Convolutional recurrent based behavior pattern recognition method and system

Abstract

The application provides a behavior pattern recognition method and system based on convolution cycles, which combines the use of a convolution neural network and a recurrent gate network, extracts signal features in the hidden layer of the convolution neural network, maps to a four-element structure, obtains a four-element variable feature map, matches an error sample set of the four-element variable feature map, and filters out useless features, so that the user behavior is better classified, a new angle is supplemented, and the problem that the prior art only detects in a single dimension of time or space is overcome.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a behavior pattern recognition method and system based on convolutional loops. Background Technology

[0002] Traditional pattern recognition methods fail to perform well in scenarios with high subjectivity and low discriminative power. Existing solutions involve introducing convolutional neural networks (CNNs) to leverage their feature learning capabilities, considering behavioral pattern recognition from temporal or spatial perspectives. However, this approach is generally ineffective, necessitating the introduction of new, complementary approaches.

[0003] Therefore, there is an urgent need for a targeted behavior pattern recognition method and system based on convolutional loops. Summary of the Invention

[0004] The purpose of this invention is to provide a behavior pattern recognition method and system based on convolutional recurrent networks. By combining convolutional neural networks and recurrent gating networks, it can better classify user behavior and add a new perspective to the existing single dimension of time or space.

[0005] In a first aspect, this application provides a behavior pattern recognition method based on convolutional loops, the method comprising:

[0006] Receive an access request sent by a user terminal, collect the data signal in the access request, and input the data signal into the hidden layer of a convolutional neural network;

[0007] The convolutional layer of the hidden layer extracts the features of the data signal and maps the features to a four-element structure, that is, decomposes the feature into one real part and three imaginary parts to complete the initial moment variableization. The one real part corresponds to the feature vector value, and the three imaginary parts correspond to the three channel values, thus obtaining the four-element variable feature map.

[0008] The quaternary variable feature map is passed to the pooling layer of the hidden layer. The feature vector of the data signal is extracted in a polar coordinate symmetric manner and sent to the error sample set for matching. The matching is to perform a conjugate operation between each feature vector and the vector in the error sample set, and determine whether the operation result is higher than a threshold. If it is, it is identified as an error and the feature vector is filtered out by the pooling layer. Otherwise, it is identified as normal and the feature vector is retained.

[0009] The first feature vector output by the pooling layer is passed to the fully connected layer of the hidden layer. The fully connected layer also receives the second feature vector passed from other neighboring fully connected layers. The correlation between the first feature vector and the second feature vector is calculated. If the correlation calculation result is lower than a preset threshold, the first feature vector is sent into the recurrent gating network.

[0010] The cyclic gating network calls the historical state information of the server, adds the historical state information to the first feature vector, and then sends it to the first input of the reset gate unit and the update gate unit of the cyclic gating network. The reset gate unit calculates the candidate state, and the candidate state is sent to the second input of the update gate unit. The update gate unit then calculates the current state.

[0011] Based on the current state, the user behavior model analyzes whether the user terminal's behavior conforms to the range of actions supported by the access object, counts the frequency of the behavior, and determines whether it contains user behavior with an aggressive tendency.

[0012] Secondly, this application provides a behavior pattern recognition system based on convolutional loops, the system comprising:

[0013] The acquisition unit is used to receive access requests sent by user terminals, acquire data signals from the access requests, and input the data signals into the hidden layers of the convolutional neural network.

[0014] The neural network unit is used to extract features of the data signal using the convolutional layer of the hidden layer, and map the features to a four-element structure, that is, to decompose the features into one real part and three imaginary parts, to complete the initial moment decomposition. The one real part corresponds to the feature vector value, and the three imaginary parts correspond to the three channel values, thus obtaining a four-element variable feature map.

[0015] The quaternary variable feature map is passed to the pooling layer of the hidden layer. The feature vector of the data signal is extracted in a polar coordinate symmetric manner and sent to the error sample set for matching. The matching is to perform a conjugate operation between each feature vector and the vector in the error sample set, and determine whether the operation result is higher than a threshold. If it is, it is identified as an error and the feature vector is filtered out by the pooling layer. Otherwise, it is identified as normal and the feature vector is retained.

[0016] The first feature vector output by the pooling layer is passed to the fully connected layer of the hidden layer. The fully connected layer also receives the second feature vector passed from other neighboring fully connected layers. The correlation between the first feature vector and the second feature vector is calculated. If the correlation calculation result is lower than a preset threshold, the first feature vector is sent into the recurrent gating network.

[0017] The cyclic gating network unit is used to call the historical state information of the server, add the historical state information to the first feature vector, and then send the data to the first input of the reset gate unit and the update gate unit of the cyclic gating network. The reset gate unit calculates the candidate state, and the candidate state is sent to the second input of the update gate unit. The update gate unit then calculates the current state.

[0018] The user behavior model is used to analyze whether the behavior of the user terminal conforms to the range of actions supported by the access object based on the current state, count the frequency of the behavior, and determine whether it contains user behavior with an aggressive tendency.

[0019] Thirdly, this application provides a behavior pattern recognition system based on convolutional loops, the system comprising a processor and a memory:

[0020] The memory is used to store program code and transmit the program code to the processor;

[0021] The processor is configured to execute any one of the four possible methods of the first aspect according to the instructions in the program code.

[0022] Fourthly, this application provides a computer-readable storage medium for storing program code for performing any one of the four possible methods of the first aspect.

[0023] Beneficial effects

[0024] This invention provides a behavior pattern recognition method and system based on convolutional recurrent networks. By combining convolutional neural networks and recurrent gated networks, signal features are extracted from the hidden layers of the convolutional neural network and mapped to a four-element structure to obtain a four-element variable feature map. The error sample set of the four-element variable feature map is matched to filter out useless features, thereby better classifying user behavior and providing a new perspective. This overcomes the problem that existing technologies only detect in a single dimension of time or space. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0026] Figure 1 This is a general flowchart of the behavior pattern recognition method based on convolutional loops of the present invention;

[0027] Figure 2 This is an architecture diagram of the behavior pattern recognition system based on convolutional loops according to the present invention. Detailed Implementation

[0028] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby providing a clearer and more explicit definition of the scope of protection of the present invention.

[0029] Figure 1A general flowchart of the behavior pattern recognition method based on convolutional recurrent loops provided in this application, the method comprising:

[0030] Receive an access request sent by a user terminal, collect the data signal in the access request, and input the data signal into the hidden layer of a convolutional neural network;

[0031] The convolutional layer of the hidden layer extracts the features of the data signal and maps the features to a four-element structure, that is, decomposes the feature into one real part and three imaginary parts to complete the initial moment variableization. The one real part corresponds to the feature vector value, and the three imaginary parts correspond to the three channel values, thus obtaining the four-element variable feature map.

[0032] The quaternary variable feature map is passed to the pooling layer of the hidden layer. The feature vector of the data signal is extracted in a polar coordinate symmetric manner and sent to the error sample set for matching. The matching is to perform a conjugate operation between each feature vector and the vector in the error sample set, and determine whether the operation result is higher than a threshold. If it is, it is identified as an error and the feature vector is filtered out by the pooling layer. Otherwise, it is identified as normal and the feature vector is retained.

[0033] The first feature vector output by the pooling layer is passed to the fully connected layer of the hidden layer. The fully connected layer also receives the second feature vector passed from other neighboring fully connected layers. The correlation between the first feature vector and the second feature vector is calculated. If the correlation calculation result is lower than a preset threshold, the first feature vector is sent into the recurrent gating network.

[0034] The cyclic gating network calls the historical state information of the server, adds the historical state information to the first feature vector, and then sends it to the first input of the reset gate unit and the update gate unit of the cyclic gating network. The reset gate unit calculates the candidate state, and the candidate state is sent to the second input of the update gate unit. The update gate unit then calculates the current state.

[0035] Based on the current state, the user behavior model analyzes whether the user terminal's behavior conforms to the range of actions supported by the access object, counts the frequency of the behavior, and determines whether it contains user behavior with an aggressive tendency.

[0036] In some preferred embodiments, the method further includes analyzing the strength of the user's behavior and determining the urgency of the behavior based on the strength of the behavior.

[0037] The strength of user behavior is determined by the frequency of its occurrence. When the frequency falls within a specified range, it is considered normal. The closer the frequency is to the specified range (higher frequency band), the stronger the perceived behavior and the more urgent the user's need; conversely, the closer the frequency is to the specified range (lower frequency band), the weaker the perceived behavior and the less urgent the user's need. If the frequency of a behavior exceeds the maximum value within the specified range, the behavior is considered suspicious.

[0038] In some preferred embodiments, a blocking policy is implemented for user behaviors that contain aggressive tendencies, and this blocking policy is issued by the server to the user terminal.

[0039] The server can also distribute the policy to intermediate devices, such as a gateway.

[0040] In some preferred embodiments, the user behavior model uses a neural network model.

[0041] Figure 2 This application provides an architecture diagram of a behavior pattern recognition system based on convolutional recurrent loops. The system includes:

[0042] The acquisition unit is used to receive access requests sent by user terminals, acquire data signals from the access requests, and input the data signals into the hidden layers of the convolutional neural network.

[0043] The neural network unit is used to extract features of the data signal using the convolutional layer of the hidden layer, and map the features to a four-element structure, that is, to decompose the features into one real part and three imaginary parts, to complete the initial moment decomposition. The one real part corresponds to the feature vector value, and the three imaginary parts correspond to the three channel values, thus obtaining a four-element variable feature map.

[0044] The quaternary variable feature map is passed to the pooling layer of the hidden layer. The feature vector of the data signal is extracted in a polar coordinate symmetric manner and sent to the error sample set for matching. The matching is to perform a conjugate operation between each feature vector and the vector in the error sample set, and determine whether the operation result is higher than a threshold. If it is, it is identified as an error and the feature vector is filtered out by the pooling layer. Otherwise, it is identified as normal and the feature vector is retained.

[0045] The first feature vector output by the pooling layer is passed to the fully connected layer of the hidden layer. The fully connected layer also receives the second feature vector passed from other neighboring fully connected layers. The correlation between the first feature vector and the second feature vector is calculated. If the correlation calculation result is lower than a preset threshold, the first feature vector is sent into the recurrent gating network.

[0046] The cyclic gating network unit is used to call the historical state information of the server, add the historical state information to the first feature vector, and then send the data to the first input of the reset gate unit and the update gate unit of the cyclic gating network. The reset gate unit calculates the candidate state, and the candidate state is sent to the second input of the update gate unit. The update gate unit then calculates the current state.

[0047] The user behavior model is used to analyze whether the behavior of the user terminal conforms to the range of actions supported by the access object based on the current state, count the frequency of the behavior, and determine whether it contains user behavior with an aggressive tendency.

[0048] This application provides a behavior pattern recognition system based on convolutional loops, the system comprising: a processor and a memory.

[0049] The memory is used to store program code and transmit the program code to the processor;

[0050] The processor is configured to execute the method described in any one of the embodiments of the first aspect according to the instructions in the program code.

[0051] This application provides a computer-readable storage medium for storing program code for performing the method described in any one of the embodiments of the first aspect.

[0052] In a specific implementation, the present invention also provides a computer storage medium, wherein the computer storage medium may store a program, and the program, when executed, may include some or all of the steps in the various embodiments of the present invention. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM), etc.

[0053] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0054] The same or similar parts between the various embodiments in this specification can be referred to mutually. In particular, the embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0055] The embodiments of the present invention described above do not constitute a limitation on the scope of protection of the present invention.

Claims

1. A behavior pattern recognition method based on convolutional loops, characterized in that, The method includes: Receive an access request sent by a user terminal, collect the data signal in the access request, and input the data signal into the hidden layer of a convolutional neural network; The convolutional layer of the hidden layer extracts the features of the data signal and maps the features to a four-element structure, that is, decomposes the feature into one real part and three imaginary parts to complete the initial moment variableization. The one real part corresponds to the feature vector value, and the three imaginary parts correspond to the three channel values, thus obtaining the four-element variable feature map. The quaternary variable feature map is passed to the pooling layer of the hidden layer. The feature vector of the data signal is extracted in a polar coordinate symmetric manner and sent to the error sample set for matching. The matching is to perform a conjugate operation between each feature vector and the vector in the error sample set, and determine whether the operation result is higher than a threshold. If it is, it is identified as an error and the feature vector is filtered out by the pooling layer. Otherwise, it is identified as normal and the feature vector is retained. The first feature vector output by the pooling layer is passed to the fully connected layer of the hidden layer. The fully connected layer also receives the second feature vector passed from other neighboring fully connected layers. The correlation between the first feature vector and the second feature vector is calculated. If the correlation calculation result is lower than a preset threshold, the first feature vector is sent into the recurrent gating network. The cyclic gating network calls the historical state information of the server, adds the historical state information to the first feature vector, and then sends it to the first input of the reset gate unit and the update gate unit of the cyclic gating network. The reset gate unit calculates the candidate state, and the candidate state is sent to the second input of the update gate unit. The update gate unit then calculates the current state. Based on the current state, the user behavior model analyzes whether the user terminal's behavior conforms to the range of actions supported by the access object, counts the frequency of the behavior, and determines whether it contains user behavior with an aggressive tendency.

2. The method according to claim 1, characterized in that: It also includes further analysis of the strength of user behavior, and judging the urgency of user behavior based on the strength of the behavior.

3. The method according to claim 1, characterized in that: A blocking policy is implemented for user behaviors that indicate an aggressive intent. This blocking policy is sent from the server to the user's terminal.

4. The method according to any one of claims 2 or 3, characterized in that: The user behavior model uses a neural network model.

5. A behavior pattern recognition system based on convolutional loops, characterized in that, The system includes: The acquisition unit is used to receive access requests sent by user terminals, acquire data signals from the access requests, and input the data signals into the hidden layers of the convolutional neural network. The neural network unit is used to extract features of the data signal using the convolutional layer of the hidden layer, and map the features to a four-element structure, that is, to decompose the features into one real part and three imaginary parts, to complete the initial moment decomposition. The one real part corresponds to the feature vector value, and the three imaginary parts correspond to the three channel values, thus obtaining a four-element variable feature map. The quaternary variable feature map is passed to the pooling layer of the hidden layer. The feature vector of the data signal is extracted in a polar coordinate symmetric manner and sent to the error sample set for matching. The matching is to perform a conjugate operation between each feature vector and the vector in the error sample set, and determine whether the operation result is higher than a threshold. If it is, it is identified as an error and the feature vector is filtered out by the pooling layer. Otherwise, it is identified as normal and the feature vector is retained. The first feature vector output by the pooling layer is passed to the fully connected layer of the hidden layer. The fully connected layer also receives the second feature vector passed from other neighboring fully connected layers. The correlation between the first feature vector and the second feature vector is calculated. If the correlation calculation result is lower than a preset threshold, the first feature vector is sent into the recurrent gating network. The cyclic gating network unit is used to call the historical state information of the server, add the historical state information to the first feature vector, and then send the data to the first input of the reset gate unit and the update gate unit of the cyclic gating network. The reset gate unit calculates the candidate state, and the candidate state is sent to the second input of the update gate unit. The update gate unit then calculates the current state. The user behavior model is used to analyze whether the behavior of the user terminal conforms to the range of actions supported by the access object based on the current state, count the frequency of the behavior, and determine whether it contains user behavior with an aggressive tendency.

6. A behavior pattern recognition system based on convolutional loops, characterized in that, The system includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute instructions in the program code to implement the method according to any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code for performing the method according to any one of claims 1-4.

Images