Behavior data processing method, device, equipment and storage medium

Abstract

Embodiments of the present invention provide a behavior data processing method, apparatus, device, and storage medium. The method includes: obtaining rules of a behavior security baseline corresponding to input behavior data; determining parameter configuration information of each node in at least one node and the relationship between each node based on the rules of the behavior security baseline; and processing the behavior data based on the parameter configuration information of each node and the relationship between each node. The above scheme can realize flexible configuration of behavior security baseline rules for various scenarios and support various security analysis scenarios.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a behavior data processing method, device, equipment and storage medium. Background Art

[0002] In recent years, with the development of machine learning and the rise of real-time computing frameworks, the user's behavioral security baseline can be obtained by learning network data and logs. The learned behavioral security baseline can then be used as benchmark data for abnormal behavior analysis and detection to analyze and detect abnormal behavior.

[0003] The behavioral security baseline learned based on the behavioral data of a certain scenario can only be used to analyze and detect abnormal behaviors and network security in the corresponding scenario, but cannot be effectively analyzed and detected for behavioral data in other scenarios, causing huge network security risks. Therefore, how to implement a behavioral data processing method that is suitable for multiple scenarios is a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0004] In view of the problems in the prior art, embodiments of the present invention provide a behavior data processing method, apparatus, device and storage medium.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a behavior data processing method, comprising:

[0007] Obtain the rules of the behavioral safety baseline corresponding to the input behavioral data;

[0008] Based on the rule of the behavioral security baseline, determining parameter configuration information of each of the nodes in at least one node and the relationship between the nodes;

[0009] The behavior data is processed based on the parameter configuration information of each of the nodes and the relationship between each of the nodes.

[0010] In a second aspect, an embodiment of the present invention provides a behavior data processing device, including:

[0011] An acquisition module is used to obtain the rules of the behavioral security baseline corresponding to the input behavioral data;

[0012] A processing module, configured to determine parameter configuration information of each of the at least one node and a relationship between the nodes based on the rule of the behavioral security baseline;

[0013] The processing module is further used to process the behavior data based on the parameter configuration information of each of the nodes and the relationship between each of the nodes.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the behavior data processing method described in the first aspect are implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the behavior data processing method described in the first aspect are implemented.

[0016] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the behavior data processing method as described in the first aspect.

[0017] The behavior data processing method, apparatus, device and storage medium provided in the embodiments of the present invention obtain the rules of the behavior security baseline corresponding to the input behavior data, and determine the parameter configuration information of each node in at least one node and the relationship between each node based on the rules of the behavior security baseline; based on the parameter configuration information of each node and the relationship between each node, the behavior data is processed. The above scheme can flexibly configure the behavior security baseline rules for various scenarios, and then can process the input behavior data based on the rules corresponding to the input behavior data, and has a wide range of application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a flow chart of a behavior data processing method provided by an embodiment of the present invention;

[0020] Figure 2 is a schematic diagram of the principle of the behavior data processing method provided by an embodiment of the present invention;

[0021] Figure 3 It is a schematic diagram of the relationship between the data input node and other nodes provided by an embodiment of the present invention;

[0022] Figure 4It is a schematic diagram of the relationship between the time configuration node and other nodes provided by an embodiment of the present invention;

[0023] Figure 5 It is a schematic diagram of the relationship between the filtering node and other nodes provided by an embodiment of the present invention;

[0024] Figure 6 It is a schematic diagram of the relationship between the time window node and other nodes provided by an embodiment of the present invention;

[0025] Figure 7 is a schematic diagram of the relationship between the grouping node and other nodes provided by an embodiment of the present invention;

[0026] Figure 8 is a schematic diagram of the relationship between the noise reduction node and other nodes provided by an embodiment of the present invention;

[0027] Fig. 9 is a schematic diagram of the relationship between the baseline generation node and other nodes provided by an embodiment of the present invention;

[0028] Fig.10 is a schematic diagram of the relationship between the baseline detection node and other nodes provided by an embodiment of the present invention;

[0029] Fig.11 is a structural diagram of a behavior data processing device provided by an embodiment of the present invention;

[0030] Fig.12 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] In the embodiment of the present invention, the behavioral security baseline refers to the one obtained based on the user's behavioral data. The user's behavioral data may include the time, quantity, user behavior, traffic usage, etc. The behavioral security baseline is usually obtained in time periods. The behavioral security baseline may represent the behavioral data of each user behavior in at least one user behavior occurring in at least one time period within a preset time range for one or more users.

[0033] In order to adapt to different security analysis scenarios, the method of the embodiment of the present invention can flexibly configure behavioral security baseline rules for various scenarios, and then process the input behavioral data based on the rules corresponding to the input behavioral data, and has a wide range of application scenarios.

[0034] Combine the following Figure 1-Figure 5 The technical solution of the embodiment of the present invention is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0035] Figure 1 FIG. 1 is a flow chart of a behavior data processing method provided by an embodiment of the present invention. Figure 1 As shown, the method provided in this embodiment includes:

[0036] Step 101: Obtain rules of a behavior security baseline corresponding to input behavior data;

[0037] Optionally, the rule of the behavioral security baseline is composed of a rule header and a rule body, and optionally, the rule is described and defined in JSON language. The rule of the behavioral security baseline can configure parameter configuration information of each node in the process of behavioral data processing and the relationship between each node.

[0038] Table 1 Rule Header

[0039] Parameter name Parameter Description id Rule ID, define the rule ID value

[0040] Table 2 Rule body

[0041]

[0042] Step 102: Determine parameter configuration information of each node in at least one node and the relationship between each node based on the rule of the behavioral security baseline;

[0043] Specifically, based on the rules of the behavior security baseline, at least one node involved in the current behavior data processing can be determined, and parameter configuration information of each node and the relationship between each node can be obtained.

[0044] Optionally, the parameter configuration information includes at least one of the following: a node type, a node identification ID, a processing method, and an ID of a next node.

[0045] The next node refers to the node to which the current node outputs the processed data, and the next node can be one or more.

[0046] like Figure 2As shown in Table 3, at least one node includes at least one of the following: a data input node, a time configuration node, a filtering node, a time window node, a grouping node, a noise reduction node, a baseline generation node, a baseline detection node, and a data output node.

[0047] Table 3 Node definition

[0048]

[0049]

[0050] Step 103: Process the behavior data based on the parameter configuration information of each node and the relationship between each node.

[0051] Specifically, the input behavior data is processed based on the parameter configuration information of each node and the relationship between each node.

[0052] The following is an example of the behavior data processing flow:

[0053]

[0054]

[0055]

[0056]

[0057] The method of this embodiment obtains the rules of the behavioral safety baseline corresponding to the input behavioral data, and determines the parameter configuration information of each node in at least one node and the relationship between each node based on the rules of the behavioral safety baseline; based on the parameter configuration information of each node and the relationship between each node, the behavioral data is processed. The above scheme can flexibly configure the behavioral safety baseline rules for various scenarios, and then can process the input behavioral data based on the rules corresponding to the input behavioral data, and has a wide range of application scenarios.

[0058] In one embodiment, the data input node is used to obtain attribute information of the input behavior data, and the attribute information includes at least one of the following: source information, data reader information, and data format;

[0059] The processing mode of the data input node is to read data.

[0060] As shown in Table 4, the processing mode of the data input node is to read data, which can be optionally implemented by a readData function.

[0061] Table 4 Data input node (DataReader)

[0062]

[0063]

[0064] The following is an example of a data input node:

[0065]

[0066] In the above implementation, based on the parameter configuration information corresponding to the rule, the data input node pre-processes the input behavior data so that the subsequent processing results are more accurate.

[0067] In one embodiment, the time configuration node is used to obtain timestamp information of the input behavior data, and the timestamp information includes at least one of the following: time type, time value, and time unit;

[0068] The processing method of the time configuration node is to obtain the timestamp.

[0069] As shown in Table 5, the processing method of the time configuration node is to obtain a timestamp, which can be optionally implemented by a timestamp function.

[0070] Table 5 Time configuration node (TimeAssigner)

[0071]

[0072] The following is an example of a time configuration node:

[0073]

[0074]

[0075] In the above implementation, based on the parameter configuration information corresponding to the rule, the time configuration node pre-processes the input behavior data so that the subsequent processing results are more accurate.

[0076] In one embodiment, the filter node is used to filter the input behavior data, and the filter parameter includes at least one of the following: a filtered data field, a filtered data field, and a filter calculation expression;

[0077] The processing mode of the filtering node is through filter processing, and the parameters of the filter include at least one of the following: a filtered data field, a data field after filtering, and a filtering result.

[0078] As shown in Table 6, the processing method of the filter node is to process through a filter, that is, to filter the input behavior data, which can be optionally implemented through a Filter function.

[0079] Table 6 Filter Node (Filter)

[0080]

[0081]

[0082] The following are examples of filter nodes:

[0083]

[0084] In the above implementation, based on the parameter configuration information corresponding to the rule, the filter node filters the input behavior data, so that the subsequent processing results are more accurate, that is, the behavior security detection is more accurate.

[0085] In one embodiment, the time window node is used to determine a sliding time window according to data output by a previous node, and the parameters of the sliding time window include at least one of the following: time window length, sliding step, and delay time.

[0086] The delay time indicates how long after the end time of the time window the receiving of behavior data can be delayed.

[0087] As shown in Table 7, the processing method of the time window node is to determine the sliding time window, that is, to determine the sliding time window based on the data output by the previous node, and optionally, it can be implemented by the TimeWindow function.

[0088] Table 7 Time Window Node (TimeWindow)

[0089]

[0090] An example of a time window node is as follows:

[0091]

[0092] In the above implementation, based on the parameter configuration information corresponding to the rule, the time window node processes the input behavior data so that the subsequent processing process is more in line with the needs of the current scene, thereby making the behavior safety detection more accurate.

[0093] In one embodiment, the grouping node is used to group the data output by the previous node based on a grouping key value; the parameters of the grouping node include the grouping key value.

[0094] As shown in Table 8, the processing method of the grouping node is to group based on the grouping key value, that is, to group the data output by the previous node based on the grouping key value, and optionally, it can be implemented by a GroupBy function.

[0095] Table 8 Grouping Node (GroupBy)

[0096]

[0097] The following are examples of grouping nodes:

[0098]

[0099]

[0100] In the above implementation, based on the parameter configuration information corresponding to the rule, the grouping node processes the input behavior data so that the subsequent processing process is more in line with the needs of the current scene, thereby making the behavior safety detection more accurate.

[0101] In one embodiment, the denoising node is used to perform denoising on the data output by the previous node, and the parameters of the denoising calculation node include at least one of the following: a method for obtaining the data to be denoised, a data type, a denoising strategy, and a data noise probability.

[0102] As shown in Table 9, the processing mode of the denoising node is denoising processing, that is, denoising the data output by the previous node, which can be optionally implemented by a Denoise function.

[0103] Table 9 Denoise Node

[0104]

[0105]

[0106] An example of a denoising node is as follows:

[0107]

[0108] In the above implementation, based on the parameter configuration information corresponding to the rule, the denoising node performs denoising on the input behavior data, so that the subsequent processing process is more in line with the needs of the current scene, thereby making the behavior safety detection more accurate.

[0109] In one embodiment, the baseline generation node is used to generate at least one of the following behavioral safety baselines based on data output by a previous node, wherein the at least one of the following behavioral safety baselines includes: a temporal behavioral safety baseline, a spatial behavioral safety baseline, a frequency behavioral safety baseline, and a numerical behavioral safety baseline;

[0110] The parameters of the temporal behavioral safety baseline include at least one of the following: the result type, data object and temporal gradient of the temporal behavioral safety baseline;

[0111] The parameters of the spatial behavior security baseline include: data object sequence;

[0112] The parameters of the frequency behavior security baseline include: data object sequence;

[0113] The parameters of the numerical behavior security baseline include: a generation method and a data object sequence.

[0114] Specifically, as shown in Table 10, the processing method of the baseline generation node is to generate a baseline, that is, to process the data output by the previous node to obtain a behavioral safety baseline, which can be optionally implemented through a Model function.

[0115] Table 10 Baseline generation nodes (Model)

[0116]

[0117]

[0118] An example of a baseline generation node is as follows:

[0119]

[0120]

[0121] In the above implementation, based on the parameter configuration information corresponding to the rule, the baseline generation node generates a behavioral safety baseline based on the input behavioral data, and the generated behavioral safety baseline is more in line with the needs of the current scenario, thereby making the results of behavioral safety detection based on the behavioral safety baseline more accurate.

[0122] In one embodiment, a baseline detection node is used to detect input behavior data based on the results output by a baseline generation node, and the input parameters of the baseline detection node include at least one of the following: behavior data, detection expression, detection field and behavior security baseline, and the output parameters include: detection results.

[0123] Specifically, as shown in Table 11, the processing method of the baseline detection node is to detect the behavior data based on the behavior security baseline, and optionally, it can be implemented through a Trigger function.

[0124] Table 11 Baseline detection node (Trigger)

[0125]

[0126]

[0127] An example of a baseline detection node is as follows:

[0128]

[0129] In the above implementation, based on the parameter configuration information corresponding to the rule, the baseline detection node obtains the behavioral safety baseline generated by the baseline generation node. Since the generated behavioral safety baseline is more in line with the needs of the current scenario, the result of the behavioral safety detection based on the behavioral safety baseline is more accurate.

[0130] In one embodiment, the data output node is used to output the output result of the previous node, and the output parameter of the data output node includes at least one of the following: data output address, output data format.

[0131] Specifically, as shown in Table 12, the processing method of the data output node is to output the output result of the previous node, which can be optionally implemented by a DataWriter function.

[0132] Table 12 Data Output Node (DataWriter)

[0133]

[0134]

[0135] The following is an example of a data output node:

[0136]

[0137] In the above implementation, the behavioral safety baseline rules for various scenarios can be flexibly configured, and the input behavioral data can be processed based on the rules corresponding to the input behavioral data, and the application scenarios are wide.

[0138] The behavior data processing device provided by the present invention is described below. The behavior data processing device described below and the behavior data processing method described above can be referenced to each other.

[0139] Fig.11 : is a schematic diagram of the structure of the behavior data processing device provided by the present invention. The behavior data processing device provided in this embodiment includes:

[0140] An acquisition module 210 is used to acquire rules of a behavior security baseline corresponding to the input behavior data;

[0141] A processing module 220, configured to determine parameter configuration information of each of the at least one node and a relationship between the nodes based on the rule of the behavior security baseline;

[0142] The processing module 220 is further configured to process the input behavior data based on the parameter configuration information of each of the nodes and the relationship between each of the nodes.

[0143] Optionally, the parameter configuration information includes at least one of the following: node type, node identification ID, processing mode and next node ID;

[0144] The at least one node includes at least one of the following: a data input node, a time configuration node, a filtering node, a time window node, a grouping node, a noise reduction node, a baseline generation node, a baseline detection node, and a data output node.

[0145] Optionally, the data input node is used to obtain attribute information of the input behavior data, and the attribute information includes at least one of the following: source information, data reader information, and data format;

[0146] The processing mode of the data input node is to read data.

[0147] Optionally, the time configuration node is used to obtain timestamp information of the input behavior data, and the timestamp information includes at least one of the following: time type, time value and time unit;

[0148] The processing method of the time configuration node is to obtain a timestamp.

[0149] Optionally, the filtering node is used to filter the input behavior data, and the filtering parameter includes at least one of the following: a filtered data field, a filtered data field, and a filtering calculation expression;

[0150] The processing mode of the filtering node is through filter processing, and the parameters of the filter include at least one of the following: a filtered data field, a data field after filtering, and a filtering result.

[0151] Optionally, the time window node is used to determine a sliding time window according to data output by a previous node, and the parameters of the sliding time window include at least one of the following: time window length, sliding step, and delay time.

[0152] Optionally, the grouping node is used to group data output by a previous node based on a grouping key value; and the parameters of the grouping node include the grouping key value.

[0153] Optionally, the denoising node is used to perform denoising on data output by a previous node, and the parameters of the denoising calculation node include at least one of the following: a method for obtaining data to be denoised, a data type, a denoising strategy and a data noise probability.

[0154] Optionally, the baseline generation node is used to generate at least one of the following behavioral safety baselines according to data output by a previous node, wherein the at least one of the following behavioral safety baselines includes: a time behavioral safety baseline, a space behavioral safety baseline, a frequency behavioral safety baseline, and a numerical behavioral safety baseline;

[0155] The parameters of the time behavior safety baseline include at least one of the following: the result type, data field and time gradient of the time behavior safety baseline;

[0156] The parameters of the spatial behavior safety baseline include: at least one data field;

[0157] The parameters of the frequency behavior safety baseline include: at least one data field;

[0158] The parameters of the numerical behavior security baseline include: a learning type of the numerical behavior security baseline and at least one data field.

[0159] Optionally, the baseline detection node is used to detect input behavior data based on the result output by the baseline generation node, and the input parameters of the baseline detection node include at least one of the following: behavior data, detection expression and behavior security baseline, and the output parameters include: detection result.

[0160] Optionally, the data output node is used to output the output result of the previous node, and the output parameter of the data output node includes at least one of the following: data output address, output data format.

[0161] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0162] Fig.12 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.12 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the behavior data processing method, which includes: obtaining the rules of the behavior security baseline corresponding to the input behavior data; determining the parameter configuration information of each node in at least one node and the relationship between each node based on the rules of the behavior security baseline; processing the input behavior data based on the parameter configuration information of each node and the relationship between each node.

[0163] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0164] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the behavior data processing method provided by the above-mentioned methods, and the method includes: obtaining the rules of the behavior safety baseline corresponding to the input behavior data; based on the rules of the behavior safety baseline, determining the parameter configuration information of each node in at least one node and the relationship between each node; based on the parameter configuration information of each node and the relationship between each node, processing the input behavior data.

[0165] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned behavioral data processing methods, the methods comprising: obtaining rules of a behavioral safety baseline corresponding to the input behavioral data; determining parameter configuration information of each of the nodes in at least one node and the relationship between each of the nodes based on the rules of the behavioral safety baseline; and processing the input behavioral data based on the parameter configuration information of each of the nodes and the relationship between each of the nodes.

[0166] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0167] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0168] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A behavioral data processing method, It is characterized in that include: Obtain the rules of the behavioral safety baseline corresponding to the input behavioral data; Based on the rule of the behavioral security baseline, determining parameter configuration information of each of the nodes in at least one node and the relationship between the nodes; Processing the behavior data based on parameter configuration information of each of the nodes and the relationship between each of the nodes; The parameter configuration information includes: node type, node identification ID, processing method and next node ID; The at least one node includes: a data input node, a time configuration node, a filtering node, a time window node, a grouping node, a noise reduction node, a baseline generation node, a baseline detection node and a data output node; The baseline generation node is used to generate a behavior safety baseline according to the data output by the previous node, and the behavior safety baseline includes: a time behavior safety baseline, a space behavior safety baseline, a frequency behavior safety baseline and a numerical behavior safety baseline; The parameters of the time behavior safety baseline include at least one of the following: the result type, data field and time gradient of the time behavior safety baseline; The parameters of the spatial behavior safety baseline include: at least one data field; The parameters of the frequency behavior safety baseline include: at least one data field; The parameters of the numerical behavior security baseline include: the learning type of the numerical behavior security baseline and at least one data field; The baseline detection node is used to detect the input behavior data based on the result output by the baseline generation node. The input parameters of the baseline detection node include at least one of the following: behavior data, detection expression and behavior security baseline, and the output parameters include: detection result.

2. The behavior data processing method according to claim 1, It is characterized in that The data input node is used to obtain attribute information of input behavior data, and the attribute information includes at least one of the following: source information, data reader information, and data format; The processing mode of the data input node is to read data.

3. The behavior data processing method according to claim 1 or 2, It is characterized in that The time configuration node is used to obtain the timestamp information of the input behavior data, and the timestamp information includes at least one of the following: time type, time value and time unit; The processing method of the time configuration node is to obtain a timestamp.

4. The behavior data processing method according to claim 1 or 2, It is characterized in that The filtering node is used to filter the input behavior data, and the filtering parameters include at least one of the following: a filtered data field, a filtered data field, and a filtering calculation expression; The processing mode of the filtering node is through filter processing, and the parameters of the filter include at least one of the following: a filtered data field, a data field after filtering, and a filtering result.

5. The behavior data processing method according to claim 1 or 2, It is characterized in that The time window node is used to determine a sliding time window according to data output by a previous node, and the parameters of the sliding time window include at least one of the following: time window length, sliding step length, and delay time.

6. The behavior data processing method according to claim 1 or 2, It is characterized in that The grouping node is used to group the data output by the previous node based on the grouping key value; the parameters of the grouping node include the grouping key value.

7. The behavior data processing method according to claim 1 or 2, It is characterized in that The denoising node is used to perform denoising on the data output by the previous node, and the parameters of the denoising node include at least one of the following: a method for obtaining the data to be denoised, a data type, a denoising strategy, and a data noise probability.

8. The behavior data processing method according to claim 1 or 2, It is characterized in that The data output node is used to output the output result of the previous node. The output parameter of the data output node includes at least one of the following: data output address and output data format.

9. A behavior data processing device, It is characterized in that include: An acquisition module is used to obtain the rules of the behavioral security baseline corresponding to the input behavioral data; A processing module, configured to determine parameter configuration information of each of the at least one node and a relationship between the nodes based on the rule of the behavioral security baseline; The parameter configuration information includes at least one of the following: node type, node identification ID, processing mode and next node ID; The at least one node includes: a data input node, a time configuration node, a filtering node, a time window node, a grouping node, a noise reduction node, a baseline generation node, a baseline detection node and a data output node; The baseline generation node is used to generate a behavior safety baseline according to the data output by the previous node, and the behavior safety baseline includes: a time behavior safety baseline, a space behavior safety baseline, a frequency behavior safety baseline and a numerical behavior safety baseline; The parameters of the time behavior safety baseline include at least one of the following: the result type, data field and time gradient of the time behavior safety baseline; The parameters of the spatial behavior safety baseline include: at least one data field; The parameters of the frequency behavior safety baseline include: at least one data field; The parameters of the numerical behavior security baseline include: the learning type of the numerical behavior security baseline and at least one data field; The baseline detection node is used to detect the input behavior data based on the result output by the baseline generation node, the input parameters of the baseline detection node include at least one of the following: behavior data, detection expression and behavior security baseline, and the output parameters include: detection result; The processing module is further used to process the behavior data based on the parameter configuration information of each of the nodes and the relationship between each of the nodes.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, It is characterized in that When the processor executes the program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product having executable instructions stored thereon, It is characterized in that When the instruction is executed by a processor, the processor implements the steps of the method as claimed in any one of claims 1 to 8.

Images