Computer user information security intelligent management method and system

Abstract

The invention relates to the technical field of information security, in particular to a computer user information security intelligent management method and system.The computer user information security intelligent management method comprises the steps that S1, lightweight collectors are locally deployed at multiple endpoints and used for collecting behavior factors under the condition that identity information is not collected, and factor abstracts are generated after processing; s2, based on a federated graph neural network framework, a graph structure is locally established for the factor abstract through each terminal node, when the method is used, the adopted lightweight collector is suitable for different terminal platforms, the requirements for equipment calculation and storage resources are low, the effects of being compatible with multi-terminal deployment and low in deployment overhead are achieved, and the method is suitable for large-scale popularization and application. According to the method, the behavior association relationship of the user can be conveniently obtained in a cross-device and environment condition without invading the privacy of the user, hidden anomalies such as behavior fraud in device jump and robot camouflage operation can be automatically found by utilizing node embedding change and structural reasoning, and the method is beneficial to being different from a traditional static rule and improving the accuracy of behavior mutation recognition.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a computer user information security intelligent management method and system. Background Art

[0002] Intelligent management of computer user information security refers to the use of advanced information technology means, including artificial intelligence (AI), machine learning, big data analysis, etc., to protect the personal information security of computer users and prevent data leakage, abuse or illegal access.

[0003] The patent publication number is CN118228229A, and the description states that "the present invention relates to a computer user information security intelligent management method and system, the method comprising: verifying according to the login request information, granting the user login authority if the verification is passed, and allowing the user to access the corresponding information data; predicting the predicted login time of each user in each unit time period based on the time prediction model; during the user login process, judging whether to trigger the confidentiality instruction based on the distance information between the associated device and the login device; when the confidentiality instruction is triggered, judging whether to start the forced exit instruction based on the predicted login time and the actual login time, and when the forced exit instruction is not started, determining the information data encryption level based on the distance information between the associated device and the login device. The present invention has This effectively prevents the information and data logged into the system from being stolen by others when the user is not at their workstation, effectively avoiding information leakage." Although the above technology reconstructs the terminal security protection paradigm through the dual dimensions of spatial location perception and temporal behavior prediction, solving the risk of misuse of traditional static password authentication, while avoiding the security risks during the window period caused by users forgetting to log out, it has the advantage of being more accurate than traditional fixed timeout strategies. However, computer users are not active on only one device and in one environment. This makes it impossible for existing technologies to directly obtain user behavior associations across devices and environments without infringing on user privacy. At the same time, existing technologies often use preset fixed strategies to detect anomalies in user behavior, which leads to high false alarm rates, rigid strategies, and the inability to identify complex attack chains.

[0004] In summary, developing a computer user information security intelligent management method and system is still a key issue that needs to be solved urgently in the field of information security technology. Summary of the Invention

[0005] The purpose of the present invention is to solve the problem in the prior art that computer users are not active in only one device and one environment, which makes it impossible for the prior art to directly obtain the user's behavior association relationship across devices and environments without infringing the user's privacy. At the same time, the prior art often uses preset fixed strategies to detect anomalies in user behavior, which leads to a high false alarm rate, rigid strategies, and an inability to identify complex attack chains. The present invention provides a computer user information security intelligent management method and system.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] The present invention provides a computer user information security intelligent management method, comprising:

[0008] S1. Lightweight collectors are deployed locally on multiple endpoints to collect behavioral factors without collecting identity information, and generate factor summaries after processing;

[0009] S2. Based on the federated graph neural network framework, each terminal node locally establishes a graph structure for the factor summary, and aggregates the intermediate graph vector weights received by the central node;

[0010] S3. The central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph and automatically identifies causal mutation points based on the intermediate graph vector weights;

[0011] S4. Calculate a risk score based on the causal mutation point, and generate a dynamic security response strategy based on the integrity of the behavior chain, time continuity, and device trust.

[0012] Furthermore, in step S1, multiple endpoints locally deploy lightweight collectors for collecting behavioral factors without collecting identity information. The method for generating factor summaries after processing is as follows:

[0013] The lightweight collector is locally deployed on multiple endpoints of PC, mobile device, and browser extension within the scope of user authorization. The behavioral factors include but are not limited to login time, operation frequency, file type, and network IP mode. The lightweight collector locally executes the behavioral modeling function to perform sliding window feature extraction on the original behavioral factor data, and combines the feature vectors of the behavioral factors. where v (i) represents the behavioral feature vector of the i-th user, represents the mean of the behavior occurrence time in the time series α of the i-th user, represents the standard deviation of the behavior time in the time series α of the i-th user, H (i) The entropy value represents the uncertainty of the behavior of the i-th user, D (i)represents the switching intensity of the i-th user between different devices, ... represents other supplementary behavioral factors, and chaos mapping + local perturbation mechanism is applied for compression and encryption to generate a factor summary after processing.

[0014] Furthermore, in step S2, based on the federated graph neural network framework, a graph structure is established locally for the factor summary through each terminal node, and the intermediate graph vector weights received by the central node are aggregated as follows:

[0015] The factor summary establishes a graph structure as follows:

[0016]

[0017] In the formula, the node set The feature vectors representing the behavioral factors of different categories, the edge set ε i Reflecting the dependency between features, the edge weight is calculated by joint mutual information, expression:

[0018]

[0019] Where, represents the edge weight between node j and node k in the i-th terminal, Representation node With node The mutual information, Σ x，y It represents the sum of all possible eigenvalue combinations (x, y), p jk (x, y) represents a node and The joint probability distribution of x and y, p j (x) represents a node The marginal probability of taking a single value of x, p k (y) represents the node The marginal probability of taking a single value of y is, The logarithm of the ratio of the joint probability to the marginal probability reflects the degree of dependence between the two, and trains the local user behavior graph embedding representation. The graph embedding representation first performs graph embedding initialization and local graph convolution propagation. Each node initializes the feature vector and adopts the Chebyshev polynomial spectral graph convolution propagation mechanism. Then, the node embedding is self-supervised learning using the variational graph autoencoder locally to generate node potential representation, and then a federal graph embedding update mechanism is established. Each terminal node only uploads a summary of the local graph embedding model weights, performs federal aggregation through the central node, and also transmits it back to all terminals through the central node, performs graph alignment mapping, unifies the graph embedding dimension, and optimizes the global consistency loss. Each terminal node receives the aggregated model parameters and mapping function, and fine-tunes the federal graph neural network.

[0020] Furthermore, in step S3, the central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph, and the method for automatically identifying causal mutation points based on the intermediate graph vector weights is:

[0021] The cross-platform user behavior causal chain graph constructs a time causal chain graph structure for all event nodes in the behavior graph according to event timestamps and operation sequences. The expression is:

[0022]

[0023] Where, Represents a global causal chain graph across platforms, Represents the set of all nodes in the cross-platform global causal chain graph, ε c Represents the set of all edges in the global cross-platform causal chain graph, Represents the node set of all i-th terminal nodes in the local graph Merge together to form the overall node set ∪ i ε i Represents the edge set ε of all local graphs merged i , ε cross Represents a set of cross-platform connection edges. The central node applies a graph attention neural network to the causal chain graph to model the causal influence strength between nodes. The expression is:

[0024]

[0025] Where, represents the embedding representation of node j in the l+1 layer, σ represents the nonlinear activation function, Represents the set of neighbor nodes for node j Sum each neighbor node k in, represents the attention weight of node j to its neighbor node k in the lth layer, W (l) represents the learnable linear transformation weight matrix of layer l, represents the embedding representation of node k in layer l, exp(·) represents the exponential function, LeakyReLU(·) represents the ReLU activation function with leakage, represents the transpose of the learnable attention weight vector, [Wh j ‖Wh k ] means concatenating the linearly transformed feature vectors of nodes j and k. Indicates that the attention score of all neighbor nodes k′ of node j is calculated, and after reasoning, the behavior pattern of each node is embedded in h j Used to analyze the causal tension of user behavior.

[0026] Furthermore, in step S3, the central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph, and the method for automatically identifying causal mutation points based on the intermediate graph vector weights is:

[0027] The automatic identification of causal mutation points includes but is not limited to device switching within a short period of time, drastic changes in behavior patterns, and causal chain breaks. The short-term device switching is defined as the short-term behavior transmission between different end devices, and the inferred edge satisfies the following formula:

[0028] Δt jk =|t j -t k |<δ, and device(ν j )≠device(ν k ),

[0029] Where Δt jk Represents node ν j With node ν k The time difference between corresponding events, δ is the pre-set time threshold, t j , t k Represents the behavior node ν j and ν k timestamp, device(ν j ) represents node ν j The corresponding device identifier, device(ν k ) represents node ν k The corresponding device identifier, device(ν j )≠device(ν k ) indicates that the two behavior nodes come from different devices, the edge is determined to be a mutation edge, and the node is marked as a switching mutation point. The behavior pattern changes drastically. Based on the node behavior pattern embedding, the behavior tension increases suddenly in a short time window. The expression is:

[0030]

[0031] Where, represents the behavioral pattern embedding vector of the jth node in the user behavior graph at time t, represents the behavioral pattern embedding vector of the same node j at time t+Δt, represents the binary norm of the vector, ‖·‖2 represents the degree of change in the behavioral embedding of node j within a short time interval Δt, and γ represents the preset behavioral drastic change threshold. If the causal chain is broken, then the behavioral pattern embedding of one of the nodes has no clear leading behavior, and the event node is marked as a causal breakpoint.

[0032] Furthermore, in step S4, the risk score is calculated based on the causal mutation point, and a dynamic security response strategy is generated according to the integrity of the behavior chain, time continuity and device trustworthiness.

[0033] The risk score is calculated based on the causal mutation point. The central node receives all detected causal mutation points, combines the integrity of the behavior chain, time continuity and device trust, calculates a comprehensive risk score for each user's current behavior path, and uses a weighted normalization function to synthesize the final risk score. The expression is:

[0034] R u =1-(ω1C u +ω2T u +ω3S u ), where ω1+ω2+ω3=1

[0035] Where R u represents the risk score of user u, ω1 represents the weight coefficient of the integrity score, ω2 represents the weight coefficient of the time continuity score, ω3 represents the weight coefficient of the device trust score, ω1+ω2+ω3=1 means that the sum of the weight coefficients is 1, which means weighted average, C u represents the integrity score of the user behavior chain, T u represents the temporal continuity score of user behavior, S u Indicates the trust score of the device used by the user, based on the user risk score R u The dynamic security response strategy is generated by combining the mutation type, device characteristics and behavioral context. The dynamic security response strategy includes but is not limited to normal behavior chains that do not require additional authentication, weak trust switching that triggers an SMS verification code, and suspicious causal paths that initiate human-machine identification.

[0036] Furthermore, in step S4, the risk score is calculated based on the causal mutation point, and a dynamic security response strategy is generated according to the integrity of the behavior chain, time continuity and device trustworthiness.

[0037] After the user completes the authentication of the dynamic security response strategy, the central node performs a label update operation and a federated graph neural network update based on the user authentication feedback result. The label update operation marks the current behavior chain path as either a safe or risky sample for subsequent federated training supervision signals. The federated graph neural network update transmits the user authentication feedback result as a reinforcement signal back to the local node and updates the federated graph neural network model parameters θ i , the central node is aggregated based on the federated averaging mechanism, expression:

[0038]

[0039] Where θ g+1 represents the global model parameters of the g+1th round, E represents the total number of terminal nodes participating in federated learning, i represents the number of the i-th terminal node, represents the parameters of the local model of the i-th terminal node after the g-th round of training, e i represents the number of local training data samples held by the i-th terminal node, e represents the sum of the total number of samples of all terminal nodes, Represents the weight of the i-th node in the total sample, and then the new model parameter θ g+1 Pushed synchronously to each of the terminal nodes.

[0040] On the other hand, the present invention also provides a computer user information security intelligent management system, comprising:

[0041] Behavioral factor collection module: lightweight collectors are deployed locally on multiple endpoints to collect behavioral factors without collecting identity information, and generate factor summaries after processing;

[0042] The graph structure module, based on the federated graph neural network framework, establishes a graph structure for the factor summary locally through each terminal node and aggregates the intermediate graph vector weights received by the central node;

[0043] Behavior causal chain graph module, the central node uses the graph neural reasoning algorithm to build a cross-platform user behavior causal chain graph, and automatically identifies causal mutation points based on the intermediate graph vector weights;

[0044] The risk scoring module calculates the risk score based on the causal mutation point and generates a dynamic security response strategy based on the integrity of the behavior chain, time continuity and device trust.

[0045] The lightweight collector is locally deployed on multiple endpoints of PC, mobile device, and browser extension within the scope of user authorization. The behavioral factors include but are not limited to login time, operation frequency, file type, and network IP mode. The lightweight collector locally executes the behavioral modeling function to perform sliding window feature extraction on the original behavioral factor data, and combines the feature vectors of the behavioral factors. where v (i) represents the behavioral feature vector of the i-th user, represents the mean of the behavior occurrence time in the time series α of the i-th user, represents the standard deviation of the behavior time in the time series α of the i-th user, H (i) The entropy value represents the uncertainty of the behavior of the i-th user, D (i) represents the switching intensity of the i-th user between different devices, ... represents other supplementary behavioral factors, and chaos mapping + local perturbation mechanism is applied for compression and encryption to generate a factor summary after processing.

[0046] The operation process of the graph structure module includes:

[0047] The factor summary establishes a graph structure as follows:

[0048]

[0049] In the formula, the node set The feature vectors representing the behavioral factors of different categories, the edge set ε i Reflecting the dependency between features, the edge weight is calculated by joint mutual information, expression:

[0050]

[0051] Where, represents the edge weight between node j and node k in the i-th terminal, Representation node With node The mutual information, Σ x，y It represents the sum of all possible eigenvalue combinations (x, y), p jk (x, y) represents a node and The joint probability distribution of x and y, p j (x) represents a node The marginal probability of taking a single value of x, p k (y) represents the node The marginal probability of taking a single value of y is, The logarithm of the ratio of the joint probability to the marginal probability reflects the degree of dependence between the two, and trains the local user behavior graph embedding representation. The graph embedding representation first performs graph embedding initialization and local graph convolution propagation. Each node initializes the feature vector and adopts the Chebyshev polynomial spectral graph convolution propagation mechanism. Then, the node embedding is self-supervised learning using the variational graph autoencoder locally to generate node potential representation, and then a federal graph embedding update mechanism is established. Each terminal node only uploads a summary of the local graph embedding model weights, performs federal aggregation through the central node, and also transmits it back to all terminals through the central node, performs graph alignment mapping, unifies the graph embedding dimension, and optimizes the global consistency loss. Each terminal node receives the aggregated model parameters and mapping function, and fine-tunes the federal graph neural network.

[0052] The cross-platform user behavior causal chain graph constructs a time causal chain graph structure for all event nodes in the behavior graph according to event timestamps and operation sequences. The expression is:

[0053]

[0054] Where, Represents a global causal chain graph across platforms, Represents the set of all nodes in the cross-platform global causal chain graph, ε c Represents the set of all edges in the global cross-platform causal chain graph, Represents the node set of all i-th terminal nodes in the local graph Merge together to form the overall node set ∪ i ε i Represents the edge set ε of all local graphs merged i , ε cross Represents a set of cross-platform connection edges. The central node applies a graph attention neural network to the causal chain graph to model the causal influence strength between nodes. The expression is:

[0055]

[0056] Where, represents the embedding representation of node j in the l+1 layer, σ represents the nonlinear activation function, Represents the set of neighbor nodes for node j Sum each neighbor node k in, represents the attention weight of node j to its neighbor node k in the lth layer, W (l) represents the learnable linear transformation weight matrix of layer l, represents the embedding representation of node k in layer l, exp(·) represents the exponential function, LeakyReLU(·) represents the ReLU activation function with leakage, represents the transpose of the learnable attention weight vector, [Wh j ‖Wh k ] means concatenating the linearly transformed feature vectors of nodes j and k. Indicates that the attention score of all neighbor nodes k′ of node j is calculated, and after reasoning, the behavior pattern of each node is embedded in h j Used to analyze the causal tension of user behavior; the automatic identification of causal mutation points, which include but are not limited to device switching within a short period of time, drastic changes in behavior patterns, and causal chain breaks. The short-term device switching is defined as the short-term behavior transmission between different end devices, and the inferred edge satisfies the following formula:

[0057] Δt jk =|t j -t k |<δ, and device(ν j )≠device(ν k ),

[0058] Where Δt jkRepresents node ν j With node ν k The time difference between corresponding events, δ is the pre-set time threshold, t j , t k Represents the behavior node ν j and ν k timestamp, device(ν j ) represents node ν j The corresponding device identifier, device(ν k ) represents node ν k The corresponding device identifier, device(ν j )≠device(ν k ) indicates that the two behavior nodes come from different devices, the edge is determined to be a mutation edge, and the node is marked as a switching mutation point. The behavior pattern changes drastically. Based on the node behavior pattern embedding, the behavior tension increases suddenly in a short time window. The expression is:

[0059]

[0060] Where, represents the behavioral pattern embedding vector of the jth node in the user behavior graph at time t, represents the behavioral pattern embedding vector of the same node j at time t+Δt, represents the binary norm of the vector, ‖·‖2 represents the degree of change in the behavioral embedding of node j within a short time interval Δt, and γ represents the preset behavioral drastic change threshold. If the causal chain is broken, then the behavioral pattern embedding of one of the nodes has no clear leading behavior, and the event node is marked as a causal breakpoint.

[0061] The operational process of the risk scoring module includes:

[0062] The risk score is calculated based on the causal mutation point. The central node receives all detected causal mutation points, combines the integrity of the behavior chain, time continuity and device trust, calculates a comprehensive risk score for each user's current behavior path, and uses a weighted normalization function to synthesize the final risk score. The expression is:

[0063] R u =1-(ω1C u +ω2T u +ω3S u ), where ω1+ω2+ω3=1

[0064] Where R urepresents the risk score of user u, ω1 represents the weight coefficient of the integrity score, ω2 represents the weight coefficient of the time continuity score, ω3 represents the weight coefficient of the device trust score, ω1+ω2+ω3=1 means that the sum of the weight coefficients is 1, which means weighted average, C u represents the integrity score of the user behavior chain, T u represents the temporal continuity score of user behavior, S u Indicates the trust score of the device used by the user, based on the user risk score R u Combined with the mutation type, device characteristics and behavior context, the dynamic security response strategy is generated. The dynamic security response strategy includes but is not limited to normal behavior chains that do not require additional authentication, weak trust switching that triggers SMS verification codes, and suspicious causal paths that start human-machine identification; after the user completes the authentication of the dynamic security response strategy, the central node performs label update operations and federated graph neural network updates based on the user authentication feedback results. The label update operation marks the current behavior chain path as any one of the safe or risk samples for subsequent federated training supervision signals. The federated graph neural network updates the user authentication feedback results as a reinforcement signal back to the local node and updates the federated graph neural network model parameters θ i , the central node is aggregated based on the federated averaging mechanism, expression:

[0065]

[0066] Where θ g+1 represents the global model parameters of the g+1th round, E represents the total number of terminal nodes participating in federated learning, i represents the number of the i-th terminal node, represents the parameters of the local model of the i-th terminal node after the g-th round of training, e i represents the number of local training data samples held by the i-th terminal node, e represents the sum of the total number of samples of all terminal nodes, Represents the weight of the i-th node in the total sample, and then the new model parameter θ g+1 Pushed synchronously to each of the terminal nodes.

[0067] Beneficial effects

[0068] Compared with the known public technology, the technical solution provided by the present invention has the following advantages:

[0069] Beneficial effects:

[0070] When the present invention is in use, the lightweight collector adopted is suitable for different terminal platforms and has low requirements for device computing and storage resources, achieving the effect of compatibility with multi-terminal deployment and low deployment overhead. It is convenient to obtain user behavior association relationships across devices and environments without infringing on user privacy, and utilizes node embedding changes and structural reasoning to automatically discover hidden anomalies, such as behavioral fraud in device jumps, robot disguised operations, etc., which is beneficial to distinguish from traditional static rules and improve the accuracy of behavioral mutation identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is a flow chart of a computer user information security intelligent management method of the present invention;

[0072] Figure 2 This is a system diagram of a computer user information security intelligent management system of the present invention. DETAILED DESCRIPTION

[0073] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0074] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or are inherent to these processes, methods, products or devices.

[0075] The present invention is described in further detail below with reference to the accompanying drawings:

[0076] Example 1:

[0077] like Figure 1 As shown, the present invention provides a computer user information security intelligent management method, comprising:

[0078] S1. Lightweight collectors are deployed locally on multiple endpoints to collect behavioral factors without collecting identity information, and generate factor summaries after processing;

[0079] Furthermore, in step S1, multiple endpoints locally deploy lightweight collectors for collecting behavioral factors without collecting identity information. The method for generating factor summaries after processing is as follows:

[0080] The lightweight collector is locally deployed on multiple endpoints of PC, mobile device, and browser extension within the scope of user authorization. The behavioral factors include but are not limited to login time, operation frequency, file type, and network IP mode. The lightweight collector locally executes the behavioral modeling function to perform sliding window feature extraction on the original behavioral factor data, and combines the feature vectors of the behavioral factors. where v (i) represents the behavioral feature vector of the i-th user, represents the mean of the behavior occurrence time in the time series α of the i-th user, represents the standard deviation of the behavior time in the time series α of the i-th user, H (i) The entropy value represents the uncertainty of the behavior of the i-th user, D (i) represents the switching intensity of the i-th user between different devices, ... represents other supplementary behavioral factors, and chaos mapping + local perturbation mechanism is applied for compression and encryption to generate a factor summary after processing.

[0081] In this embodiment, a multi-terminal user behavior factor collection and summary generation method is used. Without collecting identity information, a lightweight collector is used to perform privacy-protected behavior factor modeling on the user side, laying a data foundation for subsequent federated graph neural learning and causal analysis, facilitating compliance with data compliance and privacy computing specifications. The lightweight collector used is suitable for different terminal platforms with low requirements for device computing and storage resources, and is suitable for large-scale deployment scenarios, achieving compatibility with multi-terminal deployment and low deployment overhead.

[0082] S2. Based on the federated graph neural network framework, each terminal node locally establishes a graph structure for the factor summary, and aggregates the intermediate graph vector weights received by the central node;

[0083] Furthermore, in step S2, based on the federated graph neural network framework, a graph structure is established locally for the factor summary through each terminal node, and the intermediate graph vector weights received by the central node are aggregated as follows:

[0084] The factor summary establishes a graph structure as follows:

[0085]

[0086] In the formula, the node set The feature vectors representing the behavioral factors of different categories, the edge set ε i Reflecting the dependency between features, the edge weight is calculated by joint mutual information, expression:

[0087]

[0088] Where, represents the edge weight between node j and node k in the i-th terminal, Representation node With node The mutual information, Σ x，y It represents the sum of all possible eigenvalue combinations (x, y), p jk (x, y) represents a node and The joint probability distribution of x and y, p j (x) represents a node The marginal probability of taking a single value of x, p k (y) represents the node The marginal probability of taking a single value of y is, The logarithm of the ratio of the joint probability to the marginal probability reflects the degree of dependence between the two, and trains the local user behavior graph embedding representation. The graph embedding representation first performs graph embedding initialization and local graph convolution propagation. Each node initializes the feature vector and adopts the Chebyshev polynomial spectral graph convolution propagation mechanism. Then, the node embedding is self-supervised learning using the variational graph autoencoder locally to generate node potential representation, and then a federal graph embedding update mechanism is established. Each terminal node only uploads a summary of the local graph embedding model weights, performs federal aggregation through the central node, and also transmits it back to all terminals through the central node, performs graph alignment mapping, unifies the graph embedding dimension, and optimizes the global consistency loss. Each terminal node receives the aggregated model parameters and mapping function, and fine-tunes the federal graph neural network.

[0089] In this embodiment, this method is based on the federated graph neural network framework, and completes the behavioral graph structure modeling without the user behavior data leaving the terminal device, effectively avoiding the problem of sensitive data leakage, and facilitating compliance with the data minimization principle and data compliance requirements such as GDPR. By combining the statistical dependencies between mutual information quantification features, it can effectively capture the nonlinear relationship between complex behavioral factors, and use Chebyshev spectral convolution and variational graph autoencoder to perform deep embedding learning on the local behavior graph, thereby improving the modeling and expression capabilities of the user behavior structure and providing strong feature support for subsequent anomaly detection, risk assessment and other tasks.

[0090] S3. The central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph and automatically identifies causal mutation points based on the intermediate graph vector weights;

[0091] Furthermore, in step S3, the central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph, and the method for automatically identifying causal mutation points based on the intermediate graph vector weights is:

[0092] The cross-platform user behavior causal chain graph constructs a time causal chain graph structure for all event nodes in the behavior graph according to event timestamps and operation sequences. The expression is:

[0093]

[0094] Where, Represents a global causal chain graph across platforms, Represents the set of all nodes in the cross-platform global causal chain graph, ε c Represents the set of all edges in the global cross-platform causal chain graph, Represents the node set of all i-th terminal nodes in the local graph Merge together to form the overall node set ∪ i ε i Represents the edge set ε of all local graphs merged i , ε cross Represents a set of cross-platform connection edges. The central node applies a graph attention neural network to the causal chain graph to model the causal influence strength between nodes. The expression is:

[0095]

[0096] Where, represents the embedding representation of node j in the l+1 layer, σ represents the nonlinear activation function, Represents the set of neighbor nodes for node j Sum each neighbor node k in, represents the attention weight of node j to its neighbor node k in the lth layer, W (l) represents the learnable linear transformation weight matrix of layer l, represents the embedding representation of node k in layer l, exp(·) represents the exponential function, LeakyReLU(·) represents the ReLU activation function with leakage, represents the transpose of the learnable attention weight vector, [Wh j ‖Wh k ] means concatenating the linearly transformed feature vectors of nodes j and k. Indicates that the attention score of all neighbor nodes k′ of node j is calculated, and after reasoning, the behavior pattern of each node is embedded in h j Used to analyze the causal tension of user behavior.

[0097] Furthermore, in step S3, the central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph, and the method for automatically identifying causal mutation points based on the intermediate graph vector weights is:

[0098] The automatic identification of causal mutation points includes but is not limited to device switching within a short period of time, drastic changes in behavior patterns, and causal chain breaks. The short-term device switching is defined as the short-term behavior transmission between different end devices, and the inferred edge satisfies the following formula:

[0099] Δt jk =|t j -t k |<δ, and device(ν j )≠device(ν k ),

[0100] Where Δt jk Represents node ν j With node ν k The time difference between corresponding events, δ is the pre-set time threshold, t j , t k Represents the behavior node ν j and ν k timestamp, device(ν j ) represents node ν j The corresponding device identifier, device(ν k ) represents node ν k The corresponding device identifier, device(ν j )≠device(ν k ) indicates that the two behavior nodes come from different devices, the edge is determined to be a mutation edge, and the node is marked as a switching mutation point. The behavior pattern changes drastically. Based on the node behavior pattern embedding, the behavior tension increases suddenly in a short time window. The expression is:

[0101]

[0102] Where, represents the behavioral pattern embedding vector of the jth node in the user behavior graph at time t, represents the behavioral pattern embedding vector of the same node j at time t+Δt, represents the binary norm of the vector, ‖·‖2 represents the degree of change in the behavioral embedding of node j within a short time interval Δt, and γ represents the preset behavioral drastic change threshold. If the causal chain is broken, then the behavioral pattern embedding of one of the nodes has no clear leading behavior, and the event node is marked as a causal breakpoint.

[0103] In this embodiment, this method uses a graph neural network to uniformly model cross-platform behaviors, solving the problem of fragmented user behaviors across multiple devices and platforms and difficulty in unified modeling. It utilizes node embedding changes and structural reasoning to automatically discover hidden anomalies, such as behavioral fraud in device jumps and robot disguised operations, which is beneficial to distinguish from traditional static rules and improve the accuracy of behavioral mutation identification.

[0104] S4. Calculating a risk score based on the causal mutation point and generating a dynamic security response strategy based on the integrity of the behavior chain, time continuity, and device trustworthiness;

[0105] Furthermore, in step S4, the risk score is calculated based on the causal mutation point, and a dynamic security response strategy is generated according to the integrity of the behavior chain, time continuity and device trustworthiness.

[0106] The risk score is calculated based on the causal mutation point. The central node receives all detected causal mutation points, combines the integrity of the behavior chain, time continuity and device trust, calculates a comprehensive risk score for each user's current behavior path, and uses a weighted normalization function to synthesize the final risk score. The expression is:

[0107] R u =1-(ω1C u +ω2T u +ω3S u ), where ω1+ω2+ω3=1

[0108] Where R u represents the risk score of user u, ω1 represents the weight coefficient of the integrity score, ω2 represents the weight coefficient of the time continuity score, ω3 represents the weight coefficient of the device trust score, ω1+ω2+ω3=1 means that the sum of the weight coefficients is 1, which means weighted average, C u represents the integrity score of the user behavior chain, T u represents the temporal continuity score of user behavior, S u Indicates the trust score of the device used by the user, based on the user risk score R u The dynamic security response strategy is generated by combining the mutation type, device characteristics and behavioral context. The dynamic security response strategy includes but is not limited to normal behavior chains that do not require additional authentication, weak trust switching that triggers an SMS verification code, and suspicious causal paths that initiate human-machine identification.

[0109] Furthermore, in step S4, the risk score is calculated based on the causal mutation point, and a dynamic security response strategy is generated according to the integrity of the behavior chain, time continuity and device trustworthiness.

[0110] After the user completes the authentication of the dynamic security response strategy, the central node performs a label update operation and a federated graph neural network update based on the user authentication feedback result. The label update operation marks the current behavior chain path as either a safe or risky sample for subsequent federated training supervision signals. The federated graph neural network update transmits the user authentication feedback result as a reinforcement signal back to the local node and updates the federated graph neural network model parameters θ i , the central node is aggregated based on the federated averaging mechanism, expression:

[0111]

[0112] Where θ g+1 represents the global model parameters of the g+1th round, E represents the total number of terminal nodes participating in federated learning, i represents the number of the i-th terminal node, represents the parameters of the local model of the i-th terminal node after the g-th round of training, e i represents the number of local training data samples held by the i-th terminal node, e represents the sum of the total number of samples of all terminal nodes, Represents the weight of the i-th node in the total sample, and then the new model parameter θ g+1 Pushed synchronously to each of the terminal nodes.

[0113] In this embodiment, this method dynamically generates response strategies based on changes in user behavior, improving system security while taking into account user experience. Through causal mutation point mining and device switching identification, unified modeling of associated behavior paths between different devices is achieved, which facilitates solving the problem of heterogeneous terminal behavior islands. The model parameters are updated through user authentication feedback results, and the method has continuous learning and self-optimization capabilities, so that the system's ability to identify abnormal behavior continues to increase with usage time.

[0114] Example 2:

[0115] like Figure 2 As shown, Example 2 provides a computer user information security intelligent management system, including:

[0116] Behavioral factor collection module: lightweight collectors are deployed locally on multiple endpoints to collect behavioral factors without collecting identity information, and generate factor summaries after processing;

[0117] The graph structure module, based on the federated graph neural network framework, establishes a graph structure for the factor summary locally through each terminal node and aggregates the intermediate graph vector weights received by the central node;

[0118] Behavior causal chain graph module, the central node uses the graph neural reasoning algorithm to build a cross-platform user behavior causal chain graph, and automatically identifies causal mutation points based on the intermediate graph vector weights;

[0119] The risk scoring module calculates the risk score based on the causal mutation point and generates a dynamic security response strategy based on the integrity of the behavior chain, time continuity and device trust.

[0120] The lightweight collector is locally deployed on multiple endpoints of PC, mobile device, and browser extension within the scope of user authorization. The behavioral factors include but are not limited to login time, operation frequency, file type, and network IP mode. The lightweight collector locally executes the behavioral modeling function to perform sliding window feature extraction on the original behavioral factor data, and combines the feature vectors of the behavioral factors. where v (i) represents the behavioral feature vector of the i-th user, represents the mean of the behavior occurrence time in the time series α of the i-th user, represents the standard deviation of the behavior time in the time series α of the i-th user, H (i) The entropy value represents the uncertainty of the behavior of the i-th user, D (i) represents the switching intensity of the i-th user between different devices, ... represents other supplementary behavioral factors, and chaos mapping + local perturbation mechanism is applied for compression and encryption to generate a factor summary after processing.

[0121] The operation process of the graph structure module includes:

[0122] The factor summary establishes a graph structure as follows:

[0123]

[0124] In the formula, the node set The feature vectors representing the behavioral factors of different categories, the edge set ε i Reflecting the dependency between features, the edge weight is calculated by joint mutual information, expression:

[0125]

[0126] Where, represents the edge weight between node j and node k in the i-th terminal, Representation node With node The mutual information, Σx，y It represents the sum of all possible eigenvalue combinations (x, y), p jk (x, y) represents a node and The joint probability distribution of x and y, p j (x) represents a node The marginal probability of taking a single value of x, p k (y) represents the node The marginal probability of taking a single value of y is, The logarithm of the ratio of the joint probability to the marginal probability reflects the degree of dependence between the two, and trains the local user behavior graph embedding representation. The graph embedding representation first performs graph embedding initialization and local graph convolution propagation. Each node initializes the feature vector and adopts the Chebyshev polynomial spectral graph convolution propagation mechanism. Then, the node embedding is self-supervised learning using the variational graph autoencoder locally to generate node potential representation, and then a federal graph embedding update mechanism is established. Each terminal node only uploads a summary of the local graph embedding model weights, performs federal aggregation through the central node, and also transmits it back to all terminals through the central node, performs graph alignment mapping, unifies the graph embedding dimension, and optimizes the global consistency loss. Each terminal node receives the aggregated model parameters and mapping function, and fine-tunes the federal graph neural network.

[0127] The cross-platform user behavior causal chain graph constructs a time causal chain graph structure for all event nodes in the behavior graph according to event timestamps and operation sequences. The expression is:

[0128]

[0129] Where, Represents a global causal chain graph across platforms, Represents the set of all nodes in the cross-platform global causal chain graph, ε c Represents the set of all edges in the global cross-platform causal chain graph, Represents the node set of all i-th terminal nodes in the local graph Merge together to form the overall node set ∪ i ε i Represents the edge set ε of all local graphs merged i , ε cross Represents a set of cross-platform connection edges. The central node applies a graph attention neural network to the causal chain graph to model the causal influence strength between nodes. The expression is:

[0130]

[0131] Where, represents the embedding representation of node j in the l+1 layer, σ represents the nonlinear activation function, Represents the set of neighbor nodes for node j Sum each neighbor node k in, represents the attention weight of node j to its neighbor node k in the lth layer, W (l) represents the learnable linear transformation weight matrix of layer l, represents the embedding representation of node k in layer l, exp(·) represents the exponential function, LeakyReLU(·) represents the ReLU activation function with leakage, represents the transpose of the learnable attention weight vector, [Wh j ‖Wh k ] means concatenating the linearly transformed feature vectors of nodes j and k. Indicates that the attention score of all neighbor nodes k′ of node j is calculated, and after reasoning, the behavior pattern of each node is embedded in h j Used to analyze the causal tension of user behavior; the automatic identification of causal mutation points, which include but are not limited to device switching within a short period of time, drastic changes in behavior patterns, and causal chain breaks. The short-term device switching is defined as the short-term behavior transmission between different end devices, and the inferred edge satisfies the following formula:

[0132] Δt jk =|t j -t k |<δ, and device(ν j )≠device(ν k ),

[0133] Where Δt jk Represents node ν j With node ν k The time difference between corresponding events, δ is the pre-set time threshold, t j , t k Represents the behavior node ν j and ν k timestamp, device(ν j ) represents node ν j The corresponding device identifier, device(ν k ) represents node ν k The corresponding device identifier, device(ν j )≠device(ν k ) indicates that the two behavior nodes come from different devices, the edge is determined to be a mutation edge, and the node is marked as a switching mutation point. The behavior pattern changes drastically. Based on the node behavior pattern embedding, the behavior tension increases suddenly in a short time window. The expression is:

[0134]

[0135] Where, represents the behavioral pattern embedding vector of the jth node in the user behavior graph at time t, represents the behavioral pattern embedding vector of the same node j at time t+Δt, represents the binary norm of the vector, ‖·‖2 represents the degree of change in the behavioral embedding of node j within a short time interval Δt, and γ represents the preset behavioral drastic change threshold. If the causal chain is broken, then the behavioral pattern embedding of one of the nodes has no clear leading behavior, and the event node is marked as a causal breakpoint.

[0136] The operational process of the risk scoring module includes:

[0137] The risk score is calculated based on the causal mutation point. The central node receives all detected causal mutation points, combines the integrity of the behavior chain, time continuity and device trust, calculates a comprehensive risk score for each user's current behavior path, and uses a weighted normalization function to synthesize the final risk score. The expression is:

[0138] R u =1-(ω1C u +ω2T u +ω3S u ), where ω1+ω2+ω3=1

[0139] Where R u represents the risk score of user u, ω1 represents the weight coefficient of the integrity score, ω2 represents the weight coefficient of the time continuity score, ω3 represents the weight coefficient of the device trust score, ω1+ω2+ω3=1 means that the sum of the weight coefficients is 1, which means weighted average, C u represents the integrity score of the user behavior chain, T u represents the temporal continuity score of user behavior, S u Indicates the trust score of the device used by the user, based on the user risk score R uCombined with the mutation type, device characteristics and behavior context, the dynamic security response strategy is generated. The dynamic security response strategy includes but is not limited to normal behavior chains that do not require additional authentication, weak trust switching that triggers SMS verification codes, and suspicious causal paths that start human-machine identification; after the user completes the authentication of the dynamic security response strategy, the central node performs label update operations and federated graph neural network updates based on the user authentication feedback results. The label update operation marks the current behavior chain path as any one of the safe or risk samples for subsequent federated training supervision signals. The federated graph neural network updates the user authentication feedback results as a reinforcement signal back to the local node and updates the federated graph neural network model parameters θ i , the central node is aggregated based on the federated averaging mechanism, expression:

[0140]

[0141] Where θ g+1 represents the global model parameters of the g+1th round, E represents the total number of terminal nodes participating in federated learning, i represents the number of the i-th terminal node, represents the parameters of the local model of the i-th terminal node after the g-th round of training, e i represents the number of local training data samples held by the i-th terminal node, e represents the sum of the total number of samples of all terminal nodes, Represents the weight of the i-th node in the total sample, and then the new model parameter θ g+1 Pushed synchronously to each of the terminal nodes.

[0142] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A computer user information security intelligent management method, characterized in that: include: S1. Lightweight collectors are deployed locally on multiple endpoints to collect behavioral factors without collecting identity information, and generate factor summaries after processing; S2. Based on the federated graph neural network framework, each terminal node locally establishes a graph structure for the factor summary, and aggregates the intermediate graph vector weights received by the central node; S3. The central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph and automatically identifies causal mutation points based on the intermediate graph vector weights; S4. Calculate a risk score based on the causal mutation point, and generate a dynamic security response strategy based on the integrity of the behavior chain, time continuity, and device trust.

2. A computer user information security intelligent management method according to claim 1, characterized in that: In step S1, multiple endpoints deploy lightweight collectors locally to collect behavioral factors without collecting identity information. The method for generating factor summaries after processing is as follows: The lightweight collector is locally deployed on multiple endpoints of PC, mobile device, and browser extension within the scope of user authorization. The behavioral factors include but are not limited to login time, operation frequency, file type, and network IP mode. The lightweight collector locally executes the behavioral modeling function to perform sliding window feature extraction on the original behavioral factor data, and combines the feature vectors of the behavioral factors. where v (i) represents the behavioral feature vector of the i-th user, represents the mean of the behavior occurrence time in the time series α of the i-th user, represents the standard deviation of the behavior time in the time series α of the i-th user, H (i) The entropy value represents the uncertainty of the behavior of the i-th user, D (i) represents the switching intensity of the i-th user between different devices, ... represents other supplementary behavioral factors, and chaos mapping + local perturbation mechanism is applied for compression and encryption to generate a factor summary after processing.

3. A computer user information security intelligent management method according to claim 2, characterized in that: In step S2, based on the federated graph neural network framework, a graph structure is established locally for the factor summary through each terminal node, and the intermediate graph vector weights received by the central node are aggregated as follows: The factor summary establishes a graph structure as follows: In the formula, the node set The feature vectors representing the behavioral factors of different categories, the edge set ε i Reflecting the dependency between features, the edge weight is calculated by joint mutual information, expression: Where, represents the edge weight between node j and node k in the i-th terminal, Representation node With node The mutual information, Σ x，y It represents the sum of all possible eigenvalue combinations (x, y), p jk (x, y) represents a node and The joint probability distribution of x and y, p j (x) represents a node The marginal probability of taking a single value of x, p k (y) represents the node The marginal probability of taking a single value of y is, The logarithm of the ratio of the joint probability to the marginal probability reflects the degree of dependence between the two, and trains the local user behavior graph embedding representation. The graph embedding representation first performs graph embedding initialization and local graph convolution propagation. Each node initializes the feature vector and adopts the Chebyshev polynomial spectral graph convolution propagation mechanism. Then, the node embedding is self-supervised learning using the variational graph autoencoder locally to generate node potential representation, and then a federal graph embedding update mechanism is established. Each terminal node only uploads a summary of the local graph embedding model weights, performs federal aggregation through the central node, and also transmits it back to all terminals through the central node, performs graph alignment mapping, unifies the graph embedding dimension, and optimizes the global consistency loss. Each terminal node receives the aggregated model parameters and mapping function, and fine-tunes the federal graph neural network.

4. A computer user information security intelligent management method according to claim 3, characterized in that: In step S3, the central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph. The method for automatically identifying causal mutation points based on the intermediate graph vector weights is as follows: The cross-platform user behavior causal chain graph constructs a time causal chain graph structure for all event nodes in the behavior graph according to event timestamps and operation sequences. The expression is: Where, Represents a global causal chain graph across platforms, Represents the set of all nodes in the cross-platform global causal chain graph, ε c Represents the set of all edges in the global cross-platform causal chain graph, Represents the node set of all i-th terminal nodes in the local graph Merge together to form the overall node set ∪ i ε i Represents the edge set ε of all local graphs merged i , ε cross Represents a set of cross-platform connection edges. The central node applies a graph attention neural network to the causal chain graph to model the causal influence strength between nodes. The expression is: Where, represents the embedding representation of node j in the l+1 layer, σ represents the nonlinear activation function, Represents the set of neighbor nodes for node j Sum each neighbor node k in, represents the attention weight of node j to its neighbor node k in the lth layer, W (l) represents the learnable linear transformation weight matrix of layer l, represents the embedding representation of node k in layer l, exp(·) represents the exponential function, LeakyReLU(·) represents the ReLU activation function with leakage, represents the transpose of the learnable attention weight vector, [Wh j ‖Wh k ] means concatenating the linearly transformed feature vectors of nodes j and k. Indicates that the attention score of all neighbor nodes k′ of node j is calculated, and after reasoning, the behavior pattern of each node is embedded in h j Used to analyze the causal tension of user behavior.

5. A computer user information security intelligent management method according to claim 4, characterized in that: In step S3, the central node uses a graph neural inference algorithm to construct a cross-platform user behavior causal chain graph. The method for automatically identifying causal mutation points based on the intermediate graph vector weights is as follows: The automatic identification of causal mutation points includes but is not limited to device switching within a short period of time, drastic changes in behavior patterns, and causal chain breaks. The short-term device switching is defined as the short-term behavior transmission between different end devices, and the inferred edge satisfies the following formula: Δt jk = |t j - t k | < δ, and device(ν j ) ≠ device(ν k ) Where Δt jk Represents node ν j With node ν k The time difference between corresponding events, δ is the pre-set time threshold, t j , t k Represents the behavior node ν j and ν k timestamp, device(ν j ) represents node ν j The corresponding device identifier, device(ν k ) represents node ν k The corresponding device identifier, device(ν j )≠device(ν k ) indicates that the two behavior nodes come from different devices, the edge is determined to be a mutation edge, and the node is marked as a switching mutation point. The behavior pattern changes drastically. Based on the node behavior pattern embedding, the behavior tension increases suddenly in a short time window. The expression is: Where, represents the behavioral pattern embedding vector of the jth node in the user behavior graph at time t, represents the behavioral pattern embedding vector of the same node j at time t+Δt, represents the binary norm of the vector, ‖·‖2 represents the degree of change in the behavioral embedding of node j within a short time interval Δt, and γ represents the preset behavioral drastic change threshold. If the causal chain is broken, then the behavioral pattern embedding of one of the nodes has no clear leading behavior, and the event node is marked as a causal breakpoint.

6. A computer user information security intelligent management method according to claim 5, characterized in that: In step S4, the risk score is calculated based on the causal mutation point, and a dynamic security response strategy is generated according to the integrity of the behavior chain, time continuity and device trustworthiness. The risk score is calculated based on the causal mutation point. The central node receives all detected causal mutation points, combines the integrity of the behavior chain, time continuity and device trust, calculates a comprehensive risk score for each user's current behavior path, and uses a weighted normalization function to synthesize the final risk score. The expression is: R u =1-(ω1C u +ω2T u +ω3S u ), whereω1+ω2+ω3=1 Where R u represents the risk score of user u, ω1 represents the weight coefficient of the integrity score, ω2 represents the weight coefficient of the time continuity score, ω3 represents the weight coefficient of the device trust score, ω1+ω2+ω3=1 means that the sum of the weight coefficients is 1, which means weighted average, C u represents the integrity score of the user behavior chain, T u represents the temporal continuity score of user behavior, S u Indicates the trust score of the device used by the user, based on the user risk score R u The dynamic security response strategy is generated by combining the mutation type, device characteristics and behavioral context. The dynamic security response strategy includes but is not limited to normal behavior chains that do not require additional authentication, weak trust switching that triggers an SMS verification code, and suspicious causal paths that initiate human-machine identification.

7. A computer user information security intelligent management method according to claim 6, characterized in that: In step S4, the risk score is calculated based on the causal mutation point, and a dynamic security response strategy is generated according to the integrity of the behavior chain, time continuity and device trustworthiness. After the user completes the authentication of the dynamic security response strategy, the central node performs a label update operation and a federated graph neural network update based on the user authentication feedback result. The label update operation marks the current behavior chain path as either a safe or risky sample for subsequent federated training supervision signals. The federated graph neural network update transmits the user authentication feedback result as a reinforcement signal back to the local node and updates the federated graph neural network model parameters θ i , the central node is aggregated based on the federated averaging mechanism, expression: Where θ g+1 represents the global model parameters of the g+1th round, E represents the total number of terminal nodes participating in federated learning, i represents the number of the i-th terminal node, represents the parameters of the local model of the i-th terminal node after the g-th round of training, e i represents the number of local training data samples held by the i-th terminal node, e represents the sum of the total number of samples of all terminal nodes, Represents the weight of the i-th node in the total sample, and then the new model parameter θ g+1 Pushed synchronously to each of the terminal nodes.

8. A computer user information security intelligent management system, based on a computer user information security intelligent management method according to any one of claims 1 to 7, characterized in that: include: Behavioral factor collection module: lightweight collectors are deployed locally on multiple endpoints to collect behavioral factors without collecting identity information, and generate factor summaries after processing; The graph structure module, based on the federated graph neural network framework, establishes a graph structure for the factor summary locally through each terminal node and aggregates the intermediate graph vector weights received by the central node; Behavior causal chain graph module, the central node uses the graph neural reasoning algorithm to build a cross-platform user behavior causal chain graph, and automatically identifies causal mutation points based on the intermediate graph vector weights; The risk scoring module calculates the risk score based on the causal mutation point and generates a dynamic security response strategy based on the integrity of the behavior chain, time continuity and device trust.

9. The computer user information security intelligent management system according to claim 8, characterized in that: The operation process of the behavioral factor acquisition module includes: The lightweight collector is locally deployed on multiple endpoints of PC, mobile device, and browser extension within the scope of user authorization. The behavioral factors include but are not limited to login time, operation frequency, file type, and network IP mode. The lightweight collector locally executes the behavioral modeling function to perform sliding window feature extraction on the original behavioral factor data, and combines the feature vectors of the behavioral factors. where v (i) represents the behavioral feature vector of the i-th user, represents the mean of the behavior occurrence time in the time series α of the i-th user, represents the standard deviation of the behavior time in the time series α of the i-th user, H (i) The entropy value represents the uncertainty of the behavior of the i-th user, D (i) represents the switching intensity of the i-th user between different devices, ... represents other supplementary behavioral factors, and chaos mapping + local perturbation mechanism is applied for compression and encryption to generate a factor summary after processing. The operation process of the graph structure module includes: The factor summary establishes a graph structure as follows: In the formula, the node set The feature vectors representing the behavioral factors of different categories, the edge set ε i Reflecting the dependency between features, the edge weight is calculated by joint mutual information, expression: Where, represents the edge weight between node j and node k in the i-th terminal, Representation node With node The mutual information, Σ x，y It represents the sum of all possible eigenvalue combinations (x, y), p jk (x, y) represents a node and The joint probability distribution of x and y, p j (x) represents a node The marginal probability of taking a single value of x, p k (y) represents the node The marginal probability of taking a single value of y is, The logarithm of the ratio of the joint probability to the marginal probability reflects the degree of dependence between the two, and trains the local user behavior graph embedding representation. The graph embedding representation first performs graph embedding initialization and local graph convolution propagation. Each node initializes the feature vector and adopts the Chebyshev polynomial spectral graph convolution propagation mechanism. Then, the node embedding is self-supervised learning using the variational graph autoencoder locally to generate node potential representation, and then a federal graph embedding update mechanism is established. Each terminal node only uploads a summary of the local graph embedding model weights, performs federal aggregation through the central node, and also transmits it back to all terminals through the central node, performs graph alignment mapping, unifies the graph embedding dimension, and optimizes the global consistency loss. Each terminal node receives the aggregated model parameters and mapping function, and fine-tunes the federal graph neural network.

10. The computer user information security intelligent management system according to claim 9, characterized in that: The operation process of the behavior causal chain diagram module includes: The cross-platform user behavior causal chain graph constructs a time causal chain graph structure for all event nodes in the behavior graph according to event timestamps and operation sequences. The expression is: Where, Represents a global causal chain graph across platforms, Represents the set of all nodes in the cross-platform global causal chain graph, ε c Represents the set of all edges in the global cross-platform causal chain graph, Represents the node set of all i-th terminal nodes in the local graph Merge together to form the overall node set ∪ i ε i Represents the edge set ε of all local graphs merged i , ε cross Represents a set of cross-platform connection edges. The central node applies a graph attention neural network to the causal chain graph to model the causal influence strength between nodes. The expression is: Where, represents the embedding representation of node j in the l+1 layer, σ represents the nonlinear activation function, Represents the set of neighbor nodes for node j Sum each neighbor node k in, represents the attention weight of node j to its neighbor node k in the lth layer, W (l) represents the learnable linear transformation weight matrix of layer l, represents the embedding representation of node k in layer l, exp(·) represents the exponential function, LeakyReLU(·) represents the ReLU activation function with leakage, represents the transpose of the learnable attention weight vector, [Wh j ‖Wh k ] means concatenating the linearly transformed feature vectors of nodes j and k. Indicates that the attention score of all neighbor nodes k′ of node j is calculated, and after reasoning, the behavior pattern of each node is embedded in h j Used to analyze the causal tension of user behavior; the automatic identification of causal mutation points, which include but are not limited to device switching within a short period of time, drastic changes in behavior patterns, and causal chain breaks. The short-term device switching is defined as the short-term behavior transmission between different end devices, and the inferred edge satisfies the following formula: Δt jk = |t j - t k | < δ, and device(ν j ) ≠ device(ν k ) Where Δt jk Represents node ν j With node ν k The time difference between corresponding events, δ is the pre-set time threshold, t j , t k Represents the behavior node ν j and ν k timestamp, device(ν j ) represents node ν j The corresponding device identifier, device(ν k ) represents node ν k The corresponding device identifier, device(ν j )≠device(ν k ) indicates that the two behavior nodes come from different devices, the edge is determined to be a mutation edge, and the node is marked as a switching mutation point. The behavior pattern changes drastically. Based on the node behavior pattern embedding, the behavior tension increases suddenly in a short time window. The expression is: Where, represents the behavioral pattern embedding vector of the jth node in the user behavior graph at time t, represents the behavioral pattern embedding vector of the same node j at time t+Δt, represents the binary norm of the vector, ‖·‖2 represents the degree of change in the behavioral embedding of node j within a short time interval Δt, and γ represents the preset behavioral drastic change threshold. If the causal chain is broken, then the behavioral pattern embedding of one of the nodes has no clear leading behavior, and the event node is marked as a causal breakpoint. The operational process of the risk scoring module includes: The risk score is calculated based on the causal mutation point. The central node receives all detected causal mutation points, combines the integrity of the behavior chain, time continuity and device trust, calculates a comprehensive risk score for each user's current behavior path, and uses a weighted normalization function to synthesize the final risk score. The expression is: R u =1-(ω1C u +ω2T u +ω3S u ), whereω1+ω2+ω3=1 Where R u represents the risk score of user u, ω1 represents the weight coefficient of the integrity score, ω2 represents the weight coefficient of the time continuity score, ω3 represents the weight coefficient of the device trust score, ω1+ω2+ω3=1 means that the sum of the weight coefficients is 1, which means weighted average, C u represents the integrity score of the user behavior chain, T u represents the temporal continuity score of user behavior, S u Indicates the trust score of the device used by the user, based on the user risk score R u Combined with the mutation type, device characteristics and behavior context, the dynamic security response strategy is generated. The dynamic security response strategy includes but is not limited to normal behavior chains that do not require additional authentication, weak trust switching that triggers SMS verification codes, and suspicious causal paths that start human-machine identification; after the user completes the authentication of the dynamic security response strategy, the central node performs label update operations and federated graph neural network updates based on the user authentication feedback results. The label update operation marks the current behavior chain path as any one of the safe or risk samples for subsequent federated training supervision signals. The federated graph neural network updates the user authentication feedback results as a reinforcement signal back to the local node and updates the federated graph neural network model parameters θ i , the central node is aggregated based on the federated averaging mechanism, expression: Where θ g+1 represents the global model parameters of the g+1th round, E represents the total number of terminal nodes participating in federated learning, i represents the number of the i-th terminal node, represents the parameters of the local model of the i-th terminal node after the g-th round of training, e i represents the number of local training data samples held by the i-th terminal node, e represents the sum of the total number of samples of all terminal nodes, Represents the weight of the i-th node in the total sample, and then the new model parameter θ g+1 Pushed synchronously to each of the terminal nodes.

Images