors, the step S400 of identifying illegal behaviors of the business system based on the illegal behavior identification model includes:

[0141] Deploying the violation identification model into the business system;

[0142] The business system is monitored in real time through the violation identification model to automatically identify violations.

[0143] Furthermore, the method for identifying illegal behaviors, wherein after the business system is monitored in real time by the illegal behavior identification model to automatically identify illegal behaviors, further comprises:

[0144] Based on the monitoring results of the violation identification model, corresponding response measures are automatically triggered.

[0145] In specific implementation, in this embodiment, the violation identification model is deployed in the business system, and the business system is monitored in real time by the violation identification model to automatically identify violations, and corresponding response measures are automatically triggered based on the monitoring results of the violation identification model. The specific implementation process is as follows:

[0146] 1) Deployment of violation identification model

[0147] Environmental assessment: Evaluate the current environment of the business system to ensure appropriate computing resources and data access permissions;

[0148] Model integration: Integrate the violation identification model into the business system, either through API or other integration methods;

[0149] Security reinforcement: Ensure that model deployment complies with business system security standards, including data encryption and access control;

[0150] Test verification: Conduct thorough testing before deployment in the production environment, including unit testing, integration testing, and performance testing;

[0151] 2) Real-time monitoring and identification of violations

[0152] Data collection: real-time collection of user behavior data and transaction data in business systems;

[0153] Model reasoning: Input the collected data into the violation identification model for real-time prediction and analysis;

[0154] Result evaluation: Based on the risk score or classification results output by the model, evaluate whether the criteria for determining violations are met;

[0155] 3) Automatically trigger response measures

[0156] Alert system: When the model identifies potential violations, it automatically sends alerts to the security team;

[0157] Automated response: Automatically execute predefined response measures based on the severity of the alert, such as limiting account permissions, blocking transactions, triggering further manual review, etc.;

[0158] Logging: Record all monitoring activities, violation identification results and triggered response measures for audit and subsequent analysis;

[0159] Feedback mechanism: Establish a feedback loop to feed the response results and actual violations back to the model to continuously optimize model performance;

[0160] Through the above process, the business system can realize real-time monitoring and automatic response to violations, improve the response speed and processing capabilities to security threats; at the same time, ensure the stability and maintainability of the business system.

[0161] It can be seen from the above method embodiments that the violation identification method provided by the present invention at least includes: constructing an alarm model based on preset alarm rules, and obtaining alarm data of the business system based on the alarm model; dividing the alarm data into multiple clusters based on the K-means clustering algorithm to obtain clustering results; training a preset artificial intelligence model based on the clustering results and historical violation samples of the business system to generate a corresponding violation identification model; identifying violations of the business system based on the violation identification model; and so on. In this way, the method of the present invention can automatically, quickly, comprehensively and accurately identify violations, thereby reducing the security risks of the business system.

[0162] It should be understood that, although the present application provides method operation steps as described in the embodiments or flowcharts, more or less operation steps may be included based on conventional or non-creative labor, and these operation steps are not necessarily performed in sequence according to the embodiment or flowchart. The order of steps listed in the embodiment or flowchart is only one way of executing the order of many steps, and does not represent the only execution order. It should be noted that there is not necessarily a certain order between the above steps. A person of ordinary skill in the art can understand from the description of the embodiment of the present invention that in different embodiments, the above steps may have different execution orders, that is, they may be executed in parallel, or they may be executed in exchange, etc. Moreover, at least a part of the steps in the embodiment or flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but may be executed in turn, alternately or synchronously with other steps or at least a part of the sub-steps or stages of other steps.

[0163] Based on the above method embodiment, please refer to Figure 2 Another embodiment of the present invention further provides a device for identifying illegal behaviors, wherein the device comprises:

[0164] A construction module 11 is used to construct an alarm model based on a preset alarm rule, and obtain alarm data of the business system based on the alarm model;

[0165] A clustering module 12, used to divide the alarm data into multiple clusters based on a K-means clustering algorithm to obtain a clustering result;

[0166] A generation module 13 is used to train a preset artificial intelligence model based on the clustering results and historical violation samples of the business system to generate a corresponding violation identification model;

[0167] The identification module 14 is used to identify the illegal behavior of the business system based on the illegal identification model.

[0168] Furthermore, the illegal behavior identification device, wherein the alarm model is constructed based on the preset alarm rules, and the alarm data of the business system is obtained based on the alarm model, includes:

[0169] Predefine and set alarm rules in business systems for detecting violations;

[0170] An alarm model is constructed based on the alarm rules;

[0171] The business system is monitored using the alarm model to obtain alarm data of the business system.

[0172] In the specific implementation, in this embodiment, the alarm rules for detecting illegal behaviors in the business system are predefined and set, an alarm model is constructed based on the alarm rules, the business system is monitored using the alarm model, and the alarm data of the business system is obtained, wherein the specific implementation process is as follows:

[0173] 1) Define and set alarm rules

[0174] Demand analysis: Work with business departments to understand business processes and potential security risk points, and determine the types of violations that need to be monitored;

[0175] Rule formulation: Based on the results of demand analysis, security experts formulate specific alarm rules; these rules may include abnormal login behavior, unauthorized data access, suspicious transaction patterns, etc.

[0176] Parameter setting: set thresholds and conditions for each alarm rule, such as the number of failed logins, data access frequency, transaction amount limit, etc.

[0177] 2) Build an alarm model

[0178] Data collection: Collect relevant logs and data from the business system. These data will be used to build the alarm model and subsequent monitoring;

[0179] Feature engineering: extracting features from the collected data that can help identify violations, such as user behavior features, transaction features, etc.

[0180] Model design: Design the architecture of the alarm model and select appropriate algorithms or rule engines to implement automatic detection of alarm rules to obtain the alarm model;

[0181] 3) Monitor business systems and collect alarm data

[0182] Real-time monitoring: deploy the alarm model to the business system, analyze business activities in real time, and monitor whether there are any violations of the preset alarm rules;

[0183] Alarm triggering: When the characteristics or behaviors in business activities meet the conditions of the alarm rules, the alarm model will trigger the alarm and generate an alarm event;

[0184] Data recording: Record detailed information of alarm events, including alarm time, user information, behavior details, risk level, etc., to form an alarm data set;

[0185] Through the above process, an effective alarm model can be constructed to timely discover and record violations and related information by real-time monitoring of business activities of the business system to form alarm data.

[0186] Furthermore, in the illegal behavior identification device, the alarm model is constructed based on the preset alarm rules, and the alarm data of the business system is obtained based on the alarm model, wherein:

[0187] The alarm data includes: alarm time, user information, device information, risk type, risk level, risk event name, hit rule, and risk score.

[0188] In the specific implementation, in this embodiment, the alarm data generated by the constructed alarm model is a key component of security monitoring. The following is a brief introduction to each data item:

[0189] 1) Alarm time

[0190] Indicates the specific date and time when the violation was detected, which is critical for tracking and analyzing security incidents;

[0191] 2) User Information

[0192] This includes the user account, name, user ID, etc. associated with the violation, which is used to identify the individual involved in the violation;

[0193] 3) Device information

[0194] Describe the device used by the user to perform the illegal operation, which may include IP address, MAC address, device type, operating system, etc.

[0195] 4) Risk Type

[0196] Define the category to which the violation belongs, such as account risk, data leakage risk, access control risk, etc.

[0197] 5) Risk level

[0198] Assess the risk level of the violation based on its severity, usually divided into three levels: high, medium and low;

[0199] 6) Risk event name

[0200] Provide a clear name or description for the violation, such as "Unauthorized access attempt", "Sensitive data download", etc.

[0201] 7) Hit Rules

[0202] Indicate the specific rule name or ID that triggered the alert, which helps to quickly locate the type of violation detected;

[0203] 8) Risk Scoring

[0204] Quantify the risk level of the violation based on a preset algorithm, with a higher score indicating a greater risk;

[0205] These alert data items together constitute a comprehensive description of the violation. They can not only help the security team quickly identify and respond to security incidents, but are also necessary for subsequent security analysis, audits, and compliance checks. Through in-depth analysis of these data, potential security vulnerabilities and threat patterns can be discovered, thereby improving the overall security of the business system.

[0206] Furthermore, the device for identifying illegal behavior, wherein the alarm data is divided into a plurality of clusters based on the K-means clustering algorithm to obtain a clustering result, includes:

[0207] Preprocessing the warning data;

[0208] The preprocessed alarm data is divided into a predetermined number of clusters using a K-means clustering algorithm to obtain corresponding clustering results.

[0209] In the specific implementation, in this embodiment, the alarm data is preprocessed, and the preprocessed alarm data is divided into a predetermined number of clusters using a K-means clustering algorithm to obtain corresponding clustering results, wherein the specific implementation process is as follows:

[0210] 1) Preprocessing of alarm data

[0211] Data cleaning: remove invalid records, duplicate records, or data points containing obvious errors in the alarm data;

[0212] Data formatting: ensuring that all data follows a unified format, such as date and time formats, standardized representation of device information, etc.

[0213] Missing value handling: Identify and handle missing data, possibly by filling in the mean, median, mode, or using a predictive model to estimate missing values;

[0214] Feature selection: Select features useful for cluster analysis from the original alarm data and remove irrelevant or redundant features;

[0215] Feature scaling: Standardize or normalize selected features to eliminate the effects of different dimensions and magnitudes;

[0216] 2) Use K-means clustering algorithm to divide data

[0217] Determine the K value: Choose the appropriate number of clusters (K value), which can be determined by methods such as elbow rule and silhouette coefficient analysis;

[0218] Initialize the centroid: Randomly select K data points as the initial cluster centroids, or use algorithms such as K-means++ to intelligently select the initial centroids;

[0219] Assign data points: Assign each alarm data point to the cluster represented by the nearest centroid to form a preliminary cluster division;

[0220] Update the centroid: recalculate the centroid of each cluster, usually the mean of all points in the cluster;

[0221] Iterative optimization: Repeat the steps of assigning data points and updating the centroid until the position of the centroid no longer changes significantly or the preset number of iterations is reached;

[0222] Clustering result evaluation: Evaluate the quality of clustering results, check whether the data points in the cluster are tightly clustered, and whether the separation between clusters is obvious, so as to obtain the corresponding optimal clustering results;

[0223] Through the above process, different behavior patterns or abnormal patterns can be identified from the alarm data, providing a basis for further security analysis and violation identification.

[0224] Furthermore, the violation identification device, wherein the preset artificial intelligence model is trained based on the clustering result and the historical violation samples of the business system to generate a corresponding violation identification model, includes:

[0225] Based on the clustering results and the historical violation samples of the business system, a corresponding training data set is obtained;

[0226] The training data set is used to train the preset artificial intelligence model to generate a corresponding violation recognition model.

[0227] In the specific implementation, in this embodiment, based on the clustering results and the historical violation samples of the business system, a corresponding training data set is obtained, and the training data set is used to train the preset artificial intelligence model to generate a corresponding violation recognition model, wherein the specific implementation process is as follows:

[0228] 1) Obtain training data set based on clustering results and historical violation samples

[0229] Clustering result analysis: Review the clusters obtained by the K-means clustering algorithm, especially those that may represent abnormal or irregular behavior;

[0230] Cluster marking: Based on business logic and historical data, some clusters are marked as normal behavior clusters, while other clusters may be marked as abnormal or illegal behavior clusters;

[0231] Sample selection:

[0232] Select samples from the clusters marked as violations as positive examples (i.e., violation samples);

[0233] Select samples from the cluster marked as normal behavior as negative examples (i.e., non-violating samples);

[0234] Historical violation data integration: Add known historical violation samples to the positive example set to enhance the model's ability to identify violations;

[0235] Data balance: Dealing with class imbalance can be achieved by oversampling the minority class or undersampling the majority class;

[0236] Feature processing: extract features and perform necessary preprocessing on the selected samples, such as normalization and encoding;

[0237] 2) Train the AI ​​model to generate a violation identification model

[0238] Model selection: Select appropriate machine learning models based on data characteristics and business requirements, such as decision trees, support vector machines, neural networks, etc.;

[0239] Data partitioning: Divide the prepared training data set into training subset and validation subset;

[0240] Model training: The model is trained using the training subset, and the model learns the mapping from features to violation categories;

[0241] Hyperparameter tuning: Adjust the model's hyperparameters through cross-validation, grid search, and other methods to obtain the best model performance;

[0242] Performance evaluation: Use the validation subset to evaluate the model's accuracy, recall, F1 score and other indicators to ensure the model's generalization ability;

[0243] Model optimization: Iteratively optimize the model based on the evaluation results, which may include adjusting the model structure, training strategy, etc.

[0244] Model verification: Model performance can be verified on an independent test set to ensure the effectiveness of the model in practical applications and obtain the corresponding violation identification model;

[0245] Through the above process, an artificial intelligence model can be built that can automatically identify violations in the business system to enhance the security and responsiveness of the business system.

[0246] Furthermore, the illegal behavior identification device, wherein the identification of illegal behavior of the business system based on the illegal behavior identification model includes:

[0247] Deploying the violation identification model into the business system;

[0248] The business system is monitored in real time through the violation identification model to automatically identify violations.

[0249] Furthermore, the device for identifying illegal behaviors, wherein after the business system is monitored in real time by the illegal behavior identification model to automatically identify illegal behaviors, further comprises:

[0250] Based on the monitoring results of the violation identification model, corresponding response measures are automatically triggered.

[0251] In specific implementation, in this embodiment, the violation identification model is deployed in the business system, and the business system is monitored in real time by the violation identification model to automatically identify violations, and corresponding response measures are automatically triggered based on the monitoring results of the violation identification model. The specific implementation process is as follows:

[0252] 1) Deployment of violation identification model

[0253] Environmental assessment: Evaluate the current environment of the business system to ensure appropriate computing resources and data access permissions;

[0254] Model integration: Integrate the violation identification model into the business system, either through API or other integration methods;

[0255] Security reinforcement: Ensure that model deployment complies with business system security standards, including data encryption and access control;

[0256] Test verification: Conduct thorough testing before deployment in the production environment, including unit testing, integration testing, and performance testing;

[0257] 2) Real-time monitoring and identification of violations

[0258] Data collection: real-time collection of user behavior data and transaction data in business systems;

[0259] Model reasoning: Input the collected data into the violation identification model for real-time prediction and analysis;

[0260] Result evaluation: Based on the risk score or classification results output by the model, evaluate whether the criteria for determining violations are met;

[0261] 3) Automatically trigger response measures

[0262] Alert system: When the model identifies potential violations, it automatically sends alerts to the security team;

[0263] Automated response: Automatically execute predefined response measures based on the severity of the alert, such as limiting account permissions, blocking transactions, triggering further manual review, etc.;

[0264] Logging: Record all monitoring activities, violation identification results and triggered response measures for audit and subsequent analysis;

[0265] Feedback mechanism: Establish a feedback loop to feed the response results and actual violations back to the model to continuously optimize model performance;

[0266] Through the above process, the business system can realize real-time monitoring and automatic response to violations, improve the response speed and processing capabilities to security threats; at the same time, ensure the stability and maintainability of the business system.

[0267] It can be seen from the above device embodiments that the violation identification device provided by the present invention at least includes: constructing an alarm model based on preset alarm rules, and obtaining alarm data of the business system based on the alarm model; dividing the alarm data into multiple clusters based on the K-means clustering algorithm to obtain clustering results; training a preset artificial intelligence model based on the clustering results and historical violation samples of the business system to generate a corresponding violation identification model; identifying violations of the business system based on the violation identification model; and so on. In this way, the device of the present invention can automatically, quickly, comprehensively and accurately identify violations, thereby reducing the security risks of the business system.

[0268] Based on the above method embodiment, please refer to Figure 3 Another embodiment of the present invention further provides a computer device, wherein the computer device 10 includes:

[0269] memory 120 and one or more processors 110, Figure 3 A processor 110 is used as an example for description. The processor 110 and the memory 120 may be connected via a communication bus or other means. Figure 3 The example of connecting via a communication bus is taken as an example.

[0270] The processor 110 is used to complete various control logics of the computer device 10. It can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a single-chip microcomputer, an ARM (Acorn RISC Machine) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of these components. In addition, the processor 110 can also be any traditional processor, microprocessor or state machine. The processor 110 can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP, or any other such configuration.

[0271] The memory 120 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as the computer program corresponding to the illegal behavior identification method in the embodiment of the present invention. The processor 110 executes various functional applications and data processing of the computer device 10 by running the non-volatile software programs, instructions and units stored in the memory 120, that is, implements the illegal behavior identification method in the above method embodiment.

[0272] The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store an application required for operating the device or at least one function; the data storage area may store data created according to the use of the computer device 10, etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 120 may optionally include a memory remotely arranged relative to the processor 110, and these remote memories may be connected to the computer device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0273] One or more units are stored in the memory 120, and when executed by one or more processors 110, the violation behavior identification method in any of the above method embodiments can be implemented, for example, the above described Figure 1 The method comprises steps S100 to S400.

[0274] Those skilled in the art will understand that Figure 3 The hardware structure diagram shown in the figure is only a schematic diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0275] Based on the above method embodiments, another embodiment of the present invention further provides a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the violation behavior identification method in any of the above method embodiments can be implemented, for example, the above described Figure 1 The method comprises steps S100 to S400.

[0276] As an example, the non-volatile storage medium can include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable ROM (EEPROM), or a flash memory. Volatile memory can include a random access memory (RAM) as an external cache memory. By way of illustration and not limitation, RAM can be obtained in many forms such as synchronous RAM (SRAM), dynamic RAM, (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synch link DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The disclosed memory components or memories of the operating environment described herein are intended to include one or more of these and / or any other suitable types of memory.

[0277] Based on the above method embodiments, another embodiment of the present invention further provides a computer program product, the computer program product includes a computer program stored on a non-volatile computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a processor, the violation behavior identification method in any of the above method embodiments can be implemented, for example, the above described Figure 1 The method comprises steps S100 to S400.

[0278] The embodiments described above are merely illustrative, in which the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0279] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can exist in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0280] Conditional language such as "can," "can," "might," or "may," unless specifically stated otherwise or otherwise understood within the context as used, is generally intended to convey, among other things, that a particular embodiment can include (while other embodiments do not) a particular feature, element, and / or operation. Thus, such conditional language is also generally intended to imply that a feature, element, and / or operation is required for one or more embodiments anyway or that one or more embodiments must include logic for determining, with or without input or prompting, whether such features, elements, and / or operations are included or will be performed in any particular embodiment.

[0281] What has been described herein, in this specification and in the accompanying drawings includes examples that can provide a method, device, computer equipment, and non-volatile computer-readable storage medium for identifying violations. Of course, it is not possible to describe every conceivable combination of elements and / or methods for the purpose of describing the various features of the present disclosure, but it can be recognized that many other combinations and permutations of the disclosed features are possible. Therefore, it is obvious that various modifications can be made to the present disclosure without departing from the scope or spirit of the present disclosure, but all these various modifications should belong to the scope of protection of the claims attached to the present invention. In addition, or in an alternative, other embodiments of the present disclosure may be obvious from consideration of the present specification and the accompanying drawings and from the practice of the present disclosure as presented herein. It is intended that the examples proposed in the present specification and the accompanying drawings are considered to be illustrative and non-restrictive in all respects. Although specific terms are used herein, they are used in a general and descriptive sense and are not used for limiting purposes.

Claims

1. A method for identifying illegal behavior, characterized in that: include: An alarm model is constructed based on preset alarm rules, and alarm data of the business system is obtained based on the alarm model; Based on the K-means clustering algorithm, the alarm data is divided into multiple clusters to obtain a clustering result; Based on the clustering results and the historical violation samples of the business system, a preset artificial intelligence model is trained to generate a corresponding violation identification model; Based on the violation identification model, the violation behavior of the business system is identified.

2. The method for identifying illegal behavior according to claim 1, characterized in that: The alarm model is constructed based on the preset alarm rules, and the alarm data of the business system is obtained based on the alarm model, including: Predefine and set alarm rules in business systems for detecting violations; An alarm model is constructed based on the alarm rules; The business system is monitored using the alarm model to obtain alarm data of the business system.

3. The method for identifying illegal behavior according to claim 2, characterized in that: The alarm data is divided into a plurality of clusters based on the K-means clustering algorithm to obtain a clustering result, including: Preprocessing the warning data; The preprocessed alarm data is divided into a predetermined number of clusters using a K-means clustering algorithm to obtain corresponding clustering results.

4. The method for identifying illegal behavior according to claim 3, characterized in that: The method of training a preset artificial intelligence model based on the clustering results and the historical violation samples of the business system to generate a corresponding violation identification model includes: Based on the clustering results and the historical violation samples of the business system, a corresponding training data set is obtained; The training data set is used to train the preset artificial intelligence model to generate a corresponding violation recognition model.

5. The method for identifying illegal behavior according to claim 4, characterized in that: The identifying the violation behavior of the business system based on the violation identification model includes: Deploying the violation identification model into the business system; The business system is monitored in real time through the violation identification model to automatically identify violations.

6. The method for identifying illegal behavior according to claim 5, characterized in that: After the business system is monitored in real time by the violation identification model to automatically identify violations, the method further includes: Based on the monitoring results of the violation identification model, corresponding response measures are automatically triggered.

7. The method for identifying illegal behavior according to any one of claims 1 to 6, characterized in that: The alarm model is constructed based on the preset alarm rules, and the alarm data of the business system is obtained based on the alarm model, wherein: The alarm data includes: alarm time, user information, device information, risk type, risk level, risk event name, hit rule, and risk score.

8. A device for identifying illegal behavior, characterized in that: include: A construction module, used to construct an alarm model based on preset alarm rules, and obtain alarm data of the business system based on the alarm model; A clustering module, used to divide the alarm data into multiple clusters based on a K-means clustering algorithm to obtain a clustering result; A generation module, used to train a preset artificial intelligence model based on the clustering results and historical violation samples of the business system to generate a corresponding violation identification model; An identification module is used to identify illegal behaviors of the business system based on the illegal identification model.

9. A computer device, characterized in that: The computer device comprises at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. When the computer program is executed by the at least one processor, the violation identification method as described in any one of claims 1-7 can be implemented.

10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the violation identification method according to any one of claims 1 to 7 can be implemented.

Images