Mobile office user abnormal behavior detection method based on graph convolutional neural network

Abstract

The application discloses a mobile office user abnormal behavior detection method based on a graph convolutional neural network, relates to the technical field of user entity behavior analysis, and reserves user operation preference information for user baseline clustering by adopting knowledge graph technology to represent a user operation sequence; a relational graph convolutional neural network algorithm is used to cluster a strong correlation entity set from a user operation graph, the problem that the length of a user operation baseline is difficult to determine is solved, the difficulty of matching user operation flow data with the baseline in the later period is reduced, and the accuracy of matching the operation sequence with the baseline is improved. The method for determining the operation baseline by finding the operation weight maximum path can improve the operation baseline semantics and continuously adapt to user operation behavior changes. Meanwhile, the application can solve the problem that an Android device is difficult to detect user abnormal behavior in real time due to insufficient computing power and bandwidth by constructing a server and client cooperative detection model.

Description

Technical Field

[0001] This invention relates to the field of user entity behavior analysis technology, and in particular to a method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks. Background Technology

[0002] With the rapid development of internet technology and the promotion of the national big data strategy, data has become one of the most important assets for enterprises. Attacks targeting enterprise databases are rampant, and to protect enterprise data security, enterprise systems need to implement real-time data protection. Existing protection solutions mostly analyze system log information to detect intruders, but this method can only prevent known intrusion methods and cannot prevent new attack methods, nor can it prevent malicious acts such as account compromise or internal employee attacks. Therefore, the dual needs from both internal and external sources have given rise to User and Entity Behavior Analysis (UEBA).

[0003] User entity behavior analysis (UAV) is an emerging intrusion detection system that has shifted network security protection from "post-incident inspection" to "prevention." UAV focuses on user access behavior to resources. Its core idea is to compare a user's current behavior sequence with the user's past behavior baseline to identify abnormal behavior and issue timely alerts, thereby resolving issues such as account compromise and blocking risks before data theft occurs.

[0004] Currently, many mobile applications allow employees to perform corresponding business operations and access databases using Android devices. Therefore, a solution is needed to identify abnormal user behavior in real time and promptly issue alerts and restrict permissions for abnormal users, while meeting the computing power and bandwidth limitations of Android devices.

[0005] Existing user entity behavior analysis solutions, such as extracting features from user behavior and comparing them with a feature baseline to identify suspected anomalous users, then using an ensemble algorithm to give a comprehensive score to suspected anomalous users, with users scoring above a set threshold being identified as anomalous users, suffer from several drawbacks. The feature baseline is pre-set, failing to distinguish individual user characteristics and changes in behavioral patterns, and it ignores the relationships between entities during access. This solution only performs non-real-time detection of anomalous user behavior, making it insufficient for meeting detection requirements. Another approach involves extracting session information from user webpage access data, using the SimHash algorithm to calculate user similarity, and then using fuzzy clustering to identify suspected users. However, this solution uses fuzzy clustering to analyze differences between users to identify anomalous users, making it difficult to adapt to Android devices and unable to effectively analyze the behavior of individual users. Furthermore, it loses a significant amount of relational information during the clustering process.

[0006] It is evident that existing real-time user anomaly detection technologies primarily target PCs. Android devices, due to limitations in computing power and bandwidth, struggle to migrate and efficiently perform operations such as data baseline clustering and generation using PC-based detection solutions. Furthermore, current user anomaly detection technologies mainly extract user behavior baselines by abstracting user actions into time-series sequences and then using traditional algorithms like K-means clustering. Such algorithms struggle to define the length of user action sequences and neglect the relationships between entities accessed by the user. Summary of the Invention

[0007] To address the issues of lost entity operation relationships and incomplete operation baseline semantics during anomaly detection, this invention aims to provide a method for detecting abnormal user behavior in mobile office environments based on graph convolutional neural networks. This method employs knowledge graph processing to obtain a user operation graph. Considering entity access relationships, a relational graph convolutional neural network algorithm is used to cluster related node groups, which are then matched with the user operation graph to obtain the user operation baseline. To meet the need for real-time detection of abnormal user behavior on Android devices, this invention proposes a server-user device collaborative detection scheme to address the limitations of computing power and bandwidth on Android devices.

[0008] Therefore, the present invention provides the following technical solution:

[0009] On one hand, this invention discloses a method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks, applied to offline identification of abnormal behavior of mobile office users on user devices. When the current user device bandwidth supports real-time transmission of user operation stream data, the method includes:

[0010] User equipment uploads user operation stream data to the server in real time;

[0011] The server obtains the user operation baseline through a baseline clustering algorithm;

[0012] The server compares the extracted user operation sequence information with the edit distance of the user operation baseline in real time to determine the degree of deviation of the user operation; the edit distance is a quantitative measure of the degree of deviation of the user operation.

[0013] Compare the degree of deviation of the user's operation with the deviation threshold; when the degree of deviation of the user's operation is greater than or equal to the threshold, the application issues an alarm and restricts the user's privileges; when the degree of deviation of the user's operation is less than the threshold, the comparison information is recorded in the log.

[0014] The baseline clustering algorithm includes:

[0015] Acquire user operation stream data sent by user equipment; and construct a user operation graph based on the operation stream data within a fixed time window;

[0016] Based on the user operation graph, a set of strongly associated entities is obtained by clustering using a relational graph convolutional neural network.

[0017] The strongly associated entity set obtained by clustering each relation graph convolutional neural network is matched with the user operation graph, and the corresponding entity nodes are marked. The path with the largest weight is selected as the operation baseline.

[0018] The operation baseline is converted into a string using a symbol set approximation algorithm.

[0019] Furthermore, it also includes: the server sending the user operation baseline to the client, and the client accepting and updating the user operation baseline.

[0020] Furthermore, based on the user operation graph, a strongly associated entity set is obtained by clustering using a relational graph convolutional neural network, including:

[0021] The user operation graph is input into a relational graph convolutional neural network;

[0022] The relational graph convolutional neural network was used for training.

[0023] Classification is performed using the minimized cross-entropy loss function, outputting a set of strongly correlated nodes.

[0024] Furthermore, a user operation graph is constructed based on the operation flow data within a fixed time window, including:

[0025] Based on the data collected from each user device and the known prior knowledge of the application, each operable component of the application interface is abstracted into an entity. The relationship between entities is the temporal relationship of the user's operation of each component, and the relationship weight is the operation frequency.

[0026] Furthermore, user access restrictions include: restricting user access to the database and the permission to read application cache information.

[0027] Furthermore, before determining that the user equipment bandwidth supports real-time transmission of user operation stream data, the method further includes:

[0028] The user equipment connects to the server and initializes information;

[0029] Capture and process user operation data in real time.

[0030] In another aspect, the present invention also provides a method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks, applied to the online identification of abnormal behavior of mobile office users by a server, when the current user device bandwidth does not support real-time transmission of user operation stream data, the method includes:

[0031] The user operation baseline recorded in the user equipment's memory is obtained; the user operation baseline is determined by the server according to a baseline clustering algorithm and then transmitted to the user equipment.

[0032] Extract the operation feature string;

[0033] The degree of deviation of the user operation is obtained by comparing the edit distance between the operation feature string and the user operation baseline; the edit distance is a quantitative measure of the degree of deviation of the user operation.

[0034] The system compares the degree of deviation of a user's operation with the deviation threshold. When the degree of deviation is greater than or equal to the threshold, the application issues an alert and restricts the user's privileges. When the degree of deviation is less than the threshold, the comparison information is recorded in the log.

[0035] The baseline clustering algorithm includes:

[0036] Acquire user operation stream data sent by user equipment; and construct a user operation graph based on the operation stream data within a fixed time window;

[0037] Based on the user operation graph, a set of strongly associated entities is obtained by clustering using a relational graph convolutional neural network.

[0038] The strongly associated entity set obtained by clustering each relation graph convolutional neural network is matched with the user operation graph, and the corresponding entity nodes are marked. The path with the largest weight is selected as the operation baseline.

[0039] The operation baseline is converted into a string using a symbol set approximation algorithm.

[0040] Furthermore, the extraction of operation feature strings includes: converting the operation stream data into strings using a symbol set approximation algorithm, and extracting the corresponding operation feature strings using a sliding window method with a fixed first term.

[0041] Furthermore, when the deviation of the user's operation is less than the threshold, the process returns to the step of extracting the operation feature string.

[0042] In another aspect, the present invention also provides a mobile office user abnormal behavior detection system based on graph convolutional neural networks, the system comprising: user equipment and server;

[0043] The user equipment includes an initialization module, a user operation data acquisition module, a bandwidth determination module, and an offline identification module; wherein:

[0044] The initialization module is used for user equipment to connect to the server and initialize information;

[0045] The user operation data acquisition module is used to capture and process user operation data in real time;

[0046] The bandwidth determination module is used to determine whether the current user device bandwidth supports real-time transmission of user operation stream data. If the current device bandwidth is limited, the user device uses the offline identification module to perform offline abnormal user behavior detection; if the current device bandwidth is not limited, the server performs online abnormal user behavior detection. The offline identification module uses the above-mentioned offline identification method to perform abnormal user behavior detection; the server uses the above-mentioned online identification method to perform abnormal user behavior detection.

[0047] Advantages and positive effects of the present invention:

[0048] Compared with existing technologies, this invention uses knowledge graph technology to represent user operation sequences, preserving user operation preference information for user baseline clustering; it uses a relational graph convolutional neural network algorithm to cluster strongly associated entity sets from the user operation graph, solving the problem of difficulty in determining the length of the user operation baseline, reducing the difficulty of matching user operation flow data with the baseline in the later stage, and improving the accuracy of matching operation sequences with the baseline; the proposed method of determining the operation baseline by finding the path with the maximum operation weight can improve the semantics of the operation baseline and continuously adapt to changes in user operation behavior; by constructing a server-client collaborative detection model, it can solve the problem that Android devices are limited by insufficient computing power and bandwidth, making it difficult to detect abnormal user behavior in real time. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is the main flowchart for detecting abnormal behavior of mobile office users in this embodiment of the invention;

[0051] Figure 2 This is a flowchart of the offline identification process for abnormal user behavior in an embodiment of the present invention;

[0052] Figure 3 This is a diagram of the online user abnormal behavior identification module in an embodiment of the present invention;

[0053] Figure 4 This is a flowchart of the clustering process for strongly related nodes in an embodiment of the present invention;

[0054] Figure 5 This is a schematic diagram of the user operation map in an embodiment of the present invention;

[0055] Figure 6 This is a schematic diagram of a relational graph convolutional neural network in an embodiment of the present invention. Detailed Implementation

[0056] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0057] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0058] like Figure 1 As shown, the mobile office user abnormal behavior detection method based on graph convolutional neural networks proposed in this invention can be divided into online detection and offline detection depending on whether the user's device bandwidth is limited. Specifically, it includes the following steps:

[0059] S101. The user equipment connects to the server and initializes information.

[0060] The information that needs to be initialized includes: user information (username, group affiliation), device information (device hardware address, device cache, device logs), and network information (IP address, network bandwidth status).

[0061] S102. Capture and process user operation data in real time.

[0062] The user device captures the user device application's operation flow data (including but not limited to button clicks and text input boxes) in real time and stores the user operation flow data locally.

[0063] S103. Determine whether the current user equipment bandwidth supports real-time transmission of user operation stream data.

[0064] If bandwidth is limited, it means that the current user device bandwidth does not support real-time transmission of user operation stream data, and online recognition is not possible; offline recognition is the only option. If bandwidth is not limited, it means that the current user device bandwidth supports real-time transmission of user operation stream data, and online recognition is possible.

[0065] S104. If the current device bandwidth is limited, then activate the offline identification scheme for abnormal user behavior on the mobile terminal.

[0066] S105. If the current device bandwidth is not limited, then activate the online identification scheme for abnormal user behavior on the mobile terminal.

[0067] Offline user anomaly identification refers to the process where, when a user's bandwidth cannot support real-time streaming data transmission, the user can analyze their actions based on a baseline of previously received user activity. For example... Figure 2 As shown, the steps of the offline identification method for abnormal user behavior on mobile devices proposed in this invention are as follows:

[0068] S201. Obtain the user operation baseline recorded in the user equipment memory.

[0069] S202, Extract the operation feature string.

[0070] Since the user operation sequence string is generated in the form of streaming data, the Symbolic Aggregate Approximation (SAX) algorithm is used to convert the operation streaming data into a string. The corresponding operation feature string is extracted by the sliding window method with a fixed first item for feature matching.

[0071] S203, Calculate the degree of deviation of user operation.

[0072] By comparing the edit distance between the operation feature string and the user operation baseline, the similarity between the user operation and the baseline can be obtained, and the edit distance can be used as a quantitative measure of the degree of deviation of the user operation.

[0073] S204. Compare the degree of deviation of the operation with the magnitude of the deviation threshold.

[0074] S205. When a user's deviation is greater than or equal to the threshold, the application will issue an alert and restrict the user's privileges (including but not limited to access to the database and access to read application cache information).

[0075] S206. When the user's deviation is less than the threshold, the comparison information is recorded in the log and the process proceeds to step S202 to re-extract the operation feature string.

[0076] When the user device's bandwidth allows, the device uploads the user's action sequence string to the server. The server then performs computationally intensive operations on the action sequence, such as behavior extraction and baseline clustering, achieving higher recognition accuracy than offline recognition. By constructing a server-client collaborative detection model, the problem of Android devices being unable to detect abnormal user behavior in real time due to insufficient computing power and bandwidth can be solved.

[0077] The online user abnormal behavior identification function consists of three modules: a data preprocessing module, an operation baseline acquisition module, and an anomaly detection module. The diagram of the online user abnormal behavior identification module is shown below. Figure 3 As shown. The steps of the online identification method for abnormal user behavior on mobile devices proposed in this invention are as follows:

[0078] S301, Data Preprocessing.

[0079] User devices upload user operation stream data to the server in real time.

[0080] S302. Obtain the user operation baseline.

[0081] The user's operation baseline is obtained by calling the baseline clustering algorithm in the operation baseline acquisition module.

[0082] S303, Update the mobile user operation baseline.

[0083] The server sends the user action baseline to the client, which receives and updates the user action baseline. This baseline is used to compare the user action sequence with the user action sequence when abnormal user behavior is identified offline.

[0084] S304, Real-time anomaly detection.

[0085] The system compares the extracted user action sequence information with the user behavior baseline in real time, and compares the degree of deviation with a threshold. If the deviation is greater than or equal to the threshold, an alert is issued and user privileges are restricted (including but not limited to accessing the database and reading application cache information); if the deviation is less than the threshold, the comparison information is logged.

[0086] The steps of the baseline clustering method are as follows:

[0087] S401, Obtain user operation sequence data.

[0088] S402, Construct a knowledge graph.

[0089] The basic unit of a knowledge graph is a triple consisting of "entity-relationship-entity". The raw data for constructing the user operation graph consists of operation flow data sent by user devices within a fixed time window. Based on the data collected from each user device and known prior application knowledge, each operable component of the application interface is abstracted as an entity. The relationships between entities represent the temporal relationships of user operations on each component, and the relationship weights represent the operation frequencies. The relationship weight between entity i and entity j is denoted as w. ij .

[0090] S403. Use a relational graph convolutional neural network to cluster and obtain a set of strongly related entities.

[0091] Because user operations on entities are sequential, simply abstracting the operation sequence into feature strings would lose the corresponding relationships. Therefore, a knowledge graph based on a graph structure can be used to represent it. Since graph structures are not Euclidean space structures, clustering methods such as K-means cannot be simply used for node clustering in graph structures. In this invention, a Relational Graph Convolutional Network (R-GCN) is used to process the relational data features in the knowledge base to obtain a set of strongly associated entities. The network structure of R-GCN is as follows: Figure 6 As shown.

[0092] The relation propagation model in R-GCN is as follows:

[0093]

[0094] in, Let c represent the set of neighboring nodes of node i whose relation is r. i,r It is a regularization constant. It is a linear transformation function that transforms neighboring nodes using a parameter matrix.

[0095] To address the overfitting problem, cardinality decomposition is used to regularize the R-GCN layers:

[0096]

[0097] in It comes from Sum of coefficients linear combination, It is only related to relation r, and the relation weights are shared.

[0098] To achieve clustering of strongly correlated nodes, R-GCN convolution is used to obtain the vector representation of each node. Then, a classifier employing the minimum cross-entropy loss function is used to obtain the clustering results of strongly correlated nodes. The flowchart of the strongly correlated node clustering process is as follows: Figure 4As shown. Specifically, it includes: inputting a user action graph, training it using a relational graph convolutional neural network, classifying it using a minimum cross-entropy loss function, and finally outputting a set of strongly related nodes. The minimum cross-entropy loss function used is as follows:

[0099]

[0100] Where Y represents the set of node indices. t represents the k-th neighbor node of the labeled i-th node in layer L. ik For tags.

[0101] S404. Match the strongly associated entity set with the user operation graph to obtain the user operation baseline.

[0102] Example of user operation graph: Figure 5 As shown, the circles represent operation entities, and the lines and arrows represent the relationships between operation entities. There are a total of 6 operation entities in this example. There is a relationship between operation entity 1 and operation entity 3, operation entity 3 and operation entity 2, operation entity 2 and operation entity 4, operation entity 4 and operation entity 6, operation entity 6 and operation entity 2, and operation entity 5 is relatively independent.

[0103] Each set of strongly related entities obtained from convolutional neural network clustering of the relational graph is matched with the user operation graph, and the corresponding entity nodes are marked. The path with the largest sum of weights is selected as the operation baseline. The path weight calculation formula is as follows:

[0104]

[0105] S405, User operation baseline characterization.

[0106] The operational baseline is converted into a string using the Symbolic Aggregate Approximation (SAX) algorithm.

[0107] To address the issue that the length of the operation baseline and semantic relationships are insufficient to reflect user operation preferences, this invention proposes a method for characterizing operation sequences. By constructing a knowledge graph, the temporal relationships of user operation entities are preserved. A relational graph convolutional neural network replaces traditional clustering algorithms to cluster strongly related entity sets from the user operation graph. The operation baseline length is determined based on the number of nodes in each subset of strongly related entities. The clustered strongly related entity sets are matched with the user operation graph to find the path with the highest operation weight containing all nodes of the strongly related entity sets, which serves as the user operation baseline. The resulting operation baseline fully reflects user operation preferences. This solves the problem of determining the user operation baseline length, reduces the difficulty of matching user operation flow data with the baseline in later stages, and improves the accuracy of matching operation sequences with the baseline.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks, characterized in that, When the current user equipment bandwidth supports real-time transmission of user operation stream data, the method includes: User equipment uploads user operation stream data to the server in real time; The server obtains the user operation baseline through a baseline clustering algorithm; The server compares the extracted user operation sequence information with the edit distance of the user operation baseline in real time to determine the degree of deviation of the user operation; the edit distance is a quantitative measure of the degree of deviation of the user operation. Compare the degree of deviation of the user's operation with the deviation threshold; when the degree of deviation of the user's operation is greater than or equal to the threshold, the application issues an alarm and restricts the user's privileges; when the degree of deviation of the user's operation is less than the threshold, the comparison information is recorded in the log. The baseline clustering algorithm includes: Acquire user operation stream data sent by user equipment; and construct a user operation graph based on the operation stream data within a fixed time window; Based on the user operation graph, a set of strongly associated entities is obtained by clustering using a relational graph convolutional neural network. The strongly associated entity set obtained by clustering each relation graph convolutional neural network is matched with the user operation graph, and the corresponding entity nodes are marked. The path with the largest weight is selected as the operation baseline. The operation baseline is converted into a string using a symbol set approximation algorithm.

2. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 1, characterized in that, Also includes: The server sends the user's operation baseline to the client, and the client accepts and updates the user's operation baseline.

3. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 1, characterized in that, Based on the user operation graph, a strongly associated entity set is obtained by clustering using a relational graph convolutional neural network, including: The user operation graph is input into a relational graph convolutional neural network; The relational graph convolutional neural network was used for training. Classification is performed using the minimized cross-entropy loss function, outputting a set of strongly correlated nodes.

4. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 1, characterized in that, Constructing a user action graph based on action flow data within a fixed time window, including: Based on the data collected from each user device and the known prior knowledge of the application, each operable component of the application interface is abstracted into an entity. The relationship between entities is the temporal relationship of the user's operation of each component, and the relationship weight is the operation frequency.

5. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 1, characterized in that, User access restrictions include: restricting user access to the database and the permission to read application cache information.

6. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 1, characterized in that, Before determining that the user equipment bandwidth supports real-time transmission of user operation stream data, the method further includes: The user equipment connects to the server and initializes information; Capture and process user action stream data in real time.

7. A method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks, characterized in that, When the current user equipment bandwidth does not support real-time transmission of user operation stream data, the method includes: The user operation baseline recorded in the user equipment's memory is obtained; the user operation baseline is determined by the server according to a baseline clustering algorithm and then transmitted to the user equipment. Extract the operation feature string; The degree of deviation of the user operation is obtained by comparing the edit distance between the operation feature string and the user operation baseline; the edit distance is a quantitative measure of the degree of deviation of the user operation. The system compares the degree of deviation of a user's operation with the deviation threshold. When the degree of deviation is greater than or equal to the threshold, the application issues an alert and restricts the user's privileges. When the degree of deviation is less than the threshold, the comparison information is logged. The baseline clustering algorithm includes: Acquire user operation stream data sent by user equipment; and construct a user operation graph based on the operation stream data within a fixed time window; Based on the user operation graph, a set of strongly associated entities is obtained by clustering using a relational graph convolutional neural network. The strongly associated entity set obtained by clustering each relation graph convolutional neural network is matched with the user operation graph, and the corresponding entity nodes are marked. The path with the largest weight is selected as the operation baseline. The operation baseline is converted into a string using a symbol set approximation algorithm.

8. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 7, characterized in that, Extracting operation feature strings includes: converting operation stream data into strings using a symbol set approximation algorithm, and extracting the corresponding operation feature strings using a sliding window method with a fixed first term.

9. The method for detecting abnormal behavior of mobile office users based on graph convolutional neural networks according to claim 7, characterized in that, When the deviation of the user's operation is less than the threshold, return to the step of extracting the operation feature string.

10. A mobile office user abnormal behavior detection system based on graph convolutional neural networks, characterized in that, The system includes: user equipment and a server; The user equipment includes an initialization module, a user operation stream data acquisition module, a bandwidth determination module, and an offline identification module; wherein: The initialization module is used for user equipment to connect to the server and initialize information; The user operation flow data acquisition module is used to capture and process user operation flow data in real time; The bandwidth determination module is used to determine whether the current user device bandwidth supports real-time transmission of user operation stream data. If the current device bandwidth is limited, the user device uses the offline identification module to perform offline user abnormal behavior detection; if the current device bandwidth is not limited, the server performs online user abnormal behavior detection. The offline identification module uses the mobile office user abnormal behavior detection method based on graph convolutional neural networks as described in any one of claims 7 to 9 to perform user abnormal behavior detection; the server uses the mobile office user abnormal behavior detection method based on graph convolutional neural networks as described in any one of claims 1 to 6 to perform user abnormal behavior detection.

Images