A behavior detection method, apparatus, device, and medium

Abstract

Embodiments of the present application provide a behavior detection method, device, equipment and medium, the method comprising: obtaining target account corresponding to the behavior data to be detected; obtaining target account corresponding to the historical behavior data; determining the target data type to which the behavior data to be detected and / or the historical behavior data belong; if the target data type is a continuous numerical type, using a clustering algorithm to cluster the behavior data to be detected and the historical behavior data, obtaining at least one clustering cluster, and determining whether the current behavior of the target account is a very used behavior according to the association relationship between the behavior data to be detected and the at least one clustering cluster; if the target data type is a discrete string type, determining whether the current behavior of the target account is a very used behavior according to the matching relationship between the behavior data to be detected and the historical behavior data. By using the embodiments of the present application, the misjudgment rate of very used behavior detection can be reduced, and the accuracy of the detection result can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a behavior detection method, apparatus, device, and medium. Background Technology

[0002] With the development of information technology, people's reliance on electronic devices is increasing. However, due to the complexity of information systems and the widespread accessibility of networks, users face many security threats when using electronic devices. For example, user accounts may be maliciously logged into. Therefore, detection methods such as uncommon behavior detection can be adopted to ensure information security. Uncommon behavior detection includes multi-dimensional detection, such as uncommon location detection, uncommon time detection, and uncommon device detection. Through uncommon behavior detection, it is possible to identify whether users have performed related operations in uncommon locations, uncommon times, or uncommon devices in different application scenarios, thereby promptly discovering potential security risks (such as the potential theft of user account information).

[0003] Existing methods for detecting uncommon behaviors typically determine whether a user's current behavior is uncommon by matching data. For example, if the current device used differs from a historically frequently used device, the current behavior is considered uncommon. This method is relatively simple and prone to false positives. For instance, if a user logs into their application account multiple times at time M within a month, and the current user logs in at time N (very close to time M), it will be judged as logging in at an uncommon time, resulting in a false positive and low accuracy. Summary of the Invention

[0004] This application provides a behavior detection method, apparatus, device, and medium, which can reduce the false positive rate of uncommon behavior detection and improve the accuracy of detection results.

[0005] This application provides a behavior detection method, including:

[0006] Obtain the target account's behavior data to be detected, which represents the target account's current behavior characteristics;

[0007] Obtain historical behavior data corresponding to the target account, wherein the historical behavior data is used to represent the historical behavior characteristics of the target account;

[0008] Determine the target data type to which the behavior data to be detected and / or the historical behavior data belong, wherein the target data type is a continuous numeric type or a discrete string type, and the data type to which the behavior data to be detected belongs is the same as the data type to which the historical behavior data belongs;

[0009] If the target data type is a continuous numerical type, a clustering algorithm is used to cluster the behavior data to be detected and the historical behavior data to obtain at least one cluster. Based on the association between the behavior data to be detected and the at least one cluster, it is determined whether the current behavior of the target account is an uncommon behavior.

[0010] If the target data type is a discrete string type, the current behavior of the target account is determined to be an uncommon behavior based on the matching relationship between the behavior data to be detected and the historical behavior data.

[0011] The step of obtaining the historical behavior data corresponding to the target account includes:

[0012] Based on the behavior data to be detected, historical behavior data corresponding to the target account is obtained, wherein the category of the current behavior feature represented by the behavior data to be detected is the same as the category of the historical behavior feature represented by the historical behavior data.

[0013] The step of determining whether the current behavior of the target account is an uncommon behavior based on the association between the behavior data to be detected and the at least one cluster includes:

[0014] If the behavior data to be detected is included in one of the at least one clustering clusters, it is determined that the current behavior of the target account is a common behavior;

[0015] If the behavior data to be detected is not in any of the at least one cluster, the current behavior of the target account is determined to be an uncommon behavior.

[0016] The detected behavior data includes the current operation time corresponding to the target account, the historical behavior data includes at least one historical operation time corresponding to the target account, and the target data type is a continuous numerical type.

[0017] Before clustering the target behavior data and the historical behavior data using a clustering algorithm, the method further includes:

[0018] The number of historical operation times included in the historical behavior data is determined to be greater than a first threshold.

[0019] The historical behavior data is preprocessed to obtain preprocessed historical behavior data, wherein the number of historical operation times contained in the preprocessed historical behavior data is less than the number of historical operation times contained in the historical behavior data before preprocessing.

[0020] The step of clustering the target behavior data and the historical behavior data using a clustering algorithm includes:

[0021] Clustering algorithms are used to cluster the behavior data to be detected and the preprocessed historical behavior data.

[0022] The step of preprocessing the historical behavior data to obtain preprocessed historical behavior data includes:

[0023] The at least one historical operation time is statistically analyzed to obtain a first frequency corresponding to each statistical time point in the at least one statistical time point. The first frequency is used to represent the number of times the historical operation time associated with the statistical time point occurs in the at least one historical operation time.

[0024] According to the preset reduction ratio, the first frequency corresponding to each statistical time point is reduced to obtain the second frequency corresponding to each statistical time point;

[0025] Based on the second frequency corresponding to each statistical time point, at least one updated historical operation time associated with the statistical time point is obtained, and the number of updated historical operation times associated with the statistical time point is equal to the second frequency.

[0026] The at least one updated historical operation time associated with each statistical time point in the at least one statistical time point is determined as the preprocessed historical behavior data.

[0027] The data to be detected includes the current operation time corresponding to the target account, and the historical behavior data includes at least one historical operation time corresponding to the target account. Before clustering the data to be detected and the historical behavior data using a clustering algorithm, the method further includes:

[0028] For each historical operation time in the at least one historical operation time, according to the time offset corresponding to the time interval to which each historical operation time belongs, the historical operation time is offset to obtain at least one offset historical operation time.

[0029] Based on the time offset corresponding to the time interval to which the current operation time belongs, the current operation time is offset to obtain the offset current operation time;

[0030] The step of clustering the target behavior data and the historical behavior data using a clustering algorithm includes:

[0031] A clustering algorithm is used to cluster the historical operation time after the at least one offset and the current operation time after the offset.

[0032] The detected behavior data includes a first string corresponding to the target account, and the historical behavior data includes at least one second string corresponding to the target account. The first string is used to identify the current geographical location or current operating device of the target account, and the second string is used to identify the historical geographical location or historical operating device of the target account. The target data type is a discrete string type.

[0033] Before determining whether the current behavior of the target account is an infrequent behavior based on the matching relationship between the behavior data to be detected and the historical behavior data, the method further includes:

[0034] Determine at least one string type contained in the at least one second string, and count the third frequency corresponding to each string type in the at least one string type, wherein the third frequency is used to represent the number of times the string type appears in the at least one second string;

[0035] From the at least one string type, determine the K string types with the highest third frequency, where K is a preset integer;

[0036] Based on the K string types, a common list is determined, which includes M target strings, where M is an integer less than or equal to K. The target strings satisfy one or both of the following conditions: the third frequency of the target string is greater than the second threshold; the ratio between the third frequency of the target string and the total number of strings of the at least one second string is greater than the third threshold.

[0037] The step of determining whether the current behavior of the target account is an infrequent behavior based on the matching relationship between the behavior data to be detected and the historical behavior data includes:

[0038] Match the first string with the M target strings;

[0039] If there is a string among the M target strings that matches the first string, then it is determined that the current behavior of the target account is a common behavior;

[0040] If none of the M target strings matches the first string, then the current behavior of the target account is determined to be an unusual behavior.

[0041] One embodiment of this application provides a behavior detection device, including:

[0042] The first acquisition unit is used to acquire the behavior data to be detected corresponding to the target account, wherein the behavior data to be detected is used to represent the current behavior characteristics of the target account;

[0043] The second acquisition unit is used to acquire historical behavior data corresponding to the target account, wherein the historical behavior data is used to represent the historical behavior characteristics of the target account.

[0044] The first judgment unit is used to determine the target data type to which the behavior data to be detected and / or the historical behavior data belongs, wherein the target data type is a continuous numerical type or a discrete string type, and the data type to which the behavior data to be detected belongs is the same as the data type to which the historical behavior data belongs.

[0045] A clustering unit is used to cluster the target data and the historical data using a clustering algorithm if the target data type is a continuous numerical type, to obtain at least one cluster.

[0046] The second judgment unit is used to determine whether the current behavior of the target account is an uncommon behavior based on the association between the behavior data to be detected and the at least one cluster.

[0047] The third judgment unit is used to determine whether the current behavior of the target account is an uncommon behavior based on the matching relationship between the behavior data to be detected and the historical behavior data if the target data type is a discrete string type.

[0048] The second acquisition unit is specifically used for:

[0049] Based on the behavior data to be detected, historical behavior data corresponding to the target account is obtained, wherein the category of the current behavior feature represented by the behavior data to be detected is the same as the category of the historical behavior feature represented by the historical behavior data.

[0050] The second judgment unit is specifically used for:

[0051] If the behavior data to be detected is included in one of the at least one clusters, it is determined that the current behavior of the target account is a common behavior;

[0052] If the behavior data to be detected is not in any of the at least one cluster, the current behavior of the target account is determined to be an uncommon behavior.

[0053] The detected behavior data includes the current operation time corresponding to the target account, the historical behavior data includes at least one historical operation time corresponding to the target account, and the target data type is a continuous numerical type.

[0054] The device further includes:

[0055] A determining unit is used to determine that the number of historical operation times included in the historical behavior data is greater than a first threshold.

[0056] A preprocessing unit is used to preprocess the historical behavior data to obtain preprocessed historical behavior data, wherein the number of historical operation times contained in the preprocessed historical behavior data is less than the number of historical operation times contained in the historical behavior data before preprocessing.

[0057] The clustering unit is specifically used for:

[0058] Clustering algorithms are used to cluster the behavior data to be detected and the preprocessed historical behavior data.

[0059] The preprocessing unit is specifically used for:

[0060] The at least one historical operation time is statistically analyzed to obtain a first frequency corresponding to each statistical time point in the at least one statistical time point. The first frequency is used to represent the number of times the historical operation time associated with the statistical time point occurs in the at least one historical operation time.

[0061] According to the preset reduction ratio, the first frequency corresponding to each statistical time point is reduced to obtain the second frequency corresponding to each statistical time point;

[0062] Based on the second frequency corresponding to each statistical time point, at least one updated historical operation time associated with the statistical time point is obtained, and the number of updated historical operation times associated with the statistical time point is equal to the second frequency.

[0063] The at least one updated historical operation time associated with each statistical time point in the at least one statistical time point is determined as the preprocessed historical behavior data.

[0064] The detected behavior data includes the current operation time corresponding to the target account, the historical behavior data includes at least one historical operation time corresponding to the target account, and the target data type is a continuous numerical type.

[0065] The device further includes:

[0066] An offset unit is used to offset each historical operation time according to the time offset corresponding to the time interval to which each historical operation time belongs, for each of the at least one historical operation time, to obtain at least one offset historical operation time.

[0067] Based on the time offset corresponding to the time interval to which the current operation time belongs, the current operation time is offset to obtain the offset current operation time;

[0068] The clustering unit is also used for:

[0069] A clustering algorithm is used to cluster the historical operation time after the at least one offset and the current operation time after the offset.

[0070] The detected behavior data includes a first string corresponding to the target account, and the historical behavior data includes at least one second string corresponding to the target account. The first string is used to identify the current geographical location or current operating device of the target account, and the second string is used to identify the historical geographical location or historical operating device of the target account. The target data type is a discrete string type.

[0071] The device further includes:

[0072] A generation unit is configured to determine at least one string type contained in the at least one second string, and to count the third frequency corresponding to each string type in the at least one string type, wherein the third frequency is used to represent the number of times the string type appears in the at least one second string;

[0073] From the at least one string type, determine the K string types with the highest third frequency, where K is a preset integer;

[0074] Based on the K string types, a common list is determined, which includes M target strings, where M is an integer less than or equal to K. The target strings satisfy one or both of the following conditions: the third frequency of the target string is greater than the second threshold; the ratio between the third frequency of the target string and the total number of strings of the at least one second string is greater than the third threshold.

[0075] The third judgment unit is specifically used for:

[0076] Match the first string with the M target strings;

[0077] If there is a string among the M target strings that matches the first string, then it is determined that the current behavior of the target account is a common behavior;

[0078] If none of the M target strings matches the first string, then the current behavior of the target account is determined to be an unusual behavior.

[0079] One aspect of this application provides an electronic device, including a memory and a processor. The memory is connected to the processor, and the memory is used to store a computer program. The processor is used to call the computer program so that the electronic device executes the method provided in one aspect of this application.

[0080] One aspect of this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that an electronic device having a processor performs the method provided in one aspect of this application.

[0081] One embodiment of this application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the method provided in the above-described aspect.

[0082] This application embodiment determines the target data type of the behavior data to be detected and the historical behavior data. Different methods are used for behavior detection depending on whether the target data type is a continuous numerical type or a discrete string type. For historical behavior data of discrete string type, the matching relationship between the behavior data to be detected and the historical behavior data determines whether the current behavior is an uncommon behavior, improving detection efficiency while ensuring accuracy. For historical behavior data of continuous numerical type, a clustering algorithm is used to cluster the behavior data to be detected and the historical behavior data. The association relationship between the behavior data to be detected and the obtained clusters determines whether the current behavior is an uncommon behavior. Because clustering considers the impact of the association relationship between continuous numerical data on the detection results, the false positive rate of uncommon behavior detection can be reduced, improving the accuracy of the detection results. Attached Figure Description

[0083] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0084] Figure 1 This is a schematic diagram of a network architecture provided in an embodiment of this application;

[0085] Figure 2 This is a schematic diagram of a behavior detection scenario provided in an embodiment of this application;

[0086] Figure 3 This is a flowchart illustrating a behavior detection method provided in an embodiment of this application;

[0087] Figure 4 This is a schematic diagram of a behavior detection method provided in an embodiment of this application;

[0088] Figure 5 This is a schematic diagram illustrating the clustering effect of the DBSCAN algorithm;

[0089] Figure 6a This is a screenshot of a detection result interface provided in an embodiment of this application;

[0090] Figure 6b This is another detection result interface diagram provided in an embodiment of this application;

[0091] Figure 7 This is a schematic diagram of the structure of a user detection device provided in an embodiment of this application;

[0092] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0093] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0094] This application relates to Artificial Intelligence (AI) technology. Artificial intelligence is the theory, methods, technology, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, artificial intelligence is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. Artificial intelligence studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities. Artificial intelligence technology is a comprehensive discipline involving a wide range of fields, encompassing both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operating / interactive systems, and mechatronics. AI software technologies mainly include computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning. This application specifically relates to machine learning technology, a subfield of artificial intelligence.

[0095] Machine learning is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning includes supervised learning and unsupervised learning. Supervised learning trains a model based on known inputs and outputs, enabling the model to predict future outputs; supervised learning uses classification and regression techniques to develop predictive models. Unsupervised learning, on the other hand, can discover hidden patterns or inherent structures in data. This technique can derive inferences from unlabeled input datasets. Clustering is one of the most commonly used unsupervised learning techniques. This technique discovers hidden patterns or groupings in data through exploratory data analysis. This application specifically relates to clustering technology under machine learning. After determining that the behavior data to be detected and / or historical behavior data are continuous numerical data, the behavior data to be detected and historical behavior data are clustered. Based on the clustering results, it is determined whether the current behavior is an uncommon behavior, thus completing the behavior detection process.

[0096] This application can also be applied to the field of network security. For example, when a user performs various operations on their personal account, such as logging in, it is necessary to detect the operation data (i.e., behavioral data) of that personal account. When the detection result indicates that the operation data is frequently used, it means that the operation is safe to a certain extent; however, when the detection result indicates that the operation data is not frequently used, it means that the operation may be insecure, requiring an alert or other security verification measures to ensure the security of the account and the user. This behavior detection process can be implemented through the embodiments of this application. For example, after a user performs an operation on a target account, the current behavior data and historical behavior data of the target account can be obtained. The current behavior data is used as the behavior data to be detected. Then, according to the data type of the behavior data, the corresponding method is used to detect the behavior data to be detected. If it is determined that the current behavior is a frequently used behavior, no alert is issued; if it is determined that the current behavior is not frequently used, an alert is issued.

[0097] Please see Figure 1 , Figure 1 This is a schematic diagram of a network architecture provided in an embodiment of this application. Figure 1 As shown, the network architecture may include a server 10 and user terminals 11. The number of user terminals can be one or more, and there is no limitation here. Figure 1 As shown, server 10 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. User terminal 11 can include: smartphones, tablets, laptops, PDAs, mobile internet devices (MIDs), wearable devices (such as smartwatches, smart bracelets, etc.), and smart TVs, etc., intelligent terminals with multimedia data recognition capabilities. Figure 1 As shown, user terminal 11 can connect to server 10 via a network and exchange data through this network connection.

[0098] like Figure 2 As shown, Figure 2 This is a behavior detection scene diagram provided in an embodiment of this application, such as... Figure 2 The client shown can be the one described above. Figure 1 The client with target account operation permissions integrated in the user terminal 11 shown can be the service device described above. Figure 1 Server 10 is shown. (Example) Figure 2As shown, the client can send the target account's behavior data to be detected and historical behavior data to the service device. The service device performs non-common behavior detection based on the target behavior data and historical behavior data, and after obtaining the detection results, it can send the detection results back to the client.

[0099] Please see Figure 3 , Figure 3 This is a flowchart illustrating a behavior detection method provided in an embodiment of this application. Figure 3 As shown, the behavior detection method may include the following steps:

[0100] Step 110: Obtain the behavior data to be detected corresponding to the target account. The behavior data to be detected is used to represent the current behavior characteristics of the target account.

[0101] Specifically, the categories of user behavior characteristics represented by the data to be detected include multiple categories, such as current geographical location, current device, or current time of operation. Using this application, data from these various categories can be processed to detect uncommon behaviors across different dimensions.

[0102] Step 120: Obtain the historical behavior data corresponding to the above target account. The historical behavior data is used to represent the historical behavior characteristics of the above target account.

[0103] Specifically, obtaining the historical behavior data corresponding to the target account includes: obtaining the historical behavior data corresponding to the target account based on the behavior data to be detected, wherein the category of the current behavior feature represented by the behavior data to be detected is the same as the category of the historical behavior feature represented by the historical behavior data.

[0104] In other words, the historical behavior data and the behavior data to be detected for the target account must be of the same category. For example, if the behavior data to be detected includes the current geographical location, then the corresponding historical behavior data will include the historical geographical location. This ensures that the acquired behavior data to be detected and the historical behavior data are matched, facilitating accurate detection results and reducing anomalies during the detection process.

[0105] Step 130: Determine the target data type of the above-mentioned behavior data to be detected and / or the above-mentioned historical behavior data. The target data type is either a continuous numerical type or a discrete string type. The data type of the above-mentioned behavior data to be detected is the same as the data type of the above-mentioned historical behavior data.

[0106] Specifically, the behavioral data to be detected can include various categories of data, and the data types of different categories differ. For example, behavioral data including the current geographical location, such as "Beijing" or "Shanghai," is string data; different data points are different strings, and therefore there is no inherent correlation between the data, which can be considered discrete. However, when the behavioral data including the current time, such as "14," which represents 14, this data is numeric data, and there is a correlation between the values ​​of multiple time data points, which can be considered continuous. Therefore, the data types of the behavioral data to be detected can be divided into continuous numeric types and discrete string types. For example, the geographical location data "Beijing" belongs to the discrete string type, while the time data "14" belongs to the continuous numeric type. Furthermore, if numerical codes such as "1" and "2" are used to represent behavioral data whose values ​​do not have the aforementioned correlation, then this data still belongs to the discrete string type. Appropriate methods are used for behavior detection for different target data types.

[0107] Step 140: If the target data type is a continuous numerical type, a clustering algorithm is used to cluster the target behavior data and the historical behavior data to obtain at least one cluster. Based on the relationship between the target behavior data and the at least one cluster, it is determined whether the current behavior of the target account is an uncommon behavior.

[0108] In this embodiment, if the behavior data to be detected is continuous numerical data, the corresponding historical behavior data is also continuous numerical data. Therefore, there is a correlation between the values ​​of different data in the behavior data to be detected and the historical behavior data. A clustering algorithm can then be used to cluster the behavior data to be detected and the historical behavior data. After clustering, at least one cluster is obtained. Based on the correlation between the behavior data to be detected and this at least one cluster, it is determined whether the behavior data to be detected is infrequent behavior data, that is, whether the current behavior corresponding to the target account is infrequent behavior. In other words, by clustering the data to obtain the detection results, and considering the impact of the correlation between the numerical values ​​of the data on the detection results, the occurrence of false positives can be reduced, and the accuracy of the detection results can be improved.

[0109] Clustering can divide different data points into different clusters (a cluster is a subset of data after partitioning) according to their similarity and dissimilarity, ensuring that the data in each cluster are as similar as possible and the data in different clusters are as dissimilar as possible. Clustering includes various types of clustering algorithms, such as partition-based clustering, density-based clustering, and hierarchical clustering. In this application, a density-based clustering algorithm can be used. This type of clustering algorithm mainly examines the continuity between samples from the perspective of sample density and continuously expands the clusters based on connectable samples to obtain the final clustering result. Therefore, compared with other types of clustering algorithms, density-based clustering algorithms can not only find "circular" clusters, but also clusters of various irregular shapes. Furthermore, density-based clustering algorithms can also identify noise points. For example, the clustering algorithm used in this application can be the noisy density-based clustering algorithm DBSCAN. Understandably, this clustering algorithm can also be the OPTICS algorithm, which determines the cluster structure by ranking the points, or the DP algorithm, which is based on density peaks. Alternatively, the clustering algorithm is not limited to a density-based clustering algorithm and can be other suitable algorithms; this application does not impose any restrictions on this. The following will use the DBSCAN algorithm to cluster data as an example to introduce the relevant steps.

[0110] Specifically, based on the association between the aforementioned behavior data to be detected and the aforementioned at least one cluster, determining whether the aforementioned current behavior of the aforementioned target account is an infrequent behavior includes the following process: if the aforementioned behavior data to be detected is included in one of the aforementioned at least one cluster, then the aforementioned current behavior of the aforementioned target account is determined to be a frequent behavior; if the aforementioned behavior data to be detected is not in any of the aforementioned at least one cluster, then the aforementioned current behavior of the aforementioned target account is determined to be an infrequent behavior.

[0111] This involves clustering the target behavior data and historical behavior data to obtain at least one cluster. If the data point corresponding to the target behavior data is included in a cluster and is not a discrete point, it indicates that the target behavior data and most of the historical behavior data are correlated, and therefore the current behavior is a frequently used behavior. If the data point corresponding to the target behavior data is not included in a cluster and is a discrete point, it indicates that the target behavior data and most of the historical behavior data are not correlated, and therefore the current behavior is not a frequently used behavior. This method allows for clear and rapid acquisition of detection results.

[0112] In one embodiment, the behavior data to be detected includes the current operation time corresponding to the target account, and the historical behavior data includes at least one historical operation time corresponding to the target account. Before clustering the behavior data to be detected and the historical behavior data using a clustering algorithm, the following steps may be performed:

[0113] For each of the above at least one historical operation time, according to the time offset corresponding to the time interval to which each historical operation time belongs, the above at least one historical operation time is offset to obtain at least one offset historical operation time.

[0114] Based on the time offset corresponding to the time interval to which the current operation time belongs, the current operation time is offset to obtain the offset current operation time;

[0115] It's understandable that time data falls within a certain numerical range. For example, if time data is granular in hours, the range is 0-23. While 23:00 and 0:00 are adjacent times, they are numerically far apart. Users are typically more active during these times, meaning there are more data points associated with them. Therefore, without data processing, clustering results could be significantly affected. Specifically, the distance between these two data points might prevent them from clustering together, potentially leading to poor clustering. Therefore, shifting the time data is a viable option. Generally, user activity is lower at 3:00 and 4:00 (compared to 23:00 and 0:00), meaning there are fewer data points associated with these times. Shifting 3:00 and 4:00 to 23:00 and 0:00 (with other time data shifted accordingly) should result in better clustering than before the shift. Therefore, data in the 4-23 hour range can be shifted to the 0-19 hour range, and data in the 0-3 hour range can be shifted to the 20-23 hour range. This can further improve the accuracy of clustering results, thereby increasing the accuracy of detection results.

[0116] Specifically, for the acquired historical operation times, the time interval to which each historical operation time belongs is determined. Then, according to the aforementioned offset rules, the time offset corresponding to each time interval can be obtained. The historical operation times are then offset based on this time offset to obtain the offset historical operation time. For example, if the acquired historical operation time is "14", which falls between 4:00 and 23:00, the corresponding time offset is -4. After offset processing, the corresponding offset historical operation time is "10". The behavior data to be detected also participates in clustering, therefore, it needs to be offset according to the same rules. That is, the time offset corresponding to the time interval to which the current operation time belongs is determined, and the offset is performed based on this time offset to obtain the offset current operation time.

[0117] It is understood that in this embodiment, the above-mentioned clustering algorithm is used to cluster the above-mentioned behavior data to be detected and the above-mentioned historical behavior data, that is, the clustering algorithm is used to cluster the above-mentioned historical operation time after at least one offset and the above-mentioned current operation time after the offset.

[0118] In one embodiment, the behavior data to be detected includes the current operation time corresponding to the target account, the historical behavior data includes at least one historical operation time corresponding to the target account, and the target data type is a continuous numerical type. Before clustering the behavior data to be detected and the historical behavior data using the clustering algorithm, the following operations may also be performed:

[0119] The number of historical operation times included in the aforementioned historical behavior data is determined to be greater than the first threshold;

[0120] The historical behavior data is preprocessed to obtain preprocessed historical behavior data, wherein the number of historical operation times contained in the preprocessed historical behavior data is less than the number of historical operation times contained in the historical behavior data before preprocessing.

[0121] Specifically, if the historical behavior data contains a large amount of data, then the number of samples during clustering will be too large, consuming a lot of computing resources and affecting detection efficiency. Therefore, the historical behavior data can be preprocessed to reduce the number of samples during clustering, thereby ensuring detection efficiency. The first threshold can be set according to the computing and processing capabilities of the device implementing the behavior detection method, network resource conditions, etc. For example, the first threshold can be set to 2000, but this application does not impose any limitations on this.

[0122] It is understood that in this embodiment, the above-mentioned clustering algorithm is used to cluster the above-mentioned behavior data to be detected and the above-mentioned historical behavior data, that is, the clustering algorithm is used to cluster the above-mentioned behavior data to be detected and the above-mentioned preprocessed historical behavior data.

[0123] Specifically, the preprocessing of the aforementioned historical behavior data to obtain preprocessed historical behavior data may include the following steps:

[0124] Statistical analysis is performed on at least one historical operation time to obtain a first frequency corresponding to each statistical time point in at least one statistical time point. The first frequency is used to represent the number of times the historical operation time associated with the statistical time point occurs in the at least one historical operation time.

[0125] According to the preset reduction ratio, the first frequency corresponding to each statistical time point is reduced to obtain the second frequency corresponding to each statistical time point;

[0126] Based on the second frequency corresponding to each of the above statistical time points, at least one updated historical operation time associated with the above statistical time point is obtained, and the number of updated historical operation times associated with the above statistical time points is equal to the second frequency.

[0127] At least one updated historical operation time associated with each of the above-mentioned statistical time points is determined as the above-mentioned preprocessed historical behavior data.

[0128] In this embodiment, the granularity of historical operation time is less than or equal to the granularity of statistical time point. For example, the historical operation time is "10:23:50," which is second-level granularity, while the statistical time point can be "10," which is hour-level granularity. Therefore, after statistically analyzing the historical operation time, the statistical time point and the corresponding first frequency can be obtained. All first frequencies are proportionally reduced according to a preset reduction ratio to obtain the corresponding second frequency. The preset reduction ratio can be a fixed value or determined by a formula. For example, the formula can be: Preset Reduction Ratio = Upper Limit / Number of Historical Operation Times Included in the Historical Behavior Data, where the number of historical operation times included in the historical behavior data is the sum of all first frequencies, and the upper limit can be set to be less than or equal to a first threshold. Furthermore, to avoid the second frequency obtained after data reduction being too small, a lower limit can be set. If the second frequency is less than this lower limit, the value of the second frequency is updated to this lower limit. This ensures that the amount of data during clustering is within a certain range, preventing excessive processing resources from being consumed due to large data volume, which would affect detection efficiency, and also preventing the clustering effect from deteriorating due to small data volume, which would affect the detection results, thus ensuring the accuracy of the detection results.

[0129] After narrowing down the first frequency, the updated historical operation time is obtained based on the second frequency. The granularity of this updated historical operation time can be equal to the granularity of the statistical time point, and the number of updated historical operation times is the sum of all second frequencies. Specifically, after narrowing down, the obtained data can be dictionary-type data, i.e., key-value pair data. The key in the key-value pair represents the statistical time point, and the value in the key-value pair represents the second frequency. For example, after narrowing down, the obtained data is "14:3,15:5,16:8", where 14, 15, and 16 represent the statistical time points, and 3, 5, and 8 represent the second frequencies. Obtaining the updated historical operation time based on the second frequency can be understood as splitting the above dictionary-type data according to the values ​​in the key-value pairs to obtain numeric data. Each specific data in this numeric data represents the updated historical operation time associated with the statistical time point. In this case, the granularity of the updated historical operation time is equal to the granularity of the statistical time point. For example, each key-value pair in "14:3,15:5,16:8" can be split according to the value in the key-value pair, resulting in three 14s, five 15s, and eight 16s. Recombining these results in the data "14,14,14,15,15,15,15,15,16,16,16,16,16,16,16,16". Here, 14, 15, and 16 are all updated historical operation times associated with the statistical time points. The number of updated historical operation times is 3 + 5 + 8 = 16, which is the sum of all the second frequencies 3, 5, and 8. Then, clustering can be performed on the behavior data to be detected and the updated historical operation times.

[0130] Step 150: If the target data type is a discrete string type, determine whether the current behavior of the target account is an uncommon behavior based on the matching relationship between the behavior data to be detected and the historical behavior data.

[0131] In one embodiment, the behavior data to be detected includes a first string corresponding to the target account, and the historical behavior data includes at least one second string corresponding to the target account. The first string is used to identify the current geographical location or current operating device of the target account, and the second string is used to identify the historical geographical location or historical operating device of the target account. The target data type is a discrete string type. Before determining whether the current behavior of the target account is an infrequent behavior based on the matching relationship between the behavior data to be detected and the historical behavior data, the method may further include:

[0132] Determine at least one string type contained in the at least one second string, and count the third frequency corresponding to each string type in the at least one string type, wherein the third frequency is used to represent the number of times the string type appears in the at least one second string;

[0133] From at least one of the above string types, determine the K string types with the highest third frequency, where K is a preset integer;

[0134] Based on the above K string types, a common list is determined. The common list includes M target strings, where M is an integer less than or equal to K. The target strings satisfy one or two of the following conditions: the third frequency of the target string is greater than the second threshold; the ratio between the third frequency of the target string and the total number of strings of at least one second string is greater than the third threshold.

[0135] Specifically, if the target data type is a discrete string type, then the current behavior data can be a string representing the current geographical location or device used for the current operation, and correspondingly, the historical behavior data is a string representing the historical geographical location or device used for the previous operation. A frequently used list can be obtained from the historical behavior data. The process is as follows: identical second strings correspond to a string category, and the number of times the same string appears is the third frequency corresponding to that string category. The K string categories with the highest third frequency are selected, and the strings included in the frequently used list are determined from these K string categories. The value of K can be adjusted as needed; when K is set to 0 or a negative integer, there is no restriction on the frequently used list. Further, target strings that meet certain conditions are selected from the K string categories. These target strings need to satisfy certain conditions, such as a high frequency of occurrence (i.e., greater than the second threshold), and / or a high ratio of the frequency of occurrence of the target string to the total number of all strings (i.e., greater than the third threshold). These target strings are the strings included in the frequently used list. The frequently used list obtained in this way includes strings that appear relatively frequently among all second strings, and the frequency and percentage of occurrence are also relatively large. Therefore, the behavior data in the frequently used list represents the frequently used behavior data of the target account. This ensures that the behavioral data included in the generated list of commonly used data is representative, providing a reliable standard for determining whether the behavioral data to be detected is commonly used data, thereby improving the accuracy of the detection results.

[0136] Therefore, determining whether the current behavior of the target account is an unusual behavior based on the matching relationship between the behavior data to be detected and the historical behavior data can include:

[0137] Match the first string with the M target strings.

[0138] If any of the M target strings above matches the first string above, then the current behavior of the target account above is determined to be a common behavior.

[0139] If none of the M target strings match the first string, then the current behavior of the target account is determined to be an unusual behavior.

[0140] If the behavior data to be detected is not in the frequently used list, then the behavior data to be detected is considered uncommon behavior data, and the corresponding current behavior is also considered uncommon behavior. This allows for convenient and quick acquisition of detection results.

[0141] The following example illustrates the specific process of implementing the behavior detection method provided in this application. Figure 4 As shown, Figure 4 This is a schematic diagram of a behavior detection method provided in an embodiment of this application. The behavior detection method includes the following steps: 210, 220, 230, 240, and 250.

[0142] Step 210: Obtain the behavior data to be detected and the user information data;

[0143] The behavior data to be detected and the user information data can be sent from the client to the service device, and the service device can periodically send the above data to the behavior detection system for detection through a scheduling system. The behavior detection data to be detected may include one of the following: current operation time, current operation device, or current operation geographical location. The user information data includes the user's static data and the user's dynamic behavior data. The dynamic behavior data includes fields such as the user's historical operation geographical location, the user's historical operation time, the user's first historical use of a certain IP address, and the user's first historical use of a certain device. In this embodiment, some of the necessary fields are selected as historical behavior data.

[0144] Step 220: Perform data processing, which may specifically include the following steps 221, 222 and 223;

[0145] Step 221: Obtain historical behavior data that matches the behavior data to be detected;

[0146] Based on the acquired behavior data to be detected, historical behavior data that can be used in this behavior detection process is determined from the user information data. That is, the behavior data to be detected is time data "14", and the corresponding historical operation time is obtained as historical behavior data. Historical behavior data may include behavior data within a certain time interval in the past, and this application does not limit the length of the time interval.

[0147] Step 222: Process the acquired historical behavior data into a standard key:value format;

[0148] Frequency statistics are performed on historical behavior data, resulting in key-value pairs (key:value format). For example, "Beijing: 10, Shanghai: 15, Shenzhen: 8", where the key represents the value of the detected field, and the value represents the cumulative number of times that value has appeared historically.

[0149] Step 223: Determine whether the key of the historical behavior data is a continuous numeric type;

[0150] The system determines whether the key of historical behavior data is a continuous numeric type, or whether the behavior data to be detected is a continuous numeric type. For example, historical behavior data is "Beijing: 10, Shanghai: 15, Shenzhen: 8", where the key "Beijing", "Shanghai", and "Shenzhen" represent the geographical locations of historical operations and belong to the discrete string type data; while historical behavior data "6:5, 7:3, 12:20" has the key 6, 7, and 12, which represent the time of historical operations and belong to the continuous numeric type data.

[0151] If the judgment result is yes, proceed to step 230; if the judgment result is no, proceed to step 240.

[0152] Step 230: Detect uncommon behaviors based on clustering algorithms. This step may specifically include the following steps 231, 232, 233 and 234.

[0153] Step 231: If the sum of values ​​is too large, then reduce the value; otherwise, the value remains unchanged.

[0154] The system determines whether the sum of the values ​​exceeds a total threshold. If it does, it hinders further clustering, and the values ​​need to be reduced. Alternatively, it can determine if there is a value greater than a frequency threshold; if so, the value is reduced. A combination of these two conditions can also be used for judgment, and this application does not impose any restrictions on this. In an optional implementation, users (or user accounts) can be filtered based on the number of keys or the size of the values. Only users who meet the filtering requirements are processed in step 230; otherwise, step 240 is processed. The filtering requirements may include that the number of keys is greater than A, and / or that the number of values ​​is greater than B, and / or that the sum of the values ​​is greater than C, etc., and this application does not impose any restrictions on this.

[0155] When scaling down, the scaling ratio can be determined according to a preset formula. For example, if the sum of the values ​​is 'a', and the upper limit of the scaled-down values ​​is set to 'b', then the scaling ratio can be 'b / a', meaning each value is scaled down to 'b / a' of its original value. To prevent the scaled-down values ​​from differing too much, a lower limit 'c' can also be set. For example, historical behavior data is "14:100000,15:150,16:80000". If the values ​​are scaled down proportionally, a = 100000 + 150 + 80000 = 180150, and b = 1000 and c = 10, then the scaled data will be "14:555,15:10,16:444".

[0156] Step 232: Split the key:value format into a number of values ​​that are keys, and combine this number with the current behavior data to be detected to form a set of numbers;

[0157] For example, if the original data is "14:3,15:5,16:8", then the split data is "14,14,14,15,15,15,15,15,16,16,16,16,16,16,16,16". If the data to be detected is "17", then it is merged with the split data to obtain a set of data in no particular order: "14,14,14,15,15,15,15,15,16,16,16,16,16,16,16,16,16,17".

[0158] When the behavior data to be detected represents time data, the data can also be offset. Specifically, according to... Figure 1 The preset rule mentioned in step 140 can shift data from 4 to 23 to 0 to 19, and data from 0 to 3 to 20 to 23. For example, the split data "14,14,14,15,15,15,15,15,16,16,16,16,16,16,16,16,17" becomes "10,10,10,11,11,11,11,11,11,12,12,12,12,12,12,12,12,13" after shifting. Correspondingly, after clustering the data, the data in the clustering results needs to be restored to their values ​​before the shift.

[0159] Step 233: Cluster the group of numbers using a density-based clustering algorithm;

[0160] For example, the DBSCAN algorithm can be used for clustering. The DBSCAN algorithm can divide high-density regions into clusters of arbitrary shapes, thus separating high-density regions from low-density regions. In density-based clustering algorithms, if the density of points in a region is greater than a certain threshold, it is added to a cluster of similar points. For the set of data points corresponding to users' frequently used and infrequently used behaviors, this algorithm can be applied to divide these data points into clusters based on density. Data within the same cluster can be adjacent keys with different values.

[0161] The DBSCAN algorithm requires two parameters: density radius eps and density threshold minpts. Unlike the k-means algorithm, it does not require pre-defining the number of clusters to be obtained; instead, it obtains clusters based on eps and minpts. The DBSCAN algorithm finds clusters by examining the neighborhood of each point's eps in the data set. If the number of points in the neighborhood of a point p's eps is greater than or equal to minpts, a new cluster is created with p as the core point. Then, it repeatedly searches for points that are directly density-reachable from these core points; this process may involve merging density-reachable clusters. The process ends when no new points can be added to any cluster. The specific process is as follows:

[0162] 1) Identify any untraversed point as the target point and find the points within the neighborhood of eps of that point;

[0163] 2) If the number of points in the neighborhood of the target point's eps is greater than or equal to minpts, then the target point is identified as a core point and clustering begins. (If not, it is marked as noise).

[0164] 3) All points within the eps neighborhood of the target point also belong to the same cluster. Determine any point within the eps neighborhood of the target point as the new target point and repeat step 2).

[0165] 4) Repeat steps 2) and 3) until all the neighborhood points of the core points have been traversed;

[0166] 5) Once all points in this cluster have been found, repeat steps 1) to 4) until all data points have been processed. Eventually, each data point is either included in a cluster or belongs to noise (i.e., discrete points).

[0167] In this application, the density radius eps and density threshold minpts in the DBSCAN algorithm can be set according to specific scenarios. For example, in scenarios where detection is not frequently used, since the key value is 0-23, eps can be set to 1 or 2, and minpts can be set to 100 (p is a core point only when the number of points contained in the eps neighborhood of p is greater than or equal to 100).

[0168] like Figure 5 As shown, Figure 5 This image shows the clustering effect of the DBSCAN algorithm. As can be seen from the image, the DBSCAN algorithm can automatically separate high-density and low-density regions into different clusters. Points that are far from the clusters are considered discrete points and will not be assigned to any cluster. Figure 5 The data points in the previous example are two-dimensional data points, and the distance between the points is generally Euclidean distance. However, in this embodiment of the application, in a non-frequent time detection scenario, the data points are one-dimensional data points, i.e., time points, and the distance between the points is obtained by calculating the absolute value.

[0169] Step 234: If the behavior data to be detected is contained in the cluster of the clustering results, it is a common value; if it is a discrete point, it is a non-common value.

[0170] Based on whether the data points corresponding to the behavior to be detected are discrete points, it can be determined whether they are uncommon values. Because common values ​​and their neighboring values ​​have appeared more frequently in history, their density is relatively high. Conversely, uncommon values ​​and their neighboring values ​​have appeared less frequently in history, resulting in a lower density.

[0171] It should be noted that the data points in the clustering results may correspond to the data after the offset processing in step 232. Therefore, it is necessary to restore the data points in the clustering results to the data before the offset.

[0172] Then proceed to step 250.

[0173] Step 240, performing non-common behavior detection based on a multi-threshold method, which may specifically include the following steps 241, 242, 243 and 244;

[0174] Step 241: Determine if the sum of all values ​​is greater than the data volume threshold;

[0175] When the target behavior data and historical behavior data are discrete string types, a multi-threshold method is used for uncommon behavior detection. First, it is determined whether the number of data points in the historical behavior data exceeds a data volume threshold. If not, the detection process can be terminated without further processing or output. Only if the threshold is met will the detection continue.

[0176] Step 242: Select the K keys with the largest values ​​based on their values;

[0177] To construct a frequently used list that includes common behavioral data, we can first select the K keys with the largest values. If K is set to a positive integer, the number of data items in the frequently used list is limited; only K data items may be added to the list. However, if K is set to 0 or a negative integer, all historical behavioral data may be added to the frequently used list.

[0178] Step 243: If the value is greater than the frequency threshold and the proportion of the value is greater than the proportion threshold, then add the key to the frequently used list;

[0179] Further filtering of the K keys reveals the percentage of keys whose values ​​are greater than a frequency threshold (i.e.,...). When the value exceeds the percentage threshold, the key corresponding to that value is added to the frequently used list. Optionally, other conditions can be set to filter the keys added to the frequently used list; this application does not impose any restrictions on this.

[0180] Step 244: If the behavior data to be detected is in the common list, it is a common value; otherwise, it is a non-common value.

[0181] Specifically, if the behavior data to be detected matches any data in the frequently used list, then the behavior data to be detected is determined to be a frequently used value; otherwise, it is a rarely used value.

[0182] Step 250: Output whether the behavior data to be detected is an uncommon value and its corresponding uncommon type;

[0183] In this application, based on the data type of the behavior data to be detected, either clustering algorithm-based or multi-threshold method-based uncommon behavior detection can be selected. After obtaining the detection result, it can output whether the behavior data to be detected is an uncommon value and the uncommon detection type. The detection results can be output and displayed periodically. It is understood that the behavior detection method provided in this application is a complete and general behavior detection method that can perform uncommon behavior detection in different dimensions, such as uncommon time detection, uncommon device detection, and uncommon location detection. This method can automatically select the corresponding uncommon behavior detection process based on the category and data type of the acquired behavior data to be detected, and use the corresponding method, such as clustering algorithm or multi-threshold method, to complete the behavior detection.

[0184] The following section presents the detection results in two specific detection scenarios.

[0185] 1) In this scenario, the behavior data to be detected is the time data "14". After behavior detection based on the clustering algorithm, "14" is determined to be an infrequent time, and the corresponding infrequent detection type is infrequent time detection. Furthermore, the data source type in this scenario is VPN, and the user operation in this scenario is a login operation, so the output detection result can be "VPN user logged in at an infrequent time".

[0186] 2) In this scenario, the behavior data to be detected is the location data "Beijing". After behavior detection based on the multi-threshold method, "Beijing" is determined to be an infrequent location, and the corresponding infrequent detection type is infrequent location detection. Furthermore, the user operation in this scenario is a Linux permission change operation, so the output detection result is "Linux user performs permission change in an infrequent location".

[0187] like Figure 6a and Figure 6b As shown, Figure 6a and Figure 6b These are all possible detection result screenshots. This interface can display the detection results, such as descriptions of specific detection scenarios like "VPN user logs in at an unusual time" or "Linux user changes permissions at an unusual location," and can also display more corresponding detailed information.

[0188] This application embodiment determines the target data type of the behavior data to be detected and the historical behavior data. Different methods are used for behavior detection depending on whether the target data type is a continuous numerical type or a discrete string type. For historical behavior data of discrete string type, the matching relationship between the behavior data to be detected and the historical behavior data determines whether the current behavior is an uncommon behavior, improving detection efficiency while ensuring accuracy. For historical behavior data of continuous numerical type, a clustering algorithm is used to cluster the behavior data to be detected and the historical behavior data. The association relationship between the behavior data to be detected and the obtained clusters determines whether the current behavior is an uncommon behavior. Because clustering considers the impact of the association relationship between continuous numerical data on the detection results, the false positive rate of uncommon behavior detection can be reduced, improving the accuracy of the detection results.

[0189] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a behavior detection device provided in an embodiment of this application. Figure 7 As shown, the above-mentioned behavior detection device can be applied to the above-mentioned Figure 1The client on the user terminal shown can be a computer program (including program code) in an electronic device. The behavior detection device may include: a first acquisition unit 20, a second acquisition unit 21, a first judgment unit 22, a clustering unit 23, a second judgment unit 24, and a third judgment unit 25; optionally, the behavior detection device may also include: a determination unit 26, a preprocessing unit 27, an offset unit 28, and a generation unit 29.

[0190] The first acquisition unit 20 is used to acquire the behavior data to be detected corresponding to the target account, and the behavior data to be detected is used to represent the current behavior characteristics of the target account.

[0191] The second acquisition unit 21 is used to acquire historical behavior data corresponding to the target account, and the historical behavior data is used to represent the historical behavior characteristics of the target account.

[0192] The first judgment unit 22 is used to determine the target data type to which the above-mentioned behavior data to be detected and / or the above-mentioned historical behavior data belong. The target data type is a continuous numerical type or a discrete string type. The data type to which the above-mentioned behavior data to be detected belongs is the same as the data type to which the above-mentioned historical behavior data belongs.

[0193] Clustering unit 23 is used to cluster the above-mentioned behavior data to be detected and the above-mentioned historical behavior data using a clustering algorithm if the above-mentioned target data type is a continuous numerical type, to obtain at least one cluster.

[0194] The second judgment unit 24 is used to determine whether the current behavior of the target account is an uncommon behavior based on the association between the above-mentioned behavior data to be detected and the above-mentioned at least one cluster.

[0195] The third judgment unit 25 is used to determine whether the current behavior of the target account is an uncommon behavior based on the matching relationship between the target data and the historical behavior data if the target data is a discrete string type.

[0196] Specifically, the second acquisition unit 21 is used for:

[0197] Based on the aforementioned behavior data to be detected, historical behavior data corresponding to the aforementioned target account is obtained, wherein the category of the current behavior feature represented by the aforementioned behavior data to be detected is the same as the category of the historical behavior feature represented by the aforementioned historical behavior data.

[0198] Specifically, the second judgment unit 24 is used for:

[0199] If the aforementioned behavior data to be detected is included in one of the above at least one clustering clusters, it is determined that the aforementioned current behavior of the target account is a common behavior;

[0200] If the aforementioned behavior data to be detected is not in any of the above-mentioned at least one cluster, then the aforementioned current behavior of the target account is determined to be an unusual behavior.

[0201] The aforementioned behavior data to be detected includes the current operation time corresponding to the aforementioned target account, the aforementioned historical behavior data includes at least one historical operation time corresponding to the aforementioned target account, and the aforementioned target data type is a continuous numerical type.

[0202] The above-mentioned device also includes:

[0203] Determining unit 26 is used to determine that the number of historical operation times included in the above-mentioned historical behavior data is greater than a first threshold.

[0204] The preprocessing unit 27 is used to preprocess the aforementioned historical behavior data to obtain preprocessed historical behavior data, wherein the number of historical operation times contained in the preprocessed historical behavior data is less than the number of historical operation times contained in the aforementioned historical behavior data before preprocessing.

[0205] The aforementioned clustering unit 23 is specifically used for:

[0206] Clustering algorithms are used to cluster the above-mentioned behavioral data to be detected and the above-mentioned preprocessed historical behavioral data.

[0207] Specifically, the preprocessing unit 27 is used for:

[0208] Statistical analysis is performed on at least one historical operation time to obtain a first frequency corresponding to each statistical time point in at least one statistical time point. The first frequency is used to represent the number of times the historical operation time associated with the statistical time point occurs in the at least one historical operation time.

[0209] According to the preset reduction ratio, the first frequency corresponding to each statistical time point is reduced to obtain the second frequency corresponding to each statistical time point;

[0210] Based on the second frequency corresponding to each of the above statistical time points, at least one updated historical operation time associated with the above statistical time point is obtained, and the number of updated historical operation times associated with the above statistical time points is equal to the second frequency.

[0211] At least one updated historical operation time associated with each of the above-mentioned statistical time points is determined as the above-mentioned preprocessed historical behavior data.

[0212] The aforementioned behavior data to be detected includes the current operation time corresponding to the aforementioned target account, the aforementioned historical behavior data includes at least one historical operation time corresponding to the aforementioned target account, and the aforementioned target data type is a continuous numerical type.

[0213] The above-mentioned device also includes:

[0214] The offset unit 28 is used to offset each historical operation time according to the time offset corresponding to the time interval to which each historical operation time belongs, for each of the above at least one historical operation time, to obtain at least one offset historical operation time.

[0215] Based on the time offset corresponding to the time interval to which the current operation time belongs, the current operation time is offset to obtain the offset current operation time;

[0216] The aforementioned clustering unit 23 is also used for:

[0217] A clustering algorithm is used to cluster the historical operation time after at least one of the above offsets and the current operation time after the above offsets.

[0218] The aforementioned behavior data to be detected includes a first string corresponding to the aforementioned target account, and the aforementioned historical behavior data includes at least one second string corresponding to the aforementioned target account. The aforementioned first string is used to identify the current geographical location or current operating device of the aforementioned target account, and the aforementioned second string is used to identify the historical geographical location or historical operating device of the aforementioned target account. The aforementioned target data type is a discrete string type.

[0219] The above-mentioned device also includes:

[0220] The generation unit 29 is used to determine at least one string type contained in the at least one second string, and to count the third frequency corresponding to each string type in the at least one string type, wherein the third frequency is used to represent the number of times the string type appears in the at least one second string;

[0221] From at least one of the above string types, determine the K string types with the highest third frequency, where K is a preset integer;

[0222] Based on the above K string types, a common list is determined. The common list includes M target strings, where M is an integer less than or equal to K. The target strings satisfy one or two of the following conditions: the third frequency of the target string is greater than the second threshold; the ratio between the third frequency of the target string and the total number of strings of at least one second string is greater than the third threshold.

[0223] The aforementioned third judgment unit 26 is specifically used for:

[0224] Match the first string with the M target strings.

[0225] If any of the M target strings above matches the first string above, then the current behavior of the target account above is determined to be a common behavior.

[0226] If none of the M target strings match the first string, then the current behavior of the target account is determined to be an unusual behavior.

[0227] This application embodiment distinguishes the data types of historical behavior data and uses methods corresponding to those data types for behavior detection. It considers the influence of the strength of the correlation between different data types on the detection results, and specifically reduces the occurrence of false judgments during the detection process. This can reduce the false judgment rate of uncommon behavior detection and improve the accuracy of the detection results.

[0228] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. For example... Figure 8 As shown, the electronic device 1000 may include a processor 1001, a network interface 1004, and a memory 1005. Furthermore, the electronic device 1000 may also include a user interface 1003 and at least one communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. Optionally, the network interface 1004 may include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 1005 may also be at least one storage device located remotely from the processor 1001. Figure 8 As shown, the memory 1005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application.

[0229] In such Figure 8In the electronic device 1000 shown, the network interface 1004 can provide network communication functions; while the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve: obtaining the target account's behavior data to be detected, the aforementioned behavior data being used to represent the current behavior characteristics of the target account;

[0230] Obtain the historical behavior data corresponding to the aforementioned target account, which is used to represent the historical behavior characteristics of the aforementioned target account.

[0231] Determine the target data type of the above-mentioned behavior data to be detected and / or the above-mentioned historical behavior data. The target data type is either a continuous numerical type or a discrete string type. The data type of the above-mentioned behavior data to be detected is the same as the data type of the above-mentioned historical behavior data.

[0232] If the target data type is a continuous numerical type, a clustering algorithm is used to cluster the target behavior data and the historical behavior data to obtain at least one cluster. Based on the correlation between the target behavior data and the at least one cluster, it is determined whether the current behavior of the target account is an uncommon behavior.

[0233] If the target data type is a discrete string, the current behavior of the target account is determined as an unusual behavior based on the matching relationship between the behavior data to be detected and the historical behavior data.

[0234] It should be understood that the electronic device 1000 described in the embodiments of this application can perform the foregoing... Figure 3 The description of the behavior detection method in the corresponding embodiments can also be performed as described above. Figure 7 The description of the behavior detection device in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0235] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium, which stores a computer program executed by the aforementioned behavior detection device. The computer program includes program instructions, and when the processor executes the program instructions, it can execute the aforementioned... Figure 3The description of the behavior detection method in the corresponding embodiments is already provided and will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the description of the method embodiments of this application. As an example, program instructions can be deployed and executed on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network. These multiple computing devices distributed across multiple locations and interconnected via a communication network can constitute a blockchain system.

[0236] Furthermore, it should be noted that this application also provides a computer program product or computer program, which may include computer instructions, which may be stored in a computer-readable storage medium. The processor of the electronic device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions, causing the electronic device to perform the aforementioned actions. Figure 3 The description of the behavior detection method in the corresponding embodiments is already provided and will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer program products or computer program embodiments related to this application, please refer to the description of the method embodiments of this application.

[0237] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0238] The steps in the method of this application embodiment can be adjusted, combined, or deleted according to actual needs.

[0239] The modules in the device of this application embodiment can be merged, divided, and deleted according to actual needs.

[0240] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0241] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A behavior detection method, characterized in that, include: Obtain the target account's behavior data to be detected, which represents the target account's current behavior characteristics; Obtain historical behavior data corresponding to the target account, wherein the historical behavior data is used to represent the historical behavior characteristics of the target account; Determine the target data type to which the behavior data to be detected and / or the historical behavior data belong, wherein the target data type is a continuous numeric type or a discrete string type, and the data type to which the behavior data to be detected belongs is the same as the data type to which the historical behavior data belongs; If the target data type is a continuous numerical type, then according to the time offset of the time interval to which each historical operation time belongs to the target account included in the historical behavior data belongs, each historical operation time is offset to obtain at least one offset historical operation time; according to the time offset of the time interval to which the current operation time belongs to the target account included in the behavior data to be detected belongs, the current operation time is offset to obtain the offset current operation time. A clustering algorithm is used to cluster the historical operation time after the at least one offset and the current operation time after the offset to obtain at least one cluster. Based on the correlation between the behavior data to be detected and the at least one cluster, it is determined whether the current behavior of the target account is an uncommon behavior. If the target data type is a discrete string type, determine at least one string type contained in at least one second string corresponding to the target account in the historical behavior data, and count the third frequency corresponding to each string type in the at least one string type, wherein the third frequency is used to represent the number of times the string type appears in the at least one second string; From the at least one string type, determine the K string types with the highest third frequency, where K is a preset integer; based on the K string types, determine a common list, which includes M target strings, where M is an integer less than or equal to K, and the target strings satisfy one or both of the following conditions: the third frequency corresponding to the target string is greater than a second threshold; the ratio between the third frequency corresponding to the target string and the total number of strings in the at least one second string is greater than a third threshold; match the first string corresponding to the target account included in the behavior data to be detected with the M target strings; if there is a string in the M target strings that matches the first string, then determine that the current behavior of the target account is a common behavior; If none of the M target strings matches the first string, then the current behavior of the target account is determined to be an infrequent behavior. The first string is used to identify the current geographical location or current operating device of the target account, and the second string is used to identify the historical geographical location or historical operating device of the target account.

2. The method according to claim 1, characterized in that, The step of obtaining the historical behavior data corresponding to the target account includes: Based on the behavior data to be detected, historical behavior data corresponding to the target account is obtained, wherein the category of the current behavior feature represented by the behavior data to be detected is the same as the category of the historical behavior feature represented by the historical behavior data.

3. The method according to claim 2, characterized in that, The step of determining whether the current behavior of the target account is an infrequent behavior based on the association between the behavior data to be detected and the at least one cluster includes: If the behavior data to be detected is included in one of the at least one clustering clusters, it is determined that the current behavior of the target account is a common behavior; If the behavior data to be detected is not in any of the at least one cluster, the current behavior of the target account is determined to be an uncommon behavior.

4. The method according to any one of claims 1-3, characterized in that, The behavior data to be detected includes the current operation time corresponding to the target account, the historical behavior data includes at least one historical operation time corresponding to the target account, and the target data type is a continuous numerical type; Before clustering the target behavior data and the historical behavior data using a clustering algorithm, the method further includes: The number of historical operation times included in the historical behavior data is determined to be greater than a first threshold. The historical behavior data is preprocessed to obtain preprocessed historical behavior data, wherein the number of historical operation times contained in the preprocessed historical behavior data is less than the number of historical operation times contained in the historical behavior data before preprocessing. The step of clustering the target behavior data and the historical behavior data using a clustering algorithm includes: Clustering algorithms are used to cluster the behavior data to be detected and the preprocessed historical behavior data.

5. The method according to claim 4, wherein preprocessing the historical behavior data to obtain preprocessed historical behavior data includes: The at least one historical operation time is statistically analyzed to obtain a first frequency corresponding to each statistical time point in the at least one statistical time point. The first frequency is used to represent the number of times the historical operation time associated with the statistical time point occurs in the at least one historical operation time. According to the preset reduction ratio, the first frequency corresponding to each statistical time point is reduced to obtain the second frequency corresponding to each statistical time point; Based on the second frequency corresponding to each statistical time point, at least one updated historical operation time associated with the statistical time point is obtained, and the number of updated historical operation times associated with the statistical time point is equal to the second frequency. The at least one updated historical operation time associated with each statistical time point in the at least one statistical time point is determined as the preprocessed historical behavior data.

6. A behavior detection device, characterized in that, include: The first acquisition unit is used to acquire the behavior data to be detected corresponding to the target account, wherein the behavior data to be detected is used to represent the current behavior characteristics of the target account; The second acquisition unit is used to acquire historical behavior data corresponding to the target account, wherein the historical behavior data is used to represent the historical behavior characteristics of the target account. The first judgment unit is used to determine the target data type to which the behavior data to be detected and / or the historical behavior data belongs, wherein the target data type is a continuous numerical type or a discrete string type, and the data type to which the behavior data to be detected belongs is the same as the data type to which the historical behavior data belongs. A clustering unit is used to cluster the target data and the historical data using a clustering algorithm if the target data type is a continuous numerical type, to obtain at least one cluster. The second judgment unit is used to determine whether the current behavior of the target account is an uncommon behavior based on the association between the behavior data to be detected and the at least one cluster. The third judgment unit is used to determine whether the current behavior of the target account is an uncommon behavior based on the matching relationship between the behavior data to be detected and the historical behavior data if the target data type is a discrete string type. Wherein, if the target data type is a continuous numerical type, the behavior data to be detected includes the current operation time corresponding to the target account, and the historical behavior data includes at least one historical operation time corresponding to the target account; the device further includes: An offset unit is used to offset each historical operation time according to the time offset corresponding to the time interval to which each historical operation time belongs, for each of the at least one historical operation time, to obtain at least one offset historical operation time. Based on the time offset corresponding to the time interval to which the current operation time belongs, the current operation time is offset to obtain the offset current operation time; The clustering unit is also used for: A clustering algorithm is used to cluster the historical operation time after the at least one offset and the current operation time after the offset. Wherein, when the target data type is a discrete string type, the behavior data to be detected includes a first string corresponding to the target account, and the historical behavior data includes at least one second string corresponding to the target account. The first string is used to identify the current operating geographical location or current operating device of the target account, and the second string is used to identify the historical operating geographical location or historical operating device of the target account. The device further includes: A generation unit is configured to determine at least one string type contained in the at least one second string, and to count the third frequency corresponding to each string type in the at least one string type, wherein the third frequency is used to represent the number of times the string type appears in the at least one second string; From the at least one string type, determine the K string types with the highest third frequency, where K is a preset integer; Based on the K string types, a common list is determined, which includes M target strings, where M is an integer less than or equal to K. The target strings satisfy one or both of the following conditions: the third frequency of the target string is greater than the second threshold; the ratio between the third frequency of the target string and the total number of strings of the at least one second string is greater than the third threshold. The third judgment unit is specifically used for: Match the first string with the M target strings; If there is a string among the M target strings that matches the first string, then it is determined that the current behavior of the target account is a common behavior; If none of the M target strings matches the first string, then the current behavior of the target account is determined to be an unusual behavior.

7. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores program instructions; when the program instructions are executed by the processor, the processor performs the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program; when the computer program is run on one or more processors, it performs the method as described in any one of claims 1 to 5.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images