User behavior classification audit method, device, equipment and computer storage medium

Abstract

The present application provides a user behavior classification audit method, apparatus, device, and computer storage medium. The user behavior classification audit method includes: collecting user behavior information; when it is determined that there are preset keywords in the user behavior information, classifying the user behavior information using a preset decision tree classification model to determine the category of the user behavior information; wherein the decision tree classification model is obtained by model training using K-fold cross-validation and an improved gradient boosting decision tree algorithm; and obtaining an audit log corresponding to the category of the user behavior information. According to the embodiments of the present application, the accuracy of user behavior classification audits can be improved.

Description

Technical Field

[0001] The present application belongs to the technical field of user behavior classification auditing, and in particular relates to a user behavior classification auditing method, apparatus, equipment and computer storage medium. Background Art

[0002] By parsing the original logs collected from major data platform components, mapping fields to standardization, and dividing the log operation types and operation details, it is possible to standardize the initial logs of various components in the big data platform with different sources and formats; then, according to the audit requirements of big data security management and control, the corresponding audit rules and analysis strategies are adopted to conduct automated audit analysis on the standardized logs of various components in the big data platform to determine whether the management and data access operations of the big data platform and its components comply with security technical specifications and management requirements.

[0003] Existing technology first standardizes logs, then builds an algorithm model based on audit rules, specifies algorithm parameters, trains the model, and performs analysis and matching. The algorithm is complex and lacks flexibility. Simply using a decision tree with multiple classification nodes for classification cannot meet the requirements for classifying flexible user actions, resulting in low audit accuracy.

[0004] Therefore, how to improve the accuracy of user behavior classification auditing is a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0005] The embodiments of the present application provide a user behavior classification audit method, apparatus, device and computer storage medium, which can improve the accuracy of user behavior classification audit.

[0006] In a first aspect, an embodiment of the present application provides a user behavior classification audit method, comprising:

[0007] Collect user behavior information;

[0008] When it is determined that the user behavior information contains preset keywords, the user behavior information is classified using a preset decision tree classification model to determine the category of the user behavior information; wherein the decision tree classification model is obtained by model training using K-fold cross validation and an improved gradient boosting decision tree algorithm;

[0009] Get the audit log corresponding to the category of user behavior information.

[0010] Optionally, the keywords include operation time, operation IP, operation user, operation instruction, and instruction parameters.

[0011] Optionally, when it is determined that the user behavior information contains a preset keyword, the method further includes classifying the user behavior information using a preset decision tree classification model before determining the category of the user behavior information:

[0012] Get the audit set;

[0013] Based on the training set in the audit set, the model is trained using K-fold cross validation and the improved gradient boosting decision tree algorithm to obtain a decision tree classification model.

[0014] Optionally, after performing model training based on the training set in the audit set using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain a decision tree classification model, the method further includes:

[0015] The decision tree classification model is tested using the test set in the audit set.

[0016] In a second aspect, an embodiment of the present application provides a user behavior classification auditing device, comprising:

[0017] Collection module, used to collect user behavior information;

[0018] A classification module is used to classify the user behavior information using a preset decision tree classification model to determine the category of the user behavior information when it is determined that the user behavior information contains preset keywords; wherein the decision tree classification model is obtained by model training using K-fold cross validation and an improved gradient boosting decision tree algorithm;

[0019] The first acquisition module is used to obtain the audit log corresponding to the category of user behavior information.

[0020] Optionally, the keywords include operation time, operation IP, operation user, operation instruction, and instruction parameters.

[0021] Optionally, the device further comprises:

[0022] The second acquisition module is used to obtain the audit set;

[0023] The model training module is used to train the model based on the training set in the audit set using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain a decision tree classification model.

[0024] Optionally, the device further comprises:

[0025] The testing module is used to test the decision tree classification model using the test set in the audit set.

[0026] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising: a processor and a memory storing computer program instructions;

[0027] When the processor executes the computer program instructions, the user behavior classification audit method shown in the first aspect is implemented.

[0028] In a fourth aspect, an embodiment of the present application provides a computer storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the user behavior classification audit method shown in the first aspect is implemented.

[0029] The user behavior classification audit method, apparatus, device, and computer storage medium of the embodiments of the present application can improve the accuracy of user behavior classification audits. The user behavior classification audit method collects user behavior information; when it is determined that there are preset keywords in the user behavior information, the user behavior information is classified using a preset decision tree classification model to determine the category of the user behavior information; and the audit log corresponding to the category of the user behavior information is obtained. Since the decision tree classification model is obtained by model training using K-fold cross-validation and an improved gradient boosting decision tree algorithm, it can improve the accuracy of user behavior classification audits. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0031] Figure 1 This is a flowchart of a user behavior classification audit method provided by an embodiment of the present application;

[0032] Figure 2 This is a flowchart of a user behavior classification audit method provided by another embodiment of the present application;

[0033] Figure 3 This is a schematic diagram of the structure of a user behavior classification audit device provided by an embodiment of the present application;

[0034] Figure 4 It is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0035] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0036] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0037] In order to solve the problems of the prior art, the embodiments of the present application provide a user behavior classification audit method, apparatus, device and computer storage medium. The user behavior classification audit method provided by the embodiments of the present application is first introduced below.

[0038] Figure 1 The following is a flow chart of a user behavior classification audit method provided by an embodiment of the present application. Figure 1 As shown, the user behavior classification audit method includes:

[0039] S101. Collect user behavior information.

[0040] S102. When it is determined that preset keywords exist in the user behavior information, the user behavior information is classified using a preset decision tree classification model to determine the category of the user behavior information; wherein the decision tree classification model is obtained by model training using K-fold cross validation and an improved gradient boosting decision tree algorithm.

[0041] In one embodiment, the keywords include operation time, operation IP, operation user, operation instruction and instruction parameters.

[0042] In one embodiment, when it is determined that the user behavior information contains a preset keyword, the user behavior information is classified using a preset decision tree classification model. Before determining the category of the user behavior information, the method further includes:

[0043] Get the audit set;

[0044] Based on the training set in the audit set, the model is trained using K-fold cross validation and the improved gradient boosting decision tree algorithm to obtain a decision tree classification model.

[0045] In one embodiment, after model training is performed based on the training set in the audit set using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain a decision tree classification model, the method further includes: testing the decision tree classification model using a test set in the audit set.

[0046] S103: Obtain the audit log corresponding to the category of user behavior information.

[0047] This user behavior classification audit method collects user behavior information; if preset keywords are determined to be present in the user behavior information, it uses a preset decision tree classification model to classify the user behavior information and determine the category of the user behavior information; and then obtains the audit log corresponding to the category of the user behavior information. Because the decision tree classification model is trained using K-fold cross-validation and an improved gradient boosting decision tree algorithm, it can improve the accuracy of user behavior classification audits.

[0048] The above technical solution is described below with reference to a specific embodiment.

[0049] This embodiment defines a binary tree model based on user behavior and audit rules. Using a K-fold cross-validation-modified gradient algorithm, it automatically optimizes the parameters of the binary tree's classification nodes, achieving optimal classification of user behavior and obtaining a precise set of abnormal behavior operations. This embodiment offers flexible parameter settings, automatic optimization, accurate abnormal behavior determination, and high-quality result sets.

[0050] like Figure 2 As shown, the user behavior classification audit method provided in this embodiment includes: first collecting user behavior, then determining whether the keywords in the user behavior trigger decision classification, and then using the trained decision tree to classify the user behavior, and finally obtaining an audit log; wherein, the trained decision tree is based on the audit set, and is trained using the K-fold cross validation and Nicky index improved gradient boosting tree algorithm decision tree.

[0051] The detailed operation process of this embodiment is as follows:

[0052] 1. User behavior: Behavior keywords are pre-defined in the log data. A piece of data or a line of data in the selected log file is judged to determine whether the keyword exists. The key fields include but are not limited to: operation time (t), operation IP (p), operation user (u), operation instruction (c), instruction parameter (v), etc. Then, the content of each feature parameter is defined. When a piece of data or a line of data matches the keyword, the data is counted to form A, A[i] = (t, p, u, c, v). The time of counting A is the time of generating the audit log. Specifically, t in A[i] is the number of times the operation time appears in the audit time period, p is the number of times the operation IP appears, u is the number of times the operation user appears, c is the number of times the operation instruction appears, and v is the number of times the instruction parameter appears.

[0053] 2. Audit classification construction based on improved gradient boosting decision tree algorithm.

[0054] We use the improved gradient boosting decision tree algorithm to classify A. Since the most critical factor in audit judgment is whether an audit is triggered, and only after the audit is triggered does it become necessary to classify which audit is triggered. Therefore, we need to construct an improved gradient boosting decision tree for the classification results, which include both audit-triggered and audit-non-triggered classification decision trees.

[0055] 1) First, the algorithm model is constructed. In order to be applicable to the trigger classification of audits, the user behavior that triggers the audit can be further classified into audit content. When the decision tree is trained for classification, a binary tree-CART regression tree is used to construct the audit trigger classification model.

[0056] Input: training dataset D = {(x1,y1),(x2,y2),…,(xn,yn)};

[0057] Output: a regression tree

[0058] Assume that the input space has been divided into three units R1, R2, and R3, and each unit has a fixed output value f, which represents the corresponding classification result, where I is the discriminant function, that is, the classification feature. The classification features in this application include: t>C, use square error to express the prediction error of the regression tree on the training data: Unit R m The optimal output value on m The mean of all samples xi corresponding to yi.

[0059] Since a binary tree is selected as the classification tree in this application, the objective function is defined as the Gini index Gini, which represents the probability that a randomly selected sample in the sample set is misclassified.

[0060] The smaller the Gini index is, the smaller the probability that the selected sample in the set is misclassified is, that is, the higher the purity of the set is, and vice versa, the more impure the set is. That is, the Gini index (Gini impurity) = the probability of the sample being selected * the probability of the sample being misclassified, pk represents the probability that the selected sample belongs to category k, then the probability that the sample is misclassified is (1-p k ), there are K categories in the sample set, and a randomly selected sample can belong to any of these k categories, so the categories are summed. When it is a binary classification, Gini(P)=2p(1-p). Assuming there are K categories in the set, the Gini index of the sample set D is:

[0061] Gini index after partitioning sample set D based on feature A: It should be noted that CART is a binary tree, that is, when a certain feature is used to partition a sample set, there are only two sets: one is the sample set D1 with a given feature value, and the other is the sample set D2 with a value not equal to the given feature value. The purity of partitioning sample set D into two subsets based on the partition feature = a certain feature value is calculated:

[0062]

[0063] Therefore, for a feature with multiple values ​​(more than 2), it is necessary to calculate the purity Gini(D,A) of the subset after the sample D is divided with each value as the dividing point. i ), (where A i represents the possible value of feature A), and then from all possible partitions of Gini (D, A i ) to find the partition with the smallest Gini index. The partition point of this partition is the best partition point for dividing the sample set D using feature A.

[0064] After selecting the objective function, we traverse all the features and select the optimal feature as the partition. The specific method is to select the jth variable x j and its value s as the segmentation variable and segmentation point, and define two regions, R1={x|x j ≤s}andR2={x|x j >s}. Find the optimal variable j and the optimal split point s. The specific solution function is:

[0065]

[0066] All j, s find the best partition area this time, and then recurse this partition process for each area until the conditions are met.

[0067] 2) The above is a method for constructing a classification tree, which is used to determine whether an audit is triggered. In this application, when it is determined that an audit is triggered, it is necessary to continue to classify the audit content. The audit method is to use each and every user behavior of each disassembled line to perform audit classification after determining that A[i] triggers an audit. For example, if A[i] contains 100 user behaviors, then A[1]A[2]A[3]...A

[100] are classified according to the audit features in the audit set. Specifically, a binary tree is constructed for each or multiple audit features in the same way as the above binary tree construction method to obtain a set of multiple binary trees of A[i]. The integrated model GBDT model is further used to perform linear addition of multiple CART trees. Among them, the audit features in the audit set include but are not limited to Rule1 = {a1×A1|a2×A2|a3×A3}, Rule2 = {a1×A1&a2×A2&a3×A3}, etc.

[0068] The GBDT model can be expressed as follows: t (x) represents the model of the tth round, h t (x) represents the t-th decision tree, and the model is defined as follows: The boosting tree adopts a forward step-by-step algorithm. The model of step t is formed by the model of step t-1, which can be written as: t (x) = f t-1 (x)+h t (x). The loss function is defined as: L(f t (x),y)=L(f t-1 (x)+h t (x), y). Each time, we need to fit the negative gradient of the model. The negative gradient of the loss function of the i-th sample in the t-th round is expressed as:

[0069] r r,i =-[δL(y i ,f(x i ))δf(x i )]f(x)

[0070] r r,i =y i -f m-1 (x i )

[0071] Using (x i ,r t,i )(i=1,2,…,m), fit a CART regression tree, and get the t-th regression tree, whose corresponding leaf node region R t,j,j=1,2,…,J. Where J is the number of leaf nodes. For each sample in a leaf node, we find the output value c that minimizes the loss function, that is, the best fit for the leaf node. t,j As follows (note that y here i is the true value, not the residual): At this time, the decision tree fitting function of this round is obtained: The strong learner in this round has obtained: Then iterate until the loss function converges.

[0072] 3) In addition, since A, B, and C in the classification features in this application are the optimal classification values ​​to be solved, in order to optimize A, B, and C, K-fold cross validation and gradient descent principle are introduced to solve A, B, and C.

[0073] a. Divide the entire training set S into k disjoint subsets. Assume that the number of training examples in S is m, then each subset has m / k training examples. The corresponding subsets are called {s1, s2, …, sk}. Each time, take one of the subsets as the test set, and the remaining k-1 as the training set.

[0074] b. Train a model or hypothesis function based on the training, put this model on the test set, and get the classification rate.

[0075] c. Calculate the average classification rate q(A, B, C) obtained k times, and use the derivative of this average value as 0 as the true classification rate of the model or hypothesis function. Therefore, combine dq(A, B, C) = 0 to obtain multiple relationship solutions between A, B, and C.

[0076] d. In order to accurately calculate the specific classification feature thresholds of A, B, and C, the gradient principle is further used to calculate the A, B, and C solutions of the ternary function dq(A, B, C) = 0, thereby obtaining the optimal classification features.

[0077] In addition, for the secondary classification, for each binary tree in the gradient boosting decision tree set, the weight values ​​a1, a2, and a3 in the audit features in the audit set can also be calculated using the k-fold cross-validation and gradient descent principle. When finding the optimal variable j and the optimal split point s, a1, a2, and a3 are solved using a specific solution function and the above method. In this application, the audit features in the audit set are the relationship between any three user behaviors and the corresponding weight values.

[0078] 3. Use the constructed decision tree classification model to classify user behaviors and obtain the result set of abnormal operations.

[0079] This embodiment improves the accuracy of auditing user behavior by constructing an improved decision tree with different classification features for secondary classification, solves the problem of classification model rigidity caused by the flexibility of user behavior, and thus improves the efficiency of audit classification using user behavior.

[0080] Figure 3 This is a schematic diagram of the structure of a user behavior classification audit device provided by an embodiment of the present application. Figure 3 As shown, the user behavior classification audit device includes:

[0081] Collection module 301, used to collect user behavior information;

[0082] Classification module 302 is configured to classify the user behavior information using a preset decision tree classification model to determine the category of the user behavior information when it is determined that the user behavior information contains preset keywords. The decision tree classification model is trained using a K-fold cross-validation and improved gradient boosting decision tree algorithm.

[0083] The first acquisition module 303 is used to obtain the audit log corresponding to the category of user behavior information.

[0084] In one embodiment, the keywords include operation time, operation IP, operation user, operation instruction and instruction parameters.

[0085] In one embodiment, the apparatus further comprises:

[0086] The second acquisition module is used to obtain the audit set;

[0087] The model training module is used to train the model based on the training set in the audit set using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain a decision tree classification model.

[0088] In one embodiment, the apparatus further comprises:

[0089] The testing module is used to test the decision tree classification model using the test set in the audit set.

[0090] Figure 3 Each module / unit in the device shown has the function of realizing Figure 1 The functions of each step in the embodiment can achieve the corresponding technical effects, which will not be described in detail here for the sake of brevity.

[0091] Figure 4 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown.

[0092] The electronic device may include a processor 401 and a memory 402 storing computer program instructions.

[0093] Specifically, the processor 401 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0094] Memory 402 may include a large capacity memory for data or instructions. By way of example and not limitation, memory 402 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 402 may include removable or non-removable (or fixed) media. Where appropriate, memory 402 may be internal or external to the electronic device. In certain embodiments, memory 402 may be a non-volatile solid-state memory.

[0095] In one example, the memory 402 may be a read-only memory (ROM). In one example, the ROM may be a mask-programmable ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0096] The processor 401 implements any one of the user behavior classification audit methods in the above embodiments by reading and executing computer program instructions stored in the memory 402 .

[0097] In one example, the electronic device may further include a communication interface 403 and a bus 410. Figure 4 As shown, the processor 401 , the memory 402 , and the communication interface 403 are connected via a bus 410 and communicate with each other.

[0098] The communication interface 403 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0099] Bus 410 includes hardware, software or both, and the components of online data flow metering equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industry standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industry standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 410 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0100] In addition, the embodiments of the present application may be implemented by providing a computer storage medium having computer program instructions stored thereon; when the computer program instructions are executed by a processor, any one of the user behavior classification audit methods in the above embodiments is implemented.

[0101] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0102] The functional modules shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in unit, a function card or the like. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0103] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0104] Aspects of the present application have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed via the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. This processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or the flowchart and the combination of the boxes in the block diagram and / or the flowchart can also be implemented by the dedicated hardware that performs the specified function or action, or can be implemented by the combination of dedicated hardware and computer instructions.

[0105] The above description is only a specific embodiment of the present application. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application.

Claims

1. A user behavior classification audit method, characterized in that: include: Collect user behavior information; In the case where it is determined that the user behavior information contains a preset keyword, a classification tree is used to determine whether the user behavior information triggers an audit; When it is determined that an audit is triggered, the audit content of the user behavior information is classified using a preset decision tree classification model to determine the category of the user behavior information; wherein the decision tree classification model is obtained by model training using K-fold cross-validation and an improved gradient boosting decision tree algorithm, and the decision tree classification model includes multiple CART trees constructed based on multiple audit features and a GBDT model for linearly adding the classification results of the multiple CART trees, the multiple CART trees are used to classify the audit features in the audit content using a classification feature threshold, the classification feature threshold and the weight value of the audit feature are calculated using K-fold cross-validation and gradient descent principles, and the GBDT model is used to linearly add the classification results of the audit features in the audit content to obtain the category of the user behavior information; Obtain the audit log corresponding to the category of the user behavior information.

2. The user behavior classification audit method according to claim 1 is characterized in that: The keywords include operation time, operation IP, operation user, operation instruction and instruction parameters.

3. The user behavior classification audit method according to claim 1 is characterized in that: In the case where it is determined that the user behavior information contains a preset keyword, the method further comprises: classifying the user behavior information using a preset decision tree classification model to determine the category of the user behavior information. Get the audit set; Based on the training set in the audit set, model training is performed using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain the decision tree classification model.

4. The user behavior classification audit method according to claim 3 is characterized in that: After the model training is performed based on the training set in the audit set using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain the decision tree classification model, the method further includes: The decision tree classification model is tested using the test set in the audit set.

5. A user behavior classification audit device, characterized in that: include: Collection module, used to collect user behavior information; A classification module, configured to, upon determining that a preset keyword exists in the user behavior information, use a classification tree to determine whether the user behavior information triggers an audit; When it is determined that an audit is triggered, the audit content of the user behavior information is classified using a preset decision tree classification model to determine the category of the user behavior information; wherein the decision tree classification model is obtained by model training using K-fold cross-validation and an improved gradient boosting decision tree algorithm, and the decision tree classification model includes multiple CART trees constructed based on multiple audit features and a GBDT model for linearly adding the classification results of the multiple CART trees, the multiple CART trees are used to classify the audit features in the audit content using a classification feature threshold, the classification feature threshold and the weight value of the audit feature are calculated using K-fold cross-validation and gradient descent principles, and the GBDT model is used to linearly add the classification results of the audit features in the audit content to obtain the category of the user behavior information; The first acquisition module is used to obtain the audit log corresponding to the category of the user behavior information.

6. The user behavior classification audit device according to claim 5, characterized in that: The keywords include operation time, operation IP, operation user, operation instruction and instruction parameters.

7. The user behavior classification audit device according to claim 5, characterized in that: The device further comprises: The second acquisition module is used to obtain the audit set; The model training module is used to perform model training based on the training set in the audit set using K-fold cross validation and an improved gradient boosting decision tree algorithm to obtain the decision tree classification model.

8. The user behavior classification audit device according to claim 7, characterized in that: The device further comprises: A testing module is used to test the decision tree classification model using a test set in the audit set.

9. An electronic device, characterized in that: The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the user behavior classification audit method as described in any one of claims 1 to 4 is implemented.

10. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, which, when executed by a processor, implement the user behavior classification audit method according to any one of claims 1 to 4.

Images