An abnormality recognition device based on big data and artificial intelligence

Abstract

The application discloses an abnormality recognition device based on big data and artificial intelligence, comprising a behavior extraction stage, a user clustering stage, a baseline generation stage, an abnormality real-time detection stage, an abnormality behavior prediction stage and an abnormality result processing stage. The application can automatically extract IT management operation behaviors, intelligently distinguish different personnel operation behavior characteristics and establish a dynamic behavior baseline model to recognize abnormal behaviors by applying big data and artificial intelligence technology. The application can automatically extract operation behaviors without configuring keywords and can achieve comprehensive blind area-free management coverage, greatly reducing the technical requirements and management time cost of management personnel compared with original technical means, and greatly improving management coverage and management effect. Meanwhile, the application can predict behavior abnormality risks that may occur in the future based on artificial intelligence technology.

Description

Technical Field

[0001] This invention relates to the field of big data and artificial intelligence identification, specifically to an anomaly identification device based on big data and artificial intelligence. Background Technology

[0002] Existing solutions are as follows: Enterprises and banks possess a large number of diverse business systems. From the perspectives of internal and external auditing as well as risk control, it is necessary to conduct regular or ad-hoc audits of the operational behavior of internal and external personnel within these various business systems to identify and detect abnormal behavior, potential risks, and existing risks. Traditional identification methods include:

[0003] 1. When risks have already occurred, such as information leakage or business system failure, a manual backtracking process is conducted by manually reviewing operation records.

[0004] 2. Configure keywords for operation records (or system logs) of key systems and key operations, and use log management platform products for real-time identification, or automatically trigger early warning notifications for key operations through the operation records built into each system.

[0005] Regarding the existing technical means of identifying abnormal behavior, firstly, the manual methods mentioned in the first point above are extremely outdated, with serious omissions, numerous blind spots, and very poor lag.

[0006] The second method, based on keywords (or behavioral tags), has the following technical drawbacks:

[0007] 1. It can only cover known issues, meaning it can only configure the administrator to know about possible abnormal events within their knowledge scope, and the relevant keywords must be accurately found, resulting in a large number of blind spots in supervision;

[0008] 2. Configuring and managing keywords is time-consuming and labor-intensive. From a configuration perspective, it requires a lot of observation and analysis time; from a management perspective, it is very difficult to manage the timeliness of keywords, and it is completely unable to automatically adapt to changes when keyword applications expire or change.

[0009] 3. Completely unable to adapt to the management pressure brought about by the exponential increase in the number of activities due to the surge in the number of equipment, systems, and personnel;

[0010] 4. It is completely impossible to determine or predict whether abnormal behavior may occur in the future.

[0011] For the reasons mentioned above, an anomaly detection device based on big data and artificial intelligence has become an urgent problem for the whole society. Summary of the Invention

[0012] To solve the above-mentioned technical problems, the present invention provides the following technical solution: an anomaly identification device based on big data and artificial intelligence, comprising the following stages,

[0013] (1) Behavior extraction stage: In this stage, the IT management operation behavior is extracted from the raw information and provided for subsequent baseline generation and anomaly detection;

[0014] (2) User segmentation stage: In this stage, the deduplication and clustering of behavioral data are completed, and user groups are segmented according to the distribution of behavioral characteristics.

[0015] (3) Baseline generation phase: This phase calculates behavioral baselines within each group, including behavioral time distribution baselines and behavioral sequence baselines;

[0016] (4) Real-time anomaly detection stage: This stage will detect anomalies in the behavioral data entering the system in real time based on the behavioral time distribution baseline and the behavioral sequence baseline.

[0017] (5) Abnormal behavior prediction stage. There are two prediction methods in this stage: one is a prediction method based on the back learning of confirmed abnormal behavior, and the other is a risk prediction method based on historical behavior patterns.

[0018] (6) Abnormal result processing stage: This stage is mainly responsible for eliminating non-abnormal results, generating behavior trajectories, and triggering alarms and linkage control actions.

[0019] Furthermore, step (1) includes the following steps:

[0020] (a) Digital traceability information of IT management operations is located in the operation log and operation record database. The relevant digital traceability information includes a five-tuple of information: operation initiator, operation event, operation behavior, operation location, and operation object.

[0021] (b) Obtain relevant digital traceability information into the software system through data interface connection;

[0022] (c) Extract the quintuple information from the digital trace information and store it in the system.

[0023] Furthermore, step (2) includes the following steps:

[0024] (a) Use data from the past six months at the current point in time as the basis for clustering;

[0025] (b) Statistically calculate the frequency of each behavior in each user's time period throughout history;

[0026] (c) Based on the frequency values ​​mentioned above, clustering calculations are performed and the Euclidean distance relationship between the clustering results is determined. Multiple iterations are performed, and the iteration ends when the average Euclidean distance between all results is the farthest. At this point, the behavioral characteristics of each user group are most significantly separated, and user grouping is completed.

[0027] (d) The system automatically performs cluster calculations every month.

[0028] Furthermore, step (3) includes the following steps:

[0029] (a) The numerical distribution of the frequency of operations for each behavior of each group within each time period;

[0030] (b) Fit the data for each behavior to a normal distribution;

[0031] (c) The system automatically selects the upper and lower bounds of the confidence interval based on the 3 sigma principle;

[0032] (d) Dynamically generate behavior steep increase factor and behavior steep decrease factor based on the probability density of behavior distribution;

[0033] (e) A dynamic tolerance interval is automatically generated based on the number of behavior frequency baselines, thus completing the behavior time distribution baseline;

[0034] (f) The sequential order of behavioral feature sequences follows the Markov property;

[0035] (g) Perform 2-gram segmentation on the behavior sequences in the training data to obtain behavior pairs, perform statistical analysis on the behavior pairs and sort them in reverse order, and calculate the weights of the behavior pairs based on the statistical results;

[0036] (h) Generate a behavior knowledge graph based on behavior pairs, relationships, and weights, representing the relationships and sequence probabilities between all behaviors;

[0037] (I) Divide the training data into sliding behavior sequences, compare them with the behavior knowledge graph, and calculate the total sequence weight of all sequences;

[0038] (j) Automatically select the upper and lower bounds of the confidence interval based on the 3sigma principle;

[0039] (k) The behavioral sequence baseline is now complete;

[0040] (L) The system will automatically perform this baseline training every week.

[0041] Furthermore, step (4) includes the following steps:

[0042] (a) The system will perform baseline comparison detection in real time when each time window arrives, depending on the different behavioral data cycle settings.

[0043] (b) The system will detect the following anomalies:

[0044] a) New behavior type: When a behavior has never appeared in the group's historical behavior, it is considered a new behavior type;

[0045] b) The total number of group behaviors increases or decreases suddenly within a unit of time. The total number of behaviors of a certain group within a unit of time exceeds three times the average total number of behaviors within that unit of time in the historical training samples.

[0046] c) Sudden increase / decrease in the frequency of individual behaviors compared to the baseline value of the behavior time distribution: In a certain group, the number of behaviors of a certain behavior in a unit of time exceeds the 3 sigma region of the baseline generated by the frequency of that behavior in the historical training samples.

[0047] d) Individual behavioral sequences deviate from the baseline of behavioral sequences. In a certain group, the comprehensive weight value of a behavioral sequence greater than 4 is less than the threshold of the comprehensive weight generated based on the 3sigma principle.

[0048] Furthermore, step (5) includes the following steps:

[0049] (a) The system will save all result data that is identified as abnormal and confirmed as abnormal by manual verification as prediction reference data;

[0050] (b) When an actual behavior sequence greater than 4 occurs, it will be automatically imported into the reference system for matching. When the comprehensive weight value matched by the actual sequence in the reference system is extremely close to the theoretical maximum weight value, the behavior sequence is determined to be an abnormal risk behavior.

[0051] (c) The specific determination formula is as follows: when the sequence is n, there are n-1 2-gram weight values ​​that are calculated together, meaning the theoretical maximum weight value is n-1. In the reference system data, the confirmed behavior of each 2-gram will be weighted according to the number of its 2-gram branches, meaning the total weight of each behavior's subsequent behaviors is summed to 1. For example: when n=4, the theoretical maximum weight value is 3. Let the weights of each 2-gram be a, b, and c. Based on the matching comparison with the prediction reference system data, a, b, and c will be assigned a weight value between 0 and 1. When a+b+c>3*99.7%, the behavior sequence is considered an abnormal risk sequence.

[0052] (d) The above are prediction methods based on back learning of confirmed abnormal behavior;

[0053] (e) The risk prediction method based on historical behavior patterns is divided into two parts: the first part predicts future behavior based on the actual behavior sequence and the behavior knowledge graph obtained in the baseline generation stage, and generates a virtual behavior sequence; the second part imports the virtual behavior sequence into the real-time anomaly detection stage to perform risk prediction and detection.

[0054] (f) In the first part, when the system obtains a behavior sequence greater than 4 with a length of n, it matches the sequence with the behavior management graph to calculate a comprehensive weight. If the comprehensive weight of the behavior sequence is greater than 99.7% of the theoretical maximum weight of n-1, and the last behavior of the behavior sequence has no more than 3 subsequent behaviors in the behavior knowledge graph query of 2-gram, and the highest weight of its subsequent behaviors is greater than 0.9, then an n+1 predicted virtual behavior sequence is generated. For example, when n=4, the behavior sequence is abcd. The optimal path for ab, bc, and cd is searched in the behavior knowledge graph to obtain their weight values, and these values ​​are added together and assigned to X. When X>3*99.7%, the subsequent behaviors of d are searched in the knowledge graph. Assuming that the subsequent behaviors of d include e, f, and g, where de has a weight of 0.02, df has a weight of 0.01, and dg has a weight of 0.97, then a virtual predicted behavior sequence of abcdg is generated.

[0055] Furthermore, step (6) includes the following steps:

[0056] (a) In the step of removing non-abnormal results, all historical training samples are sorted and statistically analyzed, and the top 3% of the data with the most behaviors, which are more than 15 times the average number of behaviors of the remaining 97% of the data, are recorded as the reference system for removing non-abnormal results.

[0057] (b) When an abnormal behavior deviates from the baseline of the behavior time distribution occurs, if the abnormal behavior can be matched in the above reference system, it shall be discarded as a non-abnormal result.

[0058] (c) When an abnormal behavior sequence deviates from the behavior sequence distribution baseline, if 80% of the behaviors in the abnormal behavior sequence can be matched in the above reference system, it is discarded as a non-abnormal result.

[0059] (d) For the relevant data after the above steps have been completed, generate relevant alarm information based on the initiator of the behavior, the time of the behavior, the location of the behavior, and the object of the behavior operation in the alarm field;

[0060] (e) The system generates a behavior trajectory chart in chronological order based on all the behaviors of each individual, and can use "same time of occurrence", "same initiator of behavior", "same location of behavior" and "same target of behavior" as filtering conditions for managers to conduct correlation analysis.

[0061] (f) The system provides a playbook orchestration mechanism for linkage control, which can be used to call a third-party system to perform control actions when an abnormal situation is detected.

[0062] The advantages of this invention compared to existing technologies are as follows: By applying big data and artificial intelligence technologies, this invention automatically extracts IT management operational behaviors, intelligently distinguishes different groups based on their operational behavior characteristics, and establishes a dynamic behavioral baseline model to identify abnormal behaviors. This invention can automatically extract operational behaviors without requiring keyword configuration and achieves comprehensive, blind-spot-free management coverage. Compared to existing technologies, it significantly reduces the technical requirements for managers and management time costs while greatly improving management coverage and effectiveness. Furthermore, based on artificial intelligence technology, it can predict behavior and anticipate potential future abnormal behavioral risks.

[0063] The advantages of using the technical solution of the present invention are as follows:

[0064] 1. In terms of the coverage of behavioral supervision, the coverage has been improved from the original sampling method that could only be carried out by configuring keywords (with a very low coverage rate of less than 10%) to 100% coverage.

[0065] 2. It helps users completely get rid of the work related to keyword configuration and post-aging maintenance, greatly improving the efficiency of real-time auditing and post-audit.

[0066] 3. In terms of management efficiency, the self-iterative algorithm training process based on big data and artificial intelligence technologies is entirely based on unsupervised execution, which greatly improves management efficiency. Attached Figure Description

[0067] Figure 1 This is a flowchart illustrating an anomaly identification device based on big data and artificial intelligence according to the present invention. Detailed Implementation

[0068] The present invention will now be described in further detail with reference to the accompanying drawings.

[0069] The present invention will be described in detail with reference to the accompanying drawings.

[0070] In its specific implementation, this invention provides an anomaly detection device based on big data and artificial intelligence, comprising the following stages:

[0071] (1) Behavior extraction stage: In this stage, the IT management operation behavior is extracted from the raw information and provided for subsequent baseline generation and anomaly detection;

[0072] (2) User segmentation stage: In this stage, the deduplication and clustering of behavioral data are completed, and user groups are segmented according to the distribution of behavioral characteristics.

[0073] (3) Baseline generation phase: This phase calculates behavioral baselines within each group, including behavioral time distribution baselines and behavioral sequence baselines;

[0074] (4) Real-time anomaly detection stage: This stage will detect anomalies in the behavioral data entering the system in real time based on the behavioral time distribution baseline and the behavioral sequence baseline.

[0075] (5) Abnormal behavior prediction stage. There are two prediction methods in this stage: one is a prediction method based on the back learning of confirmed abnormal behavior, and the other is a risk prediction method based on historical behavior patterns.

[0076] (6) Abnormal result processing stage: This stage is mainly responsible for eliminating non-abnormal results, generating behavior trajectories, and triggering alarms and linkage control actions.

[0077] The specific embodiments of the present invention are as follows:

[0078] Example 1

[0079] A bank's internal **system is a platform for operations and maintenance personnel to manage maintenance strategies. During the ** period, 15,000 user behaviors occurred. There was no regulatory system to manage these behaviors within the system, which is a management blind spot.

[0080] In this system, behaviors were extracted based on behavioral loads and merged into 11 categories. The 503 people involved in the system were clustered into 5 groups: 478, 1, 9, 14, and 1 (the group with 1 person was identified because the individual's behavior pattern was extremely unique and the outlier effect was obvious; this individual was confirmed to be a maintenance specialist). Based on the above data, the AI ​​model automatically established 5533 anomaly detection points. 72 anomaly detection points detected anomalies, identifying 42 abnormal behaviors involving 26 people.

[0081] Specific risks include:

[0082] ***peifei, key characteristics: login failure, frequency of the behavior within a week exceeded the baseline value of 3.0, the actual value was 62, which may indicate account compromise or account misuse risk.

[0083] **gen, keyword characteristic: logout, the frequency of this behavior within a week is significantly lower than the baseline value of 12.0, with an actual value of 1.2, which may indicate a risk of unauthorized system logout.

[0084] ****jian, *****jingze, ***xueqing, etc., key characteristics: policy modification, frequency exceeding the baseline value of 0 between 2:00 and 3:00 on *month* *day*, actual value of 4, possibly indicating abnormal operational behavior.

[0085] ****teng, key characteristic: login, the frequency of occurrence between 0:00 and 1:00 on *month*day exceeds the baseline value of 0, the actual value is 3, which may indicate abnormal operation behavior.

[0086] Example 2

[0087] Traditional email security detection products can only detect risks based on keywords and can only answer yes / no questions.

[0088] A bank generated 102,000 emails within a specific timeframe, involving 3,816 individuals and 638 departments. Over 600 emails were denied due to keyword issues in a traditional email keyword detection system.

[0089] In this system, NLP technology is applied to extract behaviors and segment users based on email subject, attachment name, and attachment content. Users are automatically divided into **groups. For example, *****557** from the Small and Micro Business Department of **Branch *Pingli Branch** and *****736** from the Personal Finance Department of **Branch *Shengmen Branch** are grouped into the same user group due to similar behavioral patterns. The extracted user profile keywords are: credit, litigation, *****

[0090] Based on the above data, the AI ​​model automatically established 110,664 anomaly detection points. After excluding the original email security system from being denied, during the anomaly detection process, 309 anomalies were detected, with 89 abnormal behaviors found, involving 62 people.

[0091] Specific risks include:

[0092] *****139**, Key characteristics: Credit Cards, ***, ***. The frequency of this behavior in June exceeded the baseline value of 2.0, with an actual value of 20, indicating a potential risk of slow leakage of sensitive information.

[0093] *****157**, Key characteristics: job title, salary, ***, ***, frequency of the behavior in June exceeded the baseline value of 3.0, with an actual value of 27. Manual inspection revealed that all recipient addresses were external addresses, which may indicate a risk of providing information to headhunters.

[0094] Its inventive points are as follows:

[0095] 1. No need to configure behavior monitoring keywords at all.

[0096] 2. Different groups are distinguished based on the behavioral characteristics of different personnel / systems, and a behavioral baseline is automatically established for each group;

[0097] 3. Based on big data and artificial intelligence technologies, establish baselines for behavioral temporal distribution and behavioral sequence distribution;

[0098] 4. Predict potential future behavioral risks;

[0099] 5. A comprehensive abnormal result rejection mechanism ensures an ultra-low false alarm rate.

[0100] Examples are as follows: Example 1:

[0101] A bank's web access gateway controls access to its internal service systems from internet institutions / merchants. It can control access from external domains / IPs to specified URL paths on internal system domains / IPs. The system supports manually created automated scenario control policies to block or force re-authentication when a certain number of access attempts are reached. However, this involves 51 systems, over 5000 access paths, and over 500,000 actual access records daily.

[0102] The original approach involved 6 people over 3 years to develop 5,000 detection strategies based solely on keywords, which could not support behavior detection in complex scenarios.

[0103] Using this system: 2 people, 6 months, established 255,000+ dynamic anomaly detection strategies, supporting behavior detection in complex scenarios including new behavior, sudden increase in behavior, sudden decrease in behavior, and abnormal behavior sequences.

[0104] Example 2:

[0105] A bank's internal operations and maintenance dispatch center conducts quarterly spot checks on the compliance of work order operations and generates a compliance analysis report. Because this is entirely manual, requiring visual comparison of change processes in work orders and command records from the bastion host, it consumes more than 1.5-2 person-months each quarter and only covers about one-third of the operations.

[0106] Existing method: 2 people, 2 people's monthly audit workload, covering 1 / 3 of the behavioral audit work.

[0107] Using this system: 1 person, 1 person per week, covering 100% of behavioral audit work.

[0108] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. An anomaly detection device based on big data and artificial intelligence, characterized in that: Includes the following stages, (1) Behavior extraction stage: In this stage, the IT management operation behavior is extracted from the raw information and provided for subsequent baseline generation and anomaly detection; (2) User segmentation stage: In this stage, the deduplication and clustering of behavioral data are completed, and user groups are segmented according to the distribution of behavioral characteristics. (3) Baseline generation phase: This phase calculates behavioral baselines within each group, including behavioral time distribution baselines and behavioral sequence baselines; (4) Real-time anomaly detection stage: This stage will detect anomalies in the behavioral data entering the system in real time based on the behavioral time distribution baseline and the behavioral sequence baseline. (5) Abnormal behavior prediction stage. There are two prediction methods in this stage: one is a prediction method based on back learning of confirmed abnormal behavior, and the other is a risk prediction method based on historical behavior patterns. (6) Abnormal result processing stage: This stage is responsible for eliminating non-abnormal results, generating behavior trajectories, and triggering alarms and linkage control actions.

2. The anomaly detection device based on big data and artificial intelligence according to claim 1, characterized in that: The behavior extraction phase includes the following steps: (a) Digital traceability information of IT management operations is located in the operation log and operation record database. The relevant digital traceability information includes a five-tuple of information: operation initiator, operation event, operation behavior, operation location, and operation object. (b) Obtain relevant digital traceability information into the software system through data interface connection; (c) Extract the quintuple information from the digital trace information and store it in the system.

3. The anomaly detection device based on big data and artificial intelligence according to claim 1, characterized in that: The user segmentation phase includes the following steps: (a) Use data from the past six months at the current point in time as the basis for clustering; (b) Statistically calculate the frequency of each behavior in each user's time period throughout history; (c) Based on the frequency values ​​mentioned above, clustering calculations are performed and the Euclidean distance relationship between the clustering results is determined. Multiple iterations are performed, and the iteration ends when the average Euclidean distance between all results is the farthest. At this point, the behavioral characteristics of each user group are most significantly separated, and user grouping is completed. (d) The system automatically performs cluster calculations every month.

4. The anomaly detection device based on big data and artificial intelligence according to claim 1, characterized in that: The baseline generation phase includes the following steps: (a) The numerical distribution of the frequency of operations for each behavior of each group within each time period; (b) Fit the data for each behavior to a normal distribution; (c) The system automatically selects the upper and lower bounds of the confidence interval based on the 3 sigma principle; (d) Dynamically generate behavior steep increase factor and behavior steep decrease factor based on the probability density of behavior distribution; (e) A dynamic tolerance interval is automatically generated based on the number of behavior frequency baselines, thus completing the behavior time distribution baseline; (f) The sequential order of behavioral feature sequences follows the Markov property; (g) Perform 2-gram segmentation on the behavior sequences in the training data to obtain behavior pairs, and perform statistical analysis on the behavior pairs. and Arrange in reverse order, and calculate the weights of the behavior pairs based on the statistical results; (h) Generate a behavior knowledge graph based on behavior pair relationships and weights, representing the relationships and sequence probabilities between all behaviors; (I) Divide the training data into sliding behavior sequences, compare them with the behavior knowledge graph, and calculate the total sequence weight of all sequences; (j) Automatically select the upper and lower bounds of the confidence interval based on the 3sigma principle; (k) The behavioral sequence baseline is now complete; (L) The system will automatically perform this baseline generation phase every week.

5. The anomaly detection device based on big data and artificial intelligence according to claim 1, characterized in that: The real-time anomaly detection phase includes the following steps: (a) The system performs baseline comparison detection in real time at each time window, depending on the different behavioral data period settings. (b) The system will detect the following anomalies: a) New behavior type: When a behavior has never appeared in the group's historical behavior, it is considered a new behavior type; b) The total number of group behaviors increases or decreases suddenly within a unit of time. The total number of behaviors of a certain group within a unit of time exceeds three times the average total number of behaviors within that unit of time in the historical training samples. c) Sudden increase / decrease in the frequency of individual behaviors compared to the baseline value of the behavior time distribution: In a certain group, the number of behaviors of a certain behavior in a unit of time exceeds the 3 sigma region of the baseline generated by the frequency of that behavior in the historical training samples. d) Individual behavioral sequences deviate from the baseline of behavioral sequences. In a certain group, the comprehensive weight value of a behavioral sequence greater than 4 is less than the threshold of the comprehensive weight generated based on the 3sigma principle.

6. The anomaly detection device based on big data and artificial intelligence according to claim 1, characterized in that: The abnormal behavior The prediction phase includes the following steps and methods: (a) The system will save all result data that is identified as abnormal and confirmed as abnormal by manual verification as prediction reference data; (b) When an actual behavior sequence greater than 4 occurs, it will be automatically imported into the reference system for matching. When the comprehensive weight value of the actual behavior sequence matched in the reference system is extremely close to the theoretical maximum weight value, the actual behavior sequence is determined to be an abnormal risk behavior. (c) The specific determination formula is that when the actual behavior sequence is n, there are n-1 2-gram weight values ​​that are calculated together, that is, the theoretical maximum weight value is n-1; in the reference system data, each confirmed actual behavior sequence of 2-gram will be weighted according to the number of its 2-gram branches, that is, the total weight of the subsequent actual behavior sequences of each actual behavior sequence is added together to 1. (d) The above are prediction methods based on back learning of confirmed abnormal behavior; (e) The risk prediction method based on historical behavior patterns is divided into two parts: the first part predicts future behavior based on the actual behavior sequence and the behavior knowledge graph obtained in the baseline generation stage, and generates virtual behavior sequences; The second part imports the virtual behavior sequence into the real-time anomaly detection stage for risk prediction and detection. (f) In the first part, when the system obtains an actual behavior sequence greater than 4, and the length of the actual behavior sequence is m, the actual behavior sequence is matched with the behavior knowledge graph to calculate a comprehensive weight. If the comprehensive weight of the actual behavior sequence is greater than 99.7% of the theoretical maximum weight of m-1, and the last behavior of the actual behavior sequence has no more than 3 subsequent behaviors in the behavior knowledge graph query 2-gram, and the highest weight of its subsequent behaviors is greater than 0.9, then an m+1 sequence is generated. virtual Behavioral sequence.

7. The anomaly detection device based on big data and artificial intelligence according to claim 1, characterized in that: The abnormal result handling stage includes the following steps: (a) In the step of removing non-abnormal results, all historical training samples are sorted and statistically analyzed, and the top 3% of the data with the most behaviors, which are more than 15 times the average number of behaviors of the remaining 97% of the data, are used as the reference system for removing non-abnormal results. (b) When an abnormal behavior deviates from the baseline of the behavior time distribution occurs, if the abnormal behavior can be matched in the above reference system, it shall be discarded as a non-abnormal result. (c) When an abnormal behavior sequence deviates from the behavior sequence distribution baseline, if 80% of the behaviors in the abnormal behavior sequence can be matched in the above reference system, it is discarded as a non-abnormal result. (d) For the relevant data after the above steps have been completed, generate relevant alarm information based on the initiator of the behavior, the time of the behavior, the location of the behavior, and the object of the behavior operation in the alarm field; (e) The system generates a behavior trajectory chart in chronological order based on all the behaviors of each individual, and can use "same time of occurrence", "same initiator of behavior", "same location of behavior" and "same target of behavior" as filtering conditions for managers to conduct correlation analysis; (f) The system provides a playbook orchestration mechanism for linkage control, which can be used to call a third-party system to perform control actions when an abnormal situation is detected.

Images