Risk management and control method and system based on real-time behavior analysis

Abstract

The invention relates to a risk management and control method and system based on real-time behavior analysis, and the method comprises the steps: carrying out the structural processing of multi-source behavior data through lightweight protocol decoding and behavior label embedding, and constructing an original behavior data set of a user and an entity; extracting multi-dimensional behavior characteristics by using a sliding window analysis and sparse representation mechanism, and constructing a user behavior graph by combining graph embedding learning; constructing a time-sensitive behavior trend model through streaming modeling and an incremental learning strategy, identifying an abnormal evolution trajectory in real time, and introducing a dynamic risk threshold regulation and control mechanism; adopting a high-throughput flow data processing and fast similarity matching algorithm to construct a fusion discrimination model, giving risk levels to abnormal behaviors and classifying the abnormal behaviors; and finally, performing closed-loop optimization in combination with a historical treatment effect. The system has the advantages of high real-time performance, high calculation efficiency, adaptability to complex network environments and the like, and the network security protection capability can be effectively improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security monitoring, and particularly relates to a risk management and control method and system based on real-time behavior analysis. BACKGROUND

[0002] With the continuous evolution of network attack means and the increasing complexity of information system structure, network security monitoring technology has gradually developed from traditional rule matching and log analysis to real-time behavior analysis mode based on user and entity behavior. By continuously collecting multi-source data such as user access, account operation, network traffic, system call, etc., user behavior portrait is constructed, and then abnormal behavior and potential threats are identified, which has become an important means of current network security protection.

[0003] However, in practical application, the network security risk management and control system generally faces the following technical bottlenecks: the behavior identification and risk analysis process is complex and difficult to process high-frequency behavior data stream in real time. The existing technology usually introduces complex feature engineering, deep learning model or multi-stage analysis process, which leads to high resource occupation and large delay of the system when facing high concurrency access and high-frequency data input, and it is difficult to meet the strict requirements of network security monitoring on real-time performance and response speed. Therefore, it is necessary to design a risk management and control system and method based on real-time behavior analysis to improve real-time processing capability and computing efficiency. SUMMARY

[0004] (I) Invention purpose In order to overcome the above shortcomings, the purpose of the present application is to provide a risk management and control method and system based on real-time behavior analysis to solve the above technical problems.

[0005] (II) Technical scheme In order to achieve the above purpose, the technical scheme provided by the present application is as follows: A risk management and control method based on real-time behavior analysis, comprising the following steps: S1 adopts a lightweight protocol decoding and behavior label embedding method to structure the data, and constructs a raw behavior data set of users and entities; S2 performs sliding window analysis on the raw behavior data set, introduces a behavior expression mechanism based on sparse representation, fuses context information and time sequence mode, extracts multi-dimensional behavior features, and adopts a graph embedding learning method to construct a user behavior graph; S3 combines a streaming modeling method to construct a time-sensitive behavior trend model, identifies the abnormal evolution track of user behavior through an incremental learning strategy, introduces a dynamic risk threshold regulation mechanism, and adaptively adjusts the identification sensitivity according to the network situation change; S4 adopts a high-throughput flow data processing engine and a fast similarity matching algorithm, constructs a fusion discriminant model based on multi-dimensional behavior indicators and historical risk labels, assigns a risk level to the recognition result, and performs preliminary classification; S5 triggers a preset response mechanism according to the risk level, combines historical disposal effects and risk intervention records, periodically updates the behavior recognition strategy and model parameters, and forms a closed-loop safety strategy optimization mechanism.

[0006] Preferably, the specific operation steps in S1 include: S11 data collection, Through the collection agent deployed on the terminal device, the user's operation instructions and system call sequences are captured in real time, including keyboard input, file reading and writing, and process calling, Through the log collection interface of the access information system, the security event logs, user authentication logs and access control records recorded during system operation are obtained, With the network traffic mirroring device deployed on the network node, network access records are collected, including access target, protocol type, packet size and frequency; S12 data preprocessing, The collected raw data is preprocessed through Distributed lightweight protocol parsing module Including data deduplication, time alignment and field standardization; The multi-source data is input into the distributed lightweight protocol parsing module to decode the protocol and restore the content of the data in different formats, filter duplicate behavior records, and avoid data redundancy caused by system log redundancy; According to the unified system time reference, the behavior events from different sources are time-synchronized and calibrated, and the behavior fields are mapped to a unified data structure format; S13 data labeling and organization, Embed behavior labels in the preprocessed behavior data, including operation type, resource category, operation context and behavior trigger factor, and organize structured data streams in a unified format; S14 data classification and indexing, According to user identity, entity identifier and timestamp, the structured data is classified, arranged, and multi-dimensionally indexed and aggregated, the behaviors of the same user at different terminals and in different time periods are merged and managed, forming continuous behavior sequences, and finally a user and entity original behavior data set with unified semantics, traceable timeline and entity attribution is constructed.

[0007] Preferably, the specific operation steps in S2 include: S21 construct a multi-modal behavior graph, According to the interaction relationship between the user and the entity in the original behavior data set, a multi-modal behavior graph is constructed with the user, the operation resource and the operation event as nodes; Based on the generated original behavior data set, core elements in the behavior record are extracted, including user identification, operation resource and operation event, the user identification includes account ID and terminal ID, the operation resource includes accessed server, database, file path, and the operation event includes reading, writing, logging in and executing; The above three types of elements are abstracted as multi-modal nodes, and each type of node constitutes a different modality in the graph: node type 1: user node; node type 2: resource node; node type 3: event node; According to the interaction mode in the actual behavior record, the edges in the graph are established: user→event: indicating that the user performs a certain behavior; event→resource: indicating that the behavior acts on a certain resource. All nodes and edges together constitute a multi-modal behavior graph; S22 constructs an edge weight matrix The behavior sequence frequency, transition probability and event trigger relationship between nodes are counted by using a sliding window to construct an edge weight matrix; The behavior graph is time segmented by using a sliding time window machine, and the interaction mode in each window is counted; In each time window, the following edge feature indexes are calculated: (1) behavior frequency: the number of times the user-behavior-resource path appears in the window; (2) transition probability: the occurrence probability between a certain behavior sequence; (3) event trigger relationship strength: based on the time sequence and the historical rule library, the potential trigger relationship between two behaviors is judged, and according to the statistical result, the corresponding weight is assigned to the edge in the graph to form an edge weight matrix; S23 graph embedding representation, The multi-modal behavior graph is vectorized by using a graph embedding algorithm to capture local structure and global topological features; Based on the graph embedding learning algorithm, the multi-modal behavior graph and its edge weight matrix are input, and multiple rounds of random walk or message passing mechanism are performed in the graph, the semantic aggregation is combined with the node adjacency relationship and the edge weight, and the low-dimensional vector of each node is output. The vector encodes the local behavior features, role position and historical interaction mode of the node in the entire graph structure. The embedding result can not only capture the individual behavior features of the user, but also reflect the interaction characteristics between the user and other entities; S24 behavior evolution modeling and anomaly detection, The generated user behavior embedding vector is used as one of the input features for subsequent behavior evolution modeling and anomaly detection; Meanwhile, a multi-time scale graph updating mechanism is supported to maintain the timeliness of the graph; The user behavior embedding vector is input as one of the input features into the behavior evolution modeling module and the anomaly detection module, a multi-time scale graph updating mechanism is introduced, the behavior graph structure is periodically reconstructed or incrementally updated, minute-level or hour-level incremental update is adopted for fast changing scenarios, and day-level full graph reconstruction strategy is adopted for macro structure adjustment, and the updating mechanism ensures the timeliness and robustness of the embedding representation.

[0008] Preferably, the operation steps of constructing the time-sensitive behavior trend model in S3 include: S31 divides the user behavior embedding vector into a sliding window The user behavior embedding vector is divided into a sliding window sequence according to the time sequence; the user behavior embedding vector obtained from the graph embedding module records the behavior characteristics of the user in different time periods; The embedding vector is divided into a continuous time sequence in a fixed time length sliding window manner, the window size is set to T, the step size is S, each window contains a vector of T consecutive time points, and the following is obtained Each group is a time sequence input sample; the sequence data is input into the downstream time sequence modeling network as input, supporting the evolution analysis of user behavior over time; S32 constructs a behavior trend analysis model using a recurrent neural network, a time-aware attention mechanism, or a time series convolution network; A deep learning model suitable for processing time series data is selected to model the divided vector sequence, and the main candidate models include: (1) a recurrent neural network: learning time context information through hidden state transmission, suitable for behavior evolution modeling with long sequence dependence; (2) a time-aware attention mechanism: dynamically assigning weights to historical behaviors at each time point, highlighting key behavior nodes and improving model interpretability; (3) a time series convolution network: using a one-dimensional convolution kernel to extract features on the time axis, with parallel processing and long dependence modeling capabilities, suitable for high-frequency behavior sequence modeling; The model training target is to minimize the prediction error of the behavior trajectory, identify the evolution path of normal behavior, or distinguish the pattern difference between normal and abnormal sequences; S33 model incremental update, Real-time capture of user behavior pattern changes over time; real-time reception of newly generated behavior embedding vectors; concatenation of new vectors to existing sliding window sequences, and updating of the model through an incremental learning mechanism to avoid retraining the entire model: for RNN structure, the historical hidden state is retained and forward inference is continued; for attention or convolution network, a window sliding type update parameter or a distillation type fine-tuning strategy is adopted; S34 extracts a behavior evolution feature vector, Extract behavior evolution feature vector for specific behavior trajectory, as an important basis for anomaly recognition and risk prediction; For behavior path or user group, the following evolution features are extracted using modeling output: Behavior trajectory change rate: the fluctuation degree of vector difference in time dimension; Behavior turning point detection: identify the time node of behavior mutation through gradient, attention weight or model activation map; Periodicity and trend pattern: Fourier analysis or trend decomposition is performed on the behavior sequence to identify periodicity and deviation direction.

[0009] Preferably, the specific content in S33 is: In the time-sensitive trend model, set a dynamic behavior baseline, monitor the evolution trajectory of the continuous behavior feature vector; According to the output behavior evolution feature vector sequence, establish an initial behavior baseline, the initial behavior baseline is: the sliding mean and standard deviation of the historical behavior vector, the long-term trend line, and the normal distribution parameters of each type of behavior; With the arrival of new behavior data, the baseline state will continue to update to reflect the changes in normal behavior patterns; The system will continuously monitor the change curve of the evolution trajectory to form the behavior feature trajectory in each time period; When new behavior data is input, incremental training is performed based on the historical model state and current data features to avoid resource consumption caused by full retraining; Update model parameters through incremental learning algorithm, use the input at the current time + the hidden state of the model as the training unit during incremental update, and quickly learn the behavior pattern changes; In each time window, calculate the deviation degree and confidence interval of the behavior feature to determine whether it belongs to an abnormal evolution state; The behavior feature vector in the current sliding window is: The dynamic behavior baseline vector corresponding to the time period is: The deviation degree formula of the current behavior vector and the baseline behavior vector is: In the formula, n is the number of behavior feature dimensions, and are the current value and baseline value of the ith behavior feature, respectively; Statistical deviation rate and abnormal peak value, including detecting whether there is a sudden behavior; Build confidence interval under the current window; If the deviation value of the current behavior vector exceeds the confidence interval, or deviates continuously for multiple time points, it is judged as a possible abnormal evolution trend; If the behavior trajectory deviates within a certain time range, it is marked as a potential risk user; Set the time window threshold of continuous abnormal evolution; Once any of the following conditions is triggered, the user is marked as a potential risk object: the degree of abnormal behavior deviation continues to rise; Behavior category conversion occurs; The similarity between abnormal behavior and historical attack sample / abnormal event features is high.

[0010] Preferably, the process of introducing dynamic risk threshold self-adaptive adjustment in S3 is: A plurality of risk identification sensitivity levels are preset, each corresponding to a different network security situation level, and each level defines different parameter configurations, including: (1) confidence interval width of abnormal behavior detection; (2) alarm threshold of behavior deviation value; (3) granularity and update frequency of sliding window; Each sensitivity level is mapped to a network security situation level, used to automatically adjust the system response strength, and the sensitivity level is automatically switched according to rules or strategies, and manual control by a security administrator is also supported; The current network security state is determined by monitoring system-level attack warning information, security event density, and user abnormal behavior frequency; using these indicators in combination with preset weights and threshold rules, the current network is determined to be in a normal (green), attention (yellow), risk (orange), or critical (red) state level; According to the network security state level, the abnormal judgment threshold and identification sensitivity parameters in the behavior trend model are dynamically adjusted; once the situation level changes, the system automatically adjusts the following key parameters: behavior deviation judgment threshold; detection window length; abnormal behavior confidence interval range; model update frequency; When the security situation is red and critical, the model is adjusted to have extremely high sensitivity; When the security situation returns to yellow attention or green normal, the system gradually adjusts the sensitivity level to avoid excessive alarms; In the risk rising state, the system automatically increases the identification sensitivity to capture more potential risk behaviors, and in the risk decreasing stage, it is appropriately relaxed to balance performance and accuracy; In the high-risk state: the system enables high-frequency detection and low-tolerance strategy, sacrificing part of the performance to capture more suspicious behaviors; the linkage mechanism can be started, including automatic isolation strategy and manual review priority queue; In the low-risk state: the system appropriately relaxes the sensitivity, adopts low-frequency detection and high-accuracy strategy, reduces false positives, and reduces resource burden; at the same time, the model automatically compresses or archives recent behavior data, and enters maintenance mode; the overall goal is to adapt to the changing network environment.

[0011] Preferably, the process of assigning a risk level and a preliminary classification to the identification result in S4 includes: The abnormal behavior sample is input into a fusion discrimination model for feature matching and similarity analysis of multi-dimensional behavior indicators and historical risk labels; S41 The abnormal behavior sample includes an abnormal behavior feature vector identified from the trend evolution model; the abnormal behavior feature vector includes context information associated with the user identity, time window, and operation type; The S42 fusion discriminant model is a multi-modal and multi-feature general classification model, and a design target thereof is to consider multi-dimensional behavior indexes; a behavior-label contrast sample library constructed by using historical risk identification records is used for feature matching; The S43 analyzes similarity and a discriminant boundary between a current behavior and a past typical risk behavior; a model outputs a risk confidence score, and the risk confidence score is 0-1, representing an abnormal degree and a risk intensity of the current behavior; The S44 divides a user behavior into three categories of low risk, medium risk and high risk based on a confidence score output by a discriminant model and in combination with a preset risk level division standard; the system presets risk score threshold intervals, and the low risk is 0.0-0.4, the medium risk is 0.4-0.7, and the high risk is 0.7-1.0; a confidence score of each abnormal behavior sample is mapped to a corresponding level; The S45 further identifies a specific risk type for the high risk category, and labels an abnormal behavior time period and related context information; for a behavior sample in the high risk level, a fine-grained risk classification module is further triggered to identify a specific risk type, and context information is labeled, including a behavior time period, operations and resources before and after a behavior sequence, a user role, a terminal IP and a network location, to generate a structured risk event report for reference by a subsequent response module.

[0012] Preferably, the S5 is a process of forming a closed-loop security policy optimization mechanism, and the process includes the following steps: The S51 automatically records user feedback results, treatment policy effects and subsequent changes of abnormal behaviors after a risk response mechanism is executed; after abnormal behavior identification and risk level division, the system triggers a corresponding risk response strategy, and the abnormal behavior identification includes automatically logging out a suspicious account, limiting access permission and triggering manual review; The S52 automatically collects the following feedback information and records the feedback information in a database after the risk response is executed: (1) user feedback results: whether an operation is legal and whether a complaint is filed; (2) treatment policy effects: whether account blocking prevents further abnormality and whether access restriction is effective; and (3) subsequent changes of abnormal behaviors: whether a behavior is continued, whether a frequency is decreased and whether the behavior is changed into another abnormal mode; All feedback information is written in a structured manner into a risk response feedback database as a real sample source for subsequent model optimization; The S53 re-trains the discriminant model and the behavior trend model based on a historical risk event library on a regular basis, and adjusts model parameters to adapt to new attack means and behavior modes; The system regularly schedules data in the risk event library, including: abnormal behavior feature vectors; user label feedback; discriminant results and real risk consequences; The S54 respectively re-trains the behavior trend model and the fusion discriminant model in an incremental or full amount, and the process includes: Sample balancing and data augmentation: Solve the problem of uneven positive and negative samples; Hyperparameter tuning, including learning rate and attention mechanism weight adjustment; New feature fusion, including the introduction of behavior path length and sequence frequency change; The retrained model needs to be evaluated by the validation set accuracy, and after meeting the online standard, it is automatically deployed to replace the old model; The system records the data source, model configuration and effect index of each training for subsequent tracing; S55 improves the response speed and accuracy of the system to abnormal behavior by continuously optimizing behavior feature construction strategy and threshold control mechanism; According to the latest risk event analysis and model training feedback, continuously optimize the behavior feature construction method, including: Increase behavior trigger source tracking features; Optimize time window granularity, including using variable length sliding window to adapt to sudden behavior; Introduce resource sensitivity weight to improve the perception ability of key resource operation behavior; In the abnormal judgment mechanism, the system can dynamically adjust the behavior deviation threshold, confidence score boundary value, response strategy trigger standard, and the updated rules and feature fields are uniformly updated to the strategy engine and model input module, and gray test is performed; S56 builds a strategy update log and a model evolution version library to realize traceable management of security strategies and identification models, thereby realizing a closed-loop operation system of risk perception-response-optimization.

[0013] A risk management and control system based on real-time behavior analysis, comprising Behavior data acquisition module: Collect multi-source behavior data of users and entities, and perform protocol analysis, semantic label embedding and structured processing; User behavior modeling module: Construct user behavior graph based on multi-modal relationship, and mine structural features and context semantics between behaviors; Behavior trend analysis module: Analyze user behavior evolution trajectory through time series modeling and incremental learning to identify potential abnormal behavior in real time; Risk level evaluation module: Fuse multi-dimensional behavior features and historical labels to assign risk levels to abnormal behaviors and classify them; Strategy optimization module: Link response mechanism and continuously optimize behavior recognition strategy and model parameters according to the disposal effect to realize closed-loop evolution of the system.

[0014] Advantages: 1.The application can efficiently structure multiple-source behavior data by using a lightweight protocol decoding and behavior tag embedding method, and construct a user and entity original behavior dataset with unified semantics and traceable timelines. This process not only significantly reduces data redundancy, but also improves the expression and discrimination ability of behavior data, providing high-quality basic data support for subsequent behavior analysis and risk identification, thereby effectively enhancing the risk perception ability of the system in a complex network environment.

[0015] 2.The application combines a streaming modeling method to construct a time-sensitive behavior trend model and introduces an incremental learning strategy. By capturing the dynamic change trend of user behavior patterns in real time, the system can quickly identify the abnormal evolution track of user behavior and adaptively adjust the identification sensitivity according to the network situation change. This dynamic adjustment mechanism enables the system to flexibly adjust parameter configurations when facing sudden behaviors and new attack methods, thereby ensuring high accuracy while significantly improving the real-time processing capability and response speed to potential risks.

[0016] 3.The application constructs a fusion discrimination model through a high-throughput streaming data processing engine and a fast similarity matching algorithm, and realizes a closed-loop security policy optimization mechanism. The system can trigger the preset response mechanism according to the risk level, and periodically update the behavior identification strategy and model parameters combined with historical disposal effects and risk intervention records. This closed-loop optimization mechanism not only improves the intelligence level of the system, but also ensures that the model can continuously adapt to new attack methods and behavior patterns in long-term operation, thereby effectively improving the overall processing efficiency and security protection capability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a flowchart of the application; Figure 2 is a system framework diagram according to an embodiment of the application. DETAILED DESCRIPTION

[0018] To make the purpose, technical solutions and advantages of the application clearer and more intelligible, the following combines specific implementation manners and refers to the accompanying drawings Figures 1-2 , the application is further described in detail. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the application. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the application.

[0019] A risk management and control method based on real-time behavior analysis includes the following steps: S1 uses a lightweight protocol decoding and behavior tag embedding method to structure the data and construct a user and entity original behavior dataset; The specific operation steps in S1 include: S11 data collection, Through the collection agent deployed on the terminal device, the user's operation instructions and system call sequences are captured in real time, including keyboard input, file reading and writing, and process calling, Through the log collection interface of the access information system, the security event logs, user authentication logs and access control records recorded during system operation are obtained, With the help of the network traffic mirroring device deployed on the network node, network access records are collected, including access target, protocol type, packet size and frequency; S12 data preprocessing, The collected raw data is preprocessed by the distributed lightweight protocol parsing module, including data deduplication, time alignment and field standardization; The multi-source data is input into the distributed lightweight protocol parsing module to decode the protocol and restore the content of the data in different formats, filter duplicate behavior records, and avoid data redundancy caused by system log redundancy; According to the unified system time reference, the behavior events from different sources are time-synchronized and calibrated, and the behavior fields are mapped to a unified data structure format; S13 data labeling and organization, Behavior labels are embedded in the preprocessed behavior data, including operation type, resource category, operation context and behavior trigger factor, and are organized into structured data streams in a unified format; S14 data classification and indexing, According to user identity, entity identification and timestamp, the structured data is classified, arranged, and multi-dimensionally indexed and aggregated, the behaviors of the same user at different terminals and in different time periods are merged and managed to form continuous behavior sequences, and finally a user and entity original behavior dataset with unified semantics, traceable timeline and entity attribution is constructed.

[0020] S2 performs sliding window analysis on the original behavior dataset, introduces a behavior expression mechanism based on sparse representation, fuses context information and time sequence patterns, extracts multi-dimensional behavior features, and uses graph embedding learning method to construct user behavior graph; The specific operation steps in S2 include: S21 construct multi-modal behavior graph, According to the interaction relationship between users and entities in the original behavior dataset, a multi-modal behavior graph is constructed with users, operation resources and operation events as nodes; Based on the generated original behavior data set, the core elements in the behavior record are extracted, including user identification, operation resource and operation event, user identification includes account ID and terminal ID; operation resource includes accessed server, database, file path; operation event includes reading, writing, logging in, executing; The above three types of elements are abstracted as multi-modal nodes, and each type of node constitutes a different modality in the graph: node type 1: user node; node type 2: resource node; node type 3: event node; According to the interaction mode in the actual behavior record, the edges in the graph are established: user→event: indicating that the user performs a certain behavior; event→resource: indicating that the behavior acts on a certain resource. All nodes and edges together constitute a multi-modal behavior graph; S22 constructs an edge weight matrix The behavior sequence frequency, transition probability and event trigger relationship between nodes are counted by using a sliding window, and an edge weight matrix is constructed; The behavior graph is time segmented by using a sliding time window machine, and the interaction mode in each window is counted; In each time window, the following edge feature indicators are calculated: (1) behavior frequency: the number of times the user-behavior-resource path appears in the window; (2) transition probability: the occurrence probability between specific behavior sequences; (3) event trigger relationship strength: based on the time sequence and the historical rule library, the potential trigger relationship between two behaviors is judged, and according to the statistical result, the corresponding weight is assigned to the edge in the graph, and the edge weight matrix is constructed; S23 graph embedding representation, The multi-modal behavior graph is represented by a vector by using a graph embedding algorithm, which captures local structure and global topological features; Based on the graph embedding learning algorithm, the multi-modal behavior graph and its edge weight matrix are input, and multiple rounds of random walk or message passing mechanism are performed in the graph, the semantic aggregation is combined with the node adjacency relationship and the edge weight, and the low-dimensional vector of each node is output. The vector encodes the local behavior characteristics, role position and historical interaction mode of the node in the entire graph structure. The embedding result can capture both the individual behavior characteristics of the user and the interaction characteristics between other entities; S24 behavior evolution modeling and anomaly detection, The generated user behavior embedding vector is one of the input features for subsequent behavior evolution modeling and anomaly detection; A multi-time scale graph updating mechanism is also supported to maintain the timeliness of the graph; The user behavior embedding vector is input as one of the input features into the behavior evolution modeling module and the anomaly detection module, a multi-time scale graph updating mechanism is introduced, and the behavior graph structure is periodically reconstructed or incrementally updated. For fast changing scenarios, minute-level or hour-level incremental updates are used, and for macro structure adjustment, daily full graph reconstruction strategy is used. The updating mechanism ensures the timeliness and robustness of the embedding representation.

[0021] S3 combines the flow modeling method to build a time-sensitive behavior trend model, identifies the abnormal evolution trajectory of user behavior through an incremental learning strategy, introduces a dynamic risk threshold regulation mechanism, and adaptively adjusts the recognition sensitivity according to the network situation change; S4 uses a high-throughput flow data processing engine and a fast similarity matching algorithm to build a fusion discrimination model based on multi-dimensional behavior indicators and historical risk labels, assigns a risk level to the recognition result and performs preliminary classification; The process of assigning a risk level and preliminary classification to the recognition result in S4 includes: The abnormal behavior sample is input into the fusion discrimination model, and multi-dimensional behavior indicators and historical risk labels are matched and analyzed for similarity; S41 The abnormal behavior feature vector includes the context information of the user identity, time window, and operation type associated with it; S42 The fusion discrimination model is a multi-modal, multi-feature general classification model, which is designed to consider multi-dimensional behavior indicators; and a behavior-label sample library constructed using historical risk identification records is used for feature matching; S43 The similarity between the current behavior and the past typical risk behavior and the discrimination boundary are analyzed; the model outputs a risk confidence score, which is 0-1, representing the abnormality and risk intensity of the current behavior; S44 Based on the confidence score output by the discrimination model, combined with the preset risk level division standard, the user behavior is divided into low risk, medium risk, and high risk; the system presets the risk score threshold interval, low risk: 0.0-0.4; medium risk: 0.4-0.7; high risk: 0.7-1.0; the confidence score of each abnormal behavior sample is mapped to the corresponding level; S45 further identifies the specific risk type of the high-risk category and marks the abnormal behavior occurrence time period and related context information; for behavior samples in the high-risk level, further trigger the fine-grained risk classification module to identify the specific risk type, including abnormal login of account; centralized access of data; unauthorized system access; internal horizontal movement signs.

[0022] Meanwhile, the time period of the behavior, the operations and resources before and after the behavior sequence, the user's role, the terminal IP and the network location are extracted to annotate the context information and generate a structured risk event report for the subsequent response module.

[0023] S5 According to the risk level, the preset response mechanism is triggered in linkage, the historical treatment effect and the risk intervention record are combined, the behavior identification strategy and the model parameter are periodically updated, and a closed-loop security policy optimization mechanism is formed.

[0024] The process of forming a closed-loop security policy optimization mechanism in S5 is: S51 After executing the risk response mechanism, the user feedback results, the treatment strategy effect and the subsequent changes of the abnormal behavior are automatically recorded; after the abnormal behavior identification and risk level division, the system triggers the corresponding risk response strategy, the abnormal behavior identification includes automatically logging out the suspicious account, limiting access permission, and triggering manual review; S52 After the risk response is executed, the system automatically collects the following feedback information and records it in the database: (1) User feedback results: whether the operation is legal, whether to appeal; (2) Treatment strategy effect: whether the account ban prevents further abnormalities, whether the access restriction takes effect; (3) Subsequent changes of abnormal behavior: whether the behavior continues, whether the frequency decreases, and whether it changes to other abnormal patterns; All feedback information will be written into the risk response feedback database in a structured way as a real sample source for subsequent model optimization; S53 Retrain the discrimination model and the behavior trend model based on the historical risk event library regularly, and adjust the model parameters to adapt to new attack methods and behavior patterns; The system regularly schedules data in the risk event library, including: abnormal behavior feature vector; user label feedback; discrimination result and real risk consequence; S54 Incremental or full retraining of the behavior trend model and the fusion discrimination model, the process includes: Sample balancing and data enhancement: Solve the problem of uneven positive and negative samples; Hyperparameter tuning, including learning rate and attention mechanism weight adjustment; New feature fusion, including introducing behavior path length and sequence frequency change; The retrained model needs to be evaluated by the validation set accuracy, and automatically deployed to replace the old model after meeting the online standard; the system records the data source, model configuration and effect index of each training for subsequent tracing; S55 Through continuous optimization of behavior feature construction strategy and threshold control mechanism, the response speed and accuracy of the system to abnormal behavior are improved; according to the latest risk event analysis and model training feedback, the behavior feature construction method is continuously optimized, including: Increase behavior trigger source tracking features; Optimize time window granularity, including using variable-length sliding windows to adapt to bursty behavior; Introduce resource sensitivity weights to improve the perception of critical resource operation behavior; In the abnormality determination mechanism, the system can optimize the rules and feature fields by dynamically adjusting the behavior deviation threshold, confidence score boundary value, response strategy trigger standard, and then update them to the policy engine and model input module, and perform gray test; S56 builds a policy update log and a model evolution version library to realize traceable management of security policies and identification models, thereby realizing a closed-loop operation system of risk perception-response-optimization.

[0025] The original behavior data set is divided into time slices using a sliding window mechanism to capture the dynamic change trend of behavior in a local period. A behavior expression mechanism based on sparse representation is introduced to compress non-critical behavior dimensions and strengthen significant behavior features, thereby realizing efficient expression of behavior patterns. Meanwhile, operation context and time sequence patterns of behavior are fused to extract multi-dimensional behavior features. On this basis, a multi-modal behavior graph is constructed with user, operation resource and operation event as nodes, and vectorization representation is performed on it through graph embedding learning algorithm to capture the structured association and semantic features between behaviors. This can effectively reduce the redundancy of behavior data and improve the discriminability of behavior expression, so that the key behavior path and potential risk behavior features can be accurately identified within the time sequence window. The combination of multi-modal graph structure and graph embedding technology significantly enhances the modeling accuracy of complex behavior relationships and potential abnormal patterns, providing high-quality, structured input features for subsequent behavior evolution analysis and risk identification, and effectively improving the risk perception ability and processing efficiency of the system in a complex network environment.

[0026] The specific operation steps of constructing the time-sensitive behavior trend model in S3 include: S31 divides user behavior embedding vectors into sliding windows Divide user behavior embedding vectors into sliding window sequences according to time sequence. The user behavior embedding vectors obtained from the graph embedding module record the behavior features of the user in different time periods. Divide the embedding vectors into continuous time period sequences in a fixed time length sliding window manner. Set the window size to T and the step size to S. Each window contains T continuous time point vectors, resulting in Each group is a time sequence input sample. Sequence data is input into the downstream time sequence modeling network as input, supporting evolution analysis of user behavior over time. S32 constructs a behavior trend analysis model using a recurrent neural network, a time-aware attention mechanism, or a time convolutional network; Select a deep learning model suitable for processing time series data to model the divided vector sequence. The main candidate models include: (1) Recurrent Neural Network: learn the temporal context information through the transmission of hidden states, suitable for behavior evolution modeling with long sequence dependence; (2) Time-aware attention mechanism: dynamically allocate weights to historical behaviors at each time point, highlight key behavior nodes, and improve model interpretability; (3) Time convolutional network: use one-dimensional convolution kernel to extract features on the time axis, with parallel processing and long dependence modeling capability, suitable for high-frequency behavior sequence modeling; The model training goal is to minimize the prediction error of the behavior trajectory, identify the evolution path of normal behavior, or distinguish the pattern difference between normal and abnormal sequences; S33 model incremental update, Real-time capture of user behavior pattern changes over time; Real-time receive newly generated behavior embedding vectors; Concatenate new vectors to existing sliding window sequences and update the model through incremental learning mechanism to avoid retraining the entire model: For RNN structure, retain historical hidden states and continue forward inference; For attention or convolutional network, use window sliding update parameters or distillation fine-tuning strategy; S34 extract behavior evolution feature vector, Extract behavior evolution feature vectors for specific behavior trajectories as an important basis for anomaly detection and risk prediction; For behavior paths or user groups, use modeling output to extract the following evolution features: behavior trajectory change rate: the fluctuation degree of vector difference in time dimension; Behavior turning point detection: identify the time nodes of behavior mutation through gradient, attention weight or model activation map; Periodicity and trend pattern: Fourier analysis or trend decomposition on behavior sequence to identify periodicity and deviation direction.

[0027] The specific content in S33 is: In the time-sensitive trend model, set a dynamic behavior baseline by monitoring the evolution trajectory of continuous behavior feature vectors; Based on the output behavior evolution feature vector sequence, establish an initial behavior baseline: the sliding mean and standard deviation of historical behavior vectors, long-term trend line, and normal distribution parameters of each type of behavior; As new behavior data arrives, the baseline state will be continuously updated to reflect changes in normal behavior patterns; The system will continuously monitor the change curve of the evolution trajectory to form a behavior feature trajectory for each time period; When new behavior data is input, perform incremental training based on the historical model state and current data features to avoid resource consumption caused by full retraining; Update model parameters through incremental learning algorithm, and use the input at the current time + the hidden state of the model as the training unit during incremental update to quickly learn behavior pattern changes; In each time window, the deviation degree of the behavior feature and the confidence interval are calculated to determine whether it belongs to the abnormal evolution state; the behavior feature vector in the current sliding window is: The dynamic behavior baseline vector corresponding to the time period is: The deviation degree formula of the current behavior vector and the baseline behavior vector is: In the formula, n is the number of behavior feature dimensions, The current value and the baseline value of the i-th behavior feature are respectively; The change rate and the abnormal peak value of the deviation value are calculated, including detecting whether there is a sudden behavior; the confidence interval is constructed under the current window; if the deviation value of the current behavior vector exceeds the confidence interval, or deviates continuously at multiple time points, it is determined that there may be an abnormal evolution trend; if it is detected that the behavior trajectory deviates within a certain time range, it is marked as a potential risk user; The time window threshold of continuous abnormal evolution is set; once any of the following conditions is triggered, the user is marked as a potential risk object: the abnormal behavior deviation degree continuously rises; the behavior category conversion occurs; the abnormal behavior has high similarity with the historical attack sample / abnormal event feature.

[0028] The process of introducing dynamic risk threshold adaptive adjustment in S3 is: A plurality of risk identification sensitivity levels are preset, respectively corresponding to different network security situation levels, and different parameter configurations are defined for each level, including: (1) the confidence interval width of abnormal behavior detection; (2) the alarm threshold of behavior deviation value; (3) the granularity and update frequency of the sliding window; Each sensitivity level is mapped to a network security situation level, which is used to automatically adjust the system response strength, and the sensitivity level is automatically switched according to rules or strategies, and manual control by a security administrator is also supported; The current network security state is determined by monitoring the attack warning information, security event density, and user abnormal behavior frequency of the system level; the attack warning information includes the threat level, attack type, and target host provided by the intrusion detection system, host protection system, or threat intelligence platform; the security event density is the number of alarm logs and security events recorded per unit time; the user abnormal behavior frequency is the frequency of high deviation behaviors identified by a trend analysis model; These indicators are used to determine the current network state: normal (green); attention (yellow); risk (orange); critical (red) level, combined with preset weights and threshold rules; According to the network security state level, the abnormality judgment threshold and the identification sensitivity parameters in the behavior trend model are dynamically adjusted; once the situation level changes, the system automatically adjusts the following key parameters: behavior deviation judgment threshold; detection window length; abnormal behavior confidence interval range; model update frequency; When the security situation is red critical, the model is adjusted to extremely high sensitivity; When the security situation returns to yellow attention or green normal, the system gradually adjusts the sensitivity level to avoid excessive alarm; In the risk rising state, the system automatically improves the identification sensitivity to capture more potential risk behaviors, and appropriately relaxes in the risk declining stage to balance performance and accuracy; In the high-risk state: the system enables high-frequency detection and low-tolerance strategy, sacrificing part of the performance to capture more suspicious behaviors; the linkage mechanism can be started, including automatic isolation strategy and manual review priority queue; In the low-risk state: the system appropriately relaxes the sensitivity, adopts low-frequency detection and high-accuracy strategy, reduces false positives and reduces resource burden; at the same time, the model automatically compresses or archives recent behavior data and enters maintenance mode; the overall goal is to adapt to the changing network environment.

[0029] A risk management and control system based on real-time behavior analysis, comprising Behavior data acquisition module: collect multi-source behavior data of users and entities, and perform protocol analysis, semantic label embedding and structured processing; User behavior modeling module: construct user behavior graph based on multi-modal relationship, and mine structural features and context semantics between behaviors; Behavior trend analysis module: analyze user behavior evolution track through time series modeling and incremental learning to identify potential abnormal behaviors in real time; Risk level evaluation module: fuse multi-dimensional behavior features and historical labels to assign risk levels to abnormal behaviors and perform classification and discrimination; Strategy optimization module: linkage response mechanism and continuous optimization of behavior identification strategy and model parameters according to the disposal effect to realize system closed-loop evolution.

[0030] The application adopts a lightweight protocol decoding and behavior label embedding method to perform structured processing on data, constructs a raw behavior data set of users and entities, performs sliding window analysis on the raw behavior data set, introduces a behavior expression mechanism based on sparse representation, combines a streaming modeling method to construct a time-sensitive behavior trend model, identifies abnormal evolution tracks of user behavior through an incremental learning strategy, adopts a high-throughput streaming data processing engine and a fast similarity matching algorithm, constructs a fusion discriminant model based on multi-dimensional behavior indicators and historical risk labels, and according to a risk level, triggers a preset response mechanism, combines historical disposal effects and risk intervention records to periodically update behavior identification strategies and model parameters.

[0031] The application efficiently and structurally processes multi-source behavior data through a lightweight protocol decoding and behavior label embedding technology, and constructs a raw behavior data set of users and entities with unified semantics and traceable timelines. On this basis, a sliding window analysis and sparse representation mechanism are adopted, a user behavior graph is constructed by combining a graph embedding learning method, the expression and discrimination abilities of behavior data are significantly improved, and high-quality input features are provided for subsequent analysis. The system further constructs a time-sensitive behavior trend model through a streaming modeling method, introduces an incremental learning strategy, captures dynamic changes of user behavior in real time, quickly identifies abnormal evolution tracks, and adaptively adjusts identification sensitivity according to network situations, so as to efficiently and accurately perceive risks in a complex network environment. Meanwhile, the system uses a high-throughput streaming data processing engine and a fast similarity matching algorithm to construct a fusion discriminant model, assigns a risk level to abnormal behavior and performs classification and discrimination, further updates behavior identification strategies and model parameters periodically through a closed-loop security strategy optimization mechanism, combines historical disposal effects and risk intervention records, and realizes intelligent evolution of the system. This closed-loop mechanism not only improves the real-time processing capability and computing efficiency of the system, but also enhances its adaptability to new attack methods, and provides an efficient and reliable solution for risk management and control in a complex network environment.

[0032] It is to be noted that, in the present text, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0033] The above examples are merely used to illustrate the technical solutions of the present application, but not to limit it; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A risk management method based on real-time behavior analysis, characterized in that, Includes the following steps: S1 employs a lightweight protocol decoding and behavior tag embedding method to perform structured processing on the data and construct the original behavior dataset of users and entities. S2 performs sliding window analysis on the original behavior dataset, introduces a behavior expression mechanism based on sparse representation, integrates contextual information and temporal patterns, extracts multi-dimensional behavior features, and uses graph embedding learning method to construct user behavior graph; S3 combines streaming modeling methods to construct a time-sensitive behavior trend model. It identifies abnormal evolution trajectories of user behavior through an incremental learning strategy and introduces a dynamic risk threshold control mechanism to adaptively adjust the identification sensitivity according to changes in network status. S4 employs a high-throughput streaming data processing engine and a fast similarity matching algorithm. It constructs a fusion discrimination model based on multi-dimensional behavioral indicators and historical risk labels, assigns risk levels to the identification results, and performs preliminary classification. Based on the risk level, S5 triggers a preset response mechanism and, combined with historical handling results and risk intervention records, periodically updates the behavior recognition strategy and model parameters to form a closed-loop security strategy optimization mechanism.

2. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The specific operation steps in S1 include: S11 data acquisition, By deploying a data acquisition agent on the terminal device, user operation commands and system call sequences are captured in real time, including keyboard input, file read / write, and process calls. By accessing the log collection interface of the information system, we can obtain security event logs, user authentication logs, and access control records generated during system operation. By using network traffic mirroring devices deployed on network nodes, network access records are collected, including access targets, protocol types, packet sizes, and frequencies. S12 data preprocessing, The collected raw data is preprocessed through a distributed lightweight protocol parsing module, including data deduplication, time alignment, and field standardization. Input multi-source data into the distributed lightweight protocol parsing module to perform protocol decoding and content restoration on data of different formats, filter duplicate behavior records, and avoid data redundancy caused by system log redundancy; Based on a unified system time benchmark, time synchronization calibration is performed on behavioral events from different sources, and behavioral fields are mapped to a unified data structure format. S13 Data Labelling and Organization Behavioral tags, including operation type, resource category, operation context and behavior triggering factor, are embedded in the preprocessed behavioral data and organized into a structured data stream in a unified format. S14 Data Classification and Indexing Based on user identity, entity identifier, and timestamp, structured data is categorized, organized, indexed, and aggregated in multiple dimensions. The behavior of the same user on different terminals and in different time periods is merged and managed to form a continuous behavior sequence. Finally, a user and entity original behavior dataset with unified semantics, traceable timeline, and entity affiliation is constructed.

3. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The specific operation steps in S2 include: S21 constructs a multimodal behavior graph. Based on the interaction relationships between users and entities in the original behavior dataset, a multimodal behavior graph is constructed with users, operation resources, and operation events as nodes. Based on the generated original behavior dataset, core elements are extracted from the behavior records. These core elements include user identifier, operation resources, and operation events. User identifier includes account ID and terminal ID; operation resources include accessed servers, databases, and file paths; and operation events include read, write, login, and execute. The above three types of elements are abstracted into multimodal nodes, and each type of node constitutes a different modality in the graph: Node type 1: User node; Node type 2: Resource node; Node type 3: Event node; The graph is constructed based on the interaction patterns recorded in actual behavior: User → Event: represents a user performing a certain behavior; Event → Resource: represents a behavior acting on a resource. All nodes and edges together constitute a multimodal behavior graph. S22 Construct the edge weight matrix By using a sliding window to statistically analyze the frequency of behavior sequences, transition probabilities, and event triggering relationships between nodes, an edge weight matrix is ​​constructed. A sliding time window machine is used to segment the behavior graph over time and to count the interaction patterns within each window. In each time window, the following edge feature indicators are calculated: (1) Behavior frequency: the number of times the user-behavior-resource path appears in the window; (2) Transition probability: the probability of occurrence between specific behavior sequences; (3) Event triggering relationship strength: the potential triggering relationship between two behaviors is judged based on the time sequence and historical rule base. According to the statistical results, the corresponding weights are assigned to the edges in the graph to form an edge weight matrix. S23 diagram embedding representation A graph embedding algorithm is used to vectorize the multimodal behavioral graph, capturing local structure and global topological features; Based on the graph embedding learning algorithm, a multimodal behavior graph and its edge weight matrix are input. Multiple rounds of random walks or message passing mechanisms are performed in the graph. Semantic aggregation is performed by combining node adjacency relationships and edge weights. The output is a low-dimensional vector of each node. The vector encodes the local behavioral features, role position and historical interaction patterns of the node in the whole graph structure. The embedding results can capture the individual behavioral features of users and reflect their interaction characteristics with other entities. S24 Behavioral Evolution Modeling and Anomaly Detection The generated user behavior embedding vectors serve as one of the input features for subsequent behavior evolution modeling and anomaly detection; It also supports graph update mechanisms at multiple time scales to maintain the timeliness of the graph; User behavior embedding vectors are used as one of the input features and fed into the behavior evolution modeling module and the anomaly detection module. A multi-timescale graph update mechanism is introduced to periodically reconstruct or incrementally update the behavior graph structure. Minute-level or hourly-level incremental updates are used for rapidly changing scenarios, and daily-level full graph reconstruction strategy is used for macro-structural adjustments. The update mechanism ensures the timeliness and robustness of the embedded representation.

4. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The specific steps for constructing the time-sensitive behavioral trend model in S3 include: S31 Sliding Window Divides User Behavior Embedding Vectors The user behavior embedding vector is divided into a sliding window sequence according to the time series; the user behavior embedding vector obtained from the graph embedding module records the user's behavioral characteristics at different time periods; Using a sliding window with a fixed time length, the embedded vector is divided into a continuous sequence of time periods. The window size is set to T, the step size to S, and each window contains vectors at T consecutive time points. Each group serves as a time-series input sample; the sequence data is fed into the downstream time-series modeling network to support the analysis of the evolution of user behavior over time. S32 uses recurrent neural networks, time-aware attention mechanisms, or temporal convolutional networks to construct behavioral trend analysis models. Select a deep learning model suitable for processing time series data and model the divided vector sequence. The main candidate models include: (1) Recurrent Neural Network: learns time context information through the transmission of hidden states, which is suitable for modeling behavior evolution of long sequence dependencies; (2) Time-aware attention mechanism: dynamically allocates the weight of historical behavior at each time point, highlights key behavior nodes, and improves the interpretability of the model; (3) Temporal Convolutional Network: uses one-dimensional convolution kernels to extract features on the time axis, has the ability to perform parallel processing and long dependency modeling, and is suitable for modeling high-frequency behavior sequences. The model training objective is to minimize the prediction error of behavioral trajectories, identify the evolutionary path of normal behavior, or distinguish the pattern differences between normal and abnormal sequences. S33 model incremental update Real-time capture of user behavior patterns over time; real-time reception of newly generated behavior embedding vectors; concatenation of new vectors into existing sliding window sequences, and updating of the model through incremental learning mechanisms to avoid retraining the entire model: for RNN structures, historical hidden states are preserved and forward inference continues; for attention or convolutional networks, window sliding parameter update or distillation fine-tuning strategies are adopted. S34 extracts behavioral evolution feature vectors. For specific behavioral trajectories, behavioral evolution feature vectors are extracted as an important basis for anomaly identification and risk prediction. For behavioral paths or user groups, the following evolutionary features are extracted using modeling output: behavioral trajectory change rate: the degree of fluctuation of vector difference in the time dimension; behavioral turning point detection: the time nodes of behavioral mutations are identified through gradient, attention weight or model activation graph; periodic and trend patterns: Fourier analysis or trend decomposition is performed on behavioral sequences to identify periodic patterns and offset directions.

5. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The specific content of S33 is as follows: In the time-sensitive trend model, a dynamic behavior baseline is set, and the evolution trajectory of continuous behavior feature vectors is monitored. Based on the output sequence of behavior evolution feature vectors, an initial behavior baseline is established, which consists of: the moving mean and standard deviation of historical behavior vectors, long-term trend line, and normal distribution parameters of each category of behavior. As new behavioral data arrives, the baseline state will be continuously updated to reflect changes in normal behavioral patterns; the system will continuously monitor the change curve of the evolution trajectory to form behavioral characteristic trajectories for each time period. When new behavioral data is input, incremental training is performed based on the historical model state and current data features to avoid the resource consumption caused by full retraining; the model parameters are updated through incremental learning algorithms, and the current input plus the model's hidden state are used as training units during the incremental update process to quickly learn changes in behavioral patterns. Within each time window, the deviation degree and confidence interval of the behavioral features are calculated to determine whether it belongs to an abnormal evolutionary state; the behavioral feature vector within the current sliding window is: The baseline vector for dynamic behavior in the corresponding time period is: The formula for calculating the deviation between the current behavior vector and the baseline behavior vector is: In the formula, n represents the number of behavioral feature dimensions. These are the current value and the baseline value of the i-th behavioral feature, respectively; Statistical analysis of the rate of change and abnormal peak values, including detecting the presence of mutational behavior; constructing confidence intervals within the current window; If the deviation of the current behavior vector exceeds the confidence interval, or if it deviates at multiple consecutive time points, it is judged to be a possible abnormal evolution trend; if the behavior trajectory is detected to deviate within a certain time range, it is marked as a potential risk user. Set a time window threshold for continuous abnormal evolution; once any of the following conditions are triggered, the user can be marked as a potential risk object: the degree of deviation of abnormal behavior continues to increase; a change in behavior category occurs; the abnormal behavior has a high similarity to the characteristics of historical attack samples / abnormal events.

6. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The process of introducing dynamic risk threshold adaptive adjustment in S3 is as follows: Multiple risk identification sensitivity levels are preset, each corresponding to a different network security situation level. Each level defines different parameter configurations, including: (1) the confidence interval width for abnormal behavior detection; (2) the alarm threshold for behavior deviation; and (3) the granularity and update frequency of the sliding window. Each sensitivity level is mapped to a network security situation level and is used to automatically adjust the system response strength. Sensitivity levels switch automatically according to rules or policies, and also support manual control by security administrators. By monitoring system-level attack warnings, security incident density, and frequency of abnormal user behavior, the current network security status is determined. Using these indicators in combination with preset weights and threshold rules, the current network status is determined as: Normal (green); Attention (yellow); Risk (orange); Critical (red). Based on the network security status level, the anomaly judgment threshold and identification sensitivity parameters in the behavior trend model are dynamically adjusted; once the status level changes, the system automatically adjusts the following key parameters: behavior deviation judgment threshold; detection window length; anomaly behavior confidence interval range; model update frequency; When the security situation is red and critical, adjust the model to extremely high sensitivity; Once the security status returns to yellow alert or green normal, the system gradually adjusts the sensitivity level to avoid excessive alarms. When the risk level is high, the system automatically increases the recognition sensitivity to capture more potential risky behaviors, while it appropriately relaxes the sensitivity when the risk level is low in order to balance performance and accuracy. Under high-risk conditions: the system adopts a high-frequency detection and low-tolerance strategy, sacrificing some performance to capture more suspicious behaviors; a linkage mechanism can be activated, including automatic isolation strategy and manual review priority queue; Under low-risk conditions: the system appropriately relaxes its sensitivity, adopts a low-frequency detection and high-accuracy strategy to reduce false alarms and lower resource burden; at the same time, it triggers the model to automatically compress or archive recent behavioral data and enter maintenance mode; the overall goal is an adaptive, controllable, and resource-friendly behavioral risk identification mechanism that can adapt to the ever-changing network environment.

7. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The process of assigning risk levels and making preliminary classifications to the identification results in S4 includes: Abnormal behavior samples are input into a fusion discrimination model, which integrates multidimensional behavioral indicators and historical risk labels for feature matching and similarity analysis. S41 abnormal behavior samples include abnormal behavior feature vectors identified from trend evolution models; the abnormal behavior feature vectors include contextual information such as user identity, time window, and operation type associated with them; The S42 fusion discriminant model is a multimodal, multi-feature general classification model. Its design goal is to consider multidimensional behavioral indicators and to perform feature matching using a behavior-label comparison sample library constructed from historical risk identification records. S43 analyzes the similarity and discrimination boundary between the current behavior and typical past risky behaviors; the model outputs a risk confidence score, which is 0-1, representing the degree of abnormality and risk intensity of the current behavior; Based on the confidence score output by the discriminant model, S44 classifies user behavior into three categories: low risk, medium risk, and high risk, combined with a preset risk level classification standard. The system presets risk score threshold ranges: low risk: 0.0-0.4; medium risk: 0.4-0.7; high risk: 0.7-1.0; and maps the confidence score of each abnormal behavior sample to the corresponding level. S45 further identifies specific risk types for high-risk categories and marks the time period of abnormal behavior and related contextual information. For behavior samples at the high-risk level, it further triggers the fine-grained risk classification module to identify specific risk types. At the same time, it extracts and annotates contextual information such as the time period of the behavior, the operations and resources before and after the behavior sequence, the user's role, terminal IP, and network location, and generates a structured risk event report for the subsequent response module to refer to.

8. The risk management method based on real-time behavior analysis according to claim 1, characterized in that, The process of forming a closed-loop security strategy optimization mechanism in S5 is as follows: After executing the risk response mechanism, S51 automatically records user feedback results, the effectiveness of handling strategies, and subsequent changes in abnormal behavior. After abnormal behavior is identified and risk levels are classified, the system triggers corresponding risk response strategies. Abnormal behavior identification includes automatically logging out suspicious accounts and restricting access permissions. Triggering manual review; After the risk response is completed, the S52 system automatically collects the following feedback information and records it in the database: (1) User feedback results: whether the operation is confirmed to be legal, whether to appeal; (2) Effect of the handling strategy: whether the account ban prevents further abnormalities, whether the access restriction is effective; (3) Subsequent changes in abnormal behavior: whether the behavior continues, whether the frequency decreases, or whether it changes to other abnormal patterns; All feedback information will be written into the risk response feedback database in a structured manner, serving as a real sample source for subsequent model optimization; S53 regularly retrains its discrimination and behavioral trend models based on a historical risk event database, adjusting model parameters to adapt to new attack methods and behavioral patterns. The system periodically schedules data from the risk event database, including: abnormal behavior feature vectors; user tag feedback; judgment results and actual risk consequences; S54 performs incremental or full retraining on the behavioral trend model and the fusion discriminant model, respectively. The process includes: Sample balancing and data augmentation: Solving the problem of uneven distribution of positive and negative samples; Hyperparameter tuning, including learning rate and attention mechanism weight adjustment; New feature fusion features include the introduction of behavioral path length and sequence frequency variation; The retrained model needs to pass the accuracy evaluation on the validation set. Once it meets the deployment criteria, it will be automatically deployed to replace the old model. The system records the data source, model configuration, and performance metrics for each training session for future tracking. S55 improves the system's response speed and accuracy to abnormal behavior by continuously optimizing the behavioral feature construction strategy and threshold control mechanism; based on the latest risk event analysis and model training feedback, it continuously optimizes the behavioral feature construction method, including: Add behavior trigger source tracking features; Optimize the granularity of the time window, including switching to a variable-length sliding window to adapt to sudden behavior; Introduce resource sensitivity weights to enhance the ability to perceive key resource operation behaviors; In the anomaly detection mechanism, the system can dynamically adjust the behavior deviation threshold, confidence score boundary value, and response strategy triggering standard. After optimization, the rules and feature fields are uniformly updated to the strategy engine and model input module, and gray-scale testing is carried out. S56 builds a policy update log and model evolution version library to achieve traceable management of security policies and identification models, thereby realizing a closed-loop operation system of risk perception-response-optimization.

9. A risk management system based on real-time behavior analysis, characterized in that, include Behavioral data acquisition module: Collects multi-source behavioral data of users and entities, and performs protocol parsing, semantic tag embedding, and structured processing; User behavior modeling module: Constructs user behavior graphs based on multimodal relationships, and mines structural features and contextual semantics between behaviors; Behavioral trend analysis module: Analyzes the evolution trajectory of user behavior through time series modeling and incremental learning to identify potential abnormal behaviors in real time; Risk level assessment module: integrates multi-dimensional behavioral characteristics and historical tags to assign risk levels to abnormal behaviors and classify them. Strategy optimization module: It links the response mechanism and continuously optimizes the behavior recognition strategy and model parameters based on the handling effect to achieve closed-loop evolution of the system.

Images