Anomaly detection method, device and computer storage medium

Abstract

The present application provides an anomaly detection method, device and computer storage medium, which obtains the log to be detected; performs statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; uses at least two preset models to process the operation behavior indicator data respectively to obtain at least two output results, and the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject; according to the at least two output results, it is determined whether the target behavior subject is abnormal. By detecting the operation behavior indicator data through at least two preset models, and taking into account the differences in different regional characteristics and historical operation behavior characteristics, the accuracy of the log audit results can be improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an anomaly detection method, device and computer storage medium. Background Art

[0002] In recent years, with the popularization of the Internet, business systems store a large amount of user sensitive information, and data security in the information field has received more and more attention from managers. There are many reasons for the leakage of user sensitive information, in addition to common reasons such as hacker attacks, virus infections, website vulnerabilities, etc., there are also some intentional theft and leakage.

[0003] During the operation of the business system, understanding the operation behavior of staff through log auditing is an important means to prevent the leakage of sensitive information. However, the current log auditing method has some defects. For example, on the one hand, a preset threshold is usually used to judge whether the operation frequency is abnormal, but the setting of the threshold requires rich business experience, and the unified threshold will not be able to meet the differentiated business needs; on the other hand, if the audited logs come from different systems or different units, the current log auditing method does not take into account the business differences between regions; on the other hand, when modeling based on historical data, all accounts need to be uniformly analyzed and audited, and the behavioral characteristics of each account are not taken into account, resulting in the low accuracy of the current log auditing method. Summary of the invention

[0004] The present application provides an anomaly detection method, device and computer storage medium, which can fully consider the differences in business conditions in different regions and the differences in the characteristics of different behavior subjects, thereby improving the accuracy of log audit results.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, the present application provides an anomaly detection method, the method comprising:

[0007] Obtaining a log to be detected; wherein the log to be detected contains operation behavior information of multiple behavior subjects in the target business system in the current detection cycle;

[0008] Performing statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects;

[0009] The operation behavior indicator data are processed respectively by using at least two preset models to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject;

[0010] It is determined whether the target behavior subject is abnormal according to the at least two output results.

[0011] In a second aspect, the present application provides an anomaly detection device, which includes an acquisition unit, a statistical unit, a detection unit, and a determination unit, wherein:

[0012] An acquisition unit is configured to acquire a log to be detected; wherein the log to be detected contains operation behavior information of multiple behavior subjects in the target business system in the current detection cycle;

[0013] A statistical unit configured to perform statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects;

[0014] A detection unit, configured to process the operation behavior indicator data respectively using at least two preset models to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject;

[0015] A determination unit is configured to determine whether the target behavior subject has an abnormality based on the at least two output results.

[0016] In a third aspect, the present application provides an abnormality detection device, which includes a memory and a processor; wherein:

[0017] The memory is used to store a computer program that can be run on the processor;

[0018] The processor is used to execute the steps of the method described in the first aspect when running the computer program.

[0019] In a fourth aspect, the present application provides a computer storage medium storing an anomaly detection program, which implements the steps of the method described in the first aspect when executed by at least one processor.

[0020] The embodiment of the present application provides an abnormality detection method, device and computer storage medium, by obtaining a log to be detected; wherein the log to be detected contains the operation behavior information of multiple behavior subjects in the target business system in the current detection cycle; statistically analyzing the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects; using at least two preset models to process the operation behavior indicator data respectively to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject; according to the at least two output results, it is determined whether the target behavior subject is abnormal. In this way, the first model can realize the abnormality detection of the target behavior subject in combination with the regional characteristics, taking into account the business differences between regions; in addition, the second model can realize the abnormality detection of the target behavior subject in combination with the historical operation behavior indicator data, taking into account the differences in the characteristics of different behavior subjects, thereby improving the accuracy of the log audit results. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of an anomaly detection method provided in an embodiment of the present application.

[0022] Figure 2 A schematic diagram of the process architecture of a log audit system provided in an embodiment of the present application.

[0023] Figure 3 A flowchart of another anomaly detection method provided in an embodiment of the present application.

[0024] Figure 4 A flowchart of another anomaly detection method provided in an embodiment of the present application.

[0025] Figure 5 A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application.

[0026] Figure 6 A schematic diagram of the composition structure of another abnormality detection device provided in an embodiment of the present application.

[0027] Figure 7 A schematic diagram of the specific hardware structure of an anomaly detection device provided in an embodiment of the present application.

[0028] Figure 8A schematic diagram of the composition structure of a log audit system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0030] In the related technology, the anomaly detection methods based on log auditing include the following: (1) anomaly detection through multi-keyword and regular expression matching; (2) dividing the log into structured and unstructured parts, and using hierarchical clustering for anomaly detection; (3) some technical solutions use the log management analysis module to perform log data association analysis according to the preset association rule library, and classify the log data into the database or perform anomaly detection alarm according to the association analysis results; (4) based on user behavior logs, perform automated report analysis through statistical rules, automatically generate reports in a simple and efficient manner, and perform log anomaly auditing.

[0031] However, the above anomaly detection methods have the following disadvantages:

[0032] (1) Audit frequency anomalies based on preset thresholds, such as operation frequency, Internet Protocol (IP) address switching frequency, etc. On the one hand, the setting of thresholds requires rich business experience; on the other hand, if the operation logs come from different business systems, a unified threshold cannot meet the different business needs;

[0033] (2) When the operation logs come from different systems or different units, various anomaly detection methods do not consider the differences between systems or units;

[0034] (3) When building models based on historical data, all accounts are analyzed and audited uniformly without considering the behavioral characteristics of each account.

[0035] Based on this, the embodiment of the present application provides an abnormality detection method, by obtaining a log to be detected; wherein the log to be detected contains the operation behavior information of multiple behavior subjects in the target business system in the current detection cycle; statistical analysis is performed on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects; the operation behavior indicator data is processed respectively by at least two preset models to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject; according to the at least two output results, it is determined whether the target behavior subject is abnormal. In this way, the first model can realize the abnormality detection of the target behavior subject in combination with the regional characteristics, taking into account the business differences between regions; in addition, the second model can realize the abnormality detection of the target behavior subject in combination with the historical operation behavior indicator data, taking into account the differences in the characteristics of different behavior subjects, thereby improving the accuracy of the log audit results.

[0036] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0037] In one embodiment of the present application, see Figure 1 , which shows a flow chart of an abnormality detection method provided by an embodiment of the present application, such as Figure 1 As shown, the method may include:

[0038] S101: Obtain the log to be detected;

[0039] It should be noted that during the operation of the business system, the staff's operating behavior usually generates a large amount of log information. Understanding the staff's operating behavior through operation logs is one of the important means to prevent internal violations. Therefore, the embodiment of the present application analyzes the operation log to determine whether the subject of the behavior (i.e., the staff) has violated the rules such as manually querying and leaking private information, thereby preventing internal leakage of customer information.

[0040] Based on this, we first need to extract the logs to be detected from the target business system. Since the anomaly detection method is performed in cycles, such as one day, one week, or one month, the logs to be detected contain all the information about the subject of the behavior that accessed the server in the current operation cycle and the specific operation behavior information.

[0041] S102: Performing statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject;

[0042] It should be noted that the target behavior subject is one of the multiple behavior subjects.

[0043] Since the log to be detected may contain the operation information of multiple actors, and each actor needs to be analyzed separately in actual analysis, after obtaining the log to be detected, it is necessary to count the operation behavior indicator data corresponding to each actor, and then use the operation behavior indicator data to perform subsequent operations to determine whether the actor is abnormal, and the actor that is the detection object is the target actor.

[0044] It should be noted that for business systems, different staff members access and operate through their own authorized accounts, thus leaving traces in the business system. In other words, the logs to be detected extracted from the business system record a large number of operation behaviors and information related to the operation behaviors. Through log analysis technology, it is possible to identify specific operation behaviors, operation accounts, and operation times, etc.; then statistics are performed on the target behavior subject to obtain the operation behavior indicator data corresponding to the target behavior subject.

[0045] A large number of operation behaviors and information related to the operation behaviors are recorded in the log to be detected. Therefore, in some embodiments, step S102 may specifically include:

[0046] Parsing the log to be detected to obtain the information to be detected;

[0047] For the target behavior subject, the information to be detected is statistically analyzed based on preset behavior indicators to obtain operation behavior indicator data; wherein, the preset behavior indicators include but are not limited to the following items: operation frequency, operation frequency during non-working hours, online time, number of server IP addresses and number of client IP addresses.

[0048] It should be noted that, in actual use, step S102 can be divided into two steps: the first step is to parse the acquired log to be detected to obtain the information to be detected; the second step is to classify and count the extracted key information to obtain the operation behavior indicator data corresponding to the target behavior subject. In addition, based on the principle of program economy, when counting the operation behavior indicator data, the operation behavior indicator data corresponding to multiple behavior subjects can be obtained at the same time.

[0049] It should be noted that, according to actual application requirements, some behavior indicators are set as test variables, such as operation frequency, operation frequency during non-working hours, online time, number of server IP addresses, and number of client IP addresses. For the target behavior subject, the data corresponding to the preset behavior indicators of the target behavior subject are counted from the log to be detected to obtain the operation behavior indicator data. In this way, it can be judged whether the target behavior subject is an abnormal behavior subject through the operation behavior indicator data.

[0050] Exemplarily, for the log to be detected, the following information is first obtained using log parsing technology: data source unit, system code, identity document (ID) of the subject, operation ID, operation time, server IP, client IP, whether the operation object is sensitive and operation object ID; then, the subject ID is used as the grouping variable (i.e., statistics are performed for different subject IDs respectively), and the operation behavior indicator data is obtained according to the preset behavior indicator statistics. The operation behavior indicator data includes but is not limited to: data source unit, system code, subject ID, cycle identifier (when the cycle is day, it is the operation date), operation frequency, non-working time operation frequency, online time (minutes), number of server IP addresses, and number of client IP addresses.

[0051] S103: using at least two preset models to process the operation behavior indicator data respectively to obtain at least two output results;

[0052] It should be noted that the at least two preset models include a first model and a second model. The first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the geographical characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject.

[0053] It should be noted that the operational data of different actors include many differences. For example, a large group company may have multiple subsidiaries distributed in different provinces. For subsidiaries in different regions, their business content and auditing conditions are different, resulting in differences in the data of actors in different regions. In addition, the work content and operating habits of different actors are also different. Therefore, the accuracy of the results is not high when only unified rules are used to audit all actors. Based on this, multiple preset models can be used to focus on the log data of actors from different angles, so as to make a more comprehensive judgment on whether the actors are abnormal.

[0054] In the embodiment of the present application, at least two preset models include a first model and a second model, wherein the first model has fully considered the differences in business content or other systems of staff members in different regions, and incorporated the environmental variable characteristics of different regions, that is, for the target behavior subject, an anomaly detection model will be constructed in combination with the environmental variables of the region where the target behavior subject is located, and then the target behavior subject will be analyzed. It should be understood that different regions are a macro concept, and its essential meaning is "the differences caused by the different macro environments in which different behavior subjects are located". Therefore, different regions can also be extended to different systems, different departments of the same company, or different units.

[0055] On the other hand, the second model starts with the temporal characteristics of the behavior subject and establishes an anomaly screening model for each behavior subject under the time variable. That is, for the target behavior subject, the anomaly detection model will be constructed in combination with the historical operation behavior indicator characteristics of the target behavior subject. For example, the operation frequency of the behavior subject was relatively low before, and the operation frequency suddenly increased in a certain period but did not exceed the anomaly threshold of the first model. At this time, the first model cannot screen out the behavior subject. However, in fact, the behavior subject is a potential abnormal object, and it is necessary to verify the behavior subject, and the application of the second model can screen it out.

[0056] It should also be noted that anomaly detection itself is a cyclical and repetitive process. In the process of multiple anomaly detections, the same preset model can be used, or a new preset model can be used for each log audit. The latter method can fully consider the differences caused by changes in the work content of the subject in different time periods, but the required processing volume is large, and it can be selected according to the actual audit needs.

[0057] In a specific implementation, each time anomaly detection is performed, the latest preset model is generated based on the latest historical data. That is, before the operation behavior indicator data is detected based on the preset model, the method further includes: obtaining a historical data set; wherein the historical data set at least includes multiple indicator data and multiple result labels corresponding to multiple behavior subjects in the previous detection cycle; based on the historical data set, training the first model and the second model.

[0058] In actual use, the work content and operation behavior of staff will change over time. Therefore, before each anomaly detection, a preset model is generated based on the latest historical data to improve the accuracy of log auditing. Historical data sets are generally panel data, that is, multiple sections are taken on the time series, and sample data consisting of sample observations are selected on these sections at the same time. In other words, historical data sets actually refer to data within multiple historical operation cycles.

[0059] In the embodiment of the present application, the historical data set includes multiple operation behavior indicator data and multiple result labels corresponding to multiple behavior subjects in the previous detection cycle. In order to achieve the best fitting effect, before using the preset model to detect the operation behavior indicator data, a historical data set containing data in the previous detection cycle, that is, the latest historical data, is obtained, and then a preset model is generated based on the historical data set. In this way, the preset model changes over time and always contains the data in the most recent detection cycle that has been completed.

[0060] It should be noted that the preset model can be modeled using a variety of methods. Therefore, in some embodiments, the first model includes a multi-layer logistic regression model, and the second model includes a multi-layer logistic regression model.

[0061] It should be noted that the first model and the second model can adopt a multi-layer logistic regression model, or other forms of models, such as a document body generation model (Latent Dirichlet Allocation, LDA), a regular matching relationship model, and a neural network model, etc., and the first model and the second model can adopt different forms of models, which is not limited in the embodiments of the present application.

[0062] Furthermore, in some embodiments, the first model is a multi-layer Logistic regression model. Before processing the operation behavior indicator data using at least two preset models to obtain at least two output results, the method may further include:

[0063] Performing model training on a first historical data set to obtain a first training model; wherein the first historical data set is a historical data set determined based on the regional characteristics of the target behavior subject, and the first historical data set includes historical operation behavior indicator data of multiple behavior subjects with the same regional characteristics, and the first training model includes multiple first training parameters, and the first training parameters are model coefficients in the first training model;

[0064] Using the first historical data set to train a plurality of first training parameters to obtain a plurality of first parameter models;

[0065] The first training model and the plurality of first parameter models are determined as the first model.

[0066] It should be noted that the first historical data set refers to the behavior indicator data (i.e., the first indicator data) and result labels (first result labels) of multiple behavior subjects from different provinces. The behavior indicator data refers to the behavior subject's non-working time operation frequency, the number of client IP addresses, the number of server IP addresses and other operation behavior-related indicators. The result label refers to whether the behavior subject is an abnormal behavior subject. For example, the result label of the abnormal behavior subject is set to 1, and the result label of the normal subject is set to 0. The specific content and assignment of the behavior indicator data and the result label can be determined according to the actual audit requirements, and the embodiments of this application are not limited.

[0067] In addition, since the first model is used to indicate the abnormal characteristics of behavioral entities in different regions in a macro sense, it can also be extended to the abnormal characteristics of behavioral entities in different departments and systems. In this case, the first historical data set is the behavioral indicator data and result labels of multiple behavioral entities from different departments / systems.

[0068] It should be noted that multi-layer models are mainly applied to data with hierarchical structures. For example, the original data comes from the operation logs generated by multiple actors in different regions, where the data of each actor is affected by the macro level (business characteristics of different provinces, such as whether a log abnormal behavior audit mechanism has been established in the province) and the micro level (behavioral characteristics of each actor itself). At this time, the application of the multi-layer logistic regression model can take into account the variable information and random errors at different levels, thereby improving the accuracy of the model.

[0069] When the multi-layer concept is used to construct the first model, the first model includes a first training model and a first parameter model. The first training model is constructed by taking the first indicator data as the input value and the first result label as the output value. It should be understood that the constructed first training model includes multiple fitting parameters (i.e., first training parameters); then, multiple first training parameters are used as output values ​​and the first indicator data is used as input values ​​to construct multiple first parameter models. That is to say, in actual use, the output value of the first parameter model will be used as the parameter of the first training model.

[0070] Since the first training model may include multiple first training parameters (the number of the first training parameters needs to be determined according to the construction principle of the first training model), there are actually multiple second parameter models, that is, the first training model and multiple first parameter models constitute the first model. It should be understood that the multiple second parameter models have a mutually influential relationship in the fitting process, belong to a whole, and are not independent of each other.

[0071] In addition, in the embodiment of the present application, the operation behavior indicator data includes multiple types of indicators, such as the frequency of operations during non-working hours, the number of client IP addresses, the number of server IP addresses, and whether there is a provincial audit mechanism, etc. Since the meanings of establishing the first training model and the first parameter model are not the same, different types of indicators in the first indicator data can be selected and combined as independent variables of the first training model and the first parameter model, respectively.

[0072] In this way, by constructing the first model through multi-layer thinking, random effects can be incorporated, taking into account the differences in actual business and data conditions in different regions, thereby improving the accuracy of the detection results.

[0073] It should also be noted that after the first model is constructed, it is necessary to optimize the first model to ensure the accuracy of the first model when used for anomaly detection. Therefore, in some embodiments, after determining the first training model and the plurality of first parameter models as the first model, the method may further include:

[0074] Performing a tuning operation on the first model to obtain a tuned first model;

[0075] Obtaining a first significance level value of the tuned first model, and determining whether the first significance level value meets a first preset standard;

[0076] When the first significance level value meets the first preset standard, the tuned first model is determined as the first model.

[0077] It should be noted that after the first model is trained using the first historical data set, the first model is tuned, and then the first significance level value of the tuned first model is obtained. The first significance level represents the significance result of the model when it is used to detect the first historical data set. If the first significance level value does not meet the first preset standard, it means that the tuned first model is not statistically significant, and the first model needs to be further optimized until the first significance level value meets the requirements. In addition, the first preset standard is determined according to the modeling principle of the first model. Generally speaking, when the first significance level value is lower than the significance threshold, it is considered that the first significance level value meets the first preset standard.

[0078] It should also be noted that after obtaining the first model, the model can also be judged for significance first, and then it can be decided whether tuning is needed. The tuning operation depends on the experience of the algorithm designer, who needs to choose the appropriate model optimization method based on experience to perform the tuning operation. Common model optimization methods include adjusting the type and quantity of input parameters, changing the assignment method, and constraint conditions.

[0079] The second model may be a multi-layer logistic regression model. Therefore, in some embodiments, before processing the operation behavior indicator data using at least two preset models to obtain at least two output results, the method may further include:

[0080] Performing model training on a second historical data set to obtain a second training model; wherein the second historical data set includes historical operation behavior indicator data of multiple behavior subjects, and the second training model includes multiple second training parameters, and the second training parameters are model coefficients in the second training model;

[0081] Using the second historical data set to train a plurality of second training parameters to obtain a plurality of second parameter models;

[0082] The second training model and the plurality of second parameter models are determined as the second model.

[0083] It should be noted that, since the second model and the first model have different meanings, it is necessary to use a second historical data set different from the first historical data set to construct the second model. The second historical data set refers to the behavioral indicator data (i.e., second indicator data) and result labels (second result data) from multiple behavioral subjects in different detection cycles. Generally speaking, the second historical data set includes at least 30 cycles of data to achieve a better fitting effect. Similar to the first historical data set, the specific content and assignment of the behavioral indicator data and result labels can be determined according to actual audit requirements, and the embodiments of this application are not limited.

[0084] The second model can also be constructed using the multi-layer concept, so the second model also includes a second training model and a second parameter model. Specifically, the construction method of the second model can refer to the first model, that is, the second indicator data is used as the model input, and the second result label is used as the model output, and the second training model is obtained by training; wherein, the second training model includes multiple second training parameters; using the second indicator data as input, and multiple second training parameters as output, multiple second parameter models are obtained by training, and the second training model and all second parameter models are determined as the second model.

[0085] It should also be noted that after the second model is constructed, it is necessary to optimize the second model to ensure the accuracy of the second model when used for verification. Therefore, in some embodiments, after determining the second training model and the plurality of second parameter models as the second model, the method further includes:

[0086] Performing a tuning operation on the second model to obtain a tuned second model;

[0087] Obtaining a second significance level value of the tuned second model, and determining whether the second significance level value meets a second preset standard;

[0088] When the second significance level value meets the second preset standard, the tuned second model is determined as the second model.

[0089] It should be noted that the second model also needs to be optimized so that the significance of the second model meets the requirements. The specific optimization operation can be referred to above and will not be described in detail here.

[0090] In this way, according to at least two preset models, the operation behavior indicator data is used as input values ​​respectively, and at least two output results can be obtained, so as to make a more comprehensive judgment on the behavior subject and improve the accuracy of log auditing.

[0091] S104: Determine whether the target behavior subject has an abnormality according to the at least two output results.

[0092] It should be noted that, according to at least two output results from different preset models, the target behavior subject can be judged, so as to determine whether the target behavior subject is abnormal, and finally complete the abnormality detection. In addition, the process of judging the target behavior subject according to at least two output results can include multiple methods, for example, if one output result exceeds a critical value, it is considered that the target behavior subject is abnormal, or all output results exceed the critical value before the target behavior subject is considered to be abnormal, which is not limited in this embodiment.

[0093] It should also be noted that if the at least two preset models include a first model and a second model, in some embodiments, the at least two output results include a first output result and a second output result; the at least two output results obtained by processing the operation behavior indicator data respectively using the at least two preset models may specifically include:

[0094] Inputting the operation behavior indicator data of the target behavior subject into the first model to obtain a first fitting probability value; determining the first output result according to a comparison result between the first fitting probability value and a first critical threshold; wherein the first fitting probability value represents an abnormal probability value of the target behavior subject calculated by the first model;

[0095] Inputting the operation behavior index data of the target behavior subject and the historical operation behavior index data of the target behavior subject into the second model to obtain a second fitting probability value; determining the second output result according to a comparison result of the second fitting probability value and a second critical threshold; wherein the second fitting probability value represents an abnormal probability value of the target behavior subject calculated by the second model;

[0096] Accordingly, determining whether the target behavior subject is abnormal according to the at least two output results may specifically include:

[0097] Performing weighted calculation on the first output result and the second output result to obtain a comprehensive abnormality probability value;

[0098] When the comprehensive abnormal probability value is greater than the abnormal critical value, it is determined that the target behavior subject has an abnormality.

[0099] It should be noted that the target behavior subject's operational behavior indicator data is input into the first model to calculate the first fitting probability, and the target behavior subject's operational behavior indicator data and historical operational behavior indicator data are input into the second model to calculate the second fitting probability value. Since the first model and the second model are two relatively independent models, the first fitting probability value and the second fitting probability value are not statistically the same, nor do they belong to data of the same dimension. Therefore, the first output result can be further determined based on the first fitting probability value, and the second output result can be determined based on the second fitting probability value. This process can be understood as a process of unifying the first output result and the second output result, so that the first fitting probability value and the second fitting probability value are converted into parameters of the same dimension for subsequent operations.

[0100] It should be noted that the first output result represents the use of the first model to determine whether the target behavior subject is abnormal, and the second output result represents the use of the second model to determine whether the target behavior subject is abnormal. Therefore, by weighted summing the first output result and the second output result, the judgment results of the first model and the second model can be combined to obtain a more comprehensive comprehensive abnormal probability value. If the comprehensive abnormal probability value is greater than the abnormal critical value, it is determined that the target behavior subject is abnormal. Here, the abnormal critical value is set according to the actual audit requirements. For example, when the security requirements are high, the abnormal critical value can be set lower; when the security requirements are low, the abnormal critical value can be set higher.

[0101] It should also be noted that the weights of the first output result and the second output result can be the same or different. In a feasible case, the first output result takes a value of 1 or 0, 1 represents abnormality, and 0 represents normality. In this case, the higher the abnormal probability value, the greater the abnormal possibility of the target behavior subject. These assignments and settings can be adjusted according to actual usage requirements, that is, the first output result can also be set to 1 for normality and 0 for abnormality. At this time, the lower the abnormal probability value, the greater the abnormal possibility of the target behavior subject.

[0102] The first output result can be determined qualitatively. Therefore, in some implementations, determining the first output result according to the comparison result between the first fitting probability value and the first critical threshold value may specifically include:

[0103] comparing the first fitting probability value with a first critical threshold;

[0104] When the first fitting probability value is greater than a first critical threshold, determining the first output result to be 1;

[0105] When the first fitting probability value is less than or equal to a first critical threshold, the first output result is determined to be 0.

[0106] It should be noted that, as a feasible implementation method, the first output result can be determined qualitatively, that is, when the first fitting probability value is greater than the first critical threshold, the first output result is determined to be 1, otherwise it is determined to be 0. Here, the first critical threshold itself is part of the model, that is, for the first model, its first critical threshold is determined during modeling. Generally speaking, the first critical threshold can be set to 0.5.

[0107] Similarly, the second output result can also be determined qualitatively. Therefore, in some embodiments, determining the second output result according to the comparison result between the second fitting probability value and the second critical threshold value may specifically include:

[0108] comparing the second fitting probability value with a second critical threshold;

[0109] When the second fitting probability value is greater than a second critical threshold, determining that the second output result is 1;

[0110] When the second fitting probability value is less than or equal to a second critical threshold, the second output result is determined to be 0.

[0111] It should be noted that the second output result may be determined by a method similar to the first output result, that is, when the first fitting probability value is greater than the first critical threshold, the first output result is determined to be 1, otherwise it is determined to be 0.

[0112] The first model and the second model are both obtained by modeling using relevant data. On this basis, the business experience of auditors can also be referred to further improve the accuracy of the audit results. Therefore, in some embodiments, the preset model also includes a third model, and the method can also include:

[0113] Processing the operation behavior indicator data using the third model to obtain a third output result; wherein the third model is used to determine whether the target behavior subject has an abnormal output result in combination with a preset business threshold;

[0114] Accordingly, determining whether the target behavior subject is abnormal according to the at least two output results includes:

[0115] Performing weighted calculation on the first output result, the second output result and the third output result to obtain a comprehensive abnormality probability value;

[0116] When the comprehensive abnormal probability value is greater than the abnormal critical value, it is determined that the target behavior subject has an abnormality.

[0117] It should be noted that the third model is used to indicate whether the target behavior subject is abnormal based on business experience. In other words, the third model is constructed based on the actual audit experience of the auditors, and the operational behavior indicator data is tested through the third model, which can give a judgment on whether it is abnormal from the perspective of business experience, thereby increasing the accuracy of the audit results.

[0118] In the case where the preset model also includes a third model, the third output result needs to be included to determine whether the target behavior subject is an abnormal behavior subject. A feasible method is to weight the first output result, the second output result, and the third output result respectively, and then sum the weighted sum to obtain the abnormal probability value, and compare the abnormal probability value with the abnormal critical value to determine whether the target behavior subject is an abnormal behavior subject. In this way, the target behavior subject is audited by comprehensively considering different regions, different time periods, and existing audit experience, which can improve the accuracy of the audit results.

[0119] The third model may adopt a threshold judgment mode. Therefore, in some embodiments, the use of the third model to process the operation behavior indicator data to obtain a third output result may specifically include:

[0120] Comparing the operation behavior indicator data with the preset business threshold;

[0121] When the operation behavior indicator data is greater than the preset business threshold, determining that the third output result is 1;

[0122] When the operation behavior indicator data is less than or equal to the preset business threshold, the third output result is determined to be 0.

[0123] It should be noted that the third model can adopt a threshold judgment mode, that is, according to the previous business experience of auditors, behavioral indicator thresholds are respectively formulated. For example, the number of operations threshold, the operation time threshold, the online time threshold, etc., and then the operation behavior indicator data of the target behavior personnel are compared with these thresholds (for example, if it is higher than the corresponding threshold, the third output result is assigned a value of 1; otherwise, the third output result is assigned a value of 0), thereby obtaining the third output result.

[0124] Furthermore, in some embodiments, when it is determined that the target behavior subject is abnormal, the method may further include:

[0125] Receiving a verification result of whether the target behavior subject has an abnormality; wherein the verification result indicates a confirmation result of a user on whether the target behavior subject has an abnormality;

[0126] Based on the verification result, a result label is set for the target behavior subject; wherein the result label is used to indicate whether the target behavior subject is an abnormal behavior subject.

[0127] It should be noted that although the preset model can preliminarily screen out abnormal behavior subjects, since the model is not necessarily perfect, there may be cases of misjudgment. Therefore, after determining that the target behavior subject is abnormal, it can be reported to the auditor (or the supervisor of the target behavior subject), and the auditor (or the supervisor of the target behavior subject) will manually verify the target behavior subject to obtain the verification result. Then, based on the verification result, a result label is set for the target behavior subject, so that in subsequent cycles, when the historical data is used to fit the generated model, the result label is used to generate the result data of the target behavior subject. In this way, the real result is always used when the model is generated, which can improve the accuracy of the model fitting in the next cycle.

[0128] For example, one day is used as the detection cycle. Before each detection, the first model and the second model are trained using the latest historical data. The first model, the second model and the existing third model are used to analyze the log data of the day. If a certain behavior subject is determined to be an abnormal behavior subject, it will be reported to the staff, who will manually verify the behavior subject. If the verification result shows that the behavior subject is indeed an abnormal behavior subject, a result label will be set for the target behavior subject, specifically, the result data can be set to 1 in the operation behavior indicator data corresponding to the target behavior subject. If the verification result shows that the behavior subject is not an abnormal behavior subject, the result data will not be set or will be set to 0. In this way, in the next detection cycle, the log data of the previous day will be used as part of the latest historical data. Since the verification operation has been carried out, the result data therein represent the real results, which can make the model fitting more accurate.

[0129] It should be noted that, in this embodiment, because each detection is performed on the "target behavior subject", a behavior subject represents an individual account. Specifically, in the calculation process of the second model, it is necessary to compare the historical operation behavior indicator data and the current operation behavior indicator data of the target behavior subject, so as to examine the historical change trend of the individual account, so that it can be analyzed from the individual account dimension. In other words, the first model corresponds to the regional (or unit, business) dimension, the second model corresponds to the individual account dimension, and the third model corresponds to the business experience of the auditor, so as to achieve the effect of "establishing anomaly detection models from multiple dimensions of business, unit, and individual account based on panel data, reducing dependence on the business experience of auditors, but not completely abandoning business experience."

[0130] In summary, this solution combines business experience, differences in the development of audit business in various provinces, and differences in the nature of various accounts, and uses inter-provincial anomaly detection modules, vertical development anomaly detection modules, and business threshold modules to improve the accuracy of log audit results based on operational behavior. In other words, this solution fully considers the distribution differences of operation frequencies of various business groups and the distribution differences of historical operation frequencies of various behavioral subjects, and uses business experience threshold modules, vertical dynamic threshold setting modules, and horizontal dynamic threshold setting modules to comprehensively improve the accuracy of log audit results.

[0131] The embodiment of the present application provides an abnormality detection method, by obtaining a log to be detected; wherein the log to be detected contains the operation behavior information of multiple behavior subjects in the target business system in the current detection cycle; statistically analyzing the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects; using at least two preset models to process the operation behavior indicator data respectively to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject; according to the at least two output results, it is determined whether the target behavior subject is abnormal. In this way, the first model can realize the abnormality detection of the target behavior subject in combination with the regional characteristics, taking into account the business differences between regions; in addition, the second model can realize the abnormality detection of the target behavior subject in combination with the historical operation behavior indicator data, taking into account the differences in the characteristics of different behavior subjects, thereby improving the accuracy of the log audit results. In addition, the technical solution of the present application can also generate and optimize the preset model based on the latest historical data before each detection, thereby achieving the effect of continuously optimizing the preset model and further improving the accuracy of the log audit results.

[0132] In another embodiment of the present application, see Figure 2 , which shows a schematic diagram of the process architecture of a log audit system provided by an embodiment of the present application, such as Figure 2 As shown, the system architecture includes eight modules, namely, operation log extraction module 201, behavior indicator generation module 202, behavior subject abnormal marking module 203, inter-provincial abnormal detection module 204, vertical development abnormal detection module 205, business threshold module 206, audit result output module 207 and audit result feedback module 208; among them,

[0133] Operation log extraction module 201, used to obtain operation log information of each behavior subject;

[0134] It should be noted that the main function of the operation log extraction module 201 is to obtain key information of the operations of each behavior subject.

[0135] For example, see Table 1, which shows a key field table for operation log extraction provided by an embodiment of the present application. As shown in Table 1, for the log to be detected, the following information can be extracted based on the field name: (1) Data source unit, the field name is pv, which refers to the organizational affiliation of the subject using the system, for example: subsidiaries of a group company, departments of a company, etc., which have different actual meanings according to different business scenarios; (2) System code, the field name is systemcode, which refers to the business system from which the operation log comes; (3) Subject ID, the field name is accountid, which is used to identify a specific subject; (4) Operation ID, the field name is operationid, which is used to identify an operation in the operation log; (5) Operation time, the field name is operationtime, which refers to the specific time when the subject of the behavior performs an operation; (6) server IP, the field name is serverip, which refers to the IP address of the server where the sensitive information accessed by the subject of the behavior is located; (7) client IP, the field name is clientip, which refers to the IP address used by the subject of the behavior; (8) operation object ID, the field name is objectid, which is the smallest module that can locate a data information; (9) whether the operation object is sensitive, the field name is ifsensitive, which refers to the identification of whether the data information contains sensitive content. If the data information contains sensitive content, the value is 1, otherwise the value is 0.

[0136] Table 1

[0137] Serial number Field Name Chinese fields 1 pv Data source unit 2 systemcode System Code 3 accountid Behavior subject ID 4 operationid Operation ID 5 operationtime Operation time 6 serverip Server IP 7 clientip Client IP 8 ifsensitive Is the operation object sensitive? 9 objectid Operation object ID

[0138] The behavior index generating module 202 is used to count the operation behavior index of each behavior subject within a specified period;

[0139] It should be noted that the main function of the behavior indicator generation module is to count the behavior indicators of each behavior subject performing sensitive data content operations within a specified period. With data source unit, system code, and behavior subject ID as grouping fields (equivalent to obtaining the operation behavior indicator data of different behavior subjects), the operation behavior indicators within the statistical period (the default is one day, which can be adjusted according to actual needs) are counted, and the operation behavior indicators include but are not limited to operation frequency, non-working time operation frequency, online duration (minutes), the number of server IP addresses accessed, and the number of client IP addresses used, etc., wherein a non-repeated operation ID counts as one operation. Referring to Table 2, it shows the statistical operation behavior indicator table provided by the embodiment of the present application. As shown in Table 2, after the calculation of the behavior indicator generation module 202, the key information output includes: data source unit, system code, behavior subject ID, cycle identification (when the cycle is day, it is the operation date), operation frequency, non-working time operation frequency, online duration (minutes), number of server IP addresses, and number of client IP addresses.

[0140] Table 2

[0141]

[0142]

[0143] The behavior subject abnormality marking module 203 is used to collect result labels of whether each behavior subject is an abnormal behavior subject.

[0144] It should be noted that the function of the subject abnormality labeling module 203 is mainly to provide an initial sample of abnormal subject behaviors in combination with business experience. At the same time, in the subsequent audit process implementation process, the actual abnormal result labels of the subject behaviors fed back by the detection result feedback module are continuously collected. The data collected by this module provides labeled data for the subsequent inter-provincial anomaly detection module and the vertical development anomaly detection model, thereby establishing a multi-layer Logistic regression model training.

[0145] The inter-provincial anomaly detection module 204 is used to output a first suspected object using cross-sectional data of a period according to the business characteristics of different provinces;

[0146] It should be noted that the inter-provincial anomaly detection module 204 is equivalent to establishing a first model using the first historical data set, and detecting the operation behavior indicator data through the first model. The core of this module is the inter-provincial anomaly detection model established using the multi-layer Logistic regression idea (equivalent to the aforementioned first model).

[0147] The multi-layer statistical model is mainly used for data with a hierarchical structure. For example, the collected raw data comes from the operation logs generated by the actors in each province. The behavior of each actor is affected by the macro level (business characteristics of different provinces, such as whether a log abnormal behavior audit mechanism has been established in the province) and the micro level (behavioral characteristics of each actor itself, such as operation frequency, online time, number of server IP addresses and other operational behavior indicators), and different actors belong to different provinces.

[0148] This module takes into account variable information and random errors at different levels and establishes a multi-layer Logistic regression model as an inter-provincial anomaly detection model to improve the accuracy of the model.

[0149] The method of establishing a multi-layer Logistic regression model is as follows:

[0150] The first layer formula (equivalent to the first training model mentioned above):

[0151]

[0152] Among them, p ij It represents the probability that the i-th behavior subject of the j-th unit belongs to the abnormal operation behavior subject, x1 corresponds to the operation frequency in the operation behavior indicator generation module, x2 corresponds to the operation frequency during non-working hours, x3 corresponds to the online time, x4 corresponds to the number of server IP addresses, and x5 corresponds to the number of client IP addresses.

[0153] The second level formula (equivalent to the first parameter model mentioned above):

[0154] β 0j =γ 00 +γ 01 w 1j +μ 0j (2)

[0155] β 1j =γ 10 +γ 11 w 1j +μ 1j (3)

[0156] β 2j =γ 20 +γ 21 w 1j +μ 2j (4)

[0157] β 3j =γ 30 +γ 31 w 1j +μ 3j (5)

[0158] β 4j =γ 40 +γ 41 w 1j +μ 4j (6)

[0159] β 5j =γ 50 +γ 51 w 1j +μ 5j (7)

[0160] Among them, w 1j is the level 2 variable of unit j: whether the unit has a daily abnormal behavior audit mechanism, with a value of 1 for yes and 0 for no, μ 1j is the disturbance term.

[0161] In the multi-layer logistic regression model, as shown in formula (1), the traditional first-layer fixed intercept and first-layer fixed slope are replaced by the first-layer random intercept β 0j and the random slope β kj ; Corresponding to the first-layer random coefficients are multiple second-layer equations, as shown in formula (2), where the disturbance term is used to improve the robustness of the model and exists only during the fitting process. This term does not exist in the model after the fitting is completed. In these equations, the first-layer random regression coefficients become dependent variables (i.e., output quantities).

[0162] The multi-level logistic regression model is estimated in two steps: the first step is to perform the first-level regression operation in each observation unit (i.e., province), that is, the same regression model is run J times in J units to generate J sets of regression coefficients, forming J data sets of first-level intercepts and slopes, as shown in formula (1). The second step is to treat the first-level random regression coefficients as second-level variables (such as w 1j ) function to generate the second-level equation or macro model, as shown in formulas (2)-(7).

[0163] In summary, the application of multi-layer statistical models replaces the fixed effect model in conventional Logistic with a random effect model, and fits the results that the operating behavior indicators of each province have different impacts on abnormal results. This process takes into account the differences in actual business and data conditions in each province.

[0164] In another embodiment of the present application, see Figure 3 , which shows a flow chart of another abnormality detection method provided by an embodiment of the present application, such as Figure 3 As shown in Figure 1, the workflow of the inter-provincial anomaly detection module includes the following steps:

[0165] S301: Fitting the logistic regression model using cross-sectional data of operant behavior indicators;

[0166] It should be noted that the cross-sectional data of operational behavior indicators (equivalent to the first historical data set) refers to the historical data of the previous operational cycle from multiple provinces, which includes behavioral indicator data and result data. The behavioral indicator data is used as the input value and the result data is used as the output result to fit the multi-layer Logistic regression model.

[0167] S302: Optimizing the fitted Logistic regression model;

[0168] It should be noted that after obtaining the Logistic regression model, the model can be tuned according to business experience or established tuning rules;

[0169] S303: Determine whether the model significance of the optimized Logistic regression model meets the requirements;

[0170] Here, for step S303, if the judgment result is yes, then execute step S304; if the judgment result is no, then return to execute step S302;

[0171] It should be noted that the optimized Logistic regression model is used to judge the operation behavior indicator interface data, and the model output results are compared with the actual results to obtain the model significance. If the model significance meets the requirements, that is, the Logistic regression model has statistical significance, it can be used for subsequent judgments; if the model significance does not meet the requirements, that is, the Logistic regression model has no statistical significance, it needs to be tuned again.

[0172] S304: Using a multi-layer logistic regression model to detect the business characteristic data of each province, and obtaining a fitting P value corresponding to the target behavior subject;

[0173] It should be noted that in actual use, the business characteristic data of each province can be input in the prescribed format and then fitted into the multi-layer logistic regression model. In this way, the model will calculate the fitting P value of each behavioral subject.

[0174] S305: Determine whether the P value is greater than P0;

[0175] Here, for step S305, if the judgment result is yes, step S306 is executed; if the judgment result is no, step S307 is executed.

[0176] It should be noted that after the fitted model is used to complete the probability value prediction of the abnormal behavior subject, the probability value is further compared with the critical value p0 of the abnormal behavior subject. If the abnormal probability of a certain behavior subject is greater than p0, it is identified as the first suspected object, that is, y i1 =1, otherwise it is not output as an abnormal behavior subject, that is, y i1 =0.

[0177] S306: The target behavior subject is the first suspected object, let y i1 =1.

[0178] It should be noted that if the fitted P value is greater than the critical value, the data of the target behavior subject is abnormal, and the target behavior subject can be regarded as the first suspected object, and y i1 =1,y i1 This is the first output result mentioned above.

[0179] S307: The target behavior subject is not the first suspected object, let y i1 =0.

[0180] It should be noted that if the fitted P value is not greater than the critical value, the data of the target behavior subject does not have anomalies, and the target behavior subject is not the first suspected object. i1 =0.

[0181] The embodiment of the present application provides an anomaly detection method, and the specific implementation of the aforementioned embodiment is elaborated in detail. It can be seen that the first model can realize anomaly detection of the target behavior subject in combination with regional characteristics, taking into account the business differences between regions; in addition, the second model can realize anomaly detection of the target behavior subject in combination with historical operation behavior indicator data, taking into account the differences in the characteristics of different behavior subjects, thereby improving the accuracy of the log audit results. In addition, the technical solution of the embodiment of the present application can also generate and optimize the preset model according to the latest historical data before each detection, so as to achieve the effect of continuously optimizing the preset model, further improving the accuracy of the log audit results.

[0182] In this way, through the inter-provincial anomaly detection module 204, it is possible to determine whether the account subject is an abnormal behavior subject based on the behavioral characteristics of the region to which the different accounts belong, while taking into account the differences in business in different regions. After the extracted behavioral indicator data is analyzed using the inter-provincial anomaly detection module 204, the extracted behavioral indicator data can also be analyzed here using the vertical development anomaly detection module 205 to improve the accuracy of the audit results.

[0183] A vertical development anomaly detection module 205 is used to output a second suspected object using the historical period behavior indicator and the individual characteristic indicator;

[0184] It should be noted that the so-called longitudinal data refers to the data obtained after multiple measurements of the same individuals. Such data can be regarded as multi-layer data or hierarchical structure, in which multiple measurements are nested in individual objects. Therefore, the measurements of the research objects at each time point can be regarded as low-dimensional units, and the measured individuals can be regarded as high-dimensional units. In this way, the longitudinal data can be analyzed by multi-layer statistical models. The multi-layer statistical model applied to longitudinal data is also called the development model (equivalent to the second model mentioned above).

[0185] Compared with the traditional model, the advantages of the second model are as follows: First, under the premise of random missing, the development model can handle unbalanced data and incomplete data, and can estimate the model for all available data through maximum likelihood or restricted maximum likelihood methods. Therefore, there is no need to exclude those research subjects with missing observations, nor to fill in the missing observations. Secondly, the development model is more flexible. In addition to being able to cope with the situation where the number of repeated measurements of each research subject is different, it can also be applied to the situation where the time intervals of repeated measurements are unequal. Finally, when establishing the development model, the observations within the research subject are not restricted by the condition of mutual independence, and there is no need to consider restrictive assumptions.

[0186] The first layer model of the second model (equivalent to the aforementioned second training model) is:

[0187]

[0188] where p it is the probability that individual i is an abnormal behavior subject in the tth period, For p it The logit link function of x kit represents the kth behavior index of individual i in the tth period, that is, the operation frequency, online time and other behavior indexes output by the aforementioned operation behavior index generation module, ε it is the disturbance term.

[0189] The second layer of the second model is the inter-individual model (equivalent to the second parameter model mentioned above), which is generally:

[0190] β kj =γ k0 +γ k1 x 1i +μ kj (9)

[0191] where γ k1 represents the kth random effect coefficient of the first layer model, x 1i Represents the second-level indicator of the i-th individual, that is, whether the individual belongs to a program account.

[0192] The development model replaces the fixed effect model in the conventional Logistic model with a random effect model, and fits the results to find that the influence of each subject's operational behavior indicators on its abnormal results is different. This process takes into account the differences in the nature of whether each subject has a program account.

[0193] In yet another embodiment of the present application, see Figure 4 , which shows a flow chart of another abnormality detection method provided by an embodiment of the present application, such as Figure 4 As shown, the workflow of the vertical development anomaly detection module 20 includes at least the following steps:

[0194] S401: Fitting the Logistic regression model using historical data of operational behavior indicators;

[0195] It should be noted that the historical data of operational behavior indicators refers to historical data from multiple periods, which includes behavioral indicator data and result data. Therefore, by using the behavioral indicator data as input values ​​and the result data as output results, a multi-layer Logistic regression model is fitted as a longitudinal development model.

[0196] S402: Optimize the fitted Logistic regression model;

[0197] It should be noted that after obtaining the Logistic regression model, the model can be tuned according to business experience or established tuning rules;

[0198] S403: Determine whether the model significance of the optimized Logistic regression model meets the requirements;

[0199] Here, for step S403, if the judgment result is yes, then execute step S404; if the judgment result is no, then return to execute step S402;

[0200] It should be noted that the optimized Logistic regression model is used to judge the data on the operation behavior indicator interface, and the model output results are compared with the actual results to obtain the model significance. If the model significance meets the requirements, that is, the Logistic regression model has statistical significance, it can be used for subsequent judgments; if the model significance does not meet the requirements, that is, the Logistic regression model has no statistical significance, it needs to be tuned here.

[0201] S404: using a multi-layer logistic regression model to detect individual characteristic variables and obtain a fitting P value corresponding to the target behavior subject;

[0202] It should be noted that the established multi-layer logistic regression model is used to detect individual characteristic variables, obtain the P value corresponding to the target behavior subject, and judge whether the behavior subject is abnormal based on the P value.

[0203] S405: Determine whether the P value is greater than P1;

[0204] Here, for step S405, if the judgment result is yes, step S406 is executed; if the judgment result is no, step S407 is executed.

[0205] It should be noted that after fitting the multi-layer Logistic second detection model to complete the prediction of the probability value of the abnormal behavior subject, the probability value is further compared with the critical value p1 of the abnormal behavior subject. If the abnormal probability of a certain behavior subject is greater than p1, it is identified as the second suspected object and the output y i2 =1, otherwise it is not output as an abnormal behavior subject, that is, y i2 =0.y i2 This is the aforementioned second output result.

[0206] S406: The target behavior subject is the second suspected object, and y i2 =1.

[0207] It should be noted that when the P value is higher than P1, the target behavior subject can be considered as the second suspected object; otherwise, the target behavior subject is considered as a normal subject. Among them, P1 is the critical threshold for the second model.

[0208] S407: The target behavior subject is not the second suspected object, let y i2 =0.

[0209] It should be noted that if the fitted P value is not greater than the critical value, the data of the target behavior subject does not have anomalies, and the target behavior subject is not the second suspected object. i2 =0.

[0210] The embodiment of the present application provides an anomaly detection method, and the specific implementation of the aforementioned embodiment is elaborated in detail. Through the first model, it is possible to detect anomalies of the target behavior subject in combination with regional characteristics, taking into account the business differences between regions; in addition, through the second model, it is possible to detect anomalies of the target behavior subject in combination with historical operation behavior indicator data, taking into account the differences in the characteristics of different behavior subjects, thereby improving the accuracy of the log audit results. In addition, the technical solution of the embodiment of the present application can also generate and optimize the preset model according to the latest historical data before each detection, so as to achieve the effect of continuously optimizing the preset model, further improving the accuracy of the log audit results.

[0211] In this way, by vertically developing the anomaly detection module 205, it is possible to determine whether the account subject is an abnormal behavior subject based on the vertical time characteristics of different accounts while taking into account the behavioral differences of different account subjects.

[0212] A business threshold module 206 is used to build a business model based on business experience and output a third suspected object;

[0213] It should be noted that the main function of the business threshold module is to include the operation frequency that is obviously within the normal business threshold range into the audit-free range based on business experience, set a business threshold range before the subsequent vertical and horizontal dynamic threshold modules, and combine business experience to improve the accuracy of the entire audit process.

[0214] The business threshold module 206 relies on the auditor's experience accumulation of data units and business systems to define a normal business threshold range. If the auditor has rich business experience, a smaller business threshold range with higher accuracy can be given to improve the role of the model in the entire audit process; if the auditor has relatively little business experience, a larger business threshold range can be given, which relies more on the subsequent dynamic threshold module.

[0215] For example, based on business experience, if the system front desk of the Customer Relationship Management (CRM) software has an account with more than 1,500 operations per day, more than 500 operations during non-working hours, more than 10 server IP addresses, and more than 15 client IP addresses, then the subject of the behavior is output as the third suspected object. Here, 1,500 times, 500 times, 10 times, etc. are business thresholds, which can be adjusted based on business experience. If the business threshold module identifies individual i as an abnormal behavior subject within the period, then y i3 =1, otherwise y i3 =0.

[0216] Audit result output module 207, used to weight the first, second and third suspected objects, output the result of whether each individual has abnormal operation in this period, and report the result to each unit;

[0217] It should be noted that the main function of the detection result output module is to perform weighted calculation on the results of the previous modules, as described in formula (10), and finally output a label indicating whether the individual's operation behavior in this period is abnormal.

[0218] y i =ω1y i1 +ω2y i2 +ω3y i3 (10)

[0219] Among them, ω1, ω2, and ω3 are the weights corresponding to the results of the inter-provincial anomaly detection model, the longitudinal development anomaly detection model, and the third model. i is the probability of individual i's last abnormal behavior subject, if y i If it is greater than 0.5, the subject is considered to be an abnormal behavior subject in this cycle, otherwise it is not an abnormal behavior subject.

[0220] Exemplarily, refer to Table 3, which shows a detection result output information table provided by an embodiment of the present application. As shown in Table 3, the information output by the audit result output module 207 includes: data source unit, business system code, behavior subject ID, operation cycle identifier, operation frequency, whether it is the first suspected object, whether it is the second suspected object, whether it is the third suspected object, and whether it is an abnormal behavior subject. Among them, the first suspected object, the second suspected object, and the third suspected object respectively represent the target business subject that is regarded as an abnormal object in the inter-provincial anomaly detection model, the development model, and the business threshold model. The abnormal behavior subject represents that the target business subject is regarded as an abnormal object under the comprehensive judgment of the inter-provincial anomaly detection model, the development model, and the business threshold model.

[0221] Table 3

[0222] Serial number Field Name Chinese fields 1 pv Data source unit 2 systemcode System Code 3 accountid Behavior subject ID 4 period Cycle Identification 5 fisrt_illegal Is it the first suspected object? 6 second_illegal Is it the second suspected object? 7 third_illegal Is the third suspected object 8 illegal_account Is the account abnormal?

[0223] The audit result feedback module 208 is used to provide feedback on the results of the detection result output module. Auditors from various provinces verify each abnormal behavior subject and provide feedback on whether it is a real abnormal behavior subject.

[0224] It should be noted that the main function of this module is for the business personnel of each unit to verify the abnormal behavior results received, confirm the results, and feedback whether the corresponding subject belongs to the abnormal behavior subject; the feedback result is received by the behavior subject abnormal marking module 203 and used for the next round of model optimization.

[0225] At present, although the log audit system is mentioned in the relevant technical solutions, the audit module therein has not been specifically designed; or the historical operation behaviors of all behavioral subjects are used to explore abnormal behavior patterns using association rules, and then the newly emerged behavior patterns are matched with abnormal patterns to achieve the purpose of identifying anomalies; or fingerprint algorithms and machine learning algorithms are used to build models to complete log audit related work. The relevant technologies either use business experience or establish a unified log audit model through historical data. They do not combine business experience with data mining technology, nor do they consider the differences between various business scenarios and individual behavioral subjects in the log audit process. This application combines business experience, business scenario differences and individual behavior differences at the same time, combines the business threshold module, the inter-provincial anomaly detection module and the vertical development anomaly detection module, and comprehensively audits to discover abnormal operation behaviors, and further uses the audit result feedback module and the behavioral subject abnormal marking module to continuously collect abnormal labels of behavioral subjects and continuously optimize the core functional modules of the audit system.

[0226] In summary, the present application provides a log audit system based on panel data and multi-layer Logistic regression model, an inter-provincial anomaly detection module based on multi-layer Logistic, and a vertical development anomaly detection module based on multi-layer Logistic, which have the following significant advantages:

[0227] (1) Anomaly detection is performed by integrating information from business experience, statistical analysis, and anomaly detection algorithms;

[0228] (2) Vertically develop the anomaly detection module, taking into account the characteristics of the account of the behavior subject, and constructing a differentiated anomaly detection model for each behavior subject in a targeted manner;

[0229] (3) The inter-provincial anomaly detection module takes into account the differences in the audit business development of each province and constructs a random effect anomaly detection model for different provinces, thereby improving the accuracy of the anomaly detection results of each province;

[0230] (4) The introduction of the detection result feedback module and the behavior subject abnormal marking module facilitates the continuous optimization of the core functional modules of the audit system.

[0231] Based on this, the embodiment of the present application provides an anomaly detection method, and the specific implementation of the aforementioned embodiment is elaborated in detail. It can be seen that the first model can realize anomaly detection of the target behavior subject in combination with regional characteristics, taking into account the business differences between regions; in addition, the second model can realize anomaly detection of the target behavior subject in combination with historical operation behavior indicator data, taking into account the differences in the characteristics of different behavior subjects, thereby improving the accuracy of the log audit results. In addition, the technical solution of the embodiment of the present application can also generate and optimize the preset model according to the latest historical data before each detection, so as to achieve the effect of continuously optimizing the preset model, further improving the accuracy of the log audit results.

[0232] In another embodiment of the present application, see Figure 5 , which shows a schematic diagram of the structure of an abnormality detection device 50 provided in an embodiment of the present application, such as Figure 5 As shown, the abnormality detection device 50 includes an acquisition unit 501, a statistical unit 502, a detection unit 503 and a determination unit 504, wherein:

[0233] The acquisition unit 501 is configured to acquire a log to be detected; wherein the log to be detected contains operation behavior information of multiple behavior subjects in the target business system in the current detection cycle;

[0234] A statistical unit 502 is configured to perform statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects;

[0235] The detection unit 503 is configured to process the operation behavior indicator data respectively using at least two preset models to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject;

[0236] The determination unit 504 is configured to determine whether the target behavior subject has an abnormality according to the at least two output results.

[0237] In some embodiments, the at least two output results include a first output result and a second output result; the detection unit 503 is specifically configured to input the operation behavior indicator data of the target behavior subject into the first model to obtain a first fitting probability value; determine the first output result based on the comparison result of the first fitting probability value and the first critical threshold; wherein the first fitting probability value represents the abnormal probability value of the target behavior subject calculated by the first model; input the operation behavior indicator data of the target behavior subject and the historical operation behavior indicator data of the target behavior subject into the second model to obtain a second fitting probability value; determine the second output result based on the comparison result of the second fitting probability value and the second critical threshold; wherein the second fitting probability value represents the abnormal probability value of the target behavior subject calculated by the second model; accordingly, the determination unit 504 is specifically configured to perform weighted calculation on the first output result and the second output result to obtain a comprehensive abnormal probability value; when the comprehensive abnormal probability value is greater than the abnormal critical value, it is determined that the target behavior subject has an abnormality.

[0238] In some embodiments, the detection unit 503 can also be configured to compare the first fitting probability value with a first critical threshold; when the first fitting probability value is greater than the first critical threshold, the first output result is determined to be 1; when the first fitting probability value is less than or equal to the first critical threshold, the first output result is determined to be 0.

[0239] In some embodiments, the detection unit 503 can also be configured to compare the second fitting probability value with a second critical threshold; when the second fitting probability value is greater than the second critical threshold, the second output result is determined to be 1; when the second fitting probability value is less than or equal to the second critical threshold, the second output result is determined to be 0.

[0240] In some embodiments, the at least two preset models also include a third model; the detection unit 503 can also be configured to use the third model to process the operation behavior indicator data to obtain a third output result; wherein the third model is used to determine whether the output result of the target behavior subject is abnormal in combination with a preset business threshold; accordingly, the determination unit 504 can also be configured to perform weighted calculation on the first output result, the second output result and the third output result to obtain a comprehensive abnormal probability value; when the comprehensive abnormal probability value is greater than the abnormal critical value, it is determined that the target behavior subject is abnormal.

[0241] In some embodiments, the detection unit 503 can also be configured to compare the operation behavior indicator data with the preset business threshold; when the operation behavior indicator data is greater than the preset business threshold, determine that the third output result is 1; when the operation behavior indicator data is less than or equal to the preset business threshold, determine that the third output result is 0.

[0242] In some embodiments, Figure 6 As shown, the anomaly detection device 50 may also include a verification unit 505, configured to receive a verification result of whether the target behavior subject has an abnormality; wherein the verification result indicates a user's confirmation result of whether the target behavior subject has an abnormality; based on the verification result, a result label is set for the target behavior subject; wherein the result label is used to characterize whether the target behavior subject is an abnormal behavior subject.

[0243] In some embodiments, the anomaly detection device 50 may also include a modeling unit 506, configured to perform model training on a first historical data set to obtain a first training model; wherein the first historical data set is a historical data set determined based on the geographical characteristics of the target behavior subject, and the first historical data set includes historical operation behavior indicator data of multiple behavior subjects with the same geographical characteristics, the first training model includes multiple first training parameters, and the first training parameters are model coefficients in the first training model; the multiple first training parameters are trained using the first historical data set to obtain multiple first parameter models; the first training model and the multiple first parameter models are determined as the first model.

[0244] In some embodiments, the modeling unit 506 can also be configured to perform a tuning operation on the first model to obtain a tuned first model; obtain a first significance level value of the tuned first model, and determine whether the first significance level value meets a first preset standard; if the first significance level value meets the first preset standard, determine the tuned first model as the first model.

[0245] In some embodiments, the modeling unit 506 can also be configured to perform model training on a second historical data set to obtain a second training model; wherein the second historical data set includes historical operation behavior indicator data of multiple behavior subjects, and the second training model includes multiple second training parameters, and the second training parameters are model coefficients in the second training model; use the second historical data set to train multiple second training parameters to obtain multiple second parameter models; and determine the second training model and the multiple second parameter models as the second model.

[0246] In some embodiments, the modeling unit 506 can also be configured to perform a tuning operation on the second model to obtain a tuned second model; obtain a second significance level value of the tuned second model, and determine whether the second significance level value meets a second preset standard; if the second significance level value meets the second preset standard, determine the tuned second model as the second model.

[0247] In some embodiments, the first model comprises a multi-layer logistic regression model, and the second model comprises a multi-layer logistic regression model.

[0248] It can be understood that in this embodiment, a "unit" can be a part of a circuit, a part of a processor, a part of a program or software, etc., and of course it can also be a module, or it can be non-modular. Moreover, the components in this embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional module.

[0249] If the integrated unit is implemented in the form of a software function module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method described in this embodiment. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0250] Therefore, this embodiment provides a computer storage medium, which stores an anomaly detection program. When the anomaly detection program is executed by at least one processor, the steps of the method described in any one of the above embodiments are implemented.

[0251] Based on the above-mentioned composition of an abnormality detection device 50 and a computer storage medium, see Figure 7 , which shows a specific hardware structure example of an abnormality detection device 50 provided in an embodiment of the present application, such as Figure 7As shown, the abnormality detection device 50 may include: a communication interface 601, a memory 602 and a processor 603; each component is coupled together through a bus device 604. It can be understood that the bus device 604 is used to realize the connection and communication between these components. In addition to the data bus, the bus device 604 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 7 Various buses are labeled as bus devices 604. Among them, the communication interface 601 is used to receive and send signals during the process of sending and receiving information between other external network elements;

[0252] A memory 602, used to store a computer program that can be run on the processor 603;

[0253] The processor 603 is configured to execute, when running the computer program:

[0254] Obtaining a log to be detected; wherein the log to be detected contains operation behavior information of multiple behavior subjects in the target business system in the current detection cycle;

[0255] Performing statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects;

[0256] The operation behavior indicator data are processed respectively by using at least two preset models to obtain at least two output results; wherein the at least two preset models include a first model and a second model, the first model is used to determine the output result of whether the target behavior subject is abnormal in combination with the regional characteristics of the target behavior subject, and the second model is used to determine the output result of whether the target behavior subject is abnormal in combination with the historical operation behavior indicator data of the target behavior subject;

[0257] It is determined whether the target behavior subject is abnormal according to the at least two output results.

[0258] It can be understood that the memory 602 in the embodiment of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM). The memory 602 of the apparatus and method described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0259] The processor 603 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 603. The above processor 603 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (APPlication Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 603 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0260] It is understood that the embodiments described in the present application can be implemented by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application or a combination thereof.

[0261] For software implementation, the technology described in this application can be implemented by a module (e.g., a procedure, a function, etc.) that performs the functions described in this application. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0262] Optionally, as another embodiment, the processor 603 is further configured to execute the steps of the method described in any one of the aforementioned embodiments when running the computer program.

[0263] Based on the above-mentioned composition and hardware structure diagram of the abnormality detection device 50, see Figure 8 , which shows a schematic diagram of the composition structure of another log audit system 70 provided in an embodiment of the present application. Figure 8 As shown, the log audit 70 at least includes the anomaly detection device 50 described in any one of the aforementioned embodiments. For the system 70, in this way, the operation behavior indicator data is detected by the first model and the second model respectively, taking into account the differences in business conditions in different regions and the differences in characteristics of the behavior subjects under multiple historical detection cycles, thereby improving the accuracy of the log audit results; in addition, the technical solution of the embodiment of the present application can also generate and optimize the preset model according to the latest historical data before each detection, thereby achieving the effect of continuously optimizing the preset model, further improving the accuracy of the log audit results.

[0264] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

[0265] It should be noted that, in this application, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0266] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0267] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0268] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0269] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0270] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtaining a log to be detected; wherein the log to be detected contains operation behavior information of multiple behavior subjects in the target business system in the current detection cycle; Performing statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects; Inputting the operation behavior indicator data of the target behavior subject into the first model to obtain a first fitting probability value; determining a first output result according to a comparison result of the first fitting probability value and a first critical threshold value; wherein the first fitting probability value represents an abnormal probability value of the target behavior subject calculated by the first model; and inputting the operation behavior indicator data of the target behavior subject and the historical operation behavior indicator data of the target behavior subject into the second model to obtain a second fitting probability value; determining a second output result according to a comparison result of the second fitting probability value and a second critical threshold value; wherein the second fitting probability value represents an abnormal probability value of the target behavior subject calculated by the second model; The first output result and the second output result are weightedly calculated to obtain a comprehensive abnormality probability value; when the comprehensive abnormality probability value is greater than the abnormality critical value, it is determined that the target behavior subject has an abnormality.

2. The anomaly detection method according to claim 1, characterized in that: The determining the first output result according to the comparison result between the first fitting probability value and the first critical threshold value includes: comparing the first fitting probability value with a first critical threshold; When the first fitting probability value is greater than a first critical threshold, determining the first output result to be 1; When the first fitting probability value is less than or equal to a first critical threshold, the first output result is determined to be 0.

3. The anomaly detection method according to claim 1, characterized in that: The step of determining the second output result according to a comparison result between the second fitting probability value and a second critical threshold value includes: comparing the second fitting probability value with a second critical threshold; When the second fitting probability value is greater than a second critical threshold, determining that the second output result is 1; When the second fitting probability value is less than or equal to a second critical threshold, the second output result is determined to be 0.

4. The anomaly detection method according to claim 1, characterized in that: After statistically analyzing the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject, the method further includes: Processing the operation behavior indicator data using a third model to obtain a third output result; wherein the third model is used to determine whether the target behavior subject has an abnormal output result in combination with a preset business threshold; The first output result, the second output result and the third output result are weightedly calculated to obtain a comprehensive abnormality probability value; when the comprehensive abnormality probability value is greater than the abnormality critical value, it is determined that the target behavior subject has an abnormality.

5. The anomaly detection method according to claim 4, characterized in that: The using the third model to process the operation behavior indicator data to obtain a third output result includes: Comparing the operation behavior indicator data with the preset business threshold; When the operation behavior indicator data is greater than the preset business threshold, determining that the third output result is 1; When the operation behavior indicator data is less than or equal to the preset business threshold, the third output result is determined to be 0.

6. The anomaly detection method according to claim 1, characterized in that: When it is determined that the target behavior subject is abnormal, the method further includes: Receiving a verification result of whether the target behavior subject is abnormal; wherein the verification result indicates a confirmation result of the user on whether the target behavior subject is abnormal; Based on the verification result, a result label is set for the target behavior subject; wherein the result label is used to indicate whether the target behavior subject is an abnormal behavior subject.

7. The abnormality detection method according to claim 1, characterized in that: The method further comprises: Performing model training on a first historical data set to obtain a first training model; wherein the first historical data set is a historical data set determined based on the regional characteristics of the target behavior subject, and the first historical data set includes historical operation behavior indicator data of multiple behavior subjects with the same regional characteristics, and the first training model includes multiple first training parameters, and the first training parameters are model coefficients in the first training model; Using the first historical data set to train a plurality of first training parameters to obtain a plurality of first parameter models; The first training model and the plurality of first parameter models are determined as the first model.

8. The abnormality detection method according to claim 7, characterized in that: The method further comprises: Performing a tuning operation on the first model to obtain a tuned first model; Obtaining a first significance level value of the tuned first model, and determining whether the first significance level value meets a first preset standard; When the first significance level value meets the first preset standard, the tuned first model is determined as the first model.

9. The abnormality detection method according to claim 1, characterized in that: The method further comprises: Performing model training on a second historical data set to obtain a second training model; wherein the second historical data set includes historical operation behavior indicator data of multiple behavior subjects, and the second training model includes multiple second training parameters, and the second training parameters are model coefficients in the second training model; Using the second historical data set to train a plurality of second training parameters to obtain a plurality of second parameter models; The second training model and the plurality of second parameter models are determined as the second model.

10. The abnormality detection method according to claim 9, characterized in that: After determining the second training model and the plurality of second parameter models as the second model, the method further includes: Performing a tuning operation on the second model to obtain a tuned second model; Obtaining a second significance level value of the tuned second model, and determining whether the second significance level value meets a second preset standard; When the second significance level value meets the second preset standard, the tuned second model is determined as the second model.

11. The anomaly detection method according to any one of claims 1 to 10, characterized in that: The first model includes a multi-layer logistic regression model, and the second model includes a multi-layer logistic regression model.

12. An abnormality detection device, characterized in that: The abnormality detection device includes an acquisition unit, a statistical unit, a detection unit and a determination unit, wherein: The acquisition unit is configured to acquire the log to be detected; wherein the log to be detected contains the operation behavior information of multiple behavior subjects in the target business system in the current detection cycle; The statistical unit is configured to perform statistical analysis on the log to be detected to determine the operation behavior indicator data corresponding to the target behavior subject; wherein the target behavior subject is one of the multiple behavior subjects; The detection unit is configured to input the operation behavior indicator data of the target behavior subject into a first model to obtain a first fitting probability value; determine a first output result based on a comparison result of the first fitting probability value and a first critical threshold; wherein the first fitting probability value represents an abnormal probability value of the target behavior subject calculated by the first model; and input the operation behavior indicator data of the target behavior subject and the historical operation behavior indicator data of the target behavior subject into a second model to obtain a second fitting probability value; determine a second output result based on a comparison result of the second fitting probability value and a second critical threshold; wherein the second fitting probability value represents an abnormal probability value of the target behavior subject calculated by the second model; The determination unit is configured to perform weighted calculation on the first output result and the second output result to obtain a comprehensive abnormality probability value; when the comprehensive abnormality probability value is greater than an abnormality critical value, determine that the target behavior subject has an abnormality.

13. An abnormality detection device, characterized in that: The abnormality detection device includes a memory and a processor; wherein, The memory is used to store a computer program that can be run on the processor; The processor is configured to execute the steps of the method according to any one of claims 1 to 11 when running the computer program.

14. A computer storage medium, characterized in that: The computer storage medium stores an anomaly detection program, and when the anomaly detection program is executed by at least one processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images