Enterprise employee behavior analysis and safety risk early warning monitoring method and system

Abstract

The invention provides an enterprise employee behavior analysis and safety risk early warning monitoring method and system, and relates to the technical field of enterprise risk management, and the method comprises the steps: collecting employee terminal operation behavior data, building an activity thermal distribution diagram based on office area grid behavior association intensity, and training a behavior evaluation model. And inputting the behavior scoring matrix into a deep neural network to extract target behavior characteristics, calculating an abnormal behavior risk weight coefficient in combination with a department security policy, performing classification and analyzing a risk diffusion probability, and generating a risk situation index to determine an early warning level. Starting a response strategy according to the early warning level, blocking high-risk early warning in real time, tracking associated accounts, establishing a risk association map, identifying potential risk propagation nodes and performing active protection, finally generating an early warning report and feeding back effective protection rules to a behavior baseline model, and realizing continuous optimization of a risk early warning mechanism. And the accuracy and effectiveness of safety risk early warning in the enterprise are improved.

Description

Technical Field

[0001] The present invention relates to enterprise risk management technology, and in particular to a method and system for enterprise employee behavior analysis and safety risk early warning monitoring. Background Art

[0002] As enterprise informatization continues to improve, the amount of data on various types of internal employee operations has exploded. Promptly identifying anomalous behavior and assessing its potential risks from this massive amount of data has become a major challenge for enterprise security management. Traditional behavioral analysis methods, which primarily rely on static rule matching, are unable to cope with complex and changing abnormal behavior patterns and lack in-depth analysis of risk transmission paths.

[0003] Existing security early warning mechanisms suffer from issues such as delayed responses and insufficient protection. On the one hand, the lack of comprehensive analysis of the temporal and spatial distribution characteristics of employee behavior leads to low accuracy in identifying abnormal behavior. On the other hand, early warning response strategies are overly simplistic, unable to flexibly adjust protective measures based on different risk levels, and lack continuous tracking of risk transmission trends.

[0004] Currently, enterprise security management platforms lack the ability to analyze the source of abnormal behavior and address risks. This makes it difficult to construct a complete risk correlation map, accurately identify potential risk transmission nodes, and proactively protect against them. Therefore, a behavioral analysis method that integrates temporal and spatial characteristics is urgently needed, allowing for dynamic adjustment of early warning response strategies based on risk trends, to achieve intelligent and precise prevention and control of internal enterprise security risks. Summary of the Invention

[0005] The embodiments of the present invention provide a method and system for analyzing enterprise employee behavior and early warning of security risks, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention, Provides an enterprise employee behavior analysis and security risk early warning monitoring method, including: Collect employee operational behavior data at work terminals and preprocess it to obtain a behavioral feature sequence. Based on the behavioral feature sequence, extract the temporal dependency characteristics of the behavior and generate a temporal feature vector. At the same time, divide the employee office area into multiple virtual work grids, calculate the behavioral correlation strength between different grids, and construct a heat distribution map of employee behavior activities. This heat distribution map is then fused with the temporal feature vector to obtain a behavioral feature tensor, which is then used to generate a behavioral scoring matrix. Based on the behavior scoring matrix, the target behavior feature sequence is extracted. Combined with the dynamic security policy of the employee's department, the risk weight coefficient of abnormal behavior is calculated for classification. At the same time, the diffusion path of abnormal behavior within the enterprise is analyzed, and the risk diffusion probability is calculated. The risk diffusion probability is combined with the abnormal behavior type to generate a risk situation index to determine the security warning level. Based on the security warning level, the warning response strategy is called, and real-time blocking is initiated for high-risk warnings. At the same time, the associated accounts are tracked to establish a risk association map, potential risk propagation nodes are identified for active protection, and warning reports are generated and pushed to the security management platform. The handling operations of security managers are recorded, and effective protection rules in the handling operations are extracted to achieve continuous optimization of the risk warning mechanism.

[0007] In an optional embodiment, The employee office area is divided into multiple virtual work grids. The behavioral correlation strength between different grids is calculated to construct a heat distribution map of employee behavior activities. The heat distribution map of behavior activities is integrated with the time series feature vector to obtain a behavior feature tensor. The behavior feature tensor is used to generate a behavior scoring matrix, including: The office area is initially gridded to obtain an initial virtual work grid. The position coordinate sequence in the employee activity trajectory data is obtained. The personnel density and activity frequency values ​​in each grid cell are calculated. A grid importance index is constructed. The initial virtual work grid is adaptively divided according to the grid importance index to obtain a multi-level grid structure. Analyze employee activity trajectories in a multi-level grid structure, extract the time interval sequence and behavior transition sequence of employee migration between grids, calculate the average migration time, migration frequency and behavior similarity between grid pairs, construct a spatiotemporal migration tensor, decompose the spatiotemporal migration tensor to obtain a grid correlation strength matrix, and construct a grid topology structure based on the grid correlation strength matrix; The grid topology is used to calculate the centrality index of the grid nodes and the grid community structure characteristics, and the heat diffusion function is calculated in combination with the grid association strength matrix. The heat diffusion function is applied to each grid node to obtain an initial heat distribution, and a heat distribution map is generated through iterative updating. The heat distribution map is subjected to feature extraction to obtain a spatial feature vector. Performing attention calculation on the spatial feature vector and the temporal feature vector to obtain a feature fusion weight, and performing tensor fusion on the temporal feature vector and the spatial feature vector based on the feature fusion weight to generate a spatiotemporal feature tensor; Based on the spatiotemporal feature tensor, a multi-task learning approach is used to simultaneously predict the behavioral risk level and abnormality degree, and generate a behavioral scoring matrix containing risk level and abnormality score.

[0008] In an optional embodiment, The grid topology is used to calculate the centrality index of the grid nodes and the grid community structure characteristics, and the heat diffusion function is calculated in combination with the grid association strength matrix. The heat diffusion function is applied to each grid node to obtain the initial heat distribution. The heat distribution map is generated through iterative updating, including: Extract the adjacency relationship of grid nodes to construct a local connection matrix, obtain the node degree value statistically, extract the weight value from the grid association strength matrix, and calculate the ratio of the node degree value to the weight value to obtain the degree centrality index; A dynamic programming algorithm is used to calculate all the shortest paths between node pairs in the grid topology structure, and the ratio of the number of shortest paths passing through the target node to the total number of paths is counted to obtain the betweenness centrality index. Initialize each grid node as an independent community, construct a modularity function based on degree centrality and betweenness centrality indicators, and obtain the grid community structure characteristics by iteratively merging adjacent communities with the largest modularity gain and performing local optimization. Normalizing the degree centrality index and the betweenness centrality index, determining a centrality weight coefficient based on the position of the grid node in the grid community structure characteristics, and combining the weighted degree centrality index and betweenness centrality index to obtain an initial thermal value of the grid node; Calculating the Euclidean distance matrix between nodes in the grid topology, weighting the distance decay coefficient based on community structure characteristics, and combining it with the initial thermal value to construct a thermal diffusion function; applying the thermal diffusion function to each grid node in the grid topology to obtain an initial thermal distribution; The thermal conduction between grid nodes is calculated based on the thermal diffusion function, the thermal values ​​of the grid nodes in the community are smoothed in combination with the grid community structure characteristics, the thermal values ​​of the grid nodes are updated, and the process is iterated until the thermal distribution converges to obtain a thermal distribution map.

[0009] In an optional embodiment, Based on the behavior scoring matrix, the target behavior feature sequence is extracted. Combined with the dynamic security policy of the employee's department, the abnormal behavior risk weight coefficient is calculated for classification, including: Input the behavior score matrix into a pre-trained deep neural network, which includes a feature extraction module and a risk assessment module; The feature extraction module calculates the conditional mutual information and partial correlation coefficients between each rating dimension in the behavior rating matrix, constructs a dimension association network, uses a spectral clustering algorithm to perform community segmentation to obtain rating dimension association groups, performs principal component analysis on each association group to obtain a feature vector, and splices them in time sequence to generate a target behavior feature sequence; A dynamic security strategy is constructed based on the department's historical security event sequence. The accumulation and verification algorithm is executed to identify state change points. A Markov state transition model is established between adjacent change points. The state prediction results output by the Markov state transition model are integrated with the security protection rules based on the membership function to generate the department's dynamic security strategy vector. The risk assessment module inputs the target behavior feature sequence and the department's dynamic security policy vector into the multi-head attention mechanism, calculates the dimension attention weight, and combines the dimension attention weights of multiple attention heads to generate a risk weight coefficient; The target behavior feature sequence with added risk weight coefficient is input into the residual network, the feature channels of the target behavior feature sequence are weighted in importance, and the correlation features of the temporally adjacent features in the target behavior feature sequence are extracted through convolution operation; The processed features are input into the fully connected layer to obtain the probability distribution of abnormal behavior types, calculate the information entropy, and calculate the risk propagation probability in combination with the state transition matrix. The abnormal behavior type and risk level are obtained by combining the information entropy and risk propagation probability.

[0010] In an optional embodiment, Analyze the diffusion path of abnormal behavior within the enterprise, calculate the risk diffusion probability, combine the risk diffusion probability with the abnormal behavior type to generate a risk situation index, and determine the security warning level including: Construct a risk propagation network, where nodes represent enterprise departments and edges represent business connections between departments. Construct a node feature vector that includes department size, authority level, number of historical security incidents, and risk level. Construct an edge feature vector that includes business interaction frequency, information flow intensity, and access control strength. An adjacency matrix is ​​constructed based on the node feature vectors and edge feature vectors, node importance is calculated using an iterative algorithm, a state transition model is constructed on the risk propagation network, state transition probability is calculated based on the node importance, edge feature vectors are mapped to propagation attenuation coefficients, a path attenuation function is constructed in combination with the shortest path between nodes, and a risk propagation probability matrix is ​​calculated based on the state transition probability, propagation attenuation coefficient, and path attenuation function; For the detected abnormal behavior source department, recursively calculate the risk propagation probability of the target department and update it to the probability matrix; Construct an abnormal behavior hazard degree matrix and a sensitivity matrix, multiply the abnormal behavior hazard degree matrix by the sensitivity matrix to obtain a risk impact matrix, extract the risk propagation probability corresponding to the target department from the risk propagation probability matrix, and perform a weighted combination of the risk impact matrix and the risk propagation probability to obtain a risk situation index for the target department; The risk situation index of the target department is weighted and accumulated with the corresponding node importance to obtain the target risk situation index, the target risk situation index is compared with the preset multi-level warning threshold, and the current safety warning level is determined according to the comparison result.

[0011] In an optional embodiment, Based on the security warning level, the warning response strategy is called to initiate real-time blocking of high-risk warnings. At the same time, the associated accounts are tracked to establish a risk association map, identify potential risk propagation nodes, proactively protect against them, and generate warning reports, including: Receive security warning level information, call the corresponding level response strategy from the warning response strategy library, and determine the real-time blocking threshold, authority control intensity and monitoring frequency based on the warning level; Obtain the employee account that triggered the alert and the corresponding operational behavior characteristics. Build an abnormal behavior profile based on the operation time distribution, resource access pattern, and behavioral link characteristics. Match this with the preset department security baseline to obtain an abnormality level indicator. Based on the abnormality level indicator and security alert level, determine the scope of permission compression and implement access control to generate behavioral audit data. Extract historical business collaboration records of employee accounts, identify high-frequency interaction accounts by combining abnormal behavior profiling and behavioral audit data, construct a risk association map, perform community discovery and node importance analysis on the risk association map, calculate the degree centrality, betweenness centrality, and eigenvector centrality of the nodes, construct a risk scoring model by combining the node's historical security events, permission level, and the abnormality degree index, identify risk propagation nodes based on the risk scoring model, and map the structural characteristics of the risk association map into propagation influence factors; Deploy behavioral monitoring probes at risk propagation nodes, build multi-dimensional behavioral baselines based on behavioral audit data and abnormal behavior profiles, detect behavioral deviations in real time, trigger permission control policies when the deviation exceeds the real-time blocking threshold, and deploy intelligent honeypots to capture attack signatures. Based on behavioral audit data, abnormal behavior portraits and attack characteristics, the causal reasoning algorithm is used to restore the attack chain, and the risk association map and propagation impact factors are combined to predict the risk spread range and generate an early warning report.

[0012] In an optional embodiment, Deploy behavioral monitoring probes at risk propagation nodes, build a multi-dimensional behavioral baseline based on behavioral audit data and abnormal behavior profiles, detect behavioral deviations in real time, and trigger permission control policies when the deviation exceeds the real-time blocking threshold. Deploy intelligent honeypots to capture attack characteristics, including: Deploy system-layer, application-layer, and network-layer probes at risk propagation nodes to collect process behavior, file operations, network connections, business operations, data access, traffic, and protocol data, and transmit them to the behavior analysis engine in real time. Conduct time series analysis on process behavior, file operation, and business operation data, and use kernel density estimation to construct a time dimension baseline. Conduct sequence analysis on business operations and data access data, build a Markov chain model to obtain the operation sequence baseline, and build a resource affinity matrix to obtain the resource access baseline; Conduct behavioral analysis on network connection data, traffic data, and protocol data to extract data transmission characteristics, and build a data flow baseline based on the data transmission characteristics; The real-time collected data is compared with the time dimension baseline, operation sequence baseline, resource access baseline, and data flow baseline to calculate the feature vector. The Mahalanobis distance is used to calculate the time dimension deviation, operation sequence deviation, resource access deviation, and data flow deviation. The weighted combination of the deviations of each dimension is used to obtain the comprehensive deviation. An intelligent honeypot system is deployed in the network area where the risk propagation node is located. A service fingerprint is constructed based on network connection data and protocol data. A dynamic simulation service is constructed based on the service fingerprint. A deep reinforcement learning model is used to train an interactive decision maker. The interactive decision maker simulates service interaction behavior based on the business operation data, thereby capturing attack characteristics.

[0013] A second aspect of an embodiment of the present invention provides an enterprise employee behavior analysis and security risk early warning monitoring system, including: The first unit is used to collect employee operational behavior data at work terminals and preprocess it to obtain a behavioral feature sequence. Based on the behavioral feature sequence, the temporal dependency characteristics of the behavior are extracted to generate a temporal feature vector. The employee's office area is divided into multiple virtual work grids, the behavioral correlation strength between different grids is calculated, and a heat distribution map of employee behavior activities is constructed. The heat distribution map of behavior activities is then integrated with the temporal feature vector to obtain a behavioral feature tensor, which is then used to generate a behavioral scoring matrix. The second unit is used to extract the target behavior feature sequence based on the behavior scoring matrix, and calculate the abnormal behavior risk weight coefficient for classification based on the dynamic security policy of the employee's department. It also analyzes the diffusion path of abnormal behavior within the enterprise, calculates the risk diffusion probability, and combines the risk diffusion probability with the abnormal behavior type to generate a risk situation index to determine the security warning level. The third unit is used to call the warning response strategy based on the security warning level, initiate real-time blocking of high-risk warnings, track related accounts to establish a risk association map, identify potential risk propagation nodes for active protection and generate warning reports, push them to the security management platform, record the disposal operations of security managers, extract effective protection rules in the disposal operations, and realize continuous optimization of the risk warning mechanism.

[0014] The third aspect of the embodiment of the present invention An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0015] According to a fourth aspect of the embodiments of the present invention, A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0016] In this embodiment, by recursively analyzing and extracting the temporal dependency features of behavior, and combining the behavioral correlation strength of the employee's office area, a behavioral feature tensor is constructed, which can more comprehensively characterize employee behavior, thereby improving the accuracy of abnormal behavior detection and reducing false positives. Based on the extraction of target behavior feature sequences based on deep neural networks, combined with the department's dynamic security strategy and risk weight coefficient, abnormal behaviors can be classified and risk levels assessed, and the risk diffusion path and probability can be analyzed to generate a risk situation index, achieving more accurate risk warnings. For high-risk warnings, the system can activate a real-time blocking mechanism, restrict abnormal account permissions, and track related accounts to effectively control the spread of risks. The system can generate an early warning report that includes traceability analysis, propagation paths, and disposal plans, and record the disposal operations of security managers. By extracting effective protection rules and feeding them back to the behavioral baseline model, the risk early warning mechanism can be continuously optimized, and the system's early warning capabilities and protection effects can be continuously improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Schematic diagram of the process of enterprise employee behavior analysis and security risk early warning monitoring method according to an embodiment of the present invention; Figure 2 This is a comparison diagram of the thermal distribution of the grid in an embodiment of the present invention; Figure 3 This is a comparative analysis chart of the risk situation index warning threshold and historical security events in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0019] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0020] Figure 1 FIG. 1 is a flow chart of a method for analyzing enterprise employee behavior and early warning of security risks according to an embodiment of the present invention. Figure 1 As shown, the method includes: Collect employee operational behavior data at work terminals and preprocess it to obtain a behavioral feature sequence. Based on the behavioral feature sequence, extract the temporal dependency characteristics of the behavior and generate a temporal feature vector. At the same time, divide the employee office area into multiple virtual work grids, calculate the behavioral correlation strength between different grids, and construct a heat distribution map of employee behavior activities. This heat distribution map is then fused with the temporal feature vector to obtain a behavioral feature tensor, which is then used to generate a behavioral scoring matrix. Based on the behavior scoring matrix, the target behavior feature sequence is extracted. Combined with the dynamic security policy of the employee's department, the risk weight coefficient of abnormal behavior is calculated for classification. At the same time, the diffusion path of abnormal behavior within the enterprise is analyzed, and the risk diffusion probability is calculated. The risk diffusion probability is combined with the abnormal behavior type to generate a risk situation index to determine the security warning level. Based on the security warning level, the warning response strategy is called, and real-time blocking is initiated for high-risk warnings. At the same time, the associated accounts are tracked to establish a risk association map, potential risk propagation nodes are identified for active protection, and warning reports are generated and pushed to the security management platform. The handling operations of security managers are recorded, and effective protection rules in the handling operations are extracted to achieve continuous optimization of the risk warning mechanism.

[0021] For example, we first collect employee behavioral data on their work terminals. This behavioral data includes, but is not limited to, employee login time, specific operations, frequency, and patterns. This data comes from various terminal devices used by employees, such as computers, mobile phones, and tablets. To better process this raw data, we need to preprocess it to convert it into behavioral feature sequences that can be used for subsequent analysis. This preprocessing process includes data cleaning, normalization, and annotation to ensure data consistency and accuracy.

[0022] After obtaining the preprocessed behavioral feature sequence, recursive analysis is performed. Using deep learning algorithms such as recurrent neural networks (RNNs), time series features are extracted from employee action sequences. This process aims to identify temporal dependencies within employee behavior, such as whether a particular action is likely to trigger a subsequent series of abnormal behaviors. The extracted time series features can be used to generate a time series feature vector, representing the behavioral characteristics. Furthermore, the employee's office area is divided into multiple virtual work grids. By calculating the strength of behavioral correlations between different grids, the patterns of employee activity within different areas can be revealed.

[0023] In an optional implementation, the employee office area is divided into multiple virtual work grids, the behavioral correlation strength between different grids is calculated, and a heat distribution map of employee behavior activities is constructed. The heat distribution map of behavior activities is fused with the time series feature vector to obtain a behavior feature tensor. The behavior feature tensor is used to generate a behavior scoring matrix, including: The office area is initially gridded to obtain an initial virtual work grid. The position coordinate sequence in the employee activity trajectory data is obtained. The personnel density and activity frequency values ​​in each grid cell are calculated. A grid importance index is constructed. The initial virtual work grid is adaptively divided according to the grid importance index to obtain a multi-level grid structure. Analyze employee activity trajectories in a multi-level grid structure, extract the time interval sequence and behavior transition sequence of employee migration between grids, calculate the average migration time, migration frequency and behavior similarity between grid pairs, construct a spatiotemporal migration tensor, decompose the spatiotemporal migration tensor to obtain a grid correlation strength matrix, and construct a grid topology structure based on the grid correlation strength matrix; The grid topology is used to calculate the centrality index of the grid nodes and the grid community structure characteristics, and the heat diffusion function is calculated in combination with the grid association strength matrix. The heat diffusion function is applied to each grid node to obtain an initial heat distribution, and a heat distribution map is generated through iterative updating. The heat distribution map is subjected to feature extraction to obtain a spatial feature vector. Performing attention calculation on the spatial feature vector and the temporal feature vector to obtain a feature fusion weight, and performing tensor fusion on the temporal feature vector and the spatial feature vector based on the feature fusion weight to generate a spatiotemporal feature tensor; Based on the spatiotemporal feature tensor, a multi-task learning approach is used to simultaneously predict the behavioral risk level and abnormality degree, and generate a behavioral scoring matrix containing risk level and abnormality score.

[0024] For example, the office area is first divided into a virtual grid. The office area is divided into uniform initial virtual work grids, for example, a 1000 square meter office area is divided into 100 10 square meter grids. Employee activity trajectory data is obtained, which contains employee ID, timestamp, and location coordinate sequence. For example, employee A is located at (10, 20) at 9:00 and at (10, 25) at 9:05. The personnel density value and activity frequency value in each grid unit are calculated. During the time period of 9:00-9:05, if 5 employees are active in a certain grid, the personnel density of the grid is 5 / 10=0.5 people / square meter, and the activity frequency is 5 times. A grid importance index is constructed based on the personnel density and activity frequency, for example, the weighted sum of the personnel density and activity frequency is taken. The initial virtual work grid is adaptively divided according to the grid importance index, and the grids with high importance are further subdivided. For example, a grid with a personnel density greater than 0.8 people / square meter is divided into 4 sub-grids of 2.5 square meters to form a multi-level grid structure.

[0025] Analyze employee activity trajectories within a multi-level grid structure. Extract the time intervals and behavioral transitions between employee migrations between grids. For example, the time interval for employee A to migrate from grid 1 to grid 2 is 5 minutes, and her behavior transitions from "work" to "rest." Calculate the average migration time, migration frequency, and behavioral similarity between grid pairs. For example, count the migration times of all employees from grid 1 to grid 2 to calculate the average migration time; count the number of migrations from grid 1 to grid 2 over a period of time to obtain the migration frequency; and compare the distribution of employee behavior types in grids 1 and 2 to calculate behavioral similarity. Construct the average migration time, migration frequency, and behavioral similarity into a spatiotemporal migration tensor. Decompose the spatiotemporal migration tensor to obtain a grid correlation strength matrix. For example, use matrix decomposition techniques to decompose the spatiotemporal migration tensor into a grid correlation strength matrix, where each element represents the correlation strength between two grids. Build a grid topology based on the grid correlation strength matrix. For example, consider grids as nodes and correlation strengths as edge weights, and construct a weighted graph to represent the grid topology.

[0026] The grid topology is used to calculate the centrality metrics of grid nodes and the characteristics of grid community structure. For example, the degree centrality, closeness centrality, and betweenness centrality of each grid are calculated, and a community discovery algorithm is used to identify grid communities. The heat diffusion function is calculated in conjunction with the grid association strength matrix, for example, by using association strength as a weight for heat diffusion. The heat diffusion function is applied to each grid node to obtain an initial heat distribution, for example, by setting the initial heat value of each grid as its centrality metric. A heat distribution map is generated through iterative updates of the heat conduction model, for example, by simulating the process of heat diffusion between grids, until the heat distribution stabilizes. Feature extraction is performed on the heat distribution map to obtain a spatial feature vector, for example, by converting the heat distribution map into a vector representation.

[0027] The spatial feature vector is fused with the temporal feature vector. The temporal feature vector can be a statistical feature of employee activities in different time periods, such as the number of activities per hour or the average activity duration. The feature fusion weight between the spatial and temporal feature vectors is calculated using an attention mechanism. For example, the weight is calculated based on the correlation between spatial and temporal features. Based on the feature fusion weight, the temporal and spatial feature vectors are tensor-fused to generate a spatiotemporal feature tensor. For example, the weighted spatial and temporal features are concatenated into a tensor.

[0028] Build a deep neural network as a behavior assessment model. Input the spatiotemporal feature tensor into the behavior assessment model, and use multi-task learning to simultaneously predict the behavioral risk level and anomaly degree. For example, use a single neural network to simultaneously output both the behavioral risk level (e.g., low, medium, high) and the anomaly score (e.g., 0-1). Optimize the behavior assessment model using a joint loss function, such as a weighted sum of the cross-entropy loss function and the mean squared error loss function. Evaluate real-time employee behavior data based on the optimized behavior assessment model to generate a behavior scoring matrix containing the risk level and anomaly score.

[0029] In this embodiment, multi-level grid division and spatiotemporal feature tensor fusion enable a more detailed characterization of employee behavior patterns, thereby improving the accuracy of behavioral assessments. The grid topology and heat distribution map provide visual behavioral pattern analysis, enhancing the interpretability of assessment results and facilitating managers' understanding of employee behavioral patterns. Deep neural network models can rapidly process real-time employee behavior data, enabling real-time behavioral assessment and early warning, helping to promptly identify and address potential risks.

[0030] In an optional embodiment, the grid topology is used to calculate the centrality index and grid community structure characteristics of the grid nodes, and the grid association strength matrix is ​​combined to calculate the thermal diffusion function. The thermal diffusion function is applied to each grid node to obtain an initial thermal distribution. Generating a thermal distribution map through iterative updating includes: Extract the adjacency relationship of grid nodes to construct a local connection matrix, obtain the node degree value statistically, extract the weight value from the grid association strength matrix, and calculate the ratio of the node degree value to the weight value to obtain the degree centrality index; A dynamic programming algorithm is used to calculate all the shortest paths between node pairs in the grid topology structure, and the ratio of the number of shortest paths passing through the target node to the total number of paths is counted to obtain the betweenness centrality index. Initialize each grid node as an independent community, construct a modularity function based on degree centrality and betweenness centrality indicators, and obtain the grid community structure characteristics by iteratively merging adjacent communities with the largest modularity gain and performing local optimization. Normalizing the degree centrality index and the betweenness centrality index, determining a centrality weight coefficient based on the position of the grid node in the grid community structure characteristics, and combining the weighted degree centrality index and betweenness centrality index to obtain an initial thermal value of the grid node; Calculating the Euclidean distance matrix between nodes in the grid topology, weighting the distance decay coefficient based on community structure characteristics, and combining it with the initial thermal value to construct a thermal diffusion function; applying the thermal diffusion function to each grid node in the grid topology to obtain an initial thermal distribution; The thermal conduction between grid nodes is calculated based on the thermal diffusion function, the thermal values ​​of the grid nodes in the community are smoothed in combination with the grid community structure characteristics, the thermal values ​​of the grid nodes are updated, and the process is iterated until the thermal distribution converges to obtain a thermal distribution map.

[0031] For example, we first extract the adjacency relationships of the grid nodes. We traverse each node in the grid, identify the nodes directly connected to it, and construct a local connectivity matrix. In a 5x5 grid, node (2, 3) is adjacent to nodes (1, 3), (3, 3), (2, 2), and (2, 4). In the local connectivity matrix, in the row or column corresponding to node (2, 3), the position values ​​corresponding to these four nodes are 1, and the other position values ​​are 0.

[0032] Calculate the degree centrality index of the node. Based on the local connection matrix constructed in the previous step, count the degree value of each node, that is, the number of nodes directly connected to the node. At the same time, extract the connection strength value of each node with its adjacent nodes from the grid association strength matrix (this matrix is ​​known in advance and stores the connection strength between any two nodes in the grid). The ratio of the degree value of each node to the sum of the connection strength values ​​of its adjacent nodes is used as the degree centrality index of the node. For example, the degree of node (2, 3) is 4, and the connection strength values ​​with its adjacent nodes are 0.8, 0.6, 0.7, and 0.9, respectively. Then its degree centrality index is 4 / (0.8+0.6+0.7+0.9)=4 / 3=1.33.

[0033] Calculate the betweenness centrality of a node. Use a dynamic programming algorithm to calculate all shortest paths between any two nodes in the grid topology. Count the number of shortest paths that pass through the target node. The ratio of the number of shortest paths that pass through the target node to the total number of shortest paths is used as the betweenness centrality of the node. For example, if the total number of shortest paths is 100 and the number of shortest paths passing through node (2, 3) is 30, then the betweenness centrality of node (2, 3) is 30 / 100 = 0.3.

[0034] Extract grid community structure features. Initialize each grid node as an independent community. Construct a modularity function based on the node's degree centrality and betweenness centrality metrics. This modularity function, which includes node degree, edge weight, and community label terms, measures the quality of community delineation. Iteratively merge adjacent communities with the largest modularity gain and perform local optimization adjustments until modularity no longer increases significantly, resulting in the final grid community structure features.

[0035] Then, calculate the initial heat value of the node. Normalize the degree centrality and betweenness centrality metrics, for example, scaling the degree centrality metrics of all nodes to between 0 and 1. Determine a centrality weight based on the node's position in the community structure. For example, community center nodes have a larger weight, while edge nodes have a smaller weight. Add the weighted degree centrality and betweenness centrality metrics to obtain the node's initial heat value.

[0036] The Euclidean distance between any two nodes in the grid topology is calculated to construct a Euclidean distance matrix. This Euclidean distance matrix is ​​weighted based on the community structure to obtain a distance decay coefficient. For example, the distance decay coefficient between nodes in the same community is small, while the distance decay coefficient between nodes in different communities is large. The distance decay coefficient is multiplied by the node's initial thermal value to construct a thermal diffusion function.

[0037] Apply the thermal diffusion function to each node in the grid to obtain the initial thermal distribution of each node. Finally, iterate to generate the thermal distribution map. Calculate the thermal conduction between nodes based on the thermal diffusion function. Smooth the thermal values ​​of nodes within the community based on the community structure characteristics. Update the thermal value of each node based on the thermal conduction and the smoothing results within the community. Iterate these steps until the thermal distribution converges, that is, the change in node thermal value is less than the preset threshold, and finally obtain the thermal distribution map.

[0038] This example combines grid topology, node centrality metrics, and community structure features to more accurately characterize node importance and the mutual influence between nodes, thereby generating a more accurate heat map. By partitioning and optimizing the community structure, computational complexity can be reduced and the efficiency of heat map generation improved. By considering distance decay and intra-community smoothing, the impact of noise and outliers can be effectively reduced, improving the robustness of the heat map.

[0039] Figure 2 This is a comparison diagram of the thermal distribution of the grid in the embodiment of the present invention. Figure 2As shown in the figure below, this technical solution (left) has significant advantages: the thermal value of the thermal center area (grid center coordinates [5,5] and [6,6]) reaches 0.95, significantly higher than the 0.81 of the PageRank algorithm (center figure) and the 0.76 of the HITS algorithm (right figure), representing improvements of 17.3% and 25.0%, respectively. Furthermore, this technical solution has a more reasonable thermal gradient distribution, forming a clear concentric circular thermal gradient from the center to the edge. The thermal value decreases from 0.95 to 0.30, with a range of 0.65. This is 62.5% and 170.8% higher than the 0.40 of the PageRank algorithm and the 0.24 of the HITS algorithm, respectively. This significant thermal difference helps to more accurately identify key node areas in the grid. Furthermore, this technical solution demonstrates greater consistency in the heat distribution within the community. For example, the heat values ​​of the four nodes in the central community (coordinates [5,5], [5,6], [6,5], and [6,6]) are both 0.95 and 0.92, demonstrating the effectiveness of thermal smoothing within the community. In contrast, the PageRank and HITS algorithms produce more uniform heat distributions, making it difficult to highlight key node regions. This result fully demonstrates the superiority of this technical solution in constructing a heat diffusion function that combines community structure characteristics with multidimensional centrality metrics, more accurately reflecting the importance and influence of grid nodes.

[0040] In an optional embodiment, extracting a target behavior feature sequence based on a behavior scoring matrix, combining it with the dynamic security policy of the employee's department, and calculating the abnormal behavior risk weight coefficient for classification include: Input the behavior score matrix into a pre-trained deep neural network, which includes a feature extraction module and a risk assessment module; The feature extraction module calculates the conditional mutual information and partial correlation coefficients between each rating dimension in the behavior rating matrix, constructs a dimension association network, uses a spectral clustering algorithm to perform community segmentation to obtain rating dimension association groups, performs principal component analysis on each association group to obtain a feature vector, and splices them in time sequence to generate a target behavior feature sequence; A dynamic security strategy is constructed based on the department's historical security event sequence. The accumulation and verification algorithm is executed to identify state change points. A Markov state transition model is established between adjacent change points. The state prediction results output by the Markov state transition model are integrated with the security protection rules based on the membership function to generate the department's dynamic security strategy vector. The risk assessment module inputs the target behavior feature sequence and the department's dynamic security policy vector into the multi-head attention mechanism, calculates the dimension attention weight, and combines the dimension attention weights of multiple attention heads to generate a risk weight coefficient; The target behavior feature sequence with added risk weight coefficient is input into the residual network, the feature channels of the target behavior feature sequence are weighted in importance, and the correlation features of the temporally adjacent features in the target behavior feature sequence are extracted through convolution operation; The processed features are input into the fully connected layer to obtain the probability distribution of abnormal behavior types, calculate the information entropy, and calculate the risk propagation probability in combination with the state transition matrix. The abnormal behavior type and risk level are obtained by combining the information entropy and risk propagation probability.

[0041] To accurately identify and assess the risks of abnormal employee behavior, this implementation proposes an abnormal behavior detection method based on deep neural networks and dynamic security policies. This method uses a pre-trained deep neural network to extract target behavior features. Combined with the employee's department's dynamic security policy, it calculates risk weights for different types of abnormal behavior, ultimately determining the abnormal behavior type and risk level.

[0042] First, collect employee behavior data and construct a behavior scoring matrix. For example, suppose we collect behavioral data such as employee A's login time, accessed file types, and data upload volume over a week and convert it into a scoring matrix. Each row represents a day, each column represents a behavior, and the value in the matrix represents the score of that behavior. For example, the more unusual the login time, the higher the score.

[0043] The behavioral scoring matrix is ​​fed into a pre-trained deep neural network. This network comprises a feature extraction module and a risk assessment module. In the feature extraction module, a kernel density estimation model is first fitted to each scoring dimension in the scoring matrix (e.g., login time) to describe the distribution of the data in that dimension. Then, the kernel density estimation model is used to calculate the conditional mutual information and partial correlation coefficients between the scoring dimensions to measure the degree of correlation between the dimensions. For example, a high correlation between login time and accessed file type results in a larger conditional mutual information and partial correlation coefficient.

[0044] Based on the calculated conditional mutual information and partial correlation coefficient, a dimension association network is constructed, where nodes represent scoring dimensions and edge weights represent the strength of association between dimensions. A spectral clustering algorithm is used to partition this network into communities, grouping strongly correlated dimensions into the same community. For example, dimensions such as login time, accessed file type, and data upload volume may be grouped into the same community. Principal component analysis is performed on each community to extract key features and generate feature vectors. The feature vectors of each community are concatenated in chronological order to generate a target behavior feature sequence.

[0045] A dynamic security strategy is also constructed based on the department's historical security event sequences. A cumulative sum verification algorithm is applied to the historical security event sequences to identify state change points. For example, a sudden increase in the number of security events within a certain time period is identified as a state change point. A Markov state transition model is established between adjacent state change points. This model consists of a state transition matrix and a feature weight vector. The state transition matrix describes the probability of the system transitioning from one state to another, while the feature weight vector describes the degree to which different features influence the state transition.

[0046] The state prediction results from the Markov state transition model are fed into a fuzzy inference system. Based on a membership function, the system integrates the state prediction results with security protection rules to generate a dynamic departmental security policy vector. For example, if the state prediction results indicate a high-risk state for the system, the security policy vector becomes more stringent.

[0047] In the risk assessment module, the target behavior feature sequence and the department's dynamic security policy vector are input into a multi-head attention mechanism. Each attention head uses the target behavior feature sequence as the query matrix and the department's dynamic security policy vector as the key and value matrices to calculate dimensional attention weights. The dimensional attention weights from multiple attention heads are combined to generate a risk weight coefficient.

[0048] The target behavior feature sequence, with risk weights added, is fed into an improved residual network. This network incorporates channel attention units and spatial attention units within the residual block. The channel attention unit weights the importance of feature channels, while the spatial attention unit extracts correlation features between temporally adjacent features through convolution operations. The processed features are fed into a fully connected layer to generate a probability distribution of abnormal behavior types.

[0049] Information entropy is calculated based on the probability distribution and combined with the state transition matrix to calculate the risk propagation probability. Combining information entropy and risk propagation probability yields the type and risk level of abnormal behavior. For example, if a behavior has both a high information entropy and a high risk propagation probability, it is considered high-risk abnormal behavior.

[0050] In this embodiment, by combining deep neural networks with dynamic security policies, abnormal behavior can be more accurately identified, reducing false positives and missed alerts. By calculating risk weight coefficients and risk propagation probabilities, the risk level of abnormal behavior can be more comprehensively assessed, providing more accurate decision support for security management. The use of efficient deep learning models and algorithms can rapidly process large amounts of data, enabling real-time abnormal behavior detection.

[0051] In an optional embodiment, the diffusion path of abnormal behavior within the enterprise is analyzed, the risk diffusion probability is calculated, and the risk diffusion probability is combined with the abnormal behavior type to generate a risk situation index. Determining the security warning level includes: Construct a risk propagation network, where nodes represent enterprise departments and edges represent business connections between departments. Construct a node feature vector that includes department size, authority level, number of historical security incidents, and risk level. Construct an edge feature vector that includes business interaction frequency, information flow intensity, and access control strength. An adjacency matrix is ​​constructed based on the node feature vectors and edge feature vectors, node importance is calculated using an iterative algorithm, a state transition model is constructed on the risk propagation network, state transition probability is calculated based on the node importance, edge feature vectors are mapped to propagation attenuation coefficients, a path attenuation function is constructed in combination with the shortest path between nodes, and a risk propagation probability matrix is ​​calculated based on the state transition probability, propagation attenuation coefficient, and path attenuation function; For the detected abnormal behavior source department, recursively calculate the risk propagation probability of the target department and update it to the probability matrix; Construct an abnormal behavior hazard degree matrix and a sensitivity matrix, multiply the abnormal behavior hazard degree matrix by the sensitivity matrix to obtain a risk impact matrix, extract the risk propagation probability corresponding to the target department from the risk propagation probability matrix, and perform a weighted combination of the risk impact matrix and the risk propagation probability to obtain a risk situation index for the target department; The risk situation index of the target department is weighted and accumulated with the corresponding node importance to obtain the target risk situation index, the target risk situation index is compared with the preset multi-level warning threshold, and the current safety warning level is determined according to the comparison result.

[0052] For example, a risk propagation network is constructed. Each department within the enterprise is considered a network node, and the business relationships between departments are considered edges. For example, if there is a business relationship between the sales department and the finance department, an edge connecting the two departments is established in the network. A feature vector is then constructed for each node. The feature vector contains information such as department size, authority level, number of historical security incidents, and risk level. For example, a department with 50 employees, high-level access rights, two security incidents in the past year, and a medium risk level can have a node feature vector represented as {50, high-level, 2, medium}. Similarly, a feature vector is constructed for each edge, containing information such as business interaction frequency, information flow intensity, and access control strength. For example, if the sales department and the finance department interact twice a week, with high information flow intensity and medium access control strength, the feature vector of the edge connecting the two departments can be represented as {2 times a week, high, medium}.

[0053] An adjacency matrix is ​​constructed based on the node eigenvectors and edge eigenvectors. Each element of the adjacency matrix represents the strength of the connection between two nodes. This strength is calculated based on a weighted combination of the node eigenvectors and edge eigenvectors. For example, if the department size has a weight of 0.2, the authority level has a weight of 0.3, the number of historical security incidents has a weight of 0.1, and the risk level has a weight of 0.4, then the weighted combination of the node eigenvectors for a department is: 50 × 0.2 + Advanced × 0.3 + 2 × 0.1 + Medium × 0.4. Edge weights are calculated similarly.

[0054] An iterative algorithm is used to calculate node importance. Initially, a weighted combination of node feature vectors is used as the initial value for the node importance. The node importance is then continuously updated based on the weighted combination of feature vectors connected to the node and the importance of neighboring nodes until the importance value no longer changes significantly. For example, if Department A has an initial importance of 10 and is connected to Department B, which has an initial importance of 5, and the weight of the edge connecting A and B is 0.8, then the importance of Department A in the next iteration will be 10 + 0.8 × 5.

[0055] A state transition model is constructed on the risk propagation network. The state transition probability is calculated based on the node importance and edge eigenvectors. The state transition probability represents the likelihood that abnormal behavior will spread from one department to another. For example, if the importance of Department A is 10, the importance of Department B is 5, and the weight of the edge connecting A and B is 0.8, the probability that abnormal behavior will spread from A to B is 0.8×(10 / (10+5)). The edge eigenvectors are also mapped to propagation attenuation coefficients, which represent the degree to which the influence of abnormal behavior decreases during the propagation process. The shortest path between nodes is used to construct a path attenuation function, which represents the degree to which the influence of abnormal behavior decreases with the propagation distance. The state transition probability, propagation attenuation coefficient, and path attenuation function are combined to calculate the risk propagation probability matrix, where each element represents the probability of abnormal behavior spreading from one department to another.

[0056] When abnormal behavior is detected in a department, a recursive algorithm is used to calculate the risk diffusion probability for other departments. Starting with the initial risk probability of the department experiencing the abnormal behavior, the risk diffusion probability for each department is calculated incrementally over time, and the calculated results are updated in the risk diffusion probability matrix. For example, if abnormal behavior occurs in Department A with an initial probability of 1, and after one time step, the risk diffusion probability for Department B is 0.6, the risk diffusion probability from A to B in the risk diffusion probability matrix is ​​updated to 0.6.

[0057] Construct a matrix of the degree of harm caused by abnormal behavior. For each type of abnormal behavior, construct a basic harm vector, including information such as the degree of data leakage, duration of business interruption, scale of asset loss, and degree of reputation impact. For example, if 100 records are leaked, business interruption lasts for 2 hours, asset loss is 10,000 yuan, and the degree of reputation impact is low, then the basic harm vector for this abnormal behavior is {100, 2, 10,000, low}. Construct a sensitivity vector based on the business importance, data sensitivity, and system vulnerability of the target department. For example, if the business importance is high, the data sensitivity is high, and the system vulnerability is medium, then the sensitivity vector for this department is {high, high, medium}. Combine the sensitivity vectors of all departments to form a sensitivity matrix.

[0058] The risk impact matrix is ​​obtained by multiplying the abnormal behavior hazard degree matrix with the sensitivity matrix. The risk propagation probability corresponding to the target department in the risk propagation probability matrix is ​​extracted, and the risk impact matrix and the risk propagation probability are weighted and combined to obtain the risk situation index of the target department.

[0059] The risk situation index of the target department is weighted by the corresponding node importance to obtain the weighted risk situation index, and the weighted risk situation indexes of all target departments are accumulated to obtain the target risk situation index.

[0060] The target risk index is compared with the preset multi-level warning thresholds, and the current security warning level is determined based on the comparison results. For example, if the target risk index is greater than or equal to 80, a high-level warning is issued; if the target risk index is greater than or equal to 50 and less than 80, a medium-level warning is issued; if the target risk index is less than 50, a low-level warning is issued.

[0061] In this embodiment, by combining multiple factors such as abnormal behavior type, transmission path, department importance, and risk impact, the risk situation can be more accurately assessed, false positives and missed positives can be reduced, and the accuracy of early warnings can be improved. By analyzing the risk diffusion path and probability, the scope and extent of the risk spread can be predicted in advance, helping enterprises to deploy targeted security measures, block the risk transmission chain, and reduce risk losses. By quantitatively assessing the risk situation, enterprises can better understand the distribution of security risks, thereby optimizing the allocation of security resources, investing limited resources where they are most needed, and improving the efficiency of security protection.

[0062] Figure 3 This is a comparative analysis diagram of the risk situation index warning threshold and historical security events in an embodiment of the present invention. Figure 3The figure shows the trend of the risk situation index over an 80-day period of enterprise security monitoring, comparing the early warning effectiveness of this solution with that of a traditional method (CVSS scoring system). The horizontal axis represents time (days), and the vertical axis represents the risk situation index. The four horizontal dashed lines in the figure represent the four-level warning thresholds (0.8, 0.7, 0.6, and 0.5, from top to bottom). The curves show that the risk situation index calculated by this solution (square markers) is more sensitive, enabling early detection of rising risk trends. On the 35th day, the risk situation index of this solution reached 0.78 (approaching the level 1 warning threshold), while the traditional method only displayed a risk value of 0.45 (not triggering a level 4 warning). Subsequently, a data center attack incident (red diamond markers) occurred on the 35th day, demonstrating the early warning accuracy of this solution. Similarly, on the 45th day, before the IT system vulnerability was exploited, the risk index of this solution reached 0.65 (level 3 warning), providing a window for intervention by the security team. Overall, the risk profile of this technical solution shows a clear upward trend before an incident occurs, with a lead time of approximately 5-10 days. Traditional CVSS scoring methods, which focus solely on static scores of known vulnerabilities, fail to effectively capture the dynamic propagation of network risks, resulting in delayed warnings. This chart strongly demonstrates the effectiveness and timeliness of this technical solution in providing early warning for enterprise network security risks.

[0063] In an optional implementation, based on the security warning level, a warning response strategy is invoked to initiate real-time blocking of high-risk warnings. At the same time, associated accounts are tracked to establish a risk association map, potential risk propagation nodes are identified for proactive protection, and a warning report is generated, including: Receive security warning level information, call the corresponding level response strategy from the warning response strategy library, and determine the real-time blocking threshold, authority control intensity and monitoring frequency based on the warning level; Obtain the employee account that triggered the alert and the corresponding operational behavior characteristics. Build an abnormal behavior profile based on the operation time distribution, resource access pattern, and behavioral link characteristics. Match this with the preset department security baseline to obtain an abnormality level indicator. Based on the abnormality level indicator and security alert level, determine the scope of permission compression and implement access control to generate behavioral audit data. Extract historical business collaboration records of employee accounts, identify high-frequency interaction accounts by combining abnormal behavior profiling and behavioral audit data, construct a risk association map, perform community discovery and node importance analysis on the risk association map, calculate the degree centrality, betweenness centrality, and eigenvector centrality of the nodes, construct a risk scoring model by combining the node's historical security events, permission level, and the abnormality degree index, identify risk propagation nodes based on the risk scoring model, and map the structural characteristics of the risk association map into propagation influence factors; Deploy behavioral monitoring probes at risk propagation nodes, build multi-dimensional behavioral baselines based on behavioral audit data and abnormal behavior profiles, detect behavioral deviations in real time, trigger permission control policies when the deviation exceeds the real-time blocking threshold, and deploy intelligent honeypots to capture attack signatures. Based on behavioral audit data, abnormal behavior portraits and attack characteristics, the causal reasoning algorithm is used to restore the attack chain, and the risk association map and propagation impact factors are combined to predict the risk spread range and generate an early warning report.

[0064] For example, the system first receives security alert level information. For example, if the system receives a "High" alert, it then calls the corresponding response strategy from the alert response strategy library. Assume that the strategy for a "High" alert is: a real-time blocking threshold of 80, permission control intensity of "High," and a monitoring frequency of once per minute.

[0065] Obtain the employee account that triggered the alert and the corresponding operational behavior characteristics. For example, employee account A triggered the alert, and its operational behavior characteristics include: accessing a sensitive database at 2 a.m., downloading a large amount of data, and attempting to connect to an external server. Based on these characteristics, the system combines the operation time distribution (abnormal operation at 2 a.m.), resource access mode (accessing a sensitive database), and behavioral link characteristics (connecting to an external server after downloading data) to build an abnormal behavior profile. Match this profile with the preset department security baseline. For example, the department usually does not allow access to sensitive databases during non-working hours, thereby obtaining an abnormality level index. Assume that the abnormality level index is 90. Combine the abnormality level index (90) and the security alert level (high level) to determine the permission compression range. Since both the index and the alert level are high, the system will perform high-intensity access control on employee account A, for example, immediately freeze account A's access rights and generate behavioral audit data to record all operations of account A.

[0066] The system extracts historical business collaboration records for employee account A. For example, A frequently collaborates and shares files with B and C. Combining the established abnormal behavior profile with behavioral audit data, the system uses a collaborative filtering algorithm to identify accounts B and C with frequent interactions. The system constructs a risk association graph for A, B, and C. It then performs community discovery and node importance analysis on this graph, calculating a node's degree centrality (how many other nodes it is connected to), betweenness centrality (how many shortest paths pass through it), and eigenvector centrality (nodes connected to important nodes are also important). A risk scoring model is constructed based on the node's historical security events (for example, B has triggered a low-level alert), permission level (for example, C has higher permissions), and anomaly index (A's anomaly index is 90). Assume that B's risk score is 60 and C's is 75. Based on this risk scoring model, the system identifies B and C as potential risk propagation nodes and maps the structural features of the risk association graph (for example, the closeness of A's connections with B and C) into propagation influence factors. For example, A's influence factor on B is 0.8, and its influence factor on C is 0.6.

[0067] Deploy behavioral monitoring probes on risk propagation nodes B and C. Build a multi-dimensional behavioral baseline based on existing behavioral audit data and abnormal behavior profiles. For example, B and C typically access specific servers during working hours. The system detects the degree of behavioral deviation of B and C in real time. Assuming B's deviation reaches 85, exceeding the real-time blocking threshold of 80, the system immediately triggers permission control policies, for example, restricting B's access rights. At the same time, deploy intelligent honeypots in the network area where B and C are located to capture attack signatures, such as discovering an external IP attempting to connect to B's computer.

[0068] Based on collected behavioral audit data, abnormal behavior profiles, and attack signatures, causal inference algorithms are used to reconstruct the complete attack chain of abnormal behavior. For example, person A downloads data and attempts to transmit it to other people through an external server. Combining risk association maps and propagation influencing factors, the scope of risk spread is predicted. For example, person B is likely to have been influenced by person A and involved in a data leak. The system generates an early warning report that includes the attack path, propagation trends, and recommended actions (for example, isolating person A's computer and strengthening monitoring of person B and person C).

[0069] In this embodiment, by constructing abnormal behavior profiles, risk association maps, and risk scoring models, high-risk accounts and potential risk propagation nodes can be more accurately identified, avoiding the limitations of relying solely on a single indicator, thereby improving the accuracy and comprehensiveness of risk identification. By deploying behavior monitoring probes and smart honeypots at risk propagation nodes, attack characteristics and behavioral deviations can be proactively captured, achieving early warning and real-time blocking of potential threats, thereby transforming security defense from passive response to active attack. By pre-setting hierarchical response strategies and real-time blocking mechanisms, corresponding control measures can be quickly executed according to the warning level, shortening response time, effectively controlling the scope of risk spread, and avoiding greater losses caused by security incidents.

[0070] In an optional implementation, behavior monitoring probes are deployed at risk propagation nodes. A multi-dimensional behavior baseline is constructed based on behavior audit data and abnormal behavior profiles. The degree of behavioral deviation is detected in real time. When the deviation exceeds the real-time blocking threshold, the permission control policy is triggered. The deployment of intelligent honeypots to capture attack characteristics includes: Deploy system-layer, application-layer, and network-layer probes at risk propagation nodes to collect process behavior, file operations, network connections, business operations, data access, traffic, and protocol data, and transmit them to the behavior analysis engine in real time. Conduct time series analysis on process behavior, file operation, and business operation data, and use kernel density estimation to construct a time dimension baseline. Conduct sequence analysis on business operations and data access data, build a Markov chain model to obtain the operation sequence baseline, and build a resource affinity matrix to obtain the resource access baseline; Conduct behavioral analysis on network connection data, traffic data, and protocol data to extract data transmission characteristics, and build a data flow baseline based on the data transmission characteristics; The real-time collected data is compared with the time dimension baseline, operation sequence baseline, resource access baseline, and data flow baseline to calculate the feature vector. The Mahalanobis distance is used to calculate the time dimension deviation, operation sequence deviation, resource access deviation, and data flow deviation. The weighted combination of the deviations of each dimension is used to obtain the comprehensive deviation. An intelligent honeypot system is deployed in the network area where the risk propagation node is located. A service fingerprint is constructed based on network connection data and protocol data. A dynamic simulation service is constructed based on the service fingerprint. A deep reinforcement learning model is used to train an interactive decision maker. The interactive decision maker simulates service interaction behavior based on the business operation data, thereby capturing attack characteristics.

[0071] For example, by analyzing network topology, traffic patterns, vulnerability scan results, and threat intelligence, we can identify nodes in the network that are vulnerable to attack and prone to spreading malicious behavior, such as critical servers, border routers, and core switches. For example, in an enterprise network, a vulnerability scan revealed a high-risk vulnerability in a web server. Furthermore, this server is connected to a core switch and receives a high volume of traffic, so the web server is identified as a risk-propagation node.

[0072] Next, deploy multiple types of probes. Deploy system-layer, application-layer, and network-layer probes on identified risk propagation nodes. System-layer probes are used to collect process behavior data (such as process startup, termination, file reading and writing, etc.), file operation data (such as file creation, modification, deletion, etc.), and network connection data (such as connection establishment, disconnection, data transmission volume, etc.). Application-layer probes are used to collect business operation data (such as user login, data query, transaction records, etc.) and data access data (such as SQL statements for accessing databases, paths for accessing files, etc.). Network-layer probes are used to collect traffic data (such as source IP, destination IP, port number, packet size, etc.) and protocol data (such as TCP, UDP, HTTP, etc.). For example, deploy system-layer probes on a web server to collect data such as process startup and file reading and writing; deploy application-layer probes to collect data such as user login and database query; and deploy network-layer probes to collect HTTP request and response data.

[0073] Analyze the collected multi-source heterogeneous data to build a time dimension baseline, operation sequence baseline, resource access baseline, and data flow baseline. Analyze the time distribution patterns of process behavior data, file operation data, and business operation data. For example, a process usually starts at 8 a.m. every day to build a time dimension baseline. Analyze the sequence patterns of business operation data and data access data. For example, users usually perform query operations after logging in to build an operation sequence baseline. Analyze data access data. For example, a user usually only accesses a specific database to build a resource access baseline. Analyze network connection data, traffic data, and protocol data. For example, a web server usually receives HTTP requests and returns HTTP responses to build a data flow baseline. For example, by analyzing the access logs of the web server, it is found that under normal circumstances, 8 a.m. to 10 a.m. every day is the peak access period, and the number of visits is relatively low during other time periods. In this case, a time dimension baseline can be built to determine abnormal access behavior.

[0074] Compare the real-time collected data with the established baseline to calculate the time dimension deviation, operation sequence deviation, resource access deviation, and data flow deviation. For example, if a web server receives a large number of access requests at 2 a.m., the time dimension deviation is high. Weighted combinations of the deviations in each dimension are used to obtain a comprehensive deviation. The permission control policy is then triggered. A real-time blocking threshold is pre-set. When the comprehensive deviation exceeds the threshold, the permission control policy is triggered, such as blocking abnormal access, isolating infected hosts, and interrupting malicious connections. For example, the comprehensive deviation threshold is set to 0.8. When the comprehensive deviation of the web server reaches 0.9, the permission control policy is triggered to block external access to the server.

[0075] Simultaneously deploy smart honeypots and capture attack signatures. Deploy the smart honeypot system in the network area where the risk propagation node resides. Build service fingerprints based on network connection and protocol data, such as the HTTP service fingerprint of a web server. Dynamic simulation services are built based on these service fingerprints to mimic the behavior of real services. For example, a honeypot can simulate the login page of a web server. A deep reinforcement learning model is used to train an interactive decision maker. The interactive decision maker simulates service interaction behaviors based on business operation data, such as user logins and data queries, thereby capturing attack signatures, such as attempts to log in with weak passwords or SQL injections.

[0076] In this embodiment, multi-dimensional behavioral baselines combined with multi-type probe data can more comprehensively characterize normal behavior patterns, improve the accuracy of abnormal behavior detection, and reduce false positives and missed negatives. Real-time behavioral deviation detection and permission control strategies can promptly detect and prevent malicious behavior, reducing security risks. Smart honeypots can proactively capture attack signatures, proactively understand attacker intentions and methods, and provide more information for security defense.

[0077] A second aspect of an embodiment of the present invention provides an enterprise employee behavior analysis and security risk early warning monitoring system, the system comprising: The first unit is used to collect employee operational behavior data at work terminals and preprocess it to obtain a behavioral feature sequence. Based on the behavioral feature sequence, the temporal dependency characteristics of the behavior are extracted to generate a temporal feature vector. The employee's office area is divided into multiple virtual work grids, the behavioral correlation strength between different grids is calculated, and a heat distribution map of employee behavior activities is constructed. The heat distribution map of behavior activities is then integrated with the temporal feature vector to obtain a behavioral feature tensor, which is then used to generate a behavioral scoring matrix. The second unit is used to extract the target behavior feature sequence based on the behavior scoring matrix, and calculate the abnormal behavior risk weight coefficient for classification based on the dynamic security policy of the employee's department. It also analyzes the diffusion path of abnormal behavior within the enterprise, calculates the risk diffusion probability, and combines the risk diffusion probability with the abnormal behavior type to generate a risk situation index to determine the security warning level. The third unit is used to call the warning response strategy based on the security warning level, initiate real-time blocking of high-risk warnings, track related accounts to establish a risk association map, identify potential risk propagation nodes for active protection and generate warning reports, push them to the security management platform, record the disposal operations of security managers, extract effective protection rules in the disposal operations, and realize continuous optimization of the risk warning mechanism.

[0078] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0079] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0080] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for analyzing enterprise employee behavior and early warning of safety risks, characterized in that: include: Collect employee operational behavior data at work terminals and preprocess it to obtain a behavioral feature sequence. Based on the behavioral feature sequence, extract the temporal dependency characteristics of the behavior and generate a temporal feature vector. At the same time, divide the employee office area into multiple virtual work grids, calculate the behavioral correlation strength between different grids, and construct a heat distribution map of employee behavior activities. This heat distribution map is then fused with the temporal feature vector to obtain a behavioral feature tensor, which is then used to generate a behavioral scoring matrix. Based on the behavior scoring matrix, the target behavior feature sequence is extracted. Combined with the dynamic security policy of the employee's department, the risk weight coefficient of abnormal behavior is calculated for classification. At the same time, the diffusion path of abnormal behavior within the enterprise is analyzed, and the risk diffusion probability is calculated. The risk diffusion probability is combined with the abnormal behavior type to generate a risk situation index to determine the security warning level. Based on the security warning level, the warning response strategy is called, and real-time blocking is initiated for high-risk warnings. At the same time, the associated accounts are tracked to establish a risk association map, potential risk propagation nodes are identified for active protection, and warning reports are generated and pushed to the security management platform. The handling operations of security managers are recorded, and effective protection rules in the handling operations are extracted to achieve continuous optimization of the risk warning mechanism.

2. The method according to claim 1, characterized in that The employee office area is divided into multiple virtual work grids. The behavioral correlation strength between different grids is calculated to construct a heat distribution map of employee behavior activities. The heat distribution map of behavior activities is integrated with the time series feature vector to obtain a behavior feature tensor. The behavior feature tensor is used to generate a behavior scoring matrix, including: The office area is initially gridded to obtain an initial virtual work grid. The position coordinate sequence in the employee activity trajectory data is obtained. The personnel density and activity frequency values ​​in each grid cell are calculated. A grid importance index is constructed. The initial virtual work grid is adaptively divided according to the grid importance index to obtain a multi-level grid structure. Analyze employee activity trajectories in a multi-level grid structure, extract the time interval sequence and behavior transition sequence of employee migration between grids, calculate the average migration time, migration frequency and behavior similarity between grid pairs, construct a spatiotemporal migration tensor, decompose the spatiotemporal migration tensor to obtain a grid correlation strength matrix, and construct a grid topology structure based on the grid correlation strength matrix; The grid topology is used to calculate the centrality index of the grid nodes and the grid community structure characteristics, and the heat diffusion function is calculated in combination with the grid association strength matrix. The heat diffusion function is applied to each grid node to obtain an initial heat distribution, and a heat distribution map is generated through iterative updating. The heat distribution map is subjected to feature extraction to obtain a spatial feature vector. Performing attention calculation on the spatial feature vector and the temporal feature vector to obtain a feature fusion weight, and performing tensor fusion on the temporal feature vector and the spatial feature vector based on the feature fusion weight to generate a spatiotemporal feature tensor; Based on the spatiotemporal feature tensor, a multi-task learning approach is used to simultaneously predict the behavioral risk level and abnormality degree, and generate a behavioral scoring matrix containing risk level and abnormality score.

3. The method according to claim 2, characterized in that The grid topology is used to calculate the centrality index of the grid nodes and the grid community structure characteristics, and the heat diffusion function is calculated in combination with the grid association strength matrix. The heat diffusion function is applied to each grid node to obtain the initial heat distribution. The heat distribution map is generated through iterative updating, including: Extract the adjacency relationship of grid nodes to construct a local connection matrix, obtain the node degree value statistically, extract the weight value from the grid association strength matrix, and calculate the ratio of the node degree value to the weight value to obtain the degree centrality index; A dynamic programming algorithm is used to calculate all the shortest paths between node pairs in the grid topology structure, and the ratio of the number of shortest paths passing through the target node to the total number of paths is counted to obtain the betweenness centrality index. Initialize each grid node as an independent community, construct a modularity function based on degree centrality and betweenness centrality indicators, and obtain the grid community structure characteristics by iteratively merging adjacent communities with the largest modularity gain and performing local optimization. Normalizing the degree centrality index and the betweenness centrality index, determining a centrality weight coefficient based on the position of the grid node in the grid community structure characteristics, and combining the weighted degree centrality index and betweenness centrality index to obtain an initial thermal value of the grid node; Calculating the Euclidean distance matrix between nodes in the grid topology, weighting the distance decay coefficient based on community structure characteristics, and combining it with the initial thermal value to construct a thermal diffusion function; applying the thermal diffusion function to each grid node in the grid topology to obtain an initial thermal distribution; The thermal conduction between grid nodes is calculated based on the thermal diffusion function, the thermal values ​​of the grid nodes in the community are smoothed in combination with the grid community structure characteristics, the thermal values ​​of the grid nodes are updated, and the process is iterated until the thermal distribution converges to obtain a thermal distribution map.

4. The method according to claim 1, wherein Based on the behavior scoring matrix, the target behavior feature sequence is extracted. Combined with the dynamic security policy of the employee's department, the abnormal behavior risk weight coefficient is calculated for classification, including: Input the behavior score matrix into a pre-trained deep neural network, which includes a feature extraction module and a risk assessment module; The feature extraction module calculates the conditional mutual information and partial correlation coefficients between each rating dimension in the behavior rating matrix, constructs a dimension association network, uses a spectral clustering algorithm to perform community segmentation to obtain rating dimension association groups, performs principal component analysis on each association group to obtain a feature vector, and splices them in time sequence to generate a target behavior feature sequence; A dynamic security strategy is constructed based on the department's historical security event sequence. The accumulation and verification algorithm is executed to identify state change points. A Markov state transition model is established between adjacent change points. The state prediction results output by the Markov state transition model are integrated with the security protection rules based on the membership function to generate the department's dynamic security strategy vector. The risk assessment module inputs the target behavior feature sequence and the department's dynamic security policy vector into the multi-head attention mechanism, calculates the dimension attention weight, and combines the dimension attention weights of multiple attention heads to generate a risk weight coefficient; The target behavior feature sequence with added risk weight coefficient is input into the residual network, the feature channels of the target behavior feature sequence are weighted in importance, and the correlation features of the temporally adjacent features in the target behavior feature sequence are extracted through convolution operation; The processed features are input into the fully connected layer to obtain the probability distribution of abnormal behavior types, calculate the information entropy, and calculate the risk propagation probability in combination with the state transition matrix. The abnormal behavior type and risk level are obtained by combining the information entropy and risk propagation probability.

5. The method according to claim 1, characterized in that Analyze the diffusion path of abnormal behavior within the enterprise, calculate the risk diffusion probability, combine the risk diffusion probability with the abnormal behavior type to generate a risk situation index, and determine the security warning level including: Construct a risk propagation network, where nodes represent enterprise departments and edges represent business connections between departments. Construct a node feature vector that includes department size, authority level, number of historical security incidents, and risk level. Construct an edge feature vector that includes business interaction frequency, information flow intensity, and access control strength. An adjacency matrix is ​​constructed based on the node feature vectors and edge feature vectors, node importance is calculated using an iterative algorithm, a state transition model is constructed on the risk propagation network, state transition probability is calculated based on the node importance, edge feature vectors are mapped to propagation attenuation coefficients, a path attenuation function is constructed in combination with the shortest path between nodes, and a risk propagation probability matrix is ​​calculated based on the state transition probability, propagation attenuation coefficient, and path attenuation function; For the detected abnormal behavior source department, recursively calculate the risk propagation probability of the target department and update it to the probability matrix; Construct an abnormal behavior hazard degree matrix and a sensitivity matrix, multiply the abnormal behavior hazard degree matrix by the sensitivity matrix to obtain a risk impact matrix, extract the risk propagation probability corresponding to the target department from the risk propagation probability matrix, and perform a weighted combination of the risk impact matrix and the risk propagation probability to obtain a risk situation index for the target department; The risk situation index of the target department is weighted and accumulated with the corresponding node importance to obtain the target risk situation index, the target risk situation index is compared with the preset multi-level warning threshold, and the current safety warning level is determined according to the comparison result.

6. The method according to claim 1, characterized in that Based on the security warning level, the warning response strategy is called to initiate real-time blocking of high-risk warnings. At the same time, the associated accounts are tracked to establish a risk association map, identify potential risk propagation nodes, proactively protect against them, and generate warning reports, including: Receive security warning level information, call the corresponding level response strategy from the warning response strategy library, and determine the real-time blocking threshold, authority control intensity and monitoring frequency based on the warning level; Obtain the employee account that triggered the alert and the corresponding operational behavior characteristics. Build an abnormal behavior profile based on the operation time distribution, resource access pattern, and behavioral link characteristics. Match this with the preset department security baseline to obtain an abnormality level indicator. Based on the abnormality level indicator and security alert level, determine the scope of permission compression and implement access control to generate behavioral audit data. Extract historical business collaboration records of employee accounts, identify high-frequency interaction accounts by combining abnormal behavior profiling and behavioral audit data, construct a risk association map, perform community discovery and node importance analysis on the risk association map, calculate the degree centrality, betweenness centrality, and eigenvector centrality of the nodes, construct a risk scoring model by combining the node's historical security events, permission level, and the abnormality degree index, identify risk propagation nodes based on the risk scoring model, and map the structural characteristics of the risk association map into propagation influence factors; Deploy behavioral monitoring probes at risk propagation nodes, build multi-dimensional behavioral baselines based on behavioral audit data and abnormal behavior profiles, detect behavioral deviations in real time, trigger permission control policies when the deviation exceeds the real-time blocking threshold, and deploy intelligent honeypots to capture attack signatures. Based on behavioral audit data, abnormal behavior portraits and attack characteristics, the causal reasoning algorithm is used to restore the attack chain, and the risk association map and propagation impact factors are combined to predict the risk spread range and generate an early warning report.

7. The method according to claim 6, characterized in that Deploy behavioral monitoring probes at risk propagation nodes, build a multi-dimensional behavioral baseline based on behavioral audit data and abnormal behavior profiles, detect behavioral deviations in real time, and trigger permission control policies when the deviation exceeds the real-time blocking threshold. Deploy intelligent honeypots to capture attack characteristics, including: Deploy system-layer, application-layer, and network-layer probes at risk propagation nodes to collect process behavior, file operations, network connections, business operations, data access, traffic, and protocol data, and transmit them to the behavior analysis engine in real time. Conduct time series analysis on process behavior, file operation, and business operation data, and use kernel density estimation to construct a time dimension baseline. Conduct sequence analysis on business operations and data access data, build a Markov chain model to obtain the operation sequence baseline, and build a resource affinity matrix to obtain the resource access baseline; Conduct behavioral analysis on network connection data, traffic data, and protocol data to extract data transmission characteristics, and build a data flow baseline based on the data transmission characteristics; The real-time collected data is compared with the time dimension baseline, operation sequence baseline, resource access baseline, and data flow baseline to calculate the feature vector. The Mahalanobis distance is used to calculate the time dimension deviation, operation sequence deviation, resource access deviation, and data flow deviation. The weighted combination of the deviations of each dimension is used to obtain the comprehensive deviation. An intelligent honeypot system is deployed in the network area where the risk propagation node is located. A service fingerprint is constructed based on network connection data and protocol data. A dynamic simulation service is constructed based on the service fingerprint. A deep reinforcement learning model is used to train an interactive decision maker. The interactive decision maker simulates service interaction behavior based on the business operation data, thereby capturing attack characteristics.

8. An enterprise employee behavior analysis and safety risk early warning monitoring system, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The first unit is used to collect employee operational behavior data at work terminals and preprocess it to obtain a behavioral feature sequence. Based on the behavioral feature sequence, the temporal dependency characteristics of the behavior are extracted to generate a temporal feature vector. The employee's office area is divided into multiple virtual work grids, the behavioral correlation strength between different grids is calculated, and a heat distribution map of employee behavior activities is constructed. The heat distribution map of behavior activities is then integrated with the temporal feature vector to obtain a behavioral feature tensor, which is then used to generate a behavioral scoring matrix. The second unit is used to extract the target behavior feature sequence based on the behavior scoring matrix, and calculate the abnormal behavior risk weight coefficient for classification based on the dynamic security policy of the employee's department. It also analyzes the diffusion path of abnormal behavior within the enterprise, calculates the risk diffusion probability, and combines the risk diffusion probability with the abnormal behavior type to generate a risk situation index to determine the security warning level. The third unit is used to call the warning response strategy based on the security warning level, initiate real-time blocking of high-risk warnings, track related accounts to establish a risk association map, identify potential risk propagation nodes for active protection and generate warning reports, push them to the security management platform, record the disposal operations of security managers, extract effective protection rules in the disposal operations, and realize continuous optimization of the risk warning mechanism.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images