Abnormality monitoring method, device, computer equipment and storage medium

Abstract

The present application relates to the field of artificial intelligence technology, and in particular to an anomaly monitoring method, apparatus, computer equipment, and storage medium. The method comprises: obtaining the global behavior information of the target user; determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes; generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes; determining a target behavior monitoring model from candidate behavior monitoring models based on the complexity of the behavior topology map; and performing anomaly monitoring on the behavior topology map based on the target behavior monitoring model to obtain anomaly monitoring results for the global behavior information. The present application can improve the accuracy of user behavior monitoring.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an abnormality monitoring method, apparatus, computer equipment, and storage medium. Background Art

[0002] User Behavior Analytics (UBA) is a method for analyzing abnormal behavior, used to conduct compliance analysis on user behavior when accessing the system. UBA focuses on ongoing user actions, such as application launches, network connection activity, and critical file access.

[0003] Currently, traditional technologies mainly control user access (operation) behavior by issuing specific baseline policies when analyzing user behavior. The baseline policy includes multiple user behavior baselines. The user behavior baseline refers to a collection of various common attributes that are statistically calculated based on the user's various behaviors during login and access processes, such as a collection of common IP addresses, a collection of common login addresses, a collection of common devices, etc. Each user operation behavior is verified through the user behavior baseline.

[0004] However, abnormal behaviors are complex and changeable, and the current baseline strategy has poor recognition accuracy for complex abnormal behaviors, resulting in low system security. Summary of the Invention

[0005] Based on this, it is necessary to provide an anomaly monitoring method, device, computer equipment and storage medium that can improve the accuracy of user behavior monitoring in response to the above technical problems.

[0006] In a first aspect, the present application provides an abnormality monitoring method, the method comprising:

[0007] Obtain global behavior information of target users;

[0008] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0009] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0010] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0011] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0012] In one embodiment, generating a behavior topology map based on at least one monitoring node associated with global behavior information and behavior trajectories between the monitoring nodes includes:

[0013] Treat each monitoring node as a graph node in the behavior topology graph;

[0014] Determine the point attribute information of the graph node corresponding to each monitoring node based on the corresponding local behavior information in each monitoring node;

[0015] According to the behavior trajectories between different monitoring nodes, the connection edges between different graph nodes in the behavior topology graph are constructed, and the edge attribute information of each connection edge is determined.

[0016] In one embodiment, determining the point attribute information of the graph node corresponding to each monitoring node based on the local behavior information corresponding to each monitoring node includes:

[0017] For each monitoring node, determine the credibility of the corresponding local behavior information in the monitoring node;

[0018] According to the credibility, the point attribute information of the graph node corresponding to the monitoring node is determined.

[0019] In one embodiment, determining the point attribute information of the graph node corresponding to the monitoring node according to the credibility includes:

[0020] The credibility is converted into a grayscale value, and the grayscale value is used as the point attribute information of the graph node corresponding to the monitoring node.

[0021] In one embodiment, determining a target behavior monitoring model from candidate behavior monitoring models according to the complexity of the behavior topology graph includes:

[0022] According to the number of monitoring nodes corresponding to the global behavior information and the complexity of the local behavior information corresponding to each monitoring node, a target behavior monitoring model is selected from the candidate behavior monitoring models.

[0023] In a second aspect, the present application further provides an abnormality monitoring device, comprising:

[0024] Acquisition module, used to obtain global behavior information of target users;

[0025] a parsing module, configured to determine, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0026] a topology construction module for generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0027] A selection module, configured to determine a target behavior monitoring model from candidate behavior monitoring models according to the complexity of the behavior topology graph;

[0028] The monitoring module is used to perform anomaly monitoring on the behavior topology graph based on the target behavior monitoring model and obtain anomaly monitoring results of the global behavior information.

[0029] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0030] Obtain global behavior information of target users;

[0031] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0032] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0033] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0034] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0036] Obtain global behavior information of target users;

[0037] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0038] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0039] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0040] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0041] In a fifth aspect, the present application further provides a computer program product, the computer program product comprising a computer program, which, when executed by a processor, implements the following steps:

[0042] Obtain global behavior information of target users;

[0043] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0044] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0045] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0046] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0047] The above-mentioned anomaly monitoring method, device, computer equipment and storage medium generate a behavior topology map based on global behavior information, and the behavior topology map includes all monitoring nodes involved in the target user's global behavior information, the corresponding local behavior information in the monitoring nodes, and the behavior trajectories between each monitoring node; according to the complexity of the behavior topology map, the corresponding target behavior monitoring model is selected to achieve hierarchical and accurate analysis of global behavior information of different complexities; further, the global information is uniformly input into the target behavior monitoring model for analysis, which reduces the number of repeated calls of the baseline detection compared to the one-by-one analysis based on the baseline detection strategy, improves the analysis efficiency and the accuracy of anomaly monitoring; at the same time, since the target behavior monitoring model is used for anomaly monitoring, not only known abnormal behaviors can be identified in a timely manner, but also unknown abnormal behaviors can be well identified, thereby improving the monitoring ability of abnormal behaviors and greatly ensuring the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A diagram of an application environment of an abnormality monitoring method in one embodiment;

[0049] Figure 2 1 is a flow chart of an abnormality monitoring method according to an embodiment;

[0050] Figure 3A schematic diagram of a process for generating a behavior topology map in one embodiment;

[0051] Figure 4 A schematic diagram of a process for determining point attribute information based on credibility in one embodiment;

[0052] Figure 5 A schematic diagram of a flow chart of an abnormality monitoring system in another embodiment;

[0053] Figure 6 is a structural block diagram of an abnormality monitoring device in one embodiment;

[0054] Figure 7 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0056] User Behavior Analytics (UBA) is a method for analyzing abnormal behavior that is used to perform compliance analysis on the behavior of users when accessing the system. UBA focuses on the user's current behavior, such as application launch, network connection activity, key file access, etc.

[0057] Currently, traditional technologies mainly control user access (operation) behavior by issuing specific baseline policies when analyzing user behavior. The baseline policy includes multiple user behavior baselines. The user behavior baseline refers to a collection of various common attributes that are statistically calculated based on the user's various behaviors during login and access processes, such as a collection of common IP addresses, a collection of common login addresses, a collection of common devices, etc.; each user access (operation) behavior is verified through the user behavior baseline.

[0058] However, given the complex and changeable access behaviors of computers, current baseline detection can only verify and analyze known abnormal behaviors corresponding to known baseline rules, while the accuracy of identifying abnormal behaviors outside the known baseline rules is poor, resulting in lower system security.

[0059] The abnormality monitoring method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. For example, the server 104 obtains the global behavior information of the target user; based on the global behavior information, determines at least one monitoring node associated with the global behavior information, the local behavior information within each monitoring node, and the behavior trajectory between different monitoring nodes; based on at least one monitoring node associated with the global behavior information, the local behavior information within each monitoring node, and the behavior trajectory between different monitoring nodes, a behavior topology map is generated; based on the complexity of the behavior topology map, the target behavior monitoring model is determined from the candidate behavior monitoring models; based on the target behavior monitoring model, the behavior topology map is monitored for anomalies to obtain anomaly monitoring results of the global behavior information; further, the server 104 can also send the anomaly monitoring results to the terminal 102 held by the administrator so that the administrator can view the anomaly monitoring results. Terminal 102 may include, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, and smart car devices. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Server 104 may be implemented as a standalone server or a server cluster consisting of multiple servers.

[0060] In one embodiment, Figure 2 As shown, a method for abnormal monitoring is provided, which is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0061] S201, obtaining global behavior information of a target user.

[0062] The server 104 is connected to each monitoring node as a local monitoring device to monitor the security risks and operating status of each monitoring node, and each monitoring node communicates with each other through the network for data transmission.

[0063] In this embodiment, monitoring nodes are administrator-specified monitoring objects. These nodes form a monitoring set. These nodes can be servers, networked computer groups, or processors and storage within a server. They can also be containers, applications, databases, fields, records, and files on the server. Specifically, global behavior information is the behavior generated by a target user's operations on each monitoring node within the monitoring set. This information can be obtained by parsing the target user's log data. Furthermore, in this embodiment, global user behavior information characterizes a target user's continuous access behavior within the monitoring set.

[0064] For example, when determining a continuous access behavior, time can be used as a condition. Specifically, for ease of explanation, any access behavior of the target user is defined as a sub-access behavior. After the target user completes the current sub-access behavior, the server 104 starts timing until the next sub-access behavior of the target user occurs. The interval between the two sub-access behaviors is calculated. If the interval is less than the preset time, it means that the two sub-access behaviors are continuous operations, that is, they belong to the same global behavior information; otherwise, they do not belong to the same global behavior information.

[0065] S202 : Determine, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring point, and behavior trajectories between different monitoring nodes.

[0066] Among them, each monitoring node involved in (accessed by) the global behavior information is used as a monitoring node associated with the global behavior information.

[0067] Furthermore, global user behavior information includes local behavior information within each monitoring point, as well as behavior trajectories between different monitoring nodes. It is understood that local behavior information within any monitoring node is used to characterize the target user's access behavior to that monitoring node, while behavior trajectories between different monitoring nodes are used to characterize the access relationships between monitoring nodes.

[0068] Specifically, the local behavior information within a monitoring node can be the behavior information of the monitoring node when it is an access object (or accessed object). For example, as shown in Table 1 below, the local behavior information within any monitoring node (monitoring node A) can include the following attributes: access object, access time, access behavior, and accessed object within the monitoring node.

[0069] Table 1

[0070]

[0071] Specifically, when analyzing global information, a neural network model can be used for analysis. After the analysis is completed, at least one monitoring node associated with the global behavior information, the local behavior information within each monitoring point, and the behavior trajectory between different monitoring nodes can be determined.

[0072] S203 : Generate a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes.

[0073] Optionally, the parsed global behavior information is integrated into a graph, i.e., a behavior topology graph. In this embodiment, by generating a behavior topology graph, the behavior topology graph can represent the global behavior information in a hierarchical manner, i.e., including the overall behavior between different monitoring nodes and the local behavior within a single monitoring node.

[0074] S204 , determining a target behavior monitoring model from candidate behavior monitoring models according to the complexity of the behavior topology graph.

[0075] Among them, the candidate behavior monitoring model refers to a model used to analyze the behavior topology map to determine the abnormal monitoring results; it can be constructed by training the neural network model using abnormal behavior samples, wherein the abnormal behavior samples include the historical behavior topology map corresponding to the abnormal behavior information, and the label corresponding to the historical behavior topology map (corresponding abnormal monitoring results).

[0076] Since convolutional neural networks are widely used in scenarios such as image recognition, target detection, and feature extraction, when extracting image features, corresponding logistic regression will be performed in each convolution kernel to calculate the correlation probability to select the best feature. Therefore, the candidate behavior monitoring model in this embodiment can be selected by training the convolutional neural network model.

[0077] Furthermore, the candidate behavior monitoring model includes multiple neural network models that can be used to analyze behavior information of different complexities; for example, a lightweight model and a high-precision model; both the lightweight model and the high-precision model can analyze global behavior information, but the recognition accuracy of the high-precision model is higher than that of the lightweight model; further, the lightweight model can be online in real time and used to monitor global behavior information in real time; when the global behavior information is a complex access behavior, the high-precision model is used to monitor the global behavior information.

[0078] Since abnormal behaviors are complex and changeable, and the more complex the user's global behavior information is, the more difficult it is to identify whether he or she has abnormal behavior. Therefore, in this embodiment, the complexity of the behavior topology graph is first identified, and then based on the complexity, the target behavior monitoring model that matches the complexity is determined from the candidate behavior monitoring models to achieve a reasonable allocation of computing resources.

[0079] S205 , based on the target behavior monitoring model, perform anomaly monitoring on the behavior topology graph to obtain an anomaly monitoring result of the global behavior information.

[0080] Specifically, after the behavior topology map is generated, the behavior topology map is input into the target behavior monitoring model, and based on the target behavior monitoring model, the behavior topology map is monitored for anomalies to obtain an anomaly monitoring result of the global behavior information.

[0081] Furthermore, the abnormal monitoring results include the presence or absence of abnormal behavior. When abnormal behavior is detected in the global behavior information, the local monitoring device can report the global behavior information to the administrator's terminal 102 through the built-in communication module for the administrator to perform corresponding processing.

[0082] In the above-mentioned anomaly monitoring method, a behavior topology map is generated based on the global behavior information, and the behavior topology map includes all monitoring nodes involved in the target user's global behavior information, the corresponding local behavior information in the monitoring nodes, and the behavior trajectories between each monitoring node; the corresponding target behavior monitoring model is selected according to the complexity of the behavior topology map to achieve hierarchical and accurate analysis of global behavior information of different complexities; further, the global information is uniformly input into the target behavior monitoring model for analysis. Compared with the one-by-one analysis based on the baseline detection strategy, the number of repeated calls of the baseline detection is reduced, and the analysis efficiency and the accuracy of anomaly monitoring are improved; at the same time, since the target behavior monitoring model is used for anomaly monitoring, not only known abnormal behaviors can be identified in a timely manner, but also unknown abnormal behaviors can be well identified, thereby improving the monitoring ability of abnormal behaviors and greatly ensuring the security of the system.

[0083] like Figure 3 As shown, this embodiment provides an optional method for generating a behavior topology map based on at least one monitoring node associated with global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes. This provides a method for refining S203. The specific implementation process may include:

[0084] S301: Each monitoring node is used as a graph node in a behavior topology graph.

[0085] Each monitoring node is treated as a graph node, and a one-to-one mapping relationship is established between each graph node and each monitoring node. Furthermore, for each graph node, the index of the graph node corresponds to the unique index of the corresponding monitoring node in the monitoring set.

[0086] S302: Determine the point attribute information of the graph node corresponding to each monitoring node according to the local behavior information corresponding to each monitoring node.

[0087] The local behavior information corresponding to the monitoring node can be analyzed for abnormal behavior to determine the point attribute information of the corresponding graph node. Optionally, the point attribute information can be described in the form of text, numerical values, or graphic elements.

[0088] Specifically, when described in the form of graphic elements, as shown in Table 1, when the accessed monitoring node includes multiple access objects, taking the monitoring node as a computer as an example, a unique graphic element can be configured for each application, program, file, and database in the computer. After the configuration is completed, the subgraph composed of each graphic element can be used as the point attribute information of the graph node, and the access behavior at different access times (such as t1 and t2 in Table 1) can also be distinguished and represented in the point attribute information; in addition, in order to simplify the behavior topology graph, the credibility of each local behavior information in the graph node can be calculated first, and the credibility can be used as the point attribute information.

[0089] S303: Constructing connection edges between different graph nodes in the behavior topology graph according to the behavior trajectories between different monitoring nodes, and determining edge attribute information of each connection edge.

[0090] Among them, the edge attribute information is used to describe the access subject and access object (accessed) relationship between different global behavior information. The connecting edge can be a directed edge, from the access subject to the access object, to represent the access (call) relationship.

[0091] Specifically, after constructing the graph nodes, the connection edges between the graph nodes and the directions of each connection edge are constructed based on the access relationships between the graph nodes. Therefore, the generated graph nodes and the directed connection edges between the graph nodes together constitute the behavioral topology graph.

[0092] In this embodiment, an optional data structure support is provided for the target behavior monitoring model through the behavior topology graph.

[0093] In order to simplify the behavior topology diagram and improve the analysis efficiency of the target behavior monitoring model, in one embodiment, Figure 4 As shown, this embodiment provides an optional method for determining the point attribute information of the graph node corresponding to each monitoring node based on the local behavior information corresponding to each monitoring node, which may specifically include the following:

[0094] S401 : For each monitoring node, determine the credibility of the local behavior information corresponding to the monitoring node.

[0095] The local monitoring device stores the credibility weight (subject weight) of each user, the credibility weight of each monitoring node, the credibility weight of each access behavior, and the credibility weight of each accessed object (program, file, application, etc.) within each monitoring node. Accordingly, when calculating the credibility of the local behavior information of any monitoring node, taking monitoring node 1 as an example, the following table - Table 2 can be shown:

[0096] Table 2

[0097]

[0098] Specifically, the credibility of local behavior information S1 can be obtained by summarizing the credibility of each access time (access time t1 and access time t2). If the target user does not have the authority to access the monitoring node, the credibility can be configured as a negative number or 0, etc. (in the direction of reducing credibility).

[0099] It is understandable that each user's identity credibility weight (authority) is different, and each user's credibility weight based on the same access behavior is also different. Therefore, through different weight configurations, corresponding local behavior information within a variety of monitoring nodes and the credibility of the corresponding local behavior information can be derived based on the baseline rules. Furthermore, using the credibility of the above-mentioned corresponding local behavior information, various different access behaviors (corresponding behavior topology maps) can be derived, and the target behavior monitoring model can be trained using each different behavior topology map. Compared with the use of fixed baseline detection, this increases the flexibility of training samples and improves the analytical capabilities of the target behavior monitoring model.

[0100] S402: Determine the point attribute information of the graph node corresponding to the monitoring node according to the credibility.

[0101] Among them, credibility can be expressed in the form of a numerical value or in the form of attributes such as grayscale value.

[0102] Specifically, the credibility is converted or directly determined as point attribute information of the graph node corresponding to the monitoring node, and each point attribute information is displayed on the behavior topology graph.

[0103] In this embodiment, the credibility information is used as point attribute information, so that the target behavior monitoring model does not need to perform complex identification of the credibility of the access behavior within each monitoring node, simplifies the expression of the behavior topology map, and reduces the processing difficulty of the target behavior monitoring model when identifying the behavior topology map.

[0104] In one embodiment, the credibility is further converted into a grayscale value, and the grayscale value is used as the point attribute information of the graph node corresponding to the monitoring node. For example, the higher the credibility, the larger the grayscale value.

[0105] In this embodiment, the credibility of each topological point (graph node) is calculated, that is, the credibility of the entire behavioral topology graph topology is preliminarily calculated, so that when the target behavior monitoring model identifies the behavioral topology graph, it can comprehensively detect abnormal behaviors in two dimensions: single graph node access behavior and global graph node access behavior, thereby improving the detection accuracy of abnormal behaviors with higher complexity.

[0106] Since abnormal behaviors are complex and changeable, and the more complex the access behavior is, the more difficult it is to identify its credibility, in one embodiment, this embodiment provides an optional method for determining the target behavior monitoring model from the candidate behavior monitoring models based on the complexity of the behavior topology graph. Specifically, it may include the following process: based on the number of monitoring nodes corresponding to the global behavior information and the complexity of the corresponding local behavior information in each monitoring node, the target behavior monitoring model is selected from the candidate behavior monitoring models.

[0107] The number of monitoring nodes corresponding to the global behavior information refers to the number of nodes in the behavior topology graph; the complexity of the local behavior information corresponding to any monitoring node can be determined by the number of accessed objects in the monitoring node.

[0108] Specifically, the complexity of global behavior information can be divided into levels, for example, including low-complexity behavior and high-complexity behavior. For example, if the number of monitoring nodes corresponding to the global behavior information is greater than or equal to 5, then the global behavior information is high-complexity behavior; or, if the number of accessed objects in any monitoring node is greater than or equal to 5, then the global behavior information is high-complexity behavior; conversely, if there is no high-complexity behavior, then the global behavior information is low-complexity behavior.

[0109] Furthermore, the candidate models in the above example may specifically include a single-point analysis model, a lightweight model, and a high-precision model.

[0110] Among them, the access behavior corresponding to the single-point analysis model is: the target user only accesses one monitoring node, that is, it does not contain cross-node access behavior. Specifically, the single-point analysis model can adopt the K-Means model. The analysis process of the single-point analysis model is as follows: in this global behavior information, the target user visited monitoring node A and performed a series of access operations in monitoring node A. In addition, for this monitoring node A, the historical single-point behaviors that have been obtained include: user C visited monitoring node A, and user D visited monitoring node A. At this time, it is only necessary to use the K-Means model to identify the credibility of monitoring node A corresponding to the behavior topology map corresponding to the target user, the behavior topology map corresponding to user C, and the behavior topology map corresponding to user D, and perform cluster analysis on the credibility of monitoring node A. According to the cluster analysis, the abnormal points are screened. If the credibility of the target user is low (an abnormal point), then the abnormal monitoring result of the global behavior information is determined to contain abnormal behavior.

[0111] Optionally, the lightweight model is based on the structure of the AlexNet network model and is adjusted according to the actual usage scenario. Specifically, it includes: convolutional layers, pooling layers, and fully connected layers. The convolutional layers are used to extract features from the behavior topology graph, the pooling layers are used for downsampling without damaging the recognition results, and the fully connected layers are used for classification.

[0112] Exemplarily, the structure of the lightweight model can be: input layer (200x200x20) -> convolution layer (20x20) -> pooling layer (12x12) -> convolution layer (10x10) -> pooling layer (7x7) -> convolution layer x3 (5x5) -> pooling layer (3x3) -> fully connected layer (assuming 4096) -> fully connected layer (1024) -> result mapping (10).

[0113] Optionally, the high-precision model is based on the VGG-16 network structure and is adjusted according to the actual usage scenario. Specifically, it includes: input layer (input), convolution layer (conv), pooling layer (max-pool), fully connected layer (full-conn), and result layer (result);

[0114] For example, the structure of the high-precision model can be:

[0115] Input(200x200x20)->[conv(10x10)->conv(10x10)->conv(3x3)->max-pool(1x1)]x3->[conv(5x5)->conv(3x3)->m ax-pool(2x2)->conv(3x3)->conv(2x2)->max-pool(1x1)]x3->full-conn(4096)->full-conn(1024)->result(10).

[0116] If you need to further improve the calculation accuracy, you can add one or two convolution units, that is, [conv(10x10)->conv(10x10)->conv(3x3)->max-pool(1x1)] or [conv(5x5)->conv(3x3)->max-pool(2x2)->conv(3x3)->conv(2x2)->max-pool(1x1)].

[0117] In this embodiment, both the lightweight model and the high-precision model can identify behavioral topologies containing multiple graph nodes. Specifically, when using the lightweight model and the high-precision model to analyze the current behavioral topology graph corresponding to the global behavior information, the lightweight model and the high-precision model identify the access route characteristics of the behavioral topology graph (each graph node, each connecting edge, and the angle formed between adjacent connecting edges) and the grayscale value of each graph node, extract the characteristics of the current behavioral topology graph, and calculate the similarity between the characteristics and the characteristics of each abnormal behavioral topology graph extracted from the training sample. If the similarity is higher than the preset threshold, it means that there is abnormal behavior in the current behavioral topology graph. If the similarity is lower than the preset threshold, it means that there is no abnormal behavior in the current behavioral topology graph.

[0118] In summary, when the global behavior information only includes the access behavior of a single monitoring node, the single-point analysis model can be selected as the target behavior monitoring model; when the global behavior information only includes the access behavior of at least two monitoring nodes, a lightweight model and / or a high-precision model can be selected, for example, as shown in Table 3 below:

[0119] Table 3

[0120]

[0121] Furthermore, if the global behavior information corresponds to low-complexity behavior, a lightweight analysis model can be selected as the target behavior monitoring model. Then, when the complexity of the global behavior information gradually increases and is identified as high-complexity behavior, a high-precision model can be used as the target behavior monitoring model. In this case, the global behavior information may correspond to two target behavior monitoring models.

[0122] When the behavior topology map is input into the target behavior monitoring model to determine the abnormal monitoring result of the global behavior information: in one feasible method, when the number of target behavior monitoring models is at least two, the behavior topology map is input into two target behavior monitoring models respectively, and the output result of the target behavior monitoring model with higher determination accuracy (corresponding to higher access behavior complexity) is the abnormal monitoring result.

[0123] In another possible implementation, when there are at least two target behavior monitoring models, the behavior topology graph is input into the two target behavior monitoring models respectively, and the respective monitoring results of the two target behavior monitoring models are integrated to determine the abnormal monitoring result.

[0124] It should be noted that, during the monitoring process, the target behavior monitoring model used to analyze low-complexity global behavior information is first called up to analyze the real-time generated behavior topology map. When it is detected that the global behavior information reaches a corresponding high complexity, the target behavior monitoring model used to analyze high-complexity global behavior information is started. Among them, the target behavior monitoring model used to analyze high-complexity global behavior information does not have to be online in real time, which saves computing resources. At the same time, the target behavior monitoring model can perform timely analysis when high-complexity global behavior information appears, thereby improving the security of abnormal monitoring.

[0125] In this embodiment, we first analyze the number of monitoring nodes corresponding to the global behavior information and the complexity of the local behavior information corresponding to each monitoring node, determine the behavior complexity corresponding to the global behavior information, and match the corresponding target behavior monitoring model for operations of different complexities, thereby achieving targeted analysis, improving the accuracy of anomaly monitoring, and achieving the effect of reasonable allocation of computing resources.

[0126] Furthermore, the local monitoring device communicates with each monitoring node through the network to monitor the security risks and operating status of each monitoring node. That is, when the local monitoring device calls the target behavior monitoring model to analyze the behavior topology map, it uses the communication network to obtain the global behavior information of each monitoring node. At the same time, it is also used to call the corresponding target behavior monitoring model to analyze the global behavior information. Therefore, the network communication status of the local monitoring device has a corresponding impact on the process of the behavior analysis process. Therefore, in the process of calling the target behavior monitoring model to analyze the behavior topology map, the network communication status of the local monitoring device is first detected. If a delay in the network communication is detected, the network delay status can be sent to the remote decision-making platform, or the currently called target behavior monitoring model can be further adjusted according to the network communication status.

[0127] Exemplarily, the above-mentioned lightweight model requires fewer computing resources than the high-precision model, and uses a lower amount of data transmitted over the communication network; the single-point analysis model requires less data to be called than the lightweight model, and uses a lower amount of data transmitted over the communication network. If the target behavior monitoring model to which the global behavior information has been assigned is the above-mentioned high-precision model, and there is a delay in the network communication of the local monitoring device, then a lightweight model can be selected to replace the above-mentioned high-precision model, that is, the lightweight model can be used as the target behavior monitoring model corresponding to the global behavior information. In this embodiment, by analyzing the network communication status of the local monitoring device, the efficiency of the behavior topology analysis is prioritized to achieve initial screening of abnormal behaviors.

[0128] Since there is less abnormal behavior data and abnormal behavior changes are difficult to determine, the number of collected training samples that can be used for candidate behavior monitoring models is relatively small. Therefore, in order to expand the training samples and enhance the behavior monitoring model's ability to analyze abnormal behavior, in one embodiment, the abnormal monitoring method also includes: if it is determined that abnormal behavior exists in the global behavior information based on the abnormal monitoring results, the abnormal monitoring results and the behavior topology map are used as new training samples, and when the update conditions are met, the candidate behavior monitoring model is updated through the training sub-module.

[0129] Among them, satisfying the update conditions can be artificially set conditions. For example, when the behavior monitoring model determines that there is abnormal behavior in the global behavior information, the administrator verifies the result to determine whether there is an abnormality. If so, the number of behavior topology graphs corresponding to similar abnormal behaviors reaches a corresponding number, and then each candidate behavior monitoring model is updated.

[0130] In this embodiment, the candidate behavior monitoring model is updated by further identifying the abnormal monitoring results and sending the behavior topology map and abnormal monitoring results that meet the update conditions back to the training submodule. This is a means of strengthening the candidate behavior monitoring model. Compared with the traditional method of issuing baseline files, this increases the self-learning ability.

[0131] The present application also provides an abnormality monitoring system, which is configured in a local monitoring device, such as Figure 5 As shown, the anomaly monitoring system includes a topology map generation module 1, a deployment module 2, a behavior detection module 3, and an update judgment module 4; wherein the topology map generation module 1 is used to obtain the global behavior information of the target user in response to the detection request; based on the global behavior information, determine at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes; based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes, generate a behavior topology map;

[0132] The method comprises generating a behavior topology graph based on at least one monitoring node associated with global behavior information and the behavior trajectories between the monitoring nodes, comprising: treating each monitoring node as a graph node in the behavior topology graph; determining, for each monitoring node, the credibility of the local behavior information corresponding to the monitoring node; determining, based on the credibility, point attribute information of the graph node corresponding to the monitoring node; constructing connection edges between different graph nodes in the behavior topology graph based on the behavior trajectories between different monitoring nodes, and determining edge attribute information of each connection edge;

[0133] Specifically, for each monitoring node, the credibility of the local behavior information corresponding to the monitoring node is determined; based on the credibility, the point attribute information of the graph node corresponding to the monitoring node is determined.

[0134] Deployment module 2, used to deploy the trained candidate behavior monitoring models to behavior detection module 3 according to the deployment request;

[0135] The behavior detection module 3 is used to determine the target behavior monitoring model from the candidate behavior monitoring models according to the complexity of the behavior topology map; based on the target behavior monitoring model, perform anomaly monitoring on the behavior topology map to obtain anomaly monitoring results of global behavior information.

[0136] Among them, according to the complexity of the behavior topology graph, the target behavior monitoring model is determined from the candidate behavior monitoring models, including: selecting the candidate behavior monitoring model from the candidate behavior monitoring models according to the network communication situation between the local monitoring device and the monitoring node; determining the target behavior monitoring model from the candidate behavior monitoring models according to the number of monitoring nodes corresponding to the global behavior information and the complexity of the corresponding local behavior information in each monitoring node.

[0137] The update judgment module 4 is used to input the abnormal monitoring results and the behavior topology map as new training samples into the training submodule of the deployment module 2, and update the candidate behavior monitoring model when the update conditions are met.

[0138] The above specific process can be found in the description of the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0139] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0140] Based on the same inventive concept, the present application also provides an anomaly monitoring device for implementing the aforementioned anomaly monitoring method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more of the following anomaly monitoring device embodiments can be found in the above-described limitations of the anomaly monitoring method and are not further elaborated here.

[0141] In one embodiment, Figure 6 As shown, an abnormality monitoring device 100 is provided, comprising: an acquisition module 110, a parsing module 120, a topology construction module 130, a selection module 140 and a monitoring module 150, wherein:

[0142] An acquisition module 110 is used to acquire global behavior information of a target user;

[0143] The parsing module 120 is configured to determine, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0144] A topology construction module 130 is configured to generate a behavior topology graph based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0145] A selection module 140 is configured to determine a target behavior monitoring model from candidate behavior monitoring models based on the complexity of the behavior topology graph;

[0146] The monitoring module 150 is used to perform anomaly monitoring on the behavior topology graph based on the target behavior monitoring model to obtain anomaly monitoring results of global behavior information.

[0147] In one embodiment, the topology building module 130 includes:

[0148] The monitoring node construction submodule is used to treat each monitoring node as a graph node in the behavior topology graph;

[0149] The attribute construction submodule is used to determine the point attribute information of the graph node corresponding to each monitoring node based on the corresponding local behavior information in each monitoring node;

[0150] The edge construction submodule is used to construct the connection edges between different graph nodes in the behavior topology graph according to the behavior trajectories between different monitoring nodes, and to determine the edge attribute information of each connection edge.

[0151] In one embodiment, the attribute construction submodule includes:

[0152] A calculation slave module is used to determine the credibility of the local behavior information corresponding to each monitoring node;

[0153] A slave module is constructed to determine the point attribute information of the graph node corresponding to the monitoring node according to the credibility.

[0154] In one embodiment, the construction module is further used to: convert the credibility into a grayscale value, and use the grayscale value as the point attribute information of the graph node corresponding to the monitoring node.

[0155] In one embodiment, the selection module 140 is configured to select a target behavior monitoring model from candidate behavior monitoring models based on the number of monitoring nodes corresponding to the global behavior information and the complexity of the local behavior information corresponding to each monitoring node.

[0156] In one embodiment, the anomaly detection device also includes an update module, which is used to: if it is determined that abnormal behavior exists in the global behavior information based on the anomaly monitoring results, the anomaly monitoring results and the behavior topology map are used as new training samples, and when the update conditions are met, the candidate behavior monitoring model is updated.

[0157] Each module in the above-mentioned abnormality monitoring device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor of the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0158] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store abnormality monitoring data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an abnormality monitoring method is implemented.

[0159] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0160] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0161] Obtain global behavior information of target users;

[0162] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0163] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0164] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0165] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0166] In one embodiment, when a processor executes a computer program to generate the logic of a behavior topology graph based on at least one monitoring node associated with global behavior information and the behavior trajectories between each monitoring node, the processor specifically implements the following steps: treating each monitoring node as a graph node in the behavior topology graph; determining the point attribute information of the graph node corresponding to each monitoring node based on the corresponding local behavior information in each monitoring node; constructing connecting edges between different graph nodes in the behavior topology graph based on the behavior trajectories between different monitoring nodes, and determining the edge attribute information of each connecting edge.

[0167] In one embodiment, when the processor executes a computer program to determine the logic of the point attribute information of the graph node corresponding to each monitoring node based on the local behavior information corresponding to each monitoring node, the following steps are specifically implemented: for each monitoring node, the credibility of the local behavior information corresponding to the monitoring node is determined; based on the credibility, the point attribute information of the graph node corresponding to the monitoring node is determined.

[0168] In one embodiment, when the processor executes a computer program to determine the logic of the point attribute information of the graph node corresponding to the monitoring node based on the credibility, the following steps are specifically implemented: the credibility is converted into a grayscale value, and the grayscale value is used as the point attribute information of the graph node corresponding to the monitoring node.

[0169] In one embodiment, when the processor executes a computer program to determine the logic of the target behavior monitoring model from the candidate behavior monitoring models based on the complexity of the behavior topology graph, the following steps are specifically implemented: based on the number of monitoring nodes corresponding to the global behavior information and the complexity of the local behavior information corresponding to each monitoring node, the target behavior monitoring model is selected from the candidate behavior monitoring models.

[0170] In one embodiment, when the processor executes the computer program, it also implements the following steps: if it is determined that abnormal behavior exists in the global behavior information based on the abnormal monitoring results, the abnormal monitoring results and the behavior topology map are used as new training samples, and when the update conditions are met, the candidate behavior monitoring model is updated.

[0171] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0172] Obtain global behavior information of target users;

[0173] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0174] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0175] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0176] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0177] In one embodiment, when the computer program generates logic for a behavior topology graph based on at least one monitoring node associated with global behavior information and the behavior trajectories between each monitoring node, the following steps are specifically implemented when the computer program is executed by a processor: each monitoring node is treated as a graph node in the behavior topology graph; based on the corresponding local behavior information in each monitoring node, the point attribute information of the graph node corresponding to each monitoring node is determined; based on the behavior trajectories between different monitoring nodes, the connection edges between different graph nodes in the behavior topology graph are constructed, and the edge attribute information of each connection edge is determined.

[0178] In one embodiment, when the logic of the computer program that determines the point attribute information of the graph node corresponding to each monitoring node based on the local behavior information corresponding to each monitoring node is executed by the processor, the following steps are specifically implemented: for each monitoring node, the credibility of the local behavior information corresponding to the monitoring node is determined; based on the credibility, the point attribute information of the graph node corresponding to the monitoring node is determined.

[0179] In one embodiment, when the logic of determining the point attribute information of the graph node corresponding to the monitoring node based on the credibility is executed by the processor, the following steps are specifically implemented: the credibility is converted into a grayscale value, and the grayscale value is used as the point attribute information of the graph node corresponding to the monitoring node.

[0180] In one embodiment, when the computer program is executed by a processor for the logic of determining a target behavior monitoring model from candidate behavior monitoring models based on the complexity of a behavior topology graph, the following steps are specifically implemented: based on the number of monitoring nodes corresponding to the global behavior information and the complexity of the corresponding local behavior information in each monitoring node, the target behavior monitoring model is selected from the candidate behavior monitoring models.

[0181] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if it is determined that abnormal behavior exists in the global behavior information based on the abnormal monitoring results, the abnormal monitoring results and the behavior topology map are used as new training samples, and when the update conditions are met, the candidate behavior monitoring model is updated.

[0182] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0183] Obtain global behavior information of target users;

[0184] Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0185] generating a behavior topology map based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes;

[0186] According to the complexity of the behavior topology graph, a target behavior monitoring model is determined from candidate behavior monitoring models;

[0187] Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies, and the anomaly monitoring results of the global behavior information are obtained.

[0188] In one embodiment, when the computer program generates logic for a behavior topology graph based on at least one monitoring node associated with global behavior information and the behavior trajectories between each monitoring node, the following steps are specifically implemented when the computer program is executed by a processor: each monitoring node is treated as a graph node in the behavior topology graph; based on the corresponding local behavior information in each monitoring node, the point attribute information of the graph node corresponding to each monitoring node is determined; based on the behavior trajectories between different monitoring nodes, the connection edges between different graph nodes in the behavior topology graph are constructed, and the edge attribute information of each connection edge is determined.

[0189] In one embodiment, when the logic of the computer program that determines the point attribute information of the graph node corresponding to each monitoring node based on the local behavior information corresponding to each monitoring node is executed by the processor, the following steps are specifically implemented: for each monitoring node, the credibility of the local behavior information corresponding to the monitoring node is determined; based on the credibility, the point attribute information of the graph node corresponding to the monitoring node is determined.

[0190] In one embodiment, when the logic of determining the point attribute information of the graph node corresponding to the monitoring node based on the credibility is executed by the processor, the following steps are specifically implemented: the credibility is converted into a grayscale value, and the grayscale value is used as the point attribute information of the graph node corresponding to the monitoring node.

[0191] In one embodiment, when the computer program is executed by a processor for the logic of determining a target behavior monitoring model from candidate behavior monitoring models based on the complexity of a behavior topology graph, the following steps are specifically implemented: based on the number of monitoring nodes corresponding to the global behavior information and the complexity of the corresponding local behavior information in each monitoring node, the target behavior monitoring model is selected from the candidate behavior monitoring models.

[0192] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if it is determined that abnormal behavior exists in the global behavior information based on the abnormal monitoring results, the abnormal monitoring results and the behavior topology map are used as new training samples, and when the update conditions are met, the candidate behavior monitoring model is updated.

[0193] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0194] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0195] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0196] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for abnormality monitoring, characterized in that: The method comprises: Obtain global behavior information of target users; Determining, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes; A behavior topology graph is generated based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes. The behavior topology graph hierarchically represents the global behavior information, including an overall behavior hierarchy between different monitoring nodes and a local behavior hierarchy within a single monitoring node. The local behavior information within any monitoring node is used to represent the target user's access behavior to the monitoring node. The behavior trajectories between different monitoring nodes are used to represent the access relationship between the monitoring nodes. The local behavior information within any monitoring node includes the following attributes: access object, access time, access behavior, and accessed object within the monitoring node. determining a target behavior monitoring model from candidate behavior monitoring models according to the complexity of the behavior topology graph; Based on the target behavior monitoring model, the behavior topology graph is monitored for anomalies to obtain an anomaly monitoring result of the global behavior information; The generating of a behavior topology graph based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between each monitoring node includes: Treat each monitoring node as a graph node in the behavior topology graph; For each monitoring node, determine the credibility of the corresponding local behavior information within the monitoring node; Convert the credibility into a grayscale value, and use the grayscale value as the point attribute information of the graph node corresponding to the monitoring node; According to the behavior trajectories between different monitoring nodes, directed connection edges between different graph nodes in the behavior topology graph are constructed, and the edge attribute information of each directed connection edge is determined, wherein the edge attribute information is used to describe the access subject and access object relationship between different global behavior information, and the connection edge is pointed from the access subject to the access object to represent the access relationship.

2. The method according to claim 1, characterized in that Determining a target behavior monitoring model from the candidate behavior monitoring models according to the complexity of the behavior topology graph includes: The target behavior monitoring model is selected from candidate behavior monitoring models according to the number of monitoring nodes corresponding to the global behavior information and the complexity of the local behavior information corresponding to each monitoring node.

3. The method according to claim 2, characterized in that The method further comprises: If it is determined that abnormal behavior exists in the global behavior information based on the abnormal monitoring result, the abnormal monitoring result and the behavior topology map are used as new training samples, and the candidate behavior monitoring model is updated when an update condition is met.

4. An abnormality monitoring device, characterized in that: The device comprises: Acquisition module, used to obtain global behavior information of target users; a parsing module, configured to determine, based on the global behavior information, at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes; A topology construction module is configured to generate a behavior topology diagram based on at least one monitoring node associated with the global behavior information, local behavior information within each monitoring node, and behavior trajectories between different monitoring nodes, wherein the behavior topology diagram hierarchically represents the global behavior information, including an overall behavior hierarchy between different monitoring nodes and a local behavior hierarchy within a single monitoring node; the local behavior information within any monitoring node is used to represent the target user's access behavior to the monitoring node; the behavior trajectories between different monitoring nodes are used to represent the access relationship between the monitoring nodes; the local behavior information within any monitoring node includes the following attributes: access object, access time, access behavior, and accessed object within the monitoring node; A selection module, configured to determine a target behavior monitoring model from candidate behavior monitoring models according to the complexity of the behavior topology graph; A monitoring module, configured to perform anomaly monitoring on the behavior topology graph based on the target behavior monitoring model, and obtain an anomaly monitoring result of the global behavior information; The topology building module is specifically used to: Treat each monitoring node as a graph node in the behavior topology graph; For each monitoring node, determine the credibility of the corresponding local behavior information within the monitoring node; Convert the credibility into a grayscale value, and use the grayscale value as the point attribute information of the graph node corresponding to the monitoring node; According to the behavior trajectories between different monitoring nodes, directed connection edges between different graph nodes in the behavior topology graph are constructed, and the edge attribute information of each directed connection edge is determined, wherein the edge attribute information is used to describe the access subject and access object relationship between different global behavior information, and the connection edge is pointed from the access subject to the access object to represent the access relationship.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

7. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images