Intranet user behavior analysis method and system based on weight calculation

Abstract

The present invention provides an intranet user behavior analysis method and system based on weight calculation, which obtains all behavior information of intranet users within a preset time period; analyzes and matches the behavior information, labels the corresponding users and entities, and aggregates them to form multiple user behavior sequences; based on the user behavior sequence, the TF-IDF algorithm is used to calculate the high-weighted label corresponding to each user; the high-weighted label of each user is monitored and analyzed to determine its risky behavior. The present invention can accurately perform user profiling and prevent and control important behavior risks in a targeted manner.

Description

Technical Field

[0001] The present invention belongs to the technical field of user portraits, and specifically relates to an intranet user behavior analysis method and system based on weight calculation. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Applying user portrait labeling technology to intranet behavior analysis can condense the data in the log into each label that reflects the entity's behavior, making it easier for algorithm personnel to vectorize labels and discover risk factors in a timely manner. However, according to the inventor's understanding, the current user behavior analysis based on portrait labeling technology mainly manually determines the weight of the behavior label based on business needs, and then comprehensively calculates the user's behavior risk characteristics based on the time decay index. However, these solutions are too subjective and cannot provide more adaptive risk supervision for each user. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes an intranet user behavior analysis method and system based on weight calculation. The present invention can accurately perform user profiling and prevent and control important behavioral risks in a targeted manner.

[0005] According to some embodiments, the present invention adopts the following technical solutions:

[0006] A method for analyzing intranet user behavior based on weight calculation includes the following steps:

[0007] Obtain all behavior information of intranet users within a preset time period;

[0008] Analyze and match the behavior information, label the corresponding users and entities, and aggregate them to form multiple user behavior sequences;

[0009] Based on the user behavior sequence, the TF-IDF algorithm is used to calculate the high-weight tags corresponding to each user;

[0010] Monitor and analyze each user's high-weight tags to determine their risky behaviors.

[0011] As an optional implementation, the behavior information includes file operation, printing and burning, host auditing and traffic information.

[0012] As an optional implementation, the specific process of analyzing and matching the behavior information and labeling the corresponding users and entities includes: setting corresponding matching rules according to risk monitoring requirements, and labeling the users and entities according to the matching rules.

[0013] As an optional implementation, the specific process of analyzing and matching the behavior information and labeling the corresponding users and entities includes: counting the behavior information, setting corresponding thresholds, and when the statistical number of the corresponding behavior information exceeds the set threshold, determining the corresponding labels of the behavior and the user.

[0014] As an optional implementation, the specific process of performing aggregation to form multiple user behavior sequences includes: taking out the tag sequence in time sequence according to the computing requirements, and aggregating by user to obtain multiple user behavior sequences.

[0015] As an optional implementation method, based on the user behavior sequence, using the TF-IDF algorithm, the specific process of calculating the high-weight label corresponding to each user includes: extracting the user behavior sequence for a period of time, arranging them according to the time series relationship, aggregating each user to generate a behavior label sequence, calculating the occurrence frequency of each label under each user behavior sequence, and calculating the reverse document frequency; fusing the occurrence frequency and the reverse document frequency to obtain the influence of each label on different user behaviors, and selecting the label whose influence exceeds the set value as the high-weight label for the corresponding user.

[0016] As a further limitation, the specific process of fusing the occurrence frequency and the inverse document frequency to obtain the influence of each tag on different user behaviors is as follows:

[0017] The occurrence frequency TF is the ratio of the number of occurrences of the corresponding tag in the user behavior sequence to the total number of tags in the sequence; the inverse document frequency IDF is the logarithm of the sum of the ratio of the total number of tags in all user behavior sequences to the amount of user behavior sequence data containing the corresponding tag and one, with e as the base.

[0018] An intranet user behavior analysis system based on weight calculation, comprising:

[0019] An acquisition module is configured to acquire all behavior information of intranet users within a preset time period;

[0020] A preprocessing module is configured to analyze and match the behavior information, label the corresponding users and entities, and aggregate them to form multiple user behavior sequences;

[0021] The weight calculation module is configured to calculate the high-weight tag corresponding to each user based on the user behavior sequence using the TF-IDF algorithm;

[0022] The risk prevention and control module is configured to monitor and analyze each user's high-weight tags to determine their risky behaviors.

[0023] A computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the steps in the above method are completed.

[0024] An electronic device comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the above method are completed.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The steps of the present invention are clear and have a high reuse rate: tags are the highly condensed essence of log data, which facilitates the mining of the association and importance between different behaviors, can be reused, and have a high degree of scalability based on time and users;

[0027] The process of the present invention is simple, the execution efficiency is high, the weight calculation process is simple, the amount of calculation is small, the number of times the processor needs to be called is small, and the required resources are small;

[0028] The present invention can provide personalized support for user portraits in the field of intranet security, and also has the function of predicting risks. In the process of risk prevention and control, it is only necessary to pay attention to the high-weight tags reflected by the corresponding users. Few resources need to be called and the response speed is fast.

[0029] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0031] Figure 1 It is a schematic diagram of the process of the present invention;

[0032] Figure 2 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0034] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0035] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0036] like Figure 1 As shown, a method for analyzing intranet user behavior based on weight calculation includes the following steps:

[0037] (1) Obtain user behavior tags;

[0038] The specific process includes:

[0039] A) Obtain relevant information from user behavior logs

[0040] For the intranet user, all behavior information within a preset time period is obtained. In this embodiment, the behavior information includes file operations, printing and burning, host auditing, and traffic.

[0041] Of course, during the implementation of the present invention, the acquisition of behavioral information complies with the law and relevant legal provisions and is carried out with the user's consent, and there is no violation of user privacy or other illegal situations.

[0042] B) Statistical analysis and rule matching

[0043] Based on all user behavior information within a preset time period, based on rule matching (the rule can be selected or changed according to needs and analysis purposes), users and entities are labeled, or based on statistical analysis and establishing a baseline (or a minimum threshold, for example, the number of each type of user behavior information is counted and a minimum threshold is set. When the corresponding number exceeds the minimum threshold, the behavior information is considered to belong to the corresponding label).

[0044] Then, based on the computing requirements, the label sequence is taken out in time sequence and aggregated by user to obtain multiple user behavior sequences.

[0045] (2) Calculate label weight

[0046] TF is the frequency of a word. In natural language processing problems, the general process is to first segment words and then extract important features. After vectorization, the user behavior label sequence can also apply this algorithm to count the frequency of each label in each user behavior sequence.

[0047] Its calculation formula is as follows:

[0048] TF = the number of times a tag appears in the user behavior sequence / the total number of tags in the sequence

[0049] In this embodiment, user behavior sequences over a period of time are extracted and arranged in a time series relationship, and a behavior label sequence is generated for each user in an aggregated manner, and then the above formula is calculated.

[0050] IDF

[0051] Set to ignore a tag when it exceeds the upper limit of a tag frequency. When it is a float between 0 and 1, it indicates the ratio of the tag frequency; when it is an int, it indicates the number of tag frequencies;

[0052] IDF stands for Inverse Document Frequency. When applied to this topic, the fewer user behavior sequences containing a certain tag, the larger the IDF value, indicating that the tag has a stronger ability to distinguish. The specific calculation formula is as follows:

[0053] IDF=log e (Total number of tags in all user behavior sequences

[0054] / Number of user behavior sequences containing this tag + 1)

[0055] TF-IDF

[0056] By combining the above two algorithms, we can perform statistical analysis on the key tags in the sequence and evaluate the impact of each tag on different user behaviors.

[0057] The following formula is the final formula of the algorithm, based on the results of the above two sections:

[0058] TFIDF=TF×IDF

[0059] Within a preset time period, each tag and each user must be calculated, and the high-weight tag corresponding to each user is obtained according to the formula of the above algorithm.

[0060] (3) Risk monitoring

[0061] According to the weight calculation results, the high-weight tags of each user are compared to screen out unique behavior tags. The high-weight tags show the difference in the user's behavior, that is, the behavior corresponding to the high-weight tags increases their risk expectations.

[0062] Determine response measures and provide personalized risk monitoring advice for risks identified by high-weight tags.

[0063] like Figure 2 As shown, an intranet user behavior analysis system based on weight calculation includes:

[0064] An acquisition module is configured to acquire all behavior information of intranet users within a preset time period;

[0065] A preprocessing module is configured to analyze and match the behavior information, label the corresponding users and entities, and aggregate them to form multiple user behavior sequences;

[0066] The weight calculation module is configured to calculate the high-weight tag corresponding to each user based on the user behavior sequence using the TF-IDF algorithm;

[0067] The risk prevention and control module is configured to monitor and analyze each user's high-weight tags to determine their risky behaviors.

[0068] In this embodiment, the acquisition module is based on a machine-readable storage medium, such as a hard disk. We read the relevant logs according to a predetermined method and label the user entity according to the rules or statistical thresholds; the preprocessing module sorts and aggregates the label storage data to form a user behavior label sequence while retaining the integrity of the information; the weight calculation module is the core part of the entire device system, which runs based on a processor and can include CPU, GPU, ASIC, etc., and performs TF-IDF algorithm operations on all sequences by reading the code instructions stored in the readable storage device; the risk protection module focuses on monitoring the high-weight labels of each user based on the calculation results of the previous step.

[0069] In other product embodiments, the following product embodiments are also provided:

[0070] A computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the steps in the above method are completed.

[0071] An electronic device comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the above method are completed.

[0072] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0073] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0076] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0077] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A method for analyzing intranet user behavior based on weight calculation, characterized by: The following steps are involved: Obtain all behavior information of intranet users within a preset time period; Analyze and match the behavior information, label the corresponding users and entities, and aggregate them to form multiple user behavior sequences; The specific process of aggregating to form multiple user behavior sequences includes: taking out the tag sequence in time sequence according to the computing requirements, aggregating by user, and obtaining multiple user behavior sequences; Based on the user behavior sequence, the TF-IDF algorithm is used to calculate the high-weight tags corresponding to each user. The specific process includes: Extract user behavior sequences over a period of time, arrange them in time series, aggregate each user to generate a behavior tag sequence, calculate the frequency of occurrence of each tag under each user behavior sequence, and calculate the reverse document frequency; combine the occurrence frequency and reverse document frequency to obtain the influence of each tag on different user behaviors, and select the tag with an influence exceeding the set value as the high-weight tag for the corresponding user; The specific process of fusing the occurrence frequency and the inverse document frequency to obtain the influence of each tag on different user behaviors is as follows: the occurrence frequency TF is the ratio of the number of occurrences of the corresponding tag in the user behavior sequence to the total number of tags in the sequence; the inverse document frequency IDF is the logarithm of the sum of the ratio of the total number of tags in all user behavior sequences to the amount of user behavior sequence data containing the corresponding tag and one, with e as the base; Monitor and analyze each user's high-weight tags to determine their risky behaviors.

2. The method for analyzing intranet user behavior based on weight calculation according to claim 1, characterized in that: The behavior information includes file operation, printing and burning, host auditing and flow information.

3. The method for analyzing intranet user behavior based on weight calculation according to claim 1, characterized in that: The specific process of analyzing and matching the behavior information and labeling the corresponding users and entities includes: setting corresponding matching rules according to risk monitoring requirements, and labeling the users and entities according to the matching rules.

4. The method for analyzing intranet user behavior based on weight calculation according to claim 1, characterized in that: The specific process of analyzing and matching the behavior information and labeling the corresponding users and entities includes: counting the behavior information, setting corresponding thresholds, and when the statistical number of the corresponding behavior information exceeds the set threshold, determining the corresponding label of the behavior and the user.

5. An intranet user behavior analysis system based on weight calculation, characterized by: include: An acquisition module is configured to acquire all behavior information of intranet users within a preset time period; A preprocessing module is configured to analyze and match the behavior information, label corresponding users and entities, and aggregate them to form multiple user behavior sequences; The specific process of aggregating to form multiple user behavior sequences includes: taking out the tag sequence in time sequence according to the computing requirements, aggregating by user, and obtaining multiple user behavior sequences; The weight calculation module is configured to calculate the high-weight tag corresponding to each user based on the user behavior sequence using the TF-IDF algorithm. The specific process includes: Extract user behavior sequences over a period of time, arrange them in time series, aggregate each user to generate a behavior tag sequence, calculate the frequency of occurrence of each tag under each user behavior sequence, and calculate the reverse document frequency; combine the occurrence frequency and reverse document frequency to obtain the influence of each tag on different user behaviors, and select the tag with an influence exceeding the set value as the high-weight tag for the corresponding user; The specific process of fusing the occurrence frequency and the inverse document frequency to obtain the influence of each tag on different user behaviors is as follows: the occurrence frequency TF is the ratio of the number of occurrences of the corresponding tag in the user behavior sequence to the total number of tags in the sequence; the inverse document frequency IDF is the logarithm of the sum of the ratio of the total number of tags in all user behavior sequences to the amount of user behavior sequence data containing the corresponding tag and one, with e as the base; The risk prevention and control module is configured to monitor and analyze each user's high-weight tags to determine their risky behaviors.

6. A computer-readable storage medium, characterized in that: Used to store computer instructions, which, when executed by a processor, complete the steps of the method according to any one of claims 1 to 4.

7. An electronic device, characterized in that: The method comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor, wherein when the computer instructions are executed by the processor, the steps in the method according to any one of claims 1 to 4 are completed.

Images