User operation behavior full snapshot and business restoration method and device

Abstract

The present invention provides a method and device for full snapshot of user operation behavior and business restoration, the method comprising: full snapshot collection of application-layer user operation behavior data based on URL mirroring; business type identification of user operation behavior data based on a convolutional neural network TextCNN algorithm; and operation association level calculation and user behavior sequence pattern analysis based on business semantics. The method and device are based on a method for full collection of application-layer user operations using URL mirroring, a method for business type identification based on a convolutional neural network TextCNN algorithm, and operation association level calculation and user behavior sequence pattern analysis based on business semantics to quickly collect user operation behavior information, accurately restore user operation behavior, and reflect the user's actual business operation, thereby realizing user behavior operation auditing, satisfying query retrieval of the current user's associated operations, and displaying the current user's user behavior over a period of time.

Description

Technical Field

[0001] The present invention belongs to the field of data analysis technology, and in particular relates to a method and device for full snapshot and business restoration of user operation behavior. Background Art

[0002] In the management information system, the record of user operation behavior will provide a data basis for subsequent abnormal behavior analysis, user operation behavior audit and alarm warning. The record of user operation behavior is not only a log of user operation behavior, but also a record of all user operation behaviors, making the subsequent analysis more accurate. In order to balance factors such as performance, storage capacity and business needs, the existing method generally only collects user operation logs, that is, only records the summary or statistical data of user operations, and does not include the input and output information of user operation behaviors. In actual application scenarios, only collecting user behavior logs is far from meeting business requirements. For example, if a user illegally adds a new reimbursement data, the subsequent identification and auditing require the input and output data support of the user operation behavior. Therefore, when collecting user operation behavior, the present invention will record the full amount of user operation behavior data (taking into account the existence of large files in the system, only structural operation data is recorded for file data, and the file itself is not recorded).

[0003] Existing methods for the collection, processing, analysis and display of user operation behavior logs generally collect user operation behavior logs through the network layer or application layer, extract relevant and necessary operation behaviors into a unified storage system, pre-process and organize data according to business needs to form a unified format log that can be used for business analysis, and finally extract necessary fields for business applications and display log information through different visualization methods (such as Figure 1 shown).

[0004] For the full collection of user operation behaviors, existing methods have problems with data integrity and low processing efficiency. When collecting user operation behaviors through the network layer, for example, using the network mirroring method, special equipment is generally required to mirror and collect all network traffic data. Although this does not affect the performance of business operations, due to the large amount of collected data and the need to filter the data at the application layer, there are problems such as difficulty and low efficiency in extracting subsequent user operation behavior data. When collecting user operation behaviors through the application layer, it is necessary to implement a full business data bypass at the application layer, and to write a special program to filter and process user operation behaviors in real time. Although this improves the accuracy of business data extraction, it often has a greater impact on system performance. Therefore, the key issue in user operation behavior collection is to meet the requirements of full data extraction without reducing system performance.

[0005] For the processing and analysis of user operation behaviors, existing methods mainly formulate rules for different types of business to achieve the mapping from logs to user operation behaviors. Generally, the translation of log records to business types is completed by defining regular expressions. The main problems are incomplete business type information and poor adaptability to dynamic business adjustments. That is, the log only records summary or statistical data, and the business type is not fully recorded, making restoration difficult. At the same time, due to the frequent adjustments of the business system, the business type changes, making business restoration not dynamic. In addition, the same business type has different operation behaviors. For example, the business type of transportation expense reimbursement in financial reimbursement has operation behaviors such as temporary storage, submission, approval, update, deletion, and query of reimbursement forms, and these different operation behaviors correspond to different data versions. Existing methods have not yet seen a fine-grained division of business types and business operations to meet the requirements of accurate restoration of user business operations. Therefore, how to identify and restore business types and business operations is a key issue in the processing and analysis of user operation behaviors.

[0006] When displaying and analyzing user behavior, business types often correlate with each other. For example, transportation expense reimbursement is associated with financial payments and project funding revenue and expenditure. Existing methods for linking business types through log analysis are limited, especially in the area of ​​linking and visualizing different business types within management information systems. Therefore, a key challenge in analyzing and displaying user behavior is how to quickly present the current user's relevant business operations within a certain timeframe through simple queries or question-and-answer retrieval. Summary of the Invention

[0007] In order to solve the problems existing in the prior art, the present invention provides a method and device for full snapshot of user operation behavior and business restoration.

[0008] One of the technical solutions of the present invention provides a method for full snapshot of user operation behavior and business restoration, the method comprising the following steps:

[0009] Full snapshot collection of application layer user operation behavior data based on URL mirroring;

[0010] Identify business types based on user operation behavior data based on the convolutional neural network TextCNN algorithm;

[0011] Calculation of operation correlation levels and analysis of user behavior sequence patterns based on business semantics.

[0012] In a further improved solution, the business type identification based on the convolutional neural network TextCNN algorithm for user operation behavior data specifically includes:

[0013] Use the sliding window method to distinguish user operation behavior data and intercept the data segments generated by a single user's single business operation;

[0014] Based on the convolutional neural network TextCNN algorithm, the business type of the intercepted data segment generated by a single user's single business operation is identified.

[0015] In a further improved solution, the quantitative analysis of the correlation level between each business operation in the operation process is specifically as follows: using the output value sequence of the TextCNN algorithm, the cosine similarity is used to calculate the business correlation level between each business operation.

[0016] In a further improved solution, the user behavior sequence pattern mining is to mine the user behavior sequence pattern using the PrefixSpan algorithm.

[0017] Another technical solution of the present invention provides a device for full snapshot and business restoration of user operation behavior, the device comprising:

[0018] A collection module configured to collect full snapshots of application layer user operation behavior data based on URL mirroring;

[0019] A service type identification module is configured to identify the service type of user operation behavior data based on a convolutional neural network TextCNN algorithm;

[0020] The association module is configured to calculate the operation association level based on business semantics and analyze the user behavior sequence pattern.

[0021] Another technical solution of the present invention is a computer-readable storage medium storing a computer program, wherein the program is executed by a processor to implement steps of a full snapshot of user operation behavior and a business restoration method.

[0022] The present invention provides a method and device for taking a full snapshot of user operation behavior and restoring business operations. The method and device construct an application-layer full-scale user operation collection method based on URL mirroring, which can quickly and effectively collect user operation behavior logs; construct a business type identification method based on the convolutional neural network TextCNN algorithm, and obtain the business type and business operation in the business system by clustering and learning URLs and operation data; construct an operation association level calculation and user behavior sequence pattern analysis based on business semantics or semantic editing to quickly collect user operation behavior information, accurately restore user operation behavior, and reflect the user's real business operations, thereby realizing user behavior operation auditing, meeting the query and retrieval of the current user's associated operations, and displaying the current user's user behavior over a period of time. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 This is a flowchart of the collection, processing, analysis and display of user operation behavior logs disclosed in the prior art;

[0025] Figure 2 This is a flowchart of a method for full snapshot of user operation behavior and business restoration provided by some embodiments of the present invention;

[0026] Figure 3 It is a flowchart of the convolutional neural network TextCNN algorithm;

[0027] Figure 4 This is a structural block diagram of a full snapshot of user operation behavior and business restoration device provided in some embodiments of the present invention. DETAILED DESCRIPTION

[0028] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0029] Some embodiments of the present invention provide a method for full snapshot of user operation behavior and business restoration, such as Figure 2 As shown, the method includes the following steps:

[0030] S1: Full snapshot collection of application layer user operation behavior data based on URL mirroring;

[0031] When a user accesses a corresponding business function in the management information system, all user operation behavior data is collected in real time. Based on the server-side URL mirroring mechanism, all data items generated by the operation behavior are backed up at the application layer (only statistical information is extracted from the file, and the file itself is filtered). This is the user operation behavior data, which includes statistical data such as user ID, visited page, visit time, IP address, browser type, response time, as well as the URL and the input and output data associated with the URL encapsulated in a JSON structure. This series of extraction operations is the full snapshot collection of data. Using some commonly used LFA (Log File Analyzer, log file framework) systems, the data generation and data changes caused by each user access are recorded, and the transaction is rolled back to any reasonable state in the management information system as needed to achieve full snapshot collection of user operation behavior data. Using LFA to perform full snapshot collection of URLs does not increase the server burden and has little impact on service performance. Each user operation consists of a different page visit, and each page visit corresponds to a series of URLs. The data structure of extracted user behavior, derived through full snapshot collection technology, is represented as follows: ((user ID), (visited page), (visit time), (IP address), (browser type), {(URL), (JSON data items associated with the URL)}). The user ID is the ID of the current user recorded in the system, and the JSON data items refer to the input and output data associated with the URL, expressed in a standardized JSON format. This allows for complete collection of user behavior data without adding additional server load, facilitating subsequent data analysis and utilization.

[0032] S2: Identify business types based on user operation behavior data based on the convolutional neural network TextCNN algorithm.

[0033] Specifically, the business type identification of user operation behavior data based on the convolutional neural network TextCNN algorithm includes:

[0034] The user operation behavior data collected in step S1 is differentiated by a sliding window method, and the data segment generated by a single user's single business operation is intercepted.

[0035] The present invention proposes and uses a business operation time window to divide single-user business operations. The business operation time window includes three elements: window size, window front beginPos and window back endPos, wherein the window size is dynamically adjusted according to the characteristics of the data being processed and the actual scenario. The adjustment method can adopt two strategies: forward expansion and reverse contraction. Forward expansion is to keep the position of the window back edge unchanged, expand the window front value in the direction of window movement, so that the window as a whole becomes larger and can process more data. Reverse contraction means to keep the window front position unchanged, shrink the window back edge in the direction of window movement, so that the window as a whole is smaller. The method of dynamically adjusting the window front and window back edge determines the start time t0 and t1 of an atomic business operation, so that the business operation time window can be expressed as [t-t0, t+t1]. When adjusting the business operation time window, the decision to adopt positive expansion or negative contraction is primarily based on the principle of temporal correlation: when new user operation behavior data is read in sequentially, if the timestamp interval between it and the user operation behavior data at the beginPos end exceeds the set threshold Tolerance, the temporal correlation between the two behavior information is considered weak, and the probability of them belonging to the same atomic business operation is low. Therefore, this should be used as the segmentation point between the two user business operations. If the timestamp interval between the two user operation behavior data does not exceed the set threshold Tolerance, the temporal correlation between the two snapshots is considered strong and they are classified as the same atomic business operation. At this point, the sliding window needs to be positively expanded to allow the current user operation behavior data to enter the sliding window. This process repeats until the segmentation point of the business operation is found. The business operation time window for that operation can be finally determined, and all snapshot data segments generated solely by that operation can be inferred, completing the division of one business operation.

[0036] Based on the convolutional neural network TextCNN algorithm, the business type of the intercepted data segment generated by a single user's single business operation is identified.

[0037] After all business operations in the process sequence are divided into operation sequences, the business type of each operation sequence must be further identified. This identification process is achieved by training the TextCNN convolutional neural network model.

[0038] Based on the convolutional neural network TextCNN algorithm, the business type identification of the intercepted data segment generated by a single user single business operation is carried out specifically including:

[0039] Perform business labeling on the data segments generated by a single user's single business operation to form a training set; the training set contains all known business attributes;

[0040] The training set is used to train the TextCNN convolutional neural network model to obtain a business type recognition model.

[0041] The training process of the TextCNN convolutional neural network model using the training set is actually the continuous adjustment of the parameters of each layer in the TextCNN model structure.

[0042] The training process of TextCNN is as follows: the input data first passes through the embedding layer to obtain the embedding representation of the input sentence, then passes through the convolution layer to extract the features of the sentence, and finally passes through the fully connected layer to obtain the final output. The structure diagram is shown in the attached Figure 3 .

[0043] The specific explanations of each layer are as follows: embedding layer: the embedding layer. The main function of this layer is to vectorize the input sequence. The specific implementation method can be word2vec, and pre-trained word vectors can be used to speed up training. convolution layer: convolution layer. This layer mainly extracts different n-gram features through convolution. After passing through the embedding layer, the input sentence or text will be converted into a two-dimensional matrix. Assuming that the length of the text is |T| and the size of the word vector is |d|, the size of the two-dimensional matrix is ​​|T|*|d|. The next convolution work is to perform this two-dimensional matrix of |T|*|d|. The size of the convolution kernel is generally set to n*|d|, n is the length of the convolution kernel, and |d| is the width of the convolution kernel. This width is the same as the dimension of the word vector, that is, the convolution is only performed along the text sequence. There are many choices for n, such as 2, 3, 4, 5, etc. For a text of size |T|*|d|, if the convolution kernel size is 2*|d|, the result after convolution is a vector of size |T-2+1|*1. In a TextCNN network, multiple kernels of different types are used simultaneously, and multiple kernels of each size can be used. Assuming a kernel size of 4*|d| and 128 kernels of each size, the convolution network has a total of 4*128=512 convolution kernels. A max-pooling layer takes the maximum value of several one-dimensional vectors obtained after convolution and concatenates these values ​​as the output of this layer. In the above example with a kernel size of 4*|d|, max-pooling produces 512 scalar values, which are concatenated to form a final structure of a 512*1 vector. The purpose of the max-pooling layer is to extract the most activated features from the n-gram features extracted by convolution. A fully-connected layer is a fully-connected layer. This layer is similar to the fully connected layer of a typical convolutional neural network. It is typically placed after the max pooling layer and serves as the output. In practice, multiple fully connected layers can be combined to improve the network's learning capabilities. The URL call sequence corresponding to a business operation can be directly used as input for the TextCNN. By designing the network structure of the subsequent layers and adjusting the softmax activation function of the fully connected layer, the business type can be recovered. Ultimately, the probability of the URL sequence belonging to each business type is output, thereby identifying the business type of the corresponding user operation behavior.

[0044] Based on the business time window method and the convolutional neural network TextCNN method, user operation behavior data is divided into business operations and business types are identified to achieve business restoration of user operation behavior.

[0045] S3: Calculation of operation correlation levels and analysis of user behavior sequence patterns based on business semantics.

[0046] In management information systems, business operations are often interrelated. For example, reimbursement and payment operations, project fund transfers, and other business types are associated with each other. The probability value sequence generated by the trained TextCNN model can be treated as the feature vector of the corresponding input URL sequence. The similarity between these vectors can be calculated to quantitatively analyze the correlation level between business operations. After achieving quantitative analysis of the correlation level between business operations, user behavior can be further restored based on business semantics, thereby mining user behavior sequence patterns.

[0047] Specific methods include:

[0048] The output value sequence of the TextCNN algorithm is used to calculate the business correlation level between each business operation using cosine similarity.

[0049] After obtaining a TextCNN convolutional neural network model that can be used to identify business operations in URL sequences, the output value sequence of each business operation in the model can be regarded as the feature vector of the business operation, and cosine similarity is used as the evaluation criterion to measure the degree of correlation between business operations. The specific method is as follows:

[0050] Assume that the vector representations of the two operations (i.e., the output value sequences of TextCNN) are a=(x1,x2,…x i …, x n )、b=(y1,y2,…,y i ,…,y n ), the calculation formula of the cosine similarity between them is as follows: Cosine similarity uses the cosine value of the angle between two vectors in the vector space as a measure of the size of the difference between two individuals. The closer the cosine value is to 1, the closer the angle is to 0 degrees, that is, the more similar the two vectors are. In the business semantic recognition model, the higher the cosine similarity of the feature vectors of two business operations, the closer the business semantics between them are, and the greater the degree of their inherent correlation. The present invention intends to measure the correlation level between operations / businesses by cosine similarity, and by setting a reasonable threshold, determine whether there is a practical correlation between two operations / businesses, and even further subdivide it into strong correlation and weak correlation. By means of quantitative analysis, the correlation relationship between business operations can be intuitively presented.

[0051] The present invention analyzes the user behavior sequence pattern by using the PrefixSpan algorithm.

[0052] When analyzing the user behavior sequence pattern, the PrefixSpan algorithm is adopted to model the user's time-series behavior sequence by using the system memory volume behavior snapshot data information.

[0053] First, the basic concepts related to the user behavior sequence are defined as follows: ① User behavior sequence: The access path of a user within a period of time is arranged in chronological order, and the formed sequence structure is called the user behavior sequence. Suppose U is the user behavior sequence and P is a single access path, then U = <P1, P2, …, Pn> (Pi ∈ P | 1 ≤ i ≤ n), and n is denoted as the length of this behavior sequence. Generally, a sequence with length n is called an ordered n-sequence. ② Supersequence and subsequence: Given two behavior sequences U1 = <P1, P2, …, Pn> and U2 = <Q1, Q2, …, Qm>, if the condition is satisfied: there exist n integers 1 ≤ j1 < j2 < … < jn ≤ m such that Pji = Qji, where 1 ≤ j ≤ n, 1 ≤ i ≤ n, and n ≤ m, it is said that the user access sequence U1 is a subsequence of U2, and U2 is a supersequence of U1. When and only when U1 is a subsequence of U2 and U1 ≠ U2, it is said that U1 is a proper subsequence of U2. ③ Behavior sequence set: Suppose there exists a set S such that S = <U1, U2, …, Un> (Ui ∈ U | 1 ≤ i ≤ n), then S is called a behavior sequence set. ④ Behavior sequence pattern: Let r be the minimum support threshold. In the behavior sequence set S = <U1, U2, …, Un>, if there exists a behavior sequence Ui such that the support Support(U) of Ui ≥ r holds, then the behavior sequence Ui is called a behavior sequence pattern.

[0054] The basic operation steps of the PrefixSpan algorithm are as follows:

[0055] 1) In the business operation sequence formed after the process is processed through step S2, all the behaviors of each user in the system are found in units of users, and the behavior sequence Ui (i = 1, 2, …, n) of each user is generated, where n represents the number of users in the system.

[0056] 2) Each user's behavior sequence Ui is divided into multiple subsequences Uij (j = 1, 2, …, m) such that Ui = <Ui1, Ui2, …, Uij>, and m is the number of subsequences.

[0057] 3) The divided user behavior sequences are used as the user behavior sequence data set SDB.

[0058] 4) The data set SDB is traversed to mine the subsequences with a length of 1 and greater than the support threshold.

[0059] 5) Divide the subsequences according to the frequent prefixes so that the projected dataset only includes the suffixes.

[0060] 6) Recursively repeat steps 4) and 5) to generate the user's behavior sequence pattern.

[0061] 7) Use the behavior sequence patterns of all users to generate a user sequence pattern library to complete the mining of user behavior sequence patterns existing in the process.

[0062] Vector similarity is used to quantify the business relevance between user operations, and the PrefixSpan sequence pattern mining algorithm is used to mine behavioral sequence patterns in user business operations. This enables intuitive display of the relevance between user operations and the characteristics of user operation behaviors.

[0063] The present invention is aimed at the collection, analysis and application of user operation behaviors. It constructs an application-layer user operation full-scale collection method based on URL mirroring, which can quickly and effectively collect user operation behavior logs; constructs a business type identification method based on the convolutional neural network TextCNN algorithm, and obtains the business type and business operation in the business system by clustering URL and operation data; constructs operation association level calculation and user behavior sequence pattern analysis based on business semantics to quickly collect user operation behavior information, accurately restore user operation behavior, and reflect the user's real business operations, so as to realize user behavior operation auditing, meet the query and retrieval of the current user's associated operations, and display the user behavior of the current user over a period of time.

[0064] Some embodiments of the present invention provide a full snapshot of user operation behavior and a business restoration device, such as Figure 4 As shown, the device includes:

[0065] A collection module 10, which is configured to collect full snapshots of application layer user operation behavior data based on URL mirroring;

[0066] When a user accesses a corresponding business function in the management information system, all user operation behavior data is collected in real time. Based on the server-side URL mirroring mechanism, all data items generated by the operation behavior are backed up at the application layer (only statistical information is extracted from the file, and the file itself is filtered). This is the user operation behavior data, which includes statistical data such as user ID, visited page, visit time, IP address, browser type, response time, as well as the URL and the input and output data associated with the URL encapsulated in a JSON structure. This series of extraction operations is the full snapshot collection of data. Using some commonly used LFA (Log File Analyzer, log file framework) systems, the data generation and data changes caused by each user access are recorded, and the transaction is rolled back to any reasonable state in the management information system as needed to achieve full snapshot collection of user operation behavior data. Using LFA to perform full snapshot collection of URLs does not increase the server burden and has little impact on service performance. Each user operation consists of a different page visit, and each page visit corresponds to a series of URLs. The data structure of extracted user behavior, derived through full snapshot collection technology, is represented as follows: ((user ID), (visited page), (visit time), (IP address), (browser type), {(URL), (JSON data items associated with the URL)}). The user ID is the ID of the current user recorded in the system, and the JSON data items refer to the input and output data associated with the URL, expressed in a standardized JSON format. This allows for complete collection of user behavior data without adding additional server load, facilitating subsequent data analysis and utilization.

[0067] The business type identification module 20 is configured to identify the business type of user operation behavior data based on the convolutional neural network TextCNN algorithm.

[0068] Among them, the TextCNN algorithm based on convolutional neural network specifically includes:

[0069] The user operation behavior data collected in step S1 is differentiated by a sliding window method, and the data segment generated by a single user's single business operation is intercepted.

[0070] The present invention proposes and uses a business operation time window to divide single-user business operations. The business operation time window includes three elements: window size, window front beginPos and window back endPos, wherein the window size is dynamically adjusted according to the characteristics of the data being processed and the actual scenario. The adjustment method can adopt two strategies: forward expansion and reverse contraction. Forward expansion is to keep the position of the window back edge unchanged, expand the window front value in the direction of window movement, so that the window as a whole becomes larger and can process more data. Reverse contraction means to keep the window front position unchanged, shrink the window back edge in the direction of window movement, so that the window as a whole is smaller. The method of dynamically adjusting the window front and window back edge determines the start time t0 and t1 of an atomic business operation, so that the business operation time window can be expressed as [t-t0, t+t1]. When adjusting the business operation time window, the decision to adopt positive expansion or negative contraction is primarily based on the principle of temporal correlation: when new user operation behavior data is read in sequentially, if the timestamp interval between it and the user operation behavior data at the beginPos end exceeds the set threshold Tolerance, the temporal correlation between the two behavior information is considered weak, and the probability of them belonging to the same atomic business operation is low. Therefore, this should be used as the segmentation point between the two user business operations. If the timestamp interval between the two user operation behavior data does not exceed the set threshold Tolerance, the temporal correlation between the two snapshots is considered strong and they are classified as the same atomic business operation. At this point, the sliding window needs to be positively expanded to allow the current user operation behavior data to enter the sliding window. This process repeats until the segmentation point of the business operation is found. The business operation time window for that operation can be finally determined, and all snapshot data segments generated solely by that operation can be inferred, completing the division of one business operation.

[0071] Based on the convolutional neural network TextCNN algorithm, the business type of the intercepted data segment generated by a single user's single business operation is identified.

[0072] After all business operations in the process sequence are divided into operation sequences, the business type of each operation sequence must be further identified. This identification process is achieved by training the TextCNN convolutional neural network model.

[0073] Based on the convolutional neural network TextCNN algorithm, the business type identification of the intercepted data segment generated by a single user single business operation is carried out specifically including:

[0074] Perform business labeling on the data segments generated by a single user's single business operation to form a training set; the training set contains all known business attributes;

[0075] The training set is used to train the TextCNN convolutional neural network model to obtain a business type recognition model.

[0076] The training process of the TextCNN convolutional neural network model using the training set is actually the continuous adjustment of the parameters of each layer in the TextCNN model structure.

[0077] The training process of TextCNN is as follows: the input data first passes through the embedding layer to obtain the embedding representation of the input sentence, then passes through the convolution layer to extract the features of the sentence, and finally passes through the fully connected layer to obtain the final output. The structure diagram is shown in the attached Figure 3 .

[0078] The specific explanations of each layer are as follows: embedding layer: the embedding layer. The main function of this layer is to vectorize the input sequence. The specific implementation method can be word2vec, and pre-trained word vectors can be used to speed up training. convolution layer: convolution layer. This layer mainly extracts different n-gram features through convolution. After passing through the embedding layer, the input sentence or text will be converted into a two-dimensional matrix. Assuming that the length of the text is |T| and the size of the word vector is |d|, the size of the two-dimensional matrix is ​​|T|*|d|. The next convolution work is to perform this two-dimensional matrix of |T|*|d|. The size of the convolution kernel is generally set to n*|d|, n is the length of the convolution kernel, and |d| is the width of the convolution kernel. This width is the same as the dimension of the word vector, that is, the convolution is only performed along the text sequence. There are many choices for n, such as 2, 3, 4, 5, etc. For a text of size |T|*|d|, if the convolution kernel size is 2*|d|, the result after convolution is a vector of size |T-2+1|*1. In a TextCNN network, multiple kernels of different types are used simultaneously, and multiple kernels of each size can be used. Assuming a kernel size of 4*|d| and 128 kernels of each size, the convolution network has a total of 4*128=512 convolution kernels. A max-pooling layer takes the maximum value of several one-dimensional vectors obtained after convolution and concatenates these values ​​as the output of this layer. In the above example with a kernel size of 4*|d|, max-pooling produces 512 scalar values, which are concatenated to form a final structure of a 512*1 vector. The purpose of the max-pooling layer is to extract the most activated features from the n-gram features extracted by convolution. A fully-connected layer is a fully-connected layer. This layer is similar to the fully connected layer of a typical convolutional neural network. It is typically placed after the max pooling layer and serves as the output. In practice, multiple fully connected layers can be combined to improve the network's learning capabilities. The URL call sequence corresponding to a business operation can be directly used as input for the TextCNN. By designing the network structure of the subsequent layers and adjusting the softmax activation function of the fully connected layer, the business type can be recovered. Ultimately, the probability of the URL sequence belonging to each business type is output, thereby identifying the business type of the corresponding user operation behavior.

[0079] Based on the business time window method and the convolutional neural network TextCNN method, user operation behavior data is divided into business operations and business types are identified to achieve business restoration of user operation behavior.

[0080] The association module 30 is configured to calculate the operation association level based on business semantics and analyze user behavior sequence patterns.

[0081] In management information systems, business operations are often interrelated. For example, reimbursement and payment operations, project fund transfers, and other business types are associated with each other. The probability value sequence generated by the trained TextCNN model can be treated as the feature vector of the corresponding input URL sequence. The similarity between these vectors can be calculated to quantitatively analyze the correlation level between business operations. After achieving quantitative analysis of the correlation level between business operations, user behavior can be further restored based on business semantics, thereby mining user behavior sequence patterns.

[0082] Specific methods include:

[0083] The output value sequence of the TextCNN algorithm is used to calculate the business correlation level between each business operation using cosine similarity.

[0084] After obtaining a TextCNN convolutional neural network model that can be used to identify business operations in URL sequences, the output value sequence of each business operation in the model can be regarded as the feature vector of the business operation, and cosine similarity is used as the evaluation criterion to measure the degree of correlation between business operations. The specific method is as follows:

[0085] Assuming that the vector representations of the two operations (i.e., the output value sequences of TextCNN) are a = (x1, x2, ... xn) and b = (y1, y2, ... yn), the cosine similarity between them is calculated as follows:

[0086] Cosine similarity uses the cosine value of the angle between two vectors in the vector space as a measure of the size of the difference between two individuals. The closer the cosine value is to 1, the closer the angle is to 0 degrees, that is, the more similar the two vectors are. In the business semantic recognition model, the higher the cosine similarity of the feature vectors of two business operations, the closer the business semantics between them are, and the greater the degree of their inherent correlation. The present invention intends to measure the correlation level between operations / businesses by cosine similarity, and by setting a reasonable threshold, determine whether there is a practical correlation between two operations / businesses, and even further subdivide it into strong correlation and weak correlation. By means of quantitative analysis, the correlation relationship between business operations can be intuitively presented.

[0087] The present invention uses the PrefixSpan algorithm to analyze user behavior sequence patterns.

[0088] When analyzing the user behavior sequence pattern, the PrefixSpan algorithm is adopted, and the system memory volume behavior snapshot data information is used to model the user's time series behavior sequence.

[0089] First, the basic concepts related to the user behavior sequence are defined as follows: ① User behavior sequence: The access path of a user within a period of time is arranged in chronological order, and the formed sequence structure is called the user behavior sequence. Suppose U is the user behavior sequence and P is a single access path, then U = <P1, P2, …, Pn> (Pi ∈ P | 1 ≤ i ≤ n), and n is denoted as the length of this behavior sequence. Generally, a sequence with length n is called an ordered n-sequence. ② Supersequence and subsequence: Given two behavior sequences U1 = <P1, P2, …, Pn> and U2 = <Q1, Q2, …, Qm>, if the condition is satisfied: there exist n integers 1 ≤ j1 < j2 < … < jn ≤ m such that Pji = Qji, where 1 ≤ j ≤ n, 1 ≤ i ≤ n, and n ≤ m, it is said that the user access sequence U1 is a subsequence of U2, and U2 is a supersequence of U1. When and only when U1 is a subsequence of U2 and U1 ≠ U2, it is said that U1 is a proper subsequence of U2. ③ Behavior sequence set: Suppose there is a set S such that S = <U1, U2, …, Un> (Ui ∈ U | 1 ≤ i ≤ n), then S is called a behavior sequence set. ④ Behavior sequence pattern: Let r be the minimum support threshold. In the behavior sequence set S = <U1, U2, …, Un>, if there exists a behavior sequence Ui such that the support of Ui, Support(U) ≥ r holds, then the behavior sequence Ui is called a behavior sequence pattern.

[0090] The basic operation steps of the PrefixSpan algorithm are as follows:

[0091] 1) In the business operation sequence formed after the process is processed through step S2, all the behaviors of each user in the system are found in units of users, and the behavior sequence Ui (i = 1, 2, …, n) of each user is generated, where n represents the number of users in the system.

[0092] 2) Each user's behavior sequence Ui is divided into multiple subsequences Uij (j = 1, 2, …, m) such that Ui = <Ui1, Ui2, …, Uij>, and m is the number of subsequences.

[0093] 3) The divided user behavior sequences are used as the user behavior sequence data set SDB.

[0094] 4) The data set SDB is traversed to mine subsequences with a length of 1 and greater than the support threshold.

[0095] 5) The subsequences are divided according to the frequent prefixes so that the projection data set only includes the suffixes.

[0096] 6) Recursively repeat steps 4) and 5) to generate the user's behavior sequence pattern.

[0097] 7) Use the behavior sequence patterns of all users to generate a user sequence pattern library to complete the mining of user behavior sequence patterns existing in the process.

[0098] Vector similarity is used to quantify the business relevance between user operations, and the PrefixSpan sequence pattern mining algorithm is used to mine behavioral sequence patterns in user business operations. This enables intuitive display of the relevance between user operations and the characteristics of user operation behaviors.

[0099] The present invention is aimed at the collection, analysis and application of user operation behaviors. It constructs an application-layer user operation full-scale collection method based on URL mirroring, which can quickly and effectively collect user operation behavior logs; constructs a business type identification method based on the convolutional neural network TextCNN algorithm, and obtains the business type and business operation in the business system by clustering URL and operation data; constructs operation association level calculation and user behavior sequence pattern analysis based on business semantics to quickly collect user operation behavior information, accurately restore user operation behavior, and reflect the user's real business operations, so as to realize user behavior operation auditing, meet the query and retrieval of the current user's associated operations, and display the user behavior of the current user over a period of time.

[0100] Another embodiment of the present invention provides another computer-readable storage medium. This computer-readable storage medium may be the computer-readable storage medium included in the memory in the above embodiment, or may be a separate computer-readable storage medium not incorporated into the terminal. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the methods provided in the above embodiment.

[0101] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0102] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0103] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for full snapshot of user operation behavior and business restoration, characterized in that: The method comprises the following steps: Full snapshot collection of application layer user operation behavior data based on URL mirroring; The convolutional neural network TextCNN algorithm is used to identify the business type of user operation behavior data, including: Use the sliding window method to distinguish user operation behavior data and intercept the data segments generated by a single user's single business operation; Based on the convolutional neural network TextCNN algorithm, the business type is identified for the intercepted data segments generated by a single user's single business operation; Calculate the level of business association between operations based on business semantics and analyze user behavior sequence patterns. Specifically, we use the output value sequence of the TextCNN algorithm and cosine similarity to calculate the business association level between each business operation. The PrefixSpan algorithm is used to analyze user behavior sequence patterns.

2. A device for full snapshot and business restoration of user operation behavior, characterized in that: The device comprises: A collection module configured to collect full snapshots of application layer user operation behavior data based on URL mirroring; A service type identification module is configured to identify the service type of user operation behavior data based on a convolutional neural network (TextCNN) algorithm; specifically, it includes: Use the sliding window method to distinguish user operation behavior data and intercept the data segments generated by a single user's single business operation; Based on the convolutional neural network TextCNN algorithm, the business type is identified for the intercepted data segments generated by a single user's single business operation; The association module is configured to calculate the operation association level and analyze the user behavior sequence pattern based on business semantics; specifically, the business association level between each business operation is calculated using the output value sequence of the TextCNN algorithm and cosine similarity; and the user behavior sequence pattern is analyzed using the PrefixSpan algorithm.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to claim 1 are implemented.

Images