Risk behavior detection method and system based on DLP technology

Abstract

The invention relates to a risk behavior detection method and system based on the DLP technology, and the method comprises the following steps: building a user risk behavior monitoring model based on the DLP technology, and the user risk behavior monitoring model is used for collecting and monitoring user behavior data and IM communication software communication data; establishing a user risk behavior identification model through a machine learning technology according to user historical behavior data collected by the user risk behavior monitoring model, and monitoring daily operation behaviors of the user in real time; according to IM communication software communication data collected by the user risk behavior monitoring model, whether risk content exists in the IM communication software communication data or not is recognized through the NLP technology; and according to an output result of the user risk behavior identification model and risk content identified by the NLP technology, constructing a comprehensive risk assessment model, when a risk value output by the risk assessment model is higher than a preset value, giving a risk alarm, and automatically recording related data to provide evidence for subsequent investigation and auditing.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a risk behavior detection method and system based on DLP technology. Background Art

[0002] With the rapid development of information technology, the network security within enterprises and organizations faces severe challenges. When users use computer systems and IM communication software in their daily lives, they may perform various operations, some of which may pose security risks, such as abnormal logins, frequent data transmission, and transmission of sensitive information. These risky behaviors may lead to serious consequences such as corporate data leakage, system failures, and compliance issues. However, existing technologies are insufficient in detecting user risk behaviors and content, making it difficult to comprehensively and accurately identify and evaluate various risky behaviors, and unable to effectively and timely prevent potential security threats. For example, traditional detection methods may only focus on a single type of data or behavior, lacking the ability to comprehensively analyze multiple data and complex behavior patterns; or they may not be accurate enough in the risk assessment process, and are prone to problems such as false positives or false negatives.

[0003] Existing technologies such as the Chinese patent with patent number "CN116881847A" disclose a user behavior prediction method based on immune genetic algorithm optimization log audit, including S1, information collection: collecting user behavior characteristics from the system log file, the behavior characteristics include the user's basic information data, operation behavior data and expenditure level data; S2, building a prediction model: building a user behavior prediction model through an immune genetic algorithm; S3, data identification: analyzing the log file of the target user and identifying the target user's behavior data. This invention collects user behavior characteristics from the system log file, builds a user behavior prediction model through an immune genetic algorithm, identifies the target user's behavior data, predicts whether the user behavior is normal, and predicts that the user behavior is abnormal by setting three to five unqualified items, which can reduce the impact of some incidental factors on user behavior, resulting in abnormal user behavior alarms, thereby reducing the false alarm rate of abnormal user behavior alarms.

[0004] The problem with the above-mentioned prior art is that the method only uses the user's behavioral characteristics to predict behavior, and does not consider the possible illegal content in normal behavior. In addition, the method only predicts abnormal user behavior by setting three to five unqualified items, and the judgment rules for predicting abnormal user behavior are relatively simple and mechanical. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a risk behavior detection method and system based on DLP technology.

[0006] The technical solution of the present invention is as follows:

[0007] The present invention proposes a risk behavior detection method based on DLP technology, comprising the following steps:

[0008] Step S1, constructing a user risk behavior monitoring model based on DLP technology, the user risk behavior monitoring model is used to collect and monitor user behavior data and IM communication software communication data; user behavior data includes: login time, operation duration, operation frequency, operation type; IM communication software communication data includes: text, pictures, file transfer and data outbound content;

[0009] Step S2, based on the user historical behavior data collected by the user risk behavior monitoring model, a user risk behavior identification model is established through machine learning technology to monitor the user's daily operation behavior in real time;

[0010] Step S3, based on the IM communication software communication data collected by the user risk behavior monitoring model, using NLP technology to identify whether there is risky content in the IM communication software communication data;

[0011] Step S4: construct a comprehensive risk assessment model based on the output results of the user risk behavior identification model and the risk content identified by NLP technology. When the risk value output by the risk assessment model is higher than the preset value, a risk alarm is issued and relevant data is automatically recorded to provide evidence for subsequent investigation and audit.

[0012] As a preferred implementation, the method uses machine learning technology to establish a user risk behavior identification model to monitor the user's daily operation behavior in real time; specifically, the following steps are included:

[0013] Use time series analysis and behavior clustering algorithms to identify the statistical distribution of normal behavior and build a behavior baseline based on it;

[0014] Use an unsupervised learning method that combines isolation forest and local anomaly factors to detect users' sudden abnormal behaviors and discover potential risk behaviors by comparing them with the behavioral baseline.

[0015] The user's next action is predicted based on the hidden Markov sequence model and the long short-term memory network model. If the user behavior deviates from the prediction, it is marked as risky behavior.

[0016] As a preferred implementation, the use of time series analysis and behavior clustering algorithm to identify the statistical distribution of normal behavior and constructing a behavior baseline based on this specifically includes the following steps:

[0017] Collect historical user behavior data, which includes various types of user operation behavior information in different time periods, clean the collected data, remove noise data, duplicate data, and obviously erroneous data points, and use the Z-score standardization method to standardize the cleaned data;

[0018] A time series is constructed based on the user's behavioral characteristics, and the autoregressive moving average model is selected as the time series analysis model; the autoregressive moving average model expression is as follows:

[0019]

[0020] Where: y t is the observed value at time t; c is the constant term; p is the autoregressive order; q is the moving average order; are the autoregressive model parameters; θ1, θ2…, θ q is the sliding average model parameter;

[0021] Use historical behavior data to fit the autoregressive moving average model and determine the model's parameter values ​​using the least squares method;

[0022] After the data set has been processed by time series analysis, the representative and discriminative behavioral features are selected as the input of the K-Means clustering algorithm, and the clustering results are output; the specific formula is as follows:

[0023]

[0024] Where: y j ′ is the updated cluster center; C j is the jth cluster; |C j |For C j The number of data points in ;

[0025] The statistical distribution information about each behavioral feature obtained by the time series analysis model is integrated with the feature information of different clusters obtained by the clustering algorithm to determine the behavioral baseline range under different behavioral patterns.

[0026] As a preferred implementation, the unsupervised learning method using isolation forest and local abnormal factors is used to detect the user's sudden abnormal behavior and find potential behavioral risks by comparing with the behavioral baseline; wherein:

[0027] The isolation score in the isolation forest model is obtained by the following formula:

[0028]

[0029] Where: s(o) is the isolation score; h(o) is the path length of data point o; E(h(o) is the average path length; a(n) is a constant related to the number of samples n and the maximum depth of the tree, used to normalize the path length;

[0030] The local anomaly factor is obtained by the following formula:

[0031]

[0032] Where: LOF(o w ) is the data point o w Outliers; N k (o w ) is o w k-neighborhood of m for o w Data points in the k-neighborhood reachable distance; lrd k (o m ) is the data point o m The local reachable density of k (o w ) is the data point o w The local reachable density of

[0033] is the isolation score s(o) and local outlier factor LOF(o w ) assign weights and calculate the abnormal behavior score after fusion. The specific calculation formula is as follows:

[0034] A(o)=ω1×s(o)+ω2×LOF(o w );

[0035] Where: A(o) is the abnormal behavior score after fusion; ω1 is the result allocation weight of the isolation forest; ω2 is the result allocation weight of the local anomaly factor, ω1+ω2=1.

[0036] As a preferred implementation, the method predicts the user's next operation based on the hidden Markov sequence model and the long short-term memory network model; wherein the long short-term memory network model dynamically focuses on different parts of the user behavior sequence by introducing an attention mechanism; the objective function of the attention mechanism is a cross entropy loss function, and the specific formula is as follows:

[0037]

[0038] Where: L CE is the cross entropy loss function; y b,d is the value of the d-th class label of sample b, The probability that sample b belongs to the dth class label; b = 1, 2, 3, ... B; d = 1, 2, 3, ... D.

[0039] As a preferred implementation, the NLP technology is used to identify whether there is risky content in the communication data of the IM communication software; the risky content identification includes:

[0040] Identify text content risks, build a risk vocabulary, use word embedding Word2Vec and word frequency-inverse document frequency TF-IDF technology and the BERT model to perform semantic analysis, sentiment analysis and similarity analysis on text content to confirm the risk probability of text content;

[0041] Risk identification of image content, optical character recognition (OCR) technology and multimodal models, combining the image content with the captions in the image to analyze and confirm the risk probability of the image content;

[0042] File transfer content risk identification: determine the file type by analyzing the file extension and file header; directly extract the file content of text files and process them according to the text content risk identification method; image files are extracted through the corresponding parsing software and processed according to the image content risk identification method; for file types in uncommon scenarios, cluster the historical file transfer behavior data based on the clustering algorithm, and if the transmission behavior deviates from the normal mode, it is marked as a risky file.

[0043] As a preferred implementation, a comprehensive risk assessment model is constructed based on the output results of the user risk behavior identification model and the risk content identified by NLP technology. The specific comprehensive risk assessment model is as follows:

[0044] CRS=ω TVP TVP+ω IVP IVP+ω FVP ·FVP+ω BAS ·BAS;

[0045] Where: CRS is the comprehensive risk score; ω TVP is the text violation risk weight; TVP is the text violation risk probability; ω IVP is the risk weight of image violation; IVP is the probability of image violation; ω FVP is the risk weight of file violation; FVP is the probability of file violation; ω BAS is the risk behavior weight; BAS is the risk behavior score.

[0046] On the other hand, the present invention also provides a risk behavior detection system based on DLP technology, comprising:

[0047] Data collection module: build a user risk behavior monitoring model based on DLP technology, which is used to collect user historical behavior data and IM communication software communication data; historical behavior data includes: login time, operation duration, operation frequency, and operation type; IM communication software communication data includes: text, pictures, file transfer, and data outbound content;

[0048] Risk behavior identification module: Based on the user historical behavior data collected by the user risk behavior monitoring model, a user risk behavior identification model is established through machine learning technology to monitor the user's daily operation behavior in real time;

[0049] Risk content identification module: Based on the IM communication software communication data collected by the user risk behavior monitoring model, the NLP technology is used to identify whether there is risky content in the IM communication software communication data;

[0050] Violation determination and alarm module: Based on the output results of the user risk behavior identification model and the risk content identified by NLP technology, a comprehensive risk assessment model is constructed. When the risk value output by the risk assessment model is higher than the preset value, a risk alarm is issued and relevant data is automatically recorded to provide evidence for subsequent investigations and audits.

[0051] On the other hand, the present invention further provides an electronic device having a computer program stored thereon, wherein when the computer program is executed by a processor, a risk behavior detection method based on DLP technology as described in any embodiment of the present invention is implemented.

[0052] On the other hand, the present invention also provides a computer-readable medium for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement a risk behavior detection method based on DLP technology as described in any embodiment of the present invention.

[0053] The present invention has the following beneficial effects:

[0054] 1. This method can comprehensively collect user behavior data and IM communication software communication data, conduct risk detection and assessment from multiple dimensions, and thus identify potential risks more comprehensively.

[0055] 2. Through time series analysis, behavior clustering algorithm, isolation forest, local anomaly factor and other methods in machine learning technology, combined with hidden Markov sequence model and long short-term memory network model, it can accurately identify the user's normal behavior patterns and abnormal behaviors, and improve the accuracy of risk behavior identification.

[0056] 3. Accurately assess risk content: When identifying risk content in IM communication software communication data, corresponding effective technologies are used for different types of data such as text, pictures, file transfers, etc., which can more accurately determine the risk level.

[0057] 4. Timely warning and evidence provision: When the risk value is higher than the preset value, a risk alarm can be issued in time, enabling the enterprise or organization to take prompt measures to deal with the risk. At the same time, relevant data is automatically recorded to provide strong evidence for subsequent investigations and audits, which helps to trace the source of the risk and analyze the cause of the risk.

[0058] 5. The present invention helps enterprises and organizations improve their network security protection level, effectively prevent data leakage, compliance risks and other issues, protect the information asset security of enterprises and organizations, and ensure the normal and stable operation of the business. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0060] Figure 1 The figure is a schematic diagram of the method flow of embodiment 1. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0063] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0064] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0065] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0066] Embodiment 1:

[0067] In order to make the purpose, technical solutions and advantages of the present invention more clear, the following will be combined with the specific embodiments of the present application and refer to the attached Figure 1 , clearly and completely describe the technical solution of the present invention.

[0068] To solve the problems of the prior art, the present invention provides a risk behavior detection method based on DLP technology, comprising the following steps:

[0069] Step S1, constructing a user risk behavior monitoring model based on DLP technology, the user risk behavior monitoring model is used to collect and monitor user behavior data and IM communication software communication data; user behavior data includes: login time, operation duration, operation frequency, operation type; IM communication software communication data includes: text, pictures, file transfer and data outbound content;

[0070] Step S2, based on the user historical behavior data collected by the user risk behavior monitoring model, a user risk behavior identification model is established through machine learning technology to monitor the user's daily operation behavior in real time;

[0071] Step S21, using time series analysis and behavior clustering algorithm to identify the statistical distribution of normal behavior, and based on this, build a behavior baseline;

[0072] Step S211, collecting historical user behavior data, which includes various types of operation behavior information of users in different time periods, cleaning the collected data, removing noise data, duplicate data and obviously erroneous data points, and using the Z-score normalization method to standardize the cleaned data;

[0073] Step S212, construct a time series according to the user's behavior characteristics, and select an autoregressive moving average model as a time series analysis model; the autoregressive moving average model expression is as follows:

[0074]

[0075] Where: y t is the observed value at time t; c is the constant term; p is the autoregressive order; q is the moving average order; are the autoregressive model parameters; θ1, θ2…, θ q is the sliding average model parameter;

[0076] Step S212, using the historical behavior data to fit the autoregressive moving average model, and determining the parameter values ​​of the model by the least squares method;

[0077] Step S213, select the representative and discriminative behavior features of the data set after time series analysis as the input of the K-Means clustering algorithm, and output the clustering results; the specific formula is as follows:

[0078]

[0079] Where: yj ′ is the updated cluster center; C j is the jth cluster; |C j |For C j The number of data points in ;

[0080] Step S214, integrating the statistical distribution information about each behavior feature obtained by the time series analysis model with the feature information of different clusters obtained by the clustering algorithm to determine the behavior baseline range under different behavior modes.

[0081] Step S22, using an unsupervised learning method combining isolation forest and local anomaly factors to detect the user's sudden abnormal behavior, and discover potential risky behavior by comparing it with the behavior baseline;

[0082] Step S221, calculate the isolation score in the isolation forest model:

[0083]

[0084] Where: s(o) is the isolation score; h(o) is the path length of data point o; E(h(o) is the average path length; a(n) is a constant related to the number of samples n and the maximum depth of the tree, used to normalize the path length;

[0085] Step S222, calculate the local abnormality factor:

[0086]

[0087] Where: LOF(o w ) is the data point o w Outliers; N k (o w ) is o w k-neighborhood of m for o w Data points in the k-neighborhood reachable distance; lrd k (o m ) is the data point o m The local reachable density of k (o w ) is the data point o w The local reachable density of

[0088] Step S223, the isolation score s(o) and the local outlier factor LOF(o w ) assign weights and calculate the abnormal behavior score after fusion. The specific calculation formula is as follows:

[0089] A(o)=ω1×s(o)+ω2×LOF(o w );

[0090] Where: A(o) is the abnormal behavior score after fusion; ω1 is the result allocation weight of the isolation forest; ω2 is the result allocation weight of the local anomaly factor, ω1+ω2=1.

[0091] Step S224, comparing the calculated abnormal behavior score with the behavior baseline to discover potential behavior risks.

[0092] Step S23, predicting the user's next operation based on the hidden Markov sequence model and the long short-term memory network model, and marking the user's behavior as risky if it deviates from the prediction;

[0093] Step S231, analyze the user behavior data, determine the hidden state set in the hidden Markov model; calculate the probability of observing the complete observation sequence at time T and being in each hidden state, the specific calculation formula is as follows:

[0094]

[0095] Where: P(s T =k|O 1:T ) is the probability of observing the complete observation sequence at time T and being in each hidden state; α T (k) is the sequence α observed at time T T The probability of being in the kth state; N is the total number of hidden states; is the sum of all possible hidden states when the complete observation sequence is observed at time T;

[0096] Step S232: Clean the user behavior data to remove noise data and incomplete data records. Convert each user's behavior sequence into a fixed-length time step sequence, and convert the user's operation behavior into a numerical feature vector; input the feature vector of the user behavior sequence into the trained LSTM network, and the network will output the prediction result of the user's next operation based on the learned pattern;

[0097] Among them, the long short-term memory network model dynamically focuses on different parts of the user behavior sequence by introducing the attention mechanism; the objective function of the attention mechanism is the cross entropy loss function, and the specific formula is as follows:

[0098]

[0099] Where: L CE is the cross entropy loss function; y b,d is the value of the d-th class label of sample b, The probability that sample b belongs to the dth class label; b = 1, 2, 3, ... B; d = 1, 2, 3, ... D.

[0100] Step S233, use the voting method to confirm the results of HMM and LSTM predictions, vote according to the categories predicted by the two, and select the operation type with the most votes as the final prediction result.

[0101] Step S3, based on the IM communication software communication data collected by the user risk behavior monitoring model, using NLP technology to identify whether there is risky content in the IM communication software communication data;

[0102] Risky content identification includes:

[0103] Identify text content risks, build a risk vocabulary, use word embedding Word2Vec and word frequency-inverse document frequency TF-IDF technology and the BERT model to perform semantic analysis, sentiment analysis and similarity analysis on text content to confirm the risk probability of text content;

[0104] Image content risk identification, optical character recognition (OCR) technology and multimodal models, combine the image content with the captions in the image for analysis, and evaluate the risk level of the image content based on the output of the multimodal model;

[0105] File transfer content risk identification: determine the file type by analyzing the file extension and file header; directly extract the file content of text files and process them according to the text content risk identification method; image files are extracted through the corresponding parsing software and processed according to the image content risk identification method; for file types in uncommon scenarios, cluster the historical file transfer behavior data based on the clustering algorithm, and if the transmission behavior deviates from the normal mode, it is marked as a risky file.

[0106] Step S4: construct a comprehensive risk assessment model based on the output results of the user risk behavior identification model and the risk content identified by NLP technology. When the risk value output by the risk assessment model is higher than the preset value, a risk alarm is issued and relevant data is automatically recorded to provide evidence for subsequent investigation and audit.

[0107] The specific comprehensive risk assessment model is as follows:

[0108] CRS=ω TVP TVP+ω IVP IVP+ω FVP ·FVP+ω BAS ·BAS;

[0109] Where: CRS is the comprehensive risk score; ω TVP is the text violation risk weight; TVP is the text violation risk probability; ω iVP is the risk weight of image violation; IVP is the probability of image violation; ω FVP is the risk weight of file violation; FVP is the probability of file violation; ωBAS is the risk behavior weight; BAS is the risk behavior score.

[0110] Embodiment 2:

[0111] This embodiment provides a risk behavior detection system based on DLP technology, including:

[0112] Data collection module: build a user risk behavior monitoring model based on DLP technology, which is used to collect user historical behavior data and IM communication software communication data; historical behavior data includes: login time, operation duration, operation frequency, and operation type; IM communication software communication data includes: text, pictures, file transfer, and data outbound content;

[0113] Risk behavior identification module: Based on the user historical behavior data collected by the user risk behavior monitoring model, a user risk behavior identification model is established through machine learning technology to monitor the user's daily operation behavior in real time;

[0114] Risk content identification module: Based on the IM communication software communication data collected by the user risk behavior monitoring model, the NLP technology is used to identify whether there is risky content in the IM communication software communication data;

[0115] Violation determination and alarm module: Based on the output results of the user risk behavior identification model and the risk content identified by NLP technology, a comprehensive risk assessment model is constructed. When the risk value output by the risk assessment model is higher than the preset value, a risk alarm is issued and relevant data is automatically recorded to provide evidence for subsequent investigations and audits.

[0116] Embodiment three:

[0117] This embodiment provides an electronic device having a computer program stored thereon, wherein when the computer program is executed by a processor, the risk behavior detection based on the DLP technology as described in any one of the embodiments of the present invention is implemented.

[0118] Embodiment 4:

[0119] This embodiment provides a computer-readable medium for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a risk behavior detection based on DLP technology as described in any embodiment of the present invention.

[0120] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0121] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0122] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0123] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk, and other media that can store program codes.

[0124] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A risk behavior detection method based on DLP technology, characterized in that: The following steps are involved: Step S1, constructing a user risk behavior monitoring model based on DLP technology, the user risk behavior monitoring model is used to collect and monitor user behavior data and IM communication software communication data; User behavior data includes: login time, operation duration, operation frequency, and operation type; IM communication software communication data includes: text, pictures, file transfers, and data outbound content; Step S2, based on the user historical behavior data collected by the user risk behavior monitoring model, a user risk behavior identification model is established through machine learning technology to monitor the user's daily operation behavior in real time; Step S3, based on the IM communication software communication data collected by the user risk behavior monitoring model, using NLP technology to identify whether there is risky content in the IM communication software communication data; Step S4, build a comprehensive risk assessment model based on the output results of the user risk behavior identification model and the risk content identified by NLP technology. When the risk value output by the risk assessment model is higher than the preset value, a risk alarm is issued and relevant data is automatically recorded to provide evidence for subsequent investigation and audit.

2. According to claim 1, a risk behavior detection method based on DLP technology is characterized by: The above-mentioned machine learning technology is used to establish a user risk behavior identification model to monitor the user's daily operation behavior in real time; The specific steps include: Use time series analysis and behavior clustering algorithms to identify the statistical distribution of normal behavior and build a behavior baseline based on it; Use an unsupervised learning method that combines isolation forest and local anomaly factors to detect users' sudden abnormal behaviors and discover potential risk behaviors by comparing them with the behavioral baseline. The user's next action is predicted based on the hidden Markov sequence model and the long short-term memory network model. If the user behavior deviates from the prediction, it is marked as risky behavior.

3. The risk behavior detection method based on DLP technology according to claim 2 is characterized by: The method of using time series analysis and behavior clustering algorithm to identify the statistical distribution of normal behavior and building a behavior baseline based on this specifically includes the following steps: Collect historical user behavior data, which includes various types of user operation behavior information in different time periods. Clean the collected data to remove noise data, duplicate data, and obviously erroneous data points. Use the Z-score standardization method to standardize the cleaned data. A time series is constructed based on the user's behavioral characteristics, and the autoregressive moving average model is selected as the time series analysis model; the autoregressive moving average model expression is as follows: Where: y t is the observed value at time t; c is the constant term; p is the autoregressive order; q is the moving average order; are the autoregressive model parameters; θ1, θ2…, θ q is the sliding average model parameter; Use historical behavior data to fit the autoregressive moving average model and determine the model's parameter values ​​using the least squares method; After the data set has been processed by time series analysis, the representative and discriminative behavioral features are selected as the input of the K-Means clustering algorithm, and the clustering results are output; The specific formula is as follows: Where: y j ′ is the updated cluster center; C j is the jth cluster; |C j |For C j The number of data points in ; The statistical distribution information about each behavioral feature obtained by the time series analysis model is integrated with the feature information of different clusters obtained by the clustering algorithm to determine the behavioral baseline range under different behavioral patterns.

4. The risk behavior detection method based on DLP technology according to claim 2 is characterized by: The unsupervised learning method using isolation forest and local abnormal factors is used to detect the user's sudden abnormal behavior and discover potential behavioral risks by comparing with the behavioral baseline; wherein: The isolation score in the isolation forest model is obtained by the following formula: Where: s(o) is the isolation score; h(o) is the path length of data point o; E(h(o) is the average path length; a(n) is a constant related to the number of samples n and the maximum depth of the tree, used to normalize the path length; The local anomaly factor is obtained by the following formula: Where: LOF(o w ) is the data point o w Outliers; N k (o w ) is o w k-neighborhood of m for o w Data points in the k-neighborhood reachable distance; lrd k (o m ) is the data point o m The local reachable density of k (o w ) is the data point o w The local reachable density of is the isolation score s(o) and local outlier factor LOF(o w ) assign weights and calculate the abnormal behavior score after fusion. The specific calculation formula is as follows: A(o)=ω1×s(o)+ω2×LOF(o w ); Where: A(o) is the abnormal behavior score after fusion; ω1 is the result allocation weight of the isolation forest; ω2 is the result allocation weight of the local anomaly factor, ω1+ω2=1.

5. The risk behavior detection method based on DLP technology according to claim 2 is characterized by: The method predicts the user's next operation based on the hidden Markov sequence model and the long short-term memory network model; wherein the long short-term memory network model dynamically focuses on different parts of the user behavior sequence by introducing an attention mechanism; the objective function of the attention mechanism is a cross entropy loss function, and the specific formula is as follows: Where: L CE is the cross entropy loss function; y b,d is the value of the d-th class label of sample b, The probability that sample b belongs to the dth class label; b = 1, 2, 3, ... B; d = 1, 2, 3, ... D.

6. The risk behavior detection method based on DLP technology according to claim 1 is characterized by: The use of NLP technology to identify whether there is risky content in the communication data of IM communication software; Risky content identification includes: Identify text content risks, build a risk vocabulary, use word embedding Word2Vec and word frequency-inverse document frequency TF-IDF technology and the BERT model to perform semantic analysis, sentiment analysis and similarity analysis on text content to confirm the risk probability of text content; Image content risk identification, optical character recognition (OCR) technology and multimodal models, combine the image content with the captions in the image to analyze and confirm the risk probability of the image content; File transfer content risk identification: determine the file type by analyzing the file extension and file header; directly extract the file content of text files and process them according to the text content risk identification method; image files are extracted through the corresponding parsing software and processed according to the image content risk identification method; for file types in uncommon scenarios, cluster the historical file transfer behavior data based on the clustering algorithm, and if the transmission behavior deviates from the normal mode, it is marked as a risky file.

7. The risk behavior detection method based on DLP technology according to claim 1 is characterized by: According to the output results of the user risk behavior identification model and the risk content identified by NLP technology, a comprehensive risk assessment model is constructed. The specific comprehensive risk assessment model is as follows: CRS=ω TVP ·TVP+ω IVP ·IVP+ω FVP ·FVP+ω BAS ·BAS; Where: CRS is the comprehensive risk score; ω TVP is the risk weight of text violation; TVP is the risk probability of text violation; ω IVP is the risk weight of the image violation; IVP is the probability of image violation; ω FVP is the risk weight of file violation; FVP is the probability of file violation; ω BAS is the risk behavior weight; BAS is the risk behavior score.

8. A risk behavior detection system based on DLP technology, characterized in that: include: Data acquisition module; Build a user risk behavior monitoring model based on DLP technology. The user risk behavior monitoring model is used to collect user historical behavior data and IM communication software communication data; Historical behavior data includes: login time, operation duration, operation frequency, and operation type; IM communication software communication data includes: text, pictures, file transfers, and data outbound content; Risk behavior identification module: Based on the user historical behavior data collected by the user risk behavior monitoring model, a user risk behavior identification model is established through machine learning technology to monitor the user's daily operation behavior in real time; Risk content identification module: Based on the IM communication software communication data collected by the user risk behavior monitoring model, the NLP technology is used to identify whether there is risky content in the IM communication software communication data; Violation determination and alarm module: Based on the output results of the user risk behavior identification model and the risk content identified by NLP technology, a comprehensive risk assessment model is constructed. When the risk value output by the risk assessment model is higher than the preset value, a risk alarm is issued and relevant data is automatically recorded to provide evidence for subsequent investigations and audits.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the risk behavior detection based on DLP technology as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the risk behavior detection based on DLP technology as described in any one of claims 1 to 7 is implemented.

Images