User behavior analysis method and device based on small samples
By constructing a small-sample user behavior analysis method and utilizing user behavior context and intent inference models, we have solved the problem that traditional technologies are not effective on small-sample data sets, achieved dynamic monitoring of user behavior and identification of abnormal risks, and improved recognition accuracy and model self-learning capabilities.
Patent Information
- Application Number
- CN202410373773.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-29
- Publication Date
- 2025-09-30
AI Technical Summary
Traditional user behavior recognition and intent inference technologies require large amounts of data for training and testing, and are not very effective when applied to small sample datasets.
A user behavior analysis method based on small samples collects user operation data, builds user behavior context, uses a small amount of data to train user behavior recognition and intention inference models, and combines natural language processing and deep learning technologies to build a user behavior recognition and intention inference framework to achieve self-evolution and self-learning.
It can realize dynamic monitoring of user behavior and identification of abnormal risks on small sample data sets, reduce manual participation, improve recognition accuracy, reduce false alarm rate, and dynamically improve the model's abnormality recognition ability.
Smart Images
Figure CN120723595A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of data security technology, and in particular to a method and device for analyzing user behavior based on small samples. Background Art
[0002] With the continuous development of the internet and digital technologies, user behavior recognition and intent inference technologies have become an important security measure, playing a crucial role in data security. Specifically, user behavior recognition and intent inference technologies can dynamically monitor all users and data across an enterprise, enabling tracking of user activity on sensitive and important data, inferring user behavior, and identifying and warning of risky operations.
[0003] Unlike traditional methods of delayed discovery, user behavior recognition and intent inference technology not only enables rapid detection of high-risk behavior but also timely interception before risky behavior is carried out. It can also address group fraud and data theft. Therefore, it can address enterprise data leakage and theft issues at the source, such as preventing core data from being stolen by internal employees in sectors such as automotive and finance.
[0004] However, traditional user behavior recognition and intent inference technologies require a large amount of data for training and testing, and are not very effective when applied to small sample datasets. Summary of the Invention
[0005] In view of this, the present application proposes a user behavior analysis method and device based on small samples to solve the above problems.
[0006] On the one hand, this application proposes a user behavior analysis method based on a small sample, comprising the following steps:
[0007] Collecting user operation data and processing the user operation data to obtain target data; wherein the target data includes user context information;
[0008] Configuring a user behavior context identification rule, and building a user behavior context according to the user behavior context identification rule and the target data;
[0009] Training a user behavior recognition and intent inference model through the user behavior context;
[0010] The trained user behavior recognition and intention inference model is used to identify the user behavior data to be tested and generate a description of the user behavior abnormality risk.
[0011] As an optional implementation scheme of the present application, optionally, the configuration of user behavior context identification rules is implemented based on data extraction and data conversion.
[0012] As an optional implementation scheme of the present application, optionally, constructing the user behavior context according to the user behavior context identification rule and the target data includes:
[0013] Determining the user behavior context identification rule;
[0014] extracting user behavior information from the target data based on the user behavior context recognition rule;
[0015] The user behavior information is contextually associated to construct a user behavior context.
[0016] As an optional implementation scheme of the present application, optionally, after the user behavior information is contextually associated and the user behavior context is constructed, the method further includes:
[0017] Multidimensional data is received, and the user behavior context is reconstructed based on the multidimensional data.
[0018] As an optional implementation scheme of the present application, optionally, when training the user behavior recognition and intent inference model, an industry knowledge graph is used to construct a data relationship graph, and the user behavior recognition and intent inference model is trained based on the data relationship graph and the user behavior context.
[0019] As an optional implementation scheme of the present application, optionally, the user behavior context includes user data, account data, device data, application data, time data, location data, network data, access action data and access object data.
[0020] In another aspect, the present application provides a device for implementing any of the above-mentioned methods for analyzing user behavior based on a small sample, comprising:
[0021] A data collection and management module is used to collect user operation data and process the user operation data to obtain target data; and the target data includes user context information;
[0022] A user behavior context identification rule management module, configured to configure user behavior context identification rules and construct a user behavior context according to the user behavior context identification rules and the target data;
[0023] an intent recognition model management module, configured to train a user behavior recognition and intent inference model using the user behavior context;
[0024] The user abnormal behavior recognition module is used to use the trained user behavior recognition and intention inference model to identify the user behavior data to be tested and generate a description of the user behavior abnormality risk.
[0025] In another aspect, the present application provides a control system, comprising:
[0026] processor;
[0027] a memory for storing processor-executable instructions;
[0028] Wherein, the processor is configured to implement any of the above-mentioned user behavior analysis methods based on small samples when executing the executable instructions.
[0029] On the other hand, the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement any of the above-mentioned small sample-based user behavior analysis methods.
[0030] Technical effects of the present invention:
[0031] This application builds a user behavior recognition and intention inference framework based on a small sample of user behavior context, which can dynamically monitor all users and data of the enterprise, realize user behavior tracking of sensitive data, as well as inference of user intentions and identification and warning of abnormal risks. Specifically, it includes: collecting user operation data, and processing the user operation data to obtain target data; and the target data includes user behavior context information; configuring user behavior context recognition rules, and building user behavior context according to user behavior context recognition rules and target data; training user behavior recognition and intention inference models through user behavior context; using the trained user behavior recognition and intention inference models to identify the user behavior data to be tested, and generate a description of user behavior abnormality risks. By using user behavior context construction technology based on small samples, a basis for identifying abnormal user behavior is provided, and abnormal user behavior risks are automatically identified and generated through user behavior recognition and intention inference models. As data is gradually connected, the user behavior recognition and intention inference models undergo self-evolution and self-learning, continuously improving the model's abnormality recognition capabilities.
[0032] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.
[0034] Figure 1 FIG2 is a flow chart of a method for analyzing user behavior based on a small sample size according to the present invention;
[0035] Figure 2It shows a schematic diagram of the implementation process of the user behavior analysis method based on small samples of the present invention. DETAILED DESCRIPTION
[0036] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.
[0037] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.
[0038] In addition, numerous specific details are provided in the following detailed description to better illustrate the present disclosure. Those skilled in the art will appreciate that the present disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main points of the present disclosure.
[0039] It should be noted that traditional user behavior recognition and intent inference technologies require a large amount of data for training and testing, and are not very effective for small sample data sets. The present application aims to build a user behavior context and intent recognition framework based on minimal data sources, automatically identify and describe abnormal user behavior risks, and as data sources are gradually connected, conduct self-learning and continuously improve intent recognition capabilities. Specifically, in the solution of the present application, user usage data will be continuously obtained, and the judgment model will be continuously optimized and adjusted through the obtained user data, so that the model can be continuously optimized in the process of using the model. The solution of the present application is described below through specific embodiments.
[0040] Example 1
[0041] like Figure 1 and Figure 2 As shown, the present application provides a user behavior analysis method based on a small sample, including the following steps:
[0042] S100, collect user operation data, and process the user operation data to obtain target data, and the target data includes user context information. In this step, a certain amount of user usage data is obtained before startup. It should be noted that although this application uses a data model for risk judgment, in this application, a large amount of sample data does not need to be obtained during model construction and training, that is, the amount of labeled sample data required for this application is small, such as a positive-negative sample ratio of 1:1000. The data in the data source comes from the user's real usage data, and each user data in the data source contains the user's context data. Of course, when obtaining user data from the data source, as much multi-dimensional user data as possible can be obtained, such as data of multiple dimensions such as group, time, role, application, etc. In this step, the user's context data in the data source is collected. The user context data is further analyzed subsequently to construct rules and train the model.
[0043] S200: Configuring a user behavior context identification rule, and constructing a user behavior context according to the user behavior context identification rule and the target data;
[0044] In this step, the user behavior context is constructed based on the user behavior context information obtained in step S100 and the configured user behavior context identification rules. The data parsing rules are configured in the data collection task to extract the user behavior context information from the data source. Subsequently, the user behavior context identification rules are configured in the data conversion, such as the context automatic discovery and completion rules, to construct the user behavior context. It should be noted that the user behavior context information includes data such as time, location, device, network conditions, access actions, and access objects, that is, the specific environment and conditions in which the user is performing a series of operations in a time sequence. This step constructs the user behavior context by identifying the action and object of each operation and inferring its intention, and combining multiple dimensions such as group, time, role, application, and data.
[0045] It should also be noted that user behavior context is the basis for judging abnormal user behavior, but due to the limitations of the customer's specific data, the model cannot obtain the most complete dimensional data during initialization. Therefore, this application initially inputs a certain dimensional data and forms a basic user behavior context on this basis. When more dimensional data is received, a more accurate user behavior context can be constructed in more dimensions, thereby realizing the ability to support dynamic data dimensions.
[0046] S300: Training a user behavior recognition and intention inference model using the user behavior context;
[0047] It should be noted that this step uses a small amount of data to train and test the user behavior recognition and intent inference model. Natural language technologies such as NLP, NLU, and NLG are applied, and data relationship graphs are integrated with methods such as deep learning, reinforcement learning, transfer learning, and meta-learning to build a high-level anomaly risk detection and identification model. The model's generalization capabilities are enhanced through appropriate feature extraction and data augmentation. In other words, the training process does not require a large amount of sample data. Based on a small amount of user behavior context, a model capable of identifying and analyzing user abnormal behavior can be obtained, automatically identifying and generating abnormal user behavior risks. As more data is gradually added, the user behavior recognition and intent inference model undergoes self-evolution and self-learning, continuously improving the model's anomaly recognition capabilities.
[0048] S400: Utilize the trained user behavior recognition and intention inference model to identify the user behavior data to be tested, and generate a description of the user behavior abnormality risk.
[0049] In this step, the current user behavior data to be tested is detected based on the model trained in step S300. If the user behavior data deviates from the normal intention trained by the user, an abnormality is output, indicating that the user has abnormal behavior that deviates from the normal intention. This realizes the detection of abnormal user behavior, thereby effectively reducing manual participation, avoiding the risk of misjudgment caused by human experience problems, improving recognition accuracy and reducing false alarm rate.
[0050] From this, we can see that this application builds a user behavior identification and intention inference framework based on the user behavior context of a small sample, which can dynamically monitor all users and data of the enterprise, realize user behavior tracking of sensitive data, as well as infer user intentions and identify and warn of abnormal risks.
[0051] Specifically, through step S100, user operation data is collected, and the user operation data is processed to obtain target data.
[0052] That is, the present application first utilizes the data acquisition management module to connect to various data sources, collects, parses, cleans, filters, converts and normalizes the data sources, and then stores them in the data warehouse for preservation. Among them, as an optional implementation scheme of the present application, optionally, the data source includes a log data source, a basic data source, and a classified and graded data source. That is, the user behavior context information involved in this application all comes from the log data source, the basic data source, and the hierarchical classification data source, and the target data is obtained after processing the user operation data of the above data sources. The basic data source includes master data such as users, devices, and organizations, and the classified and graded data source is the hierarchical classification result data.
[0053] Then, through step S200, a user behavior context identification rule is configured, and a user behavior context is constructed according to the user behavior context identification rule and the target data.
[0054] As an optional implementation scheme of the present application, optionally, the configuration of user behavior context identification rules is implemented based on data extraction and data conversion.
[0055] As an optional implementation scheme of the present application, optionally, constructing the user behavior context according to the user behavior context identification rule and the target data includes:
[0056] Determining the user behavior context identification rule;
[0057] extracting user behavior information from the target data based on the user behavior context recognition rule;
[0058] The user behavior information is contextually associated to construct a user behavior context.
[0059] It's important to note that user behavior context recognition rules can be implemented through data extraction and data conversion. Specifically, in the data collection task, data parsing rules, such as regular expressions, JSON, and delimiters, are configured to extract user behavior information from the data source. Then, in the data conversion task, contextual automatic discovery and completion rules are configured.
[0060] Taking a VPN log as an example, the log fields are described as follows:
[0061] {
[0062] "id":"103413444658",log number
[0063] “userName”: “089554”, VPN account
[0064] "client_ip":"113.57.203.163", client IP address
[0065] "client_port":11914, client port
[0066] "client_mac":"dc-53-60-ce-a0-26", terminal MAC address
[0067] "server_ip": "192.168.2.101", obtain the intranet address after VPN connection is successful
[0068] "server_port": 1194, service port
[0069] “server_mac”: “dc-53-60-ce-a0-30”, server MAC address
[0070] "vip":"10.18.2.8", dynamically assigned VPN address
[0071] "logSubType": "allocate_vip", operation type
[0072] “msg”: “Allocate vip success!”, message content
[0073] "timeStamp": "1700635901" timestamp
[0074] }
[0075] For the VPN logs described above, we first define parsing rules and use a JSON parser to extract the account, device information, operation type, time, and other information from the logs. Furthermore, context association is automatically performed based on the extracted information. Accounts can be associated with contexts such as user, gender, contact information, email address, work location, performance record, position, department, whether resigned or current, start date, and time of resignation. Timestamps can be used to construct time contexts such as year, month, day, weekday, non-workday, holiday, weekend, working hours, non-working hours, and midnight. Devices are associated with contexts such as device owner, device status, device type, device value, device department, device owner, and device network information, ultimately constructing the user behavior context.
[0076] As an optional implementation scheme of the present application, optionally, after the user behavior information is contextually associated and the user behavior context is constructed, the method further includes:
[0077] Multidimensional data is received, and the user behavior context is reconstructed based on the multidimensional data.
[0078] It should be noted that the user behavior context is the basis for judging abnormal user behavior. Due to the limitations of the customer's specific data, the model cannot obtain the most complete dimensional data at initialization. Therefore, this application needs to support dynamic data dimension capabilities, that is, by initially inputting certain dimensional data, a basic user behavior context can be formed on this basis. When more dimensional data is received, new dimensions can be self-discovered in more dimensions to build a more accurate user behavior context. In other words, this application extracts user behavior information based on the accessed data source, and then constructs the user behavior context, and then constructs the dimension based on the context information. For example, the time dimension of user behavior (working days, non-working days, working hours, non-working hours, midnight, holidays, weekends, quarters, months, years, etc.), and user-related dimensions (job dimensions, performance appraisal level dimensions, position dimensions, employment status dimensions, work point dimensions, gender dimensions, etc.). As the access to data sources becomes more and more abundant, more context dimensions will be extracted as the basis for intent analysis.
[0079] Furthermore, through step S300, the user behavior recognition and intention inference model is trained through the user behavior context.
[0080] As an optional implementation scheme of the present application, optionally, when training the user behavior recognition and intent inference model, an industry knowledge graph is used to construct a data relationship graph, and the user behavior recognition and intent inference model is trained based on the data relationship graph and the user behavior context.
[0081] Specifically, the training data of this application is the user behavior context. First, various learning methods such as natural language technology and clustering are used to automatically learn the user behavior context, and then a data relationship map is constructed, that is, the relationship between users, accounts, devices, applications, data, programs, intelligence, vulnerabilities, time, location and behavior data. Furthermore, based on the data relationship map, the user behavior data and intent data are used to train the intent model, and finally, abnormal user behavior is detected based on the intent model. It should be noted that this application is based on a behavior sequence algorithm, such as a Markov model, to train user behavior context data.
[0082] Finally, through step S400, the trained user behavior recognition and intention inference model is used to identify the user behavior data to be tested, and a corresponding user behavior abnormality risk description is generated.
[0083] This application requires assessing the user's intention for each action, as well as the combined intention of a series of actions, to determine whether the behavior is abnormal. Specifically, this application can combine user intentions, detecting individual user intentions, and then combining these intentions to detect the user's overall intention, thereby more accurately determining abnormal behavior that deviates from the user's intention. Furthermore, it is necessary to integrate the data knowledge graph to build the ability to self-generate descriptions of abnormal risky behavior, such as: attacker XXX exploits an API vulnerability in XXX application to conduct a database attack to test customer contact information. This reduces the risk of misjudgment caused by manual intervention and human experience. It should be noted that the data knowledge graph in this embodiment constructs the relationship between users, accounts, devices, applications, data, programs, intelligence, vulnerabilities, time, location, and behavior data. When abnormal user behavior is detected through intent, a description of the abnormal behavior can be automatically generated. For example, user Li Gang uses the account ligang to log in to the device 192.168.1.101 (application server) and downloads a large amount of employee data from the human resources management system application. His behavior deviates from normal intentions and is abnormal.
[0084] Specifically, the system first collects user behavior and intent data over a period of time and trains a user intent model. It then queries the current user behavior data and uses the intent model for detection. If the user behavior data deviates from the user's trained normal intent, an exception is generated, indicating that the user has engaged in unusual behavior that deviates from normal intent. For example, a user's normal intent, as determined by training user behavior and intent data, is that the user only has access to view data. However, if any behavior that exceeds the user's normal intent occurs, an abnormal behavior is triggered, indicating that the user has engaged in illegal behavior.
[0085] This application uses minimal data sources and combines industry knowledge graphs to build an integrated algorithm framework. As data is gradually connected, it self-evolves and self-learns, continuously improving the model's anomaly recognition capabilities.
[0086] A complete example will be provided below to illustrate the method of the present application in detail.
[0087] 1. First, define the parsing rules and use the JSON parser to extract the account, device information, operation type, time, etc. in the log.
[0088] 2. Automatically associate context based on the extracted information. Accounts can be associated with context such as user, gender, contact information, email address, work location, performance record, position, department, whether current or resigned, start date, and end date. Timestamps can be used to construct time context such as year, month, day, weekday, non-workday, holiday, weekend, working hours, non-working hours, and midnight. Devices can be associated with context such as device owner, device status, device type, device value, device department, device owner, and device network information. Finally, user behavior context is constructed.
[0089] 3. Combine industry knowledge graphs to build a relationship graph of users, accounts, devices, applications, data, programs, intelligence, vulnerabilities, time, location, and behavior data.
[0090] 4. Based on the data relationship graph, use user behavior data and user intent data to train a user intent model.
[0091] 5. Use the intent model for detection. If the user behavior data deviates from the user's trained normal intent, an exception is output, indicating that the user has abnormal behavior that deviates from the normal intent.
[0092] 6. Confirm abnormal behavior: false alarm or confirm real abnormal behavior.
[0093] 7. The abnormal confirmation results are used as input, combined with the continuous input of new user behavior data and intention data, and input into the training model for re-learning and training, and a new model is output.
[0094] 8. Use the new model for testing.
[0095] 9. The entire framework is constantly iterating, self-learning and self-improving.
[0096] In summary, the method of this application can dynamically monitor all users and data across the entire enterprise, enabling tracking of user behavior with respect to sensitive and important data, as well as inferring user intent and identifying and warning of abnormal risks. By leveraging user behavior context construction technology based on small samples, a foundation for identifying abnormal user behavior is provided. User behavior recognition and intent inference models are used to automatically identify and generate abnormal user behavior risks. As data is gradually added, the user behavior recognition and intent inference models self-evolve and self-learn, continuously improving the model's ability to identify abnormalities.
[0097] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned control method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.
[0098] Example 2
[0099] Furthermore, another aspect of the present application provides a device for implementing any of the above-mentioned methods for analyzing user behavior based on a small sample, comprising:
[0100] A data collection and management module is used to collect user operation data and process the user operation data to obtain target data; and the target data includes user context information;
[0101] A user behavior context identification rule management module, configured to configure user behavior context identification rules and construct a user behavior context according to the user behavior context identification rules and the target data;
[0102] Intent recognition model management module, used to train user behavior recognition and intent inference models based on user behavior context;
[0103] The user abnormal behavior identification module is used to use the trained user behavior identification and intention inference model to identify the user behavior data to be tested and generate a corresponding user behavior abnormality risk description.
[0104] The device in this embodiment is used to implement the user behavior method based on a small sample as described in any of the above items, which involves the following modules: a data acquisition management module, a user behavior context recognition rule management module, an intention recognition model management module, and a user abnormal behavior recognition module. Among them, based on the data acquisition management module, data acquisition tasks are configured, and collection methods such as kafka, syslog, files, and databases are supported, and the data acquisition management module stores the collected data in a data warehouse; the user behavior context recognition management module is used to configure user behavior context recognition rules and build a user behavior context according to the recognition rules; the intention recognition management module configures the intention recognition model and performs model training and testing. At the same time, the user behavior context recognition module builds the user behavior context according to the user behavior context recognition rules and stores it in the data warehouse. Based on the user abnormal behavior recognition module, user behavior anomalies are automatically identified and automatically generated, and the model is optimized through the configured intention model self-evolution and self-learning module to further improve the model anomaly recognition capability.
[0105] Example 3
[0106] Furthermore, in another aspect, the present application provides a control system, comprising:
[0107] processor;
[0108] a memory for storing processor-executable instructions;
[0109] Wherein, the processor is configured to implement any of the above-mentioned user behavior analysis methods based on small samples when executing the executable instructions.
[0110] The control system of the embodiment of the present disclosure includes a processor and a memory for storing processor executable instructions. The processor is configured to implement any of the above-mentioned small sample-based user behavior analysis methods when executing the executable instructions.
[0111] It should be noted that the number of processors can be one or more. Furthermore, the control system of the disclosed embodiment may also include an input device and an output device. The processor, memory, input device, and output device may be connected via a bus or other means, which are not specifically limited herein.
[0112] Memory, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and various modules, such as the program or module corresponding to the small sample-based user behavior analysis method in the disclosed embodiment. The processor executes the various functional applications and data processing of the control system by running the software programs or modules stored in the memory.
[0113] The input device can be used to receive input numbers or signals. The signals can be key signals related to user settings and function control of the device / terminal / server. The output device can include a display device such as a display screen.
[0114] Example 4
[0115] On the other hand, the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement any of the above-mentioned small sample-based user behavior analysis methods.
[0116] While various embodiments of the present disclosure have been described above, the foregoing description is intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technical improvements to existing technologies, or to enable others skilled in the art to understand the embodiments disclosed herein.
Claims
1. A user behavior analysis method based on a small sample, characterized in that: The steps include: Collecting user operation data and processing the user operation data to obtain target data; wherein the target data includes user context information; Configuring a user behavior context identification rule, and building a user behavior context according to the user behavior context identification rule and the target data; Training a user behavior recognition and intent inference model through the user behavior context; The trained user behavior recognition and intention inference model is used to identify the user behavior data to be tested, and a corresponding user behavior abnormality risk description is generated.
2. The user behavior analysis method based on small samples according to claim 1 is characterized in that: The configuration of user behavior context recognition rules is implemented based on data extraction and data conversion.
3. The user behavior analysis method based on small samples according to claim 2 is characterized in that: The constructing the user behavior context according to the user behavior context identification rule and the target data includes: Determining the user behavior context identification rule; extracting user behavior information from the target data based on the user behavior context recognition rule; The user behavior information is contextually associated to construct a user behavior context.
4. The user behavior analysis method based on small samples according to claim 3 is characterized in that: After the user behavior information is contextually associated to construct the user behavior context, the method further includes: Multidimensional data is received, and the user behavior context is reconstructed based on the multidimensional data.
5. The user behavior analysis method based on small samples according to claim 1 is characterized in that: When training the user behavior recognition and intention inference model, the industry knowledge graph is used to construct a data relationship graph, and the user behavior recognition and intention inference model is trained based on the data relationship graph and the user behavior context.
6. The user behavior analysis method based on small samples according to claim 1 is characterized in that: The user behavior context includes user data, account data, device data, application data, time data, location data, network data, access action data and access object data.
7. A device for implementing the user behavior analysis method based on small samples according to any one of claims 1 to 6, characterized in that: include: A data collection and management module is used to collect user operation data and process the user operation data to obtain target data; And the target data includes user context information; A user behavior context identification rule management module, configured to configure user behavior context identification rules and construct a user behavior context according to the user behavior context identification rules and the target data; an intent recognition model management module, configured to train a user behavior recognition and intent inference model using the user behavior context; The user abnormal behavior identification module is used to use the trained user behavior identification and intention inference model to identify the user behavior data to be tested and generate a corresponding user behavior abnormality risk description.
8. A control system, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the user behavior analysis method based on small samples as described in any one of claims 1 to 6 when executing the executable instructions.
9. A non-volatile computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the user behavior analysis method based on small samples as described in any one of claims 1 to 6.