Abnormal behavior detection method based on multi-modal fusion and interpretability analysis

Abstract

The invention discloses an abnormal behavior detection method based on multi-modal fusion and interpretability analysis, and the method comprises the steps: carrying out the data formatting, and converting unstructured behavior data into structured employee behavior data; thirdly, constructing a daily employee behavior sequence and extracting daily employee behavior characteristics; constructing a daily interaction graph and extracting an embedded representation of each employee node; statistical analysis is introduced to obtain daily employee statistical characteristics; splicing the three features to obtain a daily multi-modal feature fusion vector; and finally, identifying an abnormal vector set through an LOF algorithm, and carrying out importance analysis by adopting an SHAP value analysis method to output an abnormal reason. According to the method, multi-angle and multi-level feature representation is constructed, so that behavior diversity is captured more comprehensively, and perception and representation of complex user behaviors are improved; and meanwhile, fusion detection is carried out based on behavior feature importance analysis, so that abnormal employees can be locked, abnormal behavior reasons can be traced, and the interpretability of an abnormal detection result is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and deep learning, and particularly relates to an abnormal behavior detection method based on multimodal fusion and interpretability analysis. Background Art

[0002] As an important research topic in the field of network security, insider threats have become one of the main causes of many network security incidents in recent years. Abuse of internal permissions, weak password management, improper employee behavior, etc. within an enterprise may all lead to problems such as data leakage and asset damage. Since insider attackers usually have a good understanding of the company's core information, the threats they pose are often more serious than external attacks. Existing insider threat detection methods are mainly divided into the following two categories: One is the rule-based serialization method: This type of method uses rules to convert various user behaviors into sequence data, which usually retains the user's time information or operation logic information, facilitating the analysis of their behavior patterns. For example, in reference [1], by serializing employee behavior types, a residual network model based on LSTM (Long Short-Term Memory Network) and GNN (Graph Neural Network) is used to detect abnormal behaviors. In reference [2], a stacked LSTM structure is used to capture user behavior characteristics, and the likelihood value of the user behavior log is used as an anomaly score to identify insider threats. This method can capture the temporal dependence and logical association between behaviors and can adapt to various threat scenarios.

[0003] The other is the behavior prediction method based on deep learning: This type of method applies the rapidly developing deep learning technology to insider threat detection, mainly by learning historical behaviors to simulate the behaviors of normal users, thereby predicting future behavior deviations and marking the deviations as anomalies, which is an important research direction in current insider threat detection. For example, in reference [3], a heterogeneous graph embedding detection model called Log2vec is proposed to extract behavioral semantic information from the perspective of user behavior patterns, effectively improving the accuracy of anomaly detection. In reference [4], a knowledge graph is constructed through audit logs, semantic information between entities is obtained by means of graph embedding, and a behavioral instance subgraph is constructed to aggregate behavioral instance features. Finally, a clustering algorithm is used for classification to narrow the semantic gap between the logs and employee behaviors and reduce the cost of false alarms in manual analysis and real attacks. In reference [5], an internal anomaly detection model based on a dual-domain graph convolutional network (DD-GCN) is proposed. By constructing a connectivity graph (structural domain graph) and a similarity graph (feature domain graph) of employees, GCN is used to fuse the two domain graphs into a unified graph embedding. Subsequently, an attention mechanism is adopted to adaptively learn the relative weights of employee behaviors in different domains, generating a node-level embedding representation (high-level behavioral feature representation) for anomaly detection, which is suitable for fine-grained internal anomaly detection.

[0004] However, the above methods also have defects. First, the rule-based serialization method relies to a large extent on preset rules and specific relationships. References [2, 3] do not fully consider the interaction behaviors among employees or the connectivity information among different entities within the enterprise, resulting in a single-dimensional behavior representation that cannot accurately reflect the real behavior patterns of employees. In complex scenarios, due to the single consideration angle, false alarms or missed alarms are likely to occur, and it is difficult to identify deeply hidden threat behaviors. Therefore, it is necessary to frequently update the rules to adapt to new situations, increasing the maintenance cost and dependence on manual intervention, thus limiting the flexibility and accuracy of the method in the dynamic and ever-changing enterprise environment. The behavior information extraction in Reference [3] is relatively one-sided, mainly relying on time relationships and ignoring other dimensional features; moreover, the randomness of its random walk simulation is difficult to control, easily causing the loss of feature information; in addition, this method lacks in-depth analysis of fine-grained features and is difficult to meet the actual needs within the enterprise. The generalization ability of Reference [4] for complex behaviors is poor. Facing new attacks, it needs to be retrained, making it difficult to cope with long-term latent short-term threats, and it depends on high-quality and complete log records, with high requirements for the accuracy of behavioral context information. Generally speaking, the rule-based serialization method has deficiencies in real-time performance and strong dependence on expert knowledge, making it difficult to effectively adapt to the complexity and diverse needs of the current enterprise security environment. Second, the internal anomaly detection method based on deep learning highly depends on data quality, but the threat data within the enterprise is usually scarce and difficult to obtain, thus limiting the high-quality training of the model. In addition, deep learning models require a large amount of labeled data to optimize the effect, and in the enterprise environment, such labeled data is not easily obtained. Since deep learning methods mainly rely on historical behavior data for fitting, when facing new threat patterns, the model usually lacks flexibility and is difficult to quickly adapt. Although methods such as References [1, 5] can capture complex behavior patterns through deep learning, their prediction processes are often opaque, and the abnormal decision-making processes are difficult to explain, which poses challenges to the interpretability of the results. Moreover, although the dual-domain convolutional network and attention mechanism in Reference [5] improve the detection effect of behavior patterns, the method contains multiple hyperparameters that need to be adjusted through a large number of experiments, resulting in high model training costs, low iteration efficiency, significantly increasing the computational overhead, and also increasing the costs of maintenance and update.

[0005] References:

[0006] [1] Hong W, Yin J, You M, et al. A graph empowered insider threat detection framework based on daily activities[J]. ISA transactions, 2023, 141: 84 - 92.

[0007] [2] Tuor A, Kaplan S, Hutchinson B, et al. Deep learning for unsupervised insider threat detection in structured cybersecurity data streams[C] / / Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. 2017.

[0008] [3] Liu F, Wen Y, Zhang D, et al. Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise[C] / / Proceedings of the 2019 ACM SIGSAC conference on computer and communications security. 2019:1777-1794.

[0009] [4] Zeng J, Chua Z L, Chen Y, et al. WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics[C] / / NDSS. 2021.

[0010] [5] Li X, Li X, Jia J, et al. A high accuracy and adaptive anomaly detection model with dual-domain graph convolutional network for insider threat detection[J]. IEEE Transactions on Information Forensics and Security, 2023, 18:1638-1652. Summary of the Invention

[0011] The main object of the present invention is to overcome the disadvantages and deficiencies of the prior art, and to provide an abnormal behavior detection method based on multimodal fusion and interpretability analysis. By integrating behavioral data from different dimensions, a multi-angle and multi-level feature representation is constructed to capture behavioral diversity more comprehensively, thereby overcoming the limitations of high-complexity behavioral dimension analysis and enhancing the perception and representation of complex user behaviors. At the same time, fusion detection is performed based on the analysis of the importance of behavioral features, which can not only lock abnormal employees but also trace the reasons for abnormal behaviors, enhancing the interpretability of abnormal detection results.

[0012] To achieve the above object, on the one hand, the present invention provides an abnormal behavior detection method based on multimodal fusion and interpretability analysis, including the following steps:

[0013] Step 1: Data formatting:

[0014] Preprocess the unstructured behavioral data of employees in enterprise data over a period of time through a formatting tool or algorithm, and convert it into structured employee behavioral data;

[0015] Step 2: Multimodal feature extraction and fusion:

[0016] Classify the structured employee behavioral data by day, and serialize and construct it according to the time sequence relationship to obtain the daily employee behavior sequence;

[0017] Use the LSTM model to extract the daily employee behavior features from the daily employee behavior sequence;

[0018] Construct a daily interaction graph based on the association relationship between employees and devices in the daily employee behavior sequence; each node in the interaction graph represents a unique employee or device, and each edge represents the interaction relationship between two nodes, and the interaction information between the two nodes is recorded;

[0019] Use a graph embedding model to extract the embedding representation of each employee node in the daily interaction graph through node embedding;

[0020] Based on the daily employee behavior sequence and the daily interaction graph, introduce statistical analysis to obtain the daily employee statistical feature through a word embedding model; the statistics include the daily device access frequency, the daily device diversity index, the cumulative device usage breadth, the device average access rate, the device coverage rate, the daily device usage density, and the daily device coverage rate;

[0021] Concatenate the daily employee behavior features, the embedding representation of each employee node in the daily interaction graph, and the daily employee statistical features to obtain a daily multimodal feature fusion vector;

[0022] Step 3: Abnormal detection and analysis:

[0023] Input the multi-modal fusion feature vectors of multiple days within a period of time into the LOF algorithm to identify the abnormal vector set;

[0024] Adopt the SHAP value analysis method to conduct importance analysis on each daily multi-modal fusion feature vector in the abnormal vector set and output the reasons for the anomalies.

[0025] As a preferred technical solution, the formatting tool includes the UVviewsoft tool and the Logviewer tool; the formatting algorithm includes the Drain algorithm.

[0026] As a preferred technical solution, the start time node and the end time node of the daily employee behavior sequence are going to work and getting off work respectively; going to work refers to the time when the employee logs in and connects to the main device; getting off work refers to the time when the employee logs out and disconnects from the main device; the main device refers to the device that the employee most frequently uses or defaults to connect to.

[0027] As a preferred technical solution, the graph embedding model generates the embedding representation of each employee node by aggregating the interaction information between each employee node and its neighbors within one-hop range in the daily interaction graph.

[0028] As a preferred technical solution, the daily device access frequency refers to the total number of times an employee uses a device per day, which is used to measure the degree of dependence of the employee on the device per day;

[0029] The daily device diversity index refers to the number of different devices an employee uses per day, which is used to reflect the diversity of devices used by the employee per day;

[0030] The cumulative device usage breadth refers to the number of different devices an employee has used cumulatively within a period of time, which is used to describe the cumulative device usage situation of the employee;

[0031] The average device access rate refers to the average number of times an employee uses a device within a period of time, and the calculation method is: the total number of times an employee uses a device within a period of time divided by the cumulative device usage breadth, which is used to describe the busy situation of the employee's device usage;

[0032] The device coverage rate refers to the proportion of the number of devices an employee has used cumulatively within a period of time to the total number of devices in the enterprise, and the calculation method is: the number of devices an employee has used cumulatively within a period of time divided by the total number of devices, which is used to describe the diversity of device usage in the enterprise;

[0033] The daily device usage density refers to the average number of times an employee uses a device per day, and the calculation method is: the daily device access frequency divided by the daily device diversity index, which is used to describe the busy degree of the employee's daily device usage;

[0034] The daily coverage rate of the device refers to the proportion of the number of devices used by employees every day to the total number of devices in the enterprise. The calculation method is: the daily device diversity index divided by the total number of devices, which is used to describe the device coverage range of employees in their daily work.

[0035] As a preferred technical solution, the abnormal vector set is specifically:

[0036] Regarding each daily multi-modal fusion feature vector within a period of time as a data point, calculate the k-distance neighborhood N k (p) of each data point p, that is, the set of the k nearest neighbor data points to the data point p;

[0037] For each neighbor data point in the neighborhood N k (p), calculate its k-reachable distance relative to the data point p and sort them;

[0038] Based on the k-reachable distance of each neighbor data point in the neighborhood N k (p), calculate the local reachability density of the data point p;

[0039] Using the local reachability density of the data point p and each neighbor data point in its neighborhood, calculate the local outlier factor of the data point p; the larger the LOF score, the more abnormal the data point p is; conversely, the smaller the LOF score, the more normal the data point p is;

[0040] Select the n data points with the highest degree of outlier, that is, the n daily multi-modal fusion feature vectors with the largest LOF scores as abnormal vectors for output, and obtain the abnormal vector set.

[0041] As a preferred technical solution, the SHAP value analysis method is used to perform importance analysis on each daily multi-modal fusion feature vector in the abnormal vector set and output the abnormal reasons, specifically:

[0042] Calculate the SHAP value of each daily multi-modal fusion feature vector in the abnormal vector set;

[0043] For each daily multi-modal fusion feature vector in the abnormal vector set, call the machine learning model to predict the contribution of each feature of each daily multi-modal fusion feature vector, and distribute the SHAP value to each feature of each daily multi-modal fusion feature vector through the SHAP value decomposition model to obtain the feature SHAP value and sort them;

[0044] Identify the feature with the largest contribution in each daily multi-modal fusion feature vector, that is, the feature with the largest feature SHAP value, perform background semantic detection and output.

[0045] As a preferred technical solution, the calculation formula of the feature SHAP value is:

[0046]

[0047] Among them, is the SHAP value of the i-th feature in the daily multi-modal fusion feature vector, N is the daily multi-modal fusion feature vector, |N| is the number of features in the daily multi-modal fusion feature vector, S is a subset of the daily multi-modal fusion feature vector, |S| is the number of features in S,! is the factorial, f(S) is the predicted value of the machine learning model for S, (f(S∪i)-f(S)) is the marginal contribution of the i-th feature in the daily multi-modal fusion feature vector to S, and N\{i} is all possible feature subsets in the daily multi-modal fusion feature vector N except the i-th feature.

[0048] On the other hand, the present invention provides an abnormal behavior detection system based on multi-modal fusion and interpretability analysis, which is applied to the above abnormal behavior detection method. The system includes a data formatting module, a sequence construction module, a feature extraction module, an interaction graph construction module, a node representation module, a statistic analysis module, a feature fusion module, an abnormal recognition module, and an abnormal analysis module;

[0049] The data formatting module is used to preprocess the unstructured behavior data of employees in enterprise data within a period of time through a formatting tool or algorithm, and convert it into structured employee behavior data;

[0050] The sequence construction module is used to classify the structured employee behavior data by day, and serialize and construct it according to the time sequence relationship to obtain a daily employee behavior sequence;

[0051] The feature extraction module is used to extract daily employee behavior features from the daily employee behavior sequence by using an LSTM model;

[0052] The interaction graph construction module is used to construct a daily interaction graph based on the association relationship between employees and devices according to the daily employee behavior sequence; each node in the interaction graph represents a unique employee or device, and each edge represents the interaction relationship between two nodes, and the interaction information between the two nodes is recorded;

[0053] The node representation module is used to extract the embedding representation of each employee node in the daily interaction graph by using a graph embedding model through node embedding;

[0054] The statistic analysis module is used to introduce statistic analysis based on the daily employee behavior sequence and the daily interaction graph to obtain daily employee statistic features through a word embedding model; the statistics include daily device access frequency, daily device diversity index, cumulative device usage breadth, device average access rate, device coverage rate, daily device usage density, and daily device coverage rate;

[0055] The feature fusion module is used to concatenate the daily employee behavior features, the embedded representation of each employee node in the daily interaction graph, and the daily employee statistical features to obtain a daily multimodal feature fusion vector;

[0056] The anomaly identification module is used to input multiple daily multimodal fusion feature vectors within a period of time into the LOF algorithm to identify anomaly vector sets;

[0057] The anomaly analysis module is used to use the SHAP value analysis method to perform importance analysis on each daily multimodal fusion feature vector in the anomaly vector set and output the anomaly cause.

[0058] Another object of the present invention is to provide a computer-readable storage medium storing a program, which, when executed by a processor, implements the above-mentioned abnormal behavior detection method.

[0059] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0060] 1. Aiming at the problem that it is difficult to extract the multi-dimensional and complex features of employee behaviors within an enterprise, the present invention designs a behavior characterization method that combines daily behavior patterns, interaction structure information and statistical usage, comprehensively considers the time dependency between employee behaviors, the different habits of different employee behavior operation logics and the interaction frequency structure between employees and devices, and integrates behavioral data of different dimensions from sequences, graphs and statistical indicators to construct a multi-angle, multi-level and comprehensive feature representation, which more comprehensively captures the diversity of behaviors and achieves a deep characterization of employee behaviors. Combining the semantic and structural advantages of LSTM and graph neural networks, through multi-dimensional feature fusion technology, on the one hand, it can overcome the limitations of the prior art in the analysis of high-complexity behavior dimensions and the problem of insufficient understanding of behavioral semantics, and enhance the comprehensive perception and characterization capabilities of employees' complex behaviors. On the other hand, it reduces the dependence on manual rule updates and reduces the cost of system maintenance and updates, making the present invention more adaptable to dynamic enterprise environments.

[0061] 2. Aiming at the interpretability and positioning problems of the existing technology in the process of internal threat detection, the present invention designs a method to use the local outlier factor algorithm (LOF algorithm) to perform local density analysis on the high-level representation vector of employee behavior, identify abnormal behaviors and lock associated abnormal employees, which can effectively discover potential hidden abnormal behaviors and improve the accuracy and flexibility of anomaly detection; then combine the SHAP value to perform importance analysis of feature dimensions, and deeply explore the key features that lead to abnormal behaviors. Compared with traditional anomaly detection methods based on rules or simple statistical analysis, the anomaly detection process in the present invention is more interpretable, which facilitates in-depth understanding of the specific causes of abnormal behaviors. It can not only effectively distinguish between abnormal and normal behaviors, but also increase the interpretability of the detection process and help enterprises identify potential hidden abnormal behaviors. Brief Description of the Drawings

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0063] Figure 1 It is a flow framework diagram of the abnormal behavior detection method based on multimodal fusion and interpretability analysis in the embodiments of the present invention.

[0064] Figure 2 It is a schematic flow diagram of data formatting in the embodiments of the present invention.

[0065] Figure 3 It is a schematic flow diagram of multimodal feature extraction and fusion in the embodiments of the present invention.

[0066] Figure 4 It is a schematic flow diagram of abnormal detection and analysis in the embodiments of the present invention.

[0067] Figure 5 It is a schematic structural diagram of the abnormal behavior detection system based on multimodal fusion and interpretability analysis in the embodiments of the present invention.

[0068] Figure 6 It is a schematic structural diagram of the computer-readable storage medium in the embodiments of the present invention. Detailed Description of the Embodiments

[0069] In order to enable those skilled in the art to better understand the solutions of the present application, the following will clearly and completely describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts fall within the scope of protection of the present application.

[0070] Referring to "embodiments" in the present application means that the specific features, structures or characteristics described in connection with the embodiments can be included in at least one embodiment of the present application. The phrase appears in various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art explicitly and implicitly understand that the embodiments described in the present application can be combined with other embodiments.

[0071] The present invention aims to solve the problem of how to efficiently extract the daily behavior characteristics of employees within an enterprise and identify abnormal employees and potential threat behaviors by analyzing these behavior characteristics. Internal threats usually originate from employees who have access to the enterprise information system and are familiar with the internal defense mechanism; various operations and behaviors of employees on systems and devices are recorded in enterprise logs, covering a large amount of detailed information, which can be used as an important basis for analyzing employees' behaviors. However, enterprise operations often have the characteristics of strategic periodicity, and behavior data is also complex and variable, making it extremely challenging to extract employees' behavior patterns. In addition, abnormal behavior data usually accounts for a very small proportion and is often masked by normal behavior data, so it is particularly difficult to detect employees' abnormal behaviors in massive data. Moreover, there is a semantic gap between log behaviors and employees' actual behaviors. How to combine log information to perform instance characterization of employees' behaviors to more accurately describe their behavior patterns still requires further research. For this reason, the present invention proposes a coding method based on multi-modal feature fusion, and combines LOF (Local Outlier Factor) and SHAP value (Feature Importance) analysis algorithms for detecting abnormal behaviors within an enterprise. Through in-depth analysis and processing of log data, employee behavior characteristics are extracted from multiple perspectives, and abnormal employees are located based on the local density clustering model, and then the feature importance analysis method is used to analyze and explain the reasons for the anomalies. The overall architecture of the present invention is as shown in Figure 1 shown, and mainly includes three major steps: data formatting, multi-modal feature extraction and fusion, and anomaly detection and analysis. Among them, data formatting aims to preprocess the unstructured behavior data of employees in enterprise data through formatting tools or algorithms, and convert it into a structured data format suitable for subsequent analysis for downstream tasks; multi-modal feature extraction and fusion extracts behavior characteristics from employees' behavior data and describes individual behavior patterns in the form of vectors; finally, anomaly detection and analysis uses models and algorithms to deeply analyze the behavior vectors to achieve the detection and cause analysis of abnormal behaviors. Therefore, this embodiment provides an abnormal behavior detection method based on multi-modal fusion and interpretability analysis, including the following steps:

[0072] Step 1, data formatting: Preprocess the unstructured behavior data of employees in enterprise data over a period of time through formatting tools or algorithms, and convert it into structured employee behavior data.

[0073] Employees' behavior patterns are complex and variable, as they show significant personalized characteristics at the individual level. However, due to the fact that the internal work processes of enterprises usually have periodicity and stages, employees' behaviors show consistency and similarity at the macro level, while showing unique behavior characteristics at the micro level due to individual differences. To process these complex behavior data, preprocessing operations are first required, such as Figure 2As shown, the unstructured data of enterprise data within a period of time is formatted through algorithms such as Drain algorithm, UVviewsoft tool, or Logviewer tool to generate structured behavior data that can be effectively utilized and saved.

[0074] Step 2: Multi-modal feature extraction and fusion (as Figure 3 shown):

[0075] 2.1. Classify the structured employee behavior data by day and serialize it according to the temporal relationship to obtain the daily employee behavior sequence;

[0076] 2.2. Use the LSTM model to extract daily employee behavior features from the daily employee behavior sequence.

[0077] Specifically, the employee behavior data contains rich behavior pattern information, especially in the behavior data arranged in chronological order. To more accurately capture the time logic of behaviors, the present invention classifies the structured employee behavior data by day and serializes it according to the temporal relationship, so that each behavior sequence completely describes the behavior details of an employee in a day. Since the behaviors of employees within an enterprise have typical time nodes, such as going to work (logging in and connecting to the main device) and getting off work (logging out and disconnecting from the main device), during the sequence construction process, the going-to-work and getting-off-work behaviors of employees are specially processed at the beginning and end, making them the starting time node and ending time node of the employee behavior sequence, where the main device refers to the device that the employee most frequently uses or is defaultly connected to. Thus, the construction of the daily employee behavior sequence lays a good data foundation for subsequent model training.

[0078] Then, the present invention uses the Long Short-Term Memory (LSTM) model to extract daily employee behavior features from the daily employee behavior sequence. The LSTM model has significant advantages in processing long-sequence-dependent data and is particularly suitable for learning the long-term dependence relationships in the daily employee behavior sequence. Through its memory cells and gating mechanisms, LSTM can effectively capture and store the behavior patterns and change trends of employees within a specific time span, thus showing superior learning ability in dealing with the complex features of employee behaviors and the correlations of different time sequences. Through the training of the LSTM model, the key features in the daily behaviors of employees can be extracted, providing accurate and highly discriminative behavior feature representations for subsequent anomaly detection.

[0079] 2.3. Construct a daily interaction graph based on the association relationship between employees and devices in the daily employee behavior sequence; in the interaction graph, each node represents a unique employee or device, and each edge represents the interaction relationship between two nodes, and the interaction information between the two nodes is recorded;

[0080] 2.4. Use the graph embedding model to extract the embedding representation of each employee node in the daily interaction graph through node embedding.

[0081] Specifically, the interaction information within the enterprise is an important part of behavior pattern analysis. The close interaction between employees and devices often implies potential risks. Internal threats are usually triggered by the behavior of individual employees and gradually spread through the interaction of multiple devices, which may ultimately lead to data leakage or asset loss. Therefore, the present invention focuses on mining the interaction behaviors among employees, between employees and devices, and between devices to identify potential abnormal activities. To achieve interaction feature extraction, the present invention constructs a daily interaction graph based on the daily employee behavior sequence and the association relationship between employees and devices; in this graph, each node represents a unique employee or device, the edge represents the interaction relationship between two nodes, and the specific information of the interaction (such as the number of interactions, the first interaction time and the latest interaction time of the day) is recorded on the edge. By generating an interaction graph for each day within the enterprise, all the interaction situations of all employees and devices can be comprehensively captured, laying a data foundation for subsequent interaction feature extraction. In terms of interaction feature extraction, the present invention adopts a graph embedding model to extract the interaction features of each employee and device through node embedding. Specifically, the graph embedding model generates the embedding representation of each employee node by aggregating the interaction information between each employee node in the daily interaction graph and its neighbor nodes within one-hop range. This adaptive aggregation mechanism can flexibly capture the local interaction structure of the node and the neighbor node information, thereby generating a high-dimensional feature representation, making the embedding of each node contain rich behavior interaction features; the finally extracted interaction features provide multi-dimensional behavior information for anomaly detection and can effectively identify potential abnormal interaction patterns across devices or employees.

[0082] 2.5. Introduce statistical analysis based on the daily employee behavior sequence and the daily interaction graph to obtain the daily employee statistic features through the word embedding model; where the statistics include the daily device access frequency, the daily device diversity index, the cumulative device usage breadth, the device average access rate, the device coverage rate, the daily device usage density, and the daily device coverage rate.

[0083] To further explore the behavior patterns of employees, based on extracting the behavior characteristics between employees and within the organization using specific employee behavior sequences and interaction graph information, the present invention particularly introduces statistical analysis to deeply explore the individual usage habits of employees. Behavior sequences and interaction information can capture the behavior patterns of employees, but cannot fully reveal the unique frequency characteristics of employees in device usage. Therefore, the present invention deeply explores the usage frequency of devices through statistical methods, thereby revealing the long-term behavior habits and usage rules of employees. Using statistics can describe the device usage characteristics of employees from a macroscopic perspective, compensating for the deficiencies in daily habits in behavior sequences and graph interactions. The calculation of statistics is both stable and reliable, and can effectively avoid abnormal fluctuations in individual behaviors, thus providing an objective assessment of overall behaviors. Statistics can extract time-accumulated information, such as frequency and coverage, which is suitable for describing the long-term usage preferences of employees and revealing potential trends and patterns existing in behavior patterns. The present invention describes the usage characteristics of employees through seven key statistics, including the daily device access frequency, daily device diversity index, cumulative device usage breadth, average device access rate, device coverage rate, daily device usage density, and daily device coverage rate, as detailed in Table 1 below.

[0084] Table 1 Explanation of Statistics

[0085]

[0086]

[0087] Subsequently, by using a word embedding model (such as Word2Vec) to vectorize the statistics, the usage frequency characteristics of employees (i.e., employee statistic characteristics) are further generated. This method can not only convert complex statistical information into vector data, but also establish the feature similarity between different employees in a multi-dimensional space, thereby providing precise feature support for subsequent behavior pattern analysis and anomaly detection.

[0088] 2.6. Concatenate the daily employee behavior characteristics, the embedding representation of each node in the daily interaction graph, and the daily employee statistic characteristics to obtain the daily multi-modal feature fusion vector.

[0089] After the extraction of employee behavior sequence features, graph structure embedding features, and statistic features, the present invention concatenates these obtained different modality vectors to achieve the deep fusion of multi-modal features. The employee behavior sequence features include the time dynamic features of employee behaviors, which can reflect the changing trends of employee behaviors over time; the graph structure embedding features capture the interaction features between employees and devices, and can effectively describe the association relationships between different nodes (i.e., employees or devices); while the statistic features characterize the long-term usage habits and frequency features of employees from a global perspective, providing stable and cumulative information. By concatenating the above three vectors to form a multi-modal feature fusion vector, this fusion vector can not only comprehensively reflect the features of employee behaviors in the time, space, and frequency dimensions, but also enhance the complementarity of each modality feature, making the model's learning of employee behavior patterns more comprehensive and accurate. Multi-modal feature fusion can effectively improve the performance of the anomaly detection model, making it more accurate and robust in dealing with complex behavior anomalies, thereby enhancing the adaptability of the model in different scenarios. Finally, the feature vector obtained through multi-modal feature fusion will provide a rich and complete data basis for subsequent anomaly detection and analysis, and provide a more efficient detection means for identifying potential threats within the enterprise.

[0090] Step 3. Anomaly detection and analysis (as Figure 4 shown):

[0091] 3.1. Input multiple daily multi-modal fusion feature vectors within a period of time into the LOF algorithm to identify the anomaly vector set.

[0092] To effectively detect potential threat behaviors within an enterprise, based on the multi-modal feature fusion vector, this invention adopts the Local Outlier Factor (LOF) algorithm for anomaly detection. The LOF algorithm is a density-based detection method that identifies abnormal behaviors significantly deviating within a local range by comparing the local density of each data point with its neighborhood density. This characteristic makes LOF particularly suitable for analyzing the complex behavior patterns of enterprise employees because it can more accurately detect behaviors that are inconsistent or abnormal within a local range, without being affected by overall pattern fluctuations. Employees' behaviors are usually influenced by job responsibilities, personal habits, and time-space limitations. The LOF algorithm can adaptively detect based on these local features, thus effectively identifying individual abnormal behaviors at the micro level and meeting the requirements of enterprise internal threat detection. This invention inputs the multi-modal fusion feature vector into the LOF algorithm to generate an Outlier Factor for each data point. The higher the outlier factor value, the greater the degree of deviation of the behavior from its neighborhood pattern. In addition, LOF is applicable to large-scale high-dimensional data, so it can process the high-dimensional vectors generated by multi-modal feature fusion. Its local sensitivity can also discover subtle anomalies in behavior patterns, making it suitable for detecting potential abnormal behaviors and identifying possible internal risk sources. The specific steps are as follows:

[0093] 3.1.1. Consider each daily multi-modal fusion feature vector within a period of time as a data point, and calculate the k-distance neighborhood N k (p) of each data point p, that is, the set of the k nearest neighbor data points to the data point p.

[0094] 3.1.2. For each neighbor data point in the neighborhood N k (p), calculate its k-reachability distance relative to the data point p and sort them.

[0095] 3.1.3. Based on the k-reachability distances of each neighbor data point in the neighborhood N k (p), calculate the local reachability density of the data point p.

[0096] 3.1.4. Use the local reachability density of the data point p and each neighbor data point in its neighborhood to calculate the local outlier factor of the data point p; among them, the larger the LOF score, the more abnormal the data point p is; conversely, the smaller the LOF score, the more normal the data point p is.

[0097] 3.1.5. Select the n data points with the highest degree of outlier, that is, the n daily multi-modal fusion feature vectors with the largest LOF scores as abnormal vectors for output, and obtain the abnormal vector set.

[0098] The LOF algorithm mainly determines the degree of its outlier by comparing the local density of data points. The outlier factor is calculated by the following formula:

[0099] k-distance:

[0100] Let the neighborhood radius of any data point p in the dataset be r. Define the farthest distance among the k nearest neighbor points as the k-distance of data point p. All data points (except data point p) within this distance range are the k-distance neighborhood N k (p) of data point p. Then, for any data point q in the dataset, if its distance from data point p satisfies d(p, q) less than or equal to the k-distance of data point p, it is said that data point q is within the k-distance neighborhood N k (p) of data point p.

[0101] Reachability Distance:

[0102] For the reachability distance reach_dist k (p, o) between data point p and data point o (o belongs to the neighborhood N k (p)), it is expressed as: reach_dist k (p, o) = max(k_distance(o), d(p, o)), where k_distance(o) is the k-distance of data point o, and d(p, o) is the distance between data point p and data point o. Note: This value ensures that the local density calculation is not significantly affected by a single outlier.

[0103] Local Reachability Density (LRD):

[0104] The local reachability density of data point p is defined as the reciprocal of the average reachability distance from data point p to all data points in its k-distance neighborhood N k (p):

[0105]

[0106] Among them, LRD k (p) is the local reachability density of data point p.

[0107] Local Outlier Factor (LOF):

[0108] The outlier factor LOF k (p) of data point p is obtained by comparing its local reachability density with the local reachability densities of each data point within its k-distance neighborhood N k (p):

[0109]

[0110] Among them, LRD k (o) is the local reachability density of data point o. If LOF k (p) is significantly greater than 1, then data point p is an outlier relative to its k-distance neighborhood N k (p).

[0111] The present invention flexibly controls the sensitivity of anomaly detection by adjusting the neighborhood size of the LOF algorithm to meet the requirements of different security scenarios. The unique advantage of the LOF algorithm lies in its ability to identify local outliers in the dataset, which is particularly suitable for complex and non-uniformly distributed datasets. Different from traditional global outlier detection methods, the LOF algorithm measures the degree of anomaly by comparing local densities, which is very suitable for the characteristics of enterprise employee behavior data - these data often have the characteristics of multimodality, multi-dimension, and non-uniform distribution. The LOF algorithm can accurately discover the hidden outliers in these data, especially those behavior patterns that may indicate potential risks. Using the LOF algorithm can more effectively detect internal potential threats, which usually do not show obvious global anomalies but only deviate from normal behavior within a local range.

[0112] 3.2. Use the SHAP value analysis method to perform importance analysis on each daily multimodal fusion feature vector in the anomaly vector set and output the anomaly reasons.

[0113] During the anomaly detection process, after identifying the anomaly vector set through the local outlier factor (LOF) algorithm, further feature analysis is required to explore the reasons for its generation. The present invention uses the SHAP (SHapley Additive exPlanations) value analysis method to perform importance analysis on the feature vectors in the anomaly vector set and uses the SHAP value to explain the prediction results of each anomaly vector, quantifying the contribution degree of different features to the model output. Specifically:

[0114] First, calculate the SHAP value of each multimodal fusion vector feature in the anomaly vector set;

[0115] Next, for each daily multimodal fusion feature vector in the anomaly vector set, call the machine learning model to predict the contribution of each feature of each daily multimodal fusion feature vector. Through the SHAP value decomposition model, the SHAP value is assigned to each feature of each daily multimodal fusion feature vector to obtain the feature SHAP value and sort them; the SHAP value decomposition model distributes the overall result to each feature, thereby determining the importance of each feature to the abnormal daily multimodal fusion feature vector (abnormal behavior).

[0116] Finally, identify the feature with the greatest contribution in each daily multi-modal fusion feature vector, that is, the feature with the largest SHAP value, screen out the key features of the abnormal vector, and perform background semantic detection to output the main reasons for the abnormality of the daily multi-modal fusion feature vector.

[0117] Furthermore, the SHAP value provides a quantitative measure of the contribution of each feature in the daily multi-modal fusion feature vector to the output of the machine learning model through the Shapley value principle in game theory, thus effectively revealing the key features leading to the abnormality. The SHAP value aims to explain the impact of each feature in the daily multi-modal fusion feature vector on a specific prediction result, and its calculation is based on the following assumption: the output of a machine learning model can be regarded as the sum of the independent contributions of each feature in the daily multi-modal fusion feature vector.

[0118] Assume that the predicted output of the machine learning model is f(x), where i is a certain feature in the daily multi-modal fusion feature vector, then the SHAP value of the feature is defined as:

[0119]

[0120] where, is the SHAP value of the i-th feature in the daily multi-modal fusion feature vector, N is the daily multi-modal fusion feature vector, |N| is the number of features in the daily multi-modal fusion feature vector, S is a subset of the daily multi-modal fusion feature vector, |S| is the number of features in S,! is the factorial, f(S) is the predicted value of the machine learning model for S, (f(S∪i)-f(S)) is the marginal contribution of the i-th feature in the daily multi-modal fusion feature vector to S, and N\{i} is all possible feature subsets in the daily multi-modal fusion feature vector N except the i-th feature. means that the contributions of all possible feature subsets need to be summed up. represents the weight coefficient of this feature subset, that is, considering the influence of different permutations of feature combinations on the result. In this embodiment, the machine learning model is a prediction model of any machine learning, which can be arbitrarily selected according to the scenario. The simplest linear regression or a complex xgboost ensemble model, etc. can be selected. Its purpose is to predict the contribution of each feature and achieve model interpretation.

[0121] By calculating the marginal contribution of the i-th feature in the daily multi-modal fusion feature vector among all possible feature combinations using SHAP values, the interaction between features can be comprehensively considered, providing a comprehensive basis for identifying the key features leading to anomalies. In the present invention, an analysis method based on SHAP values is used to analyze the feature importance of the abnormal vectors detected by the LOF algorithm. The process includes the extraction of abnormal vectors, the calculation of SHAP values, the evaluation of feature contributions, and the identification of the causes of anomalies. First, the vector data marked as abnormal is extracted from the LOF output, and the contribution degree of each feature in the vector is accurately calculated through the SHAP algorithm. This analysis not only reveals the influence of features on anomaly determination but also identifies the key features that promote or inhibit anomaly determination by analyzing the magnitude of SHAP values, helping to explain the features leading to anomalies. Through the SHAP value analysis method, security analysts can intuitively understand the mutual relationship and influence among features, providing more insightful basis for enterprise security management. This method not only has fairness and consistency but also effectively identifies and understands the sources of internal threats through the clear measurement of feature contribution degrees, thereby enhancing the detection and response capabilities for potential risks and providing precise support for the overall security of the enterprise.

[0122] In summary, to address the limitations of existing detection methods, the present invention proposes an abnormal behavior detection method based on multi-modal fusion and interpretability analysis. This method converts employee behavior instances into sequence data, combines behavioral context and semantic information to learn the daily behavior patterns of employees, and improves the accuracy of time nodes through empirical analysis. At the same time, it uses graph structures to integrate interaction information and connectivity features, enhancing the understanding of the relationship structures between users and devices and among users. Then, scientific statistical frequency analysis is introduced to further supplement the deep-level features of users' device usage. Finally, by integrating behavioral data from different dimensions, a multi-angle and multi-level feature representation is constructed to more comprehensively capture behavioral diversity, thus overcoming the limitations of high-complexity behavioral dimension analysis and enhancing the perception and representation of complex user behaviors. During the anomaly detection process, the behavior vectors are analyzed using the LOF (Local Outlier Factor) method based on local density, the local density differences of each vector are calculated, the overall abnormal vectors are identified, and the dominator of the abnormal behavior, that is, the abnormal employee, is determined. Subsequently, SHAP values are introduced to evaluate the importance of each feature dimension, accurately locating the specific features leading to anomalies. In this way, hidden abnormal behaviors can be identified among similar groups, the key features of anomalies can be accurately located, abnormal and normal behaviors can be effectively distinguished, the causes of abnormal behaviors can be traced, and the interpretability of anomaly detection results can be enhanced.

[0123] It should be noted that for the foregoing method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the present invention is not limited by the described action sequence because according to the present invention, certain steps can be performed in other sequences or simultaneously.

[0124] Based on the same idea as the abnormal behavior detection method based on multi-modal fusion and interpretability analysis in the above embodiments, the present invention also provides an abnormal behavior detection system based on multi-modal fusion and interpretability analysis, which can be used to execute the above abnormal behavior detection method based on multi-modal fusion and interpretability analysis. For the convenience of description, in the structural schematic diagram of the embodiment of the abnormal behavior detection system based on multi-modal fusion and interpretability analysis, only the parts related to the embodiment of the present invention are shown. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and it may include more or fewer components than those illustrated, or combine certain components, or have different component arrangements.

[0125] As Figure 5 shown, another embodiment of the present invention provides an abnormal behavior detection system based on multi-modal fusion and interpretability analysis, including a data formatting module, a sequence construction module, a feature extraction module, an interaction graph construction module, a node representation module, a statistic analysis module, a feature fusion module, an anomaly recognition module, and an anomaly analysis module;

[0126] Among them, the data formatting module is used to preprocess the unstructured behavior data of employees in enterprise data within a period of time through formatting tools or algorithms and convert it into structured employee behavior data;

[0127] The sequence construction module is used to classify the structured employee behavior data by day and serialize it according to the time sequence relationship to obtain the daily employee behavior sequence;

[0128] The feature extraction module is used to extract daily employee behavior features from the daily employee behavior sequence by using the LSTM model;

[0129] The interaction graph construction module is used to construct a daily interaction graph based on the association relationship between employees and devices according to the daily employee behavior sequence; each node in the interaction graph represents a unique employee or device, and each edge represents the interaction relationship between two nodes, and the interaction information between the two nodes is recorded;

[0130] The node representation module is used to extract the embedding representation of each employee node in the daily interaction graph by using a graph embedding model through node embedding;

[0131] The statistic analysis module is used to introduce statistic analysis based on the daily employee behavior sequence and the daily interaction graph to obtain daily employee statistic features through a word embedding model; the statistics include daily device access frequency, daily device diversity index, cumulative device usage breadth, device average access rate, device coverage rate, daily device usage density, and daily device coverage rate;

[0132] The feature fusion module is used to concatenate the daily employee behavior features, the embedded representation of each employee node in the daily interaction graph, and the daily employee statistical features to obtain a daily multimodal feature fusion vector;

[0133] The anomaly identification module is used to input the multimodal fusion feature vectors of multiple days within a period of time into the LOF algorithm to identify the anomaly vector set;

[0134] The anomaly analysis module is used to use the SHAP value analysis method to perform importance analysis on each daily multimodal fusion feature vector in the anomaly vector set and output the cause of the anomaly.

[0135] It should be noted that the abnormal behavior detection system based on multimodal fusion and explainable analysis of the present invention corresponds one to one with the abnormal behavior detection method based on multimodal fusion and explainable analysis of the present invention. The technical features and beneficial effects described in the above-mentioned embodiment of the abnormal behavior detection method based on multimodal fusion and explainable analysis are applicable to the embodiment of the abnormal behavior detection system based on multimodal fusion and explainable analysis. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. This is hereby declared.

[0136] In addition, in the implementation of the abnormal behavior detection system based on multimodal fusion and explainability analysis in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the convenience of corresponding hardware configuration requirements or software implementation. That is, the internal structure of the abnormal behavior detection system based on multimodal fusion and explainability analysis is divided into different program modules to complete all or part of the functions described above.

[0137] like Figure 6 As shown, in one embodiment, a computer-readable storage medium is provided, in which a program is stored in a memory. When the program is executed by a processor, an abnormal behavior detection method based on multimodal fusion and interpretability analysis is implemented, specifically:

[0138] Step 1: Data formatting:

[0139] The unstructured employee behavior data of enterprise data over a period of time is preprocessed through formatting tools or algorithms and converted into structured employee behavior data.

[0140] Step 2: Multimodal feature extraction and fusion:

[0141] The structured employee behavior data is classified by day, and serialized according to the time series relationship to obtain the daily employee behavior sequence;

[0142] Use the LSTM model to extract daily employee behavior features from daily employee behavior sequences;

[0143] Construct a daily interaction graph based on the daily employee behavior sequence and the association relationship between employees and devices; among them, each node in the interaction graph represents a unique employee or device, and each edge represents the interaction relationship between two nodes, and the interaction information between the two nodes is recorded;

[0144] Use a graph embedding model to extract the embedding representation of each employee node in the daily interaction graph through node embedding;

[0145] Based on the daily employee behavior sequence and the daily interaction graph, introduce statistical analysis to obtain the daily employee statistic features through a word embedding model; among them, the statistics include the daily device access frequency, the daily device diversity index, the cumulative device usage breadth, the device average access rate, the device coverage rate, the daily device usage density, and the daily device coverage rate;

[0146] Concatenate the daily employee behavior features, the embedding representation of each employee node in the daily interaction graph, and the daily employee statistic features to obtain a daily multi-modal feature fusion vector.

[0147] Step 3. Anomaly detection and analysis:

[0148] Input multiple daily multi-modal fusion feature vectors within a period of time into the LOF algorithm to identify the abnormal vector set;

[0149] Use the SHAP value analysis method to perform importance analysis on each daily multi-modal fusion feature vector in the abnormal vector set and output the reasons for the anomalies.

[0150] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided in this application can include non-volatile and / or volatile memories. Non-volatile memories can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memories can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0151] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this specification.

[0152] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications made without departing from the spirit and principle of the present invention shall be equivalent replacement methods and are all included in the protection scope of the present invention.

Claims

1. An abnormal behavior detection method based on multimodal fusion and explainability analysis, characterized in that: The steps include: Step 1: Data formatting: Pre-process the unstructured employee behavior data of enterprise data over a period of time through formatting tools or algorithms and convert them into structured employee behavior data; Step 2: Multimodal feature extraction and fusion: The structured employee behavior data is classified by day, and serialized according to the time series relationship to obtain the daily employee behavior sequence; Use the LSTM model to extract daily employee behavior features from daily employee behavior sequences; A daily interaction graph is constructed based on the association between employees and devices according to the daily employee behavior sequence; each node in the interaction graph represents a unique employee or device, and each edge represents the interaction relationship between two nodes, and each edge records the interaction information between the two nodes; The graph embedding model is used to extract the embedding representation of each employee node in the daily interaction graph through node embedding; Based on the daily employee behavior sequence and daily interaction graph, statistical analysis is introduced to obtain daily employee statistical features through a word embedding model; the statistics include daily device access frequency, daily device diversity index, cumulative device usage breadth, average device access rate, device coverage rate, daily average device usage density, and daily average device coverage rate; The daily employee behavior features, the embedded representation of each employee node in the daily interaction graph, and the daily employee statistical features are concatenated to obtain the daily multimodal feature fusion vector; Step 3: Anomaly detection and analysis: Input the multimodal fusion feature vectors of multiple days within a period of time into the LOF algorithm to identify the abnormal vector set; The SHAP value analysis method is used to perform importance analysis on each daily multimodal fusion feature vector in the abnormal vector set and output the abnormal cause.

2. The abnormal behavior detection method according to claim 1, characterized in that: The formatting tools include UVviewsoft tool and Logviewer tool; the formatting algorithm includes Drain algorithm.

3. The abnormal behavior detection method according to claim 1, characterized in that: The starting time node and the ending time node of the daily employee behavior sequence are working day and leaving get off work respectively; working day refers to the time when the employee logs in and connects to the main device; leaving get off work refers to the time when the employee logs out and disconnects from the main device; the main device refers to the device most frequently used by the employee or connected by default.

4. The abnormal behavior detection method according to claim 1, characterized in that: The graph embedding model generates an embedding representation of each employee node by aggregating the interaction information between each employee node and each neighboring node within one hop in the daily interaction graph.

5. The abnormal behavior detection method according to claim 1, characterized in that: The daily device access frequency refers to the total number of times an employee uses a device every day, and is used to measure the employee's daily reliance on the device; The daily device diversity index refers to the number of different devices used by employees every day, which is used to reflect the diversity of devices used by employees every day; The cumulative device usage breadth refers to the cumulative number of different devices used by employees within a period of time, which is used to describe the cumulative use of devices by employees; The average device access rate refers to the average number of times an employee uses a device within a period of time. It is calculated by dividing the total number of times an employee uses a device within a period of time by the cumulative breadth of device use. It is used to describe the busyness of employees in using devices. The equipment coverage rate refers to the proportion of the cumulative number of devices used by employees in a period of time to the total number of devices in the enterprise. The calculation method is: the cumulative number of devices used by employees in a period of time divided by the total number of devices. It is used to describe the diversity of equipment put into use by the enterprise; The average daily device usage density refers to the average number of times an employee uses a device every day. It is calculated by dividing the daily device access frequency by the daily device diversity index, which is used to describe how busy employees are in using their devices every day. The daily average device coverage rate refers to the ratio of the number of devices used by employees every day to the total number of devices in the enterprise. It is calculated as follows: the daily device diversity index divided by the total number of devices. It is used to describe the device coverage of employees in their daily work.

6. The abnormal behavior detection method according to claim 1, characterized in that: The identification abnormality vector set is specifically: Consider each daily multimodal fusion feature vector in a period of time as a data point and calculate the kth distance neighborhood N of each data point p k (p), that is, the set of k neighbor data points closest to data point p; For field N k For each neighbor data point in (p), calculate its kth reachable distance relative to data point p and sort them; Based on domain N k The kth reachable distance of each neighbor data point in (p) is used to calculate the local reachable density of data point p; The local outlier factor of the data point p is calculated using the local reachable density of the data point p and each neighboring data point in its domain; the larger the LOF score, the more abnormal the data point p is; conversely, the smaller the LOF score, the more normal the data point p is; The n data points with the highest degree of outliers, that is, the n daily multimodal fusion feature vectors with the largest LOF scores are selected as the anomaly vectors for output to obtain the anomaly vector set.

7. The abnormal behavior detection method according to claim 1, characterized in that: The SHAP value analysis method is used to perform importance analysis on each daily multimodal fusion feature vector in the abnormal vector set to output the abnormal cause, specifically: Calculate the SHAP value of each day's multimodal fusion feature vector in the anomaly vector set; For each daily multimodal fusion feature vector in the anomaly vector set, the machine learning model is called to predict the contribution of each feature of each daily multimodal fusion feature vector. The SHAP value decomposition model is used to assign the SHAP value to each feature of each daily multimodal fusion feature vector, and the feature SHAP values ​​are obtained and sorted. Identify the feature with the largest contribution in each day's multimodal fusion feature vector, that is, the feature with the largest feature SHAP value, perform background semantic detection and output.

8. The abnormal behavior detection method according to claim 7, characterized in that: The calculation formula of the characteristic SHAP value is: in, is the SHAP value of the i-th feature in the daily multimodal fusion feature vector, N is the daily multimodal fusion feature vector, |N| is the number of features in the daily multimodal fusion feature vector, S is a subset of the daily multimodal fusion feature vector, |S| is the number of features in S, ! is the factorial, f(S) is the predicted value of S by the machine learning model, (f(S∪i)-f(S)) is the marginal contribution of the i-th feature in the daily multimodal fusion feature vector to S, and N\{i} is all possible feature subsets in the daily multimodal fusion feature vector N except the i-th feature.

9. An abnormal behavior detection system based on multimodal fusion and explainability analysis, applied to the abnormal behavior detection method according to any one of claims 1 to 8, characterized in that: The system includes a data formatting module, a sequence construction module, a feature extraction module, an interaction graph construction module, a node representation module, a statistics analysis module, a feature fusion module, an anomaly identification module and an anomaly analysis module; The data formatting module is used to pre-process the unstructured employee behavior data of enterprise data within a period of time through a formatting tool or algorithm to convert it into structured employee behavior data; The sequence construction module is used to classify the structured employee behavior data by day, and to construct a daily employee behavior sequence by serialization according to the time series relationship; The feature extraction module is used to extract daily employee behavior features from daily employee behavior sequences using an LSTM model; The interaction graph construction module is used to construct a daily interaction graph based on the association between employees and equipment according to the daily employee behavior sequence; each node in the interaction graph represents a unique employee or equipment, and each edge represents the interaction relationship between two nodes, and both record the interaction information between the two nodes; The node representation module is used to extract the embedding representation of each employee node in the daily interaction graph by node embedding using a graph embedding model; The statistical analysis module is used to introduce statistical analysis based on daily employee behavior sequences and daily interaction graphs to obtain daily employee statistical features through a word embedding model; the statistics include daily device access frequency, daily device diversity index, cumulative device usage breadth, average device access rate, device coverage rate, average daily device usage density, and average daily device coverage rate; The feature fusion module is used to concatenate the daily employee behavior features, the embedded representation of each employee node in the daily interaction graph, and the daily employee statistical features to obtain a daily multimodal feature fusion vector; The anomaly identification module is used to input the multimodal fusion feature vectors of multiple days within a period of time into the LOF algorithm to identify the anomaly vector set; The anomaly analysis module is used to use the SHAP value analysis method to perform importance analysis on each daily multimodal fusion feature vector in the anomaly vector set and output the anomaly cause.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the abnormal behavior detection method described in any one of claims 1 to 8 is implemented.

Images