Abnormal user identification model construction method and abnormal user identification method

Abstract

This invention provides a method for constructing an abnormal user identification model and a method for identifying abnormal users. The method for constructing the abnormal user identification model includes: acquiring associated log data of all users within a target time period; constructing user feature vectors based on data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data; training a classification neural network based on the user feature vectors and corresponding labels; and constructing an abnormal user identification model based on the trained classification neural network. This invention solves the problem of inaccurate identification of abnormal users in the Industrial Internet existing in related technologies.

Description

Technical Field

[0001] This invention relates to the field of data recognition technology, and in particular to a method for constructing an abnormal user recognition model and an abnormal user recognition method. Background Technology

[0002] In the Industrial Internet, Siemens proprietary communication protocols are frequently used for data communication, especially in the industrial control field. However, because Siemens proprietary protocols do not publicly disclose their specifications, it is difficult to conduct fuzz tests and detect security vulnerabilities in the system. Taking Siemens' S7 protocol as an example, because this protocol lacks an authentication mechanism, there is an authentication flaw during data exchange. For network attacks, exchanging a large number of chaotic data packets over the network can cause abnormalities in network device nodes.

[0003] Currently, network vulnerability detection for industrial information security incidents primarily involves searching for unique data features within a large volume of related log data. These features are then used to reflect the current network status. However, analyzing these unique features often relies on pre-defined rules to analyze the data characteristics of each user unit within the industrial internet individually. This analysis process is complex and cannot accurately and quickly identify abnormal users based on network data characteristics. Therefore, existing technologies suffer from inaccurate identification of abnormal users in the industrial internet. Summary of the Invention

[0004] This invention provides a method for constructing an abnormal user identification model and an abnormal user identification method, so as to at least solve the problem of inaccurate identification of abnormal users in the industrial Internet in related technologies.

[0005] According to a first aspect of the present invention, an abnormal user identification model construction method is provided, the method comprising: acquiring associated log data of all users during a target time period; constructing user feature vectors based on data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data; training a classification neural network based on the user feature vectors and corresponding labels; and constructing an abnormal user identification model based on the trained classification neural network.

[0006] Optionally, constructing a user feature vector based on the data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data includes: calculating network instability based on a preset sampling time and data packet transmission quantity information, wherein the network instability is used to represent the transmission quantity characteristics of data packet headers; calculating a first atypicality using cosine distance based on a first statistical interval and data packet transmission frequency information, wherein the first atypicality is used to represent the transmission quantity characteristics of data packets; calculating a second atypicality using cosine distance based on a second statistical interval and user response data packet information, wherein the second atypicality is used to represent the latency and jitter characteristics of data packets; and constructing a user feature vector based on the network instability, the first atypicality, and the second atypicality.

[0007] Optionally, network instability is calculated based on a preset sampling time and data packet transmission quantity information, wherein the network instability is used to represent the transmission quantity characteristics of data packet headers, including: generating an active user quantity sequence based on the preset sampling time and data packet transmission quantity information in the associated log data under the target time period, wherein an active user is a user whose data packet transmission rate is greater than a preset data packet transmission rate threshold at any preset sampling time under the target time period; calculating network instability based on the difference between the average of the maximum element values ​​of a preset number of elements in the active user quantity sequence and the average of all element values ​​in the active user quantity sequence; and calculating a first atypicality using cosine distance based on a first statistical interval and data packet transmission frequency information, wherein the first atypicality is used to represent the transmission quantity characteristics of data packets, including: generating a data packet transmission frequency vector based on the data packet transmission frequency information in the associated log data under the first statistical interval and the target time period; and calculating the data packet transmission frequency of the target user. The process involves: calculating the first difference between the target user and other users based on the cosine distance between the target user's data packet transmission frequency vector and the data packet transmission frequency vectors of other users; calculating a first atypical degree based on the average of a reference first difference and a minimum first difference, where the reference first difference and the minimum first difference are the values ​​of the first reference position and the first digit corresponding to the first difference after sorting the target user's first differences with other users in ascending order; calculating a second atypical degree based on the cosine distance according to a second statistical interval and user response data packet information, where the second atypical degree is used to represent the latency and jitter characteristics of data packets, including: generating a user response vector based on the second statistical interval and user response data packet information in the associated log data under the target time period; calculating the second difference between the target user and other users based on the cosine distance between the target user's user response vector and the user response vectors of other users; and calculating a second atypical degree based on a reference second difference, where the reference second difference is the value of the second reference position after sorting the target user's second differences with other users in ascending order.

[0008] Optionally, generating a user response vector based on user response data packet information in the associated log data under the second statistical interval and the target time period includes: obtaining the time interval of each user response data packet in the user response data packet information; arranging the time intervals according to the user response order to obtain a response time interval sequence; modifying the time intervals where the order of user response data packets is inconsistent with the transmission order of the data packets to zero; calculating the modified time interval of each user response data packet; and generating a user response vector based on the second statistical interval and the modified time interval of each user response data packet.

[0009] Optionally, training the classification neural network based on the user feature vector and corresponding labels includes: grouping all users into multiple user groups using the OPTICS clustering algorithm based on the user feature vector and user response vector, wherein the user groups include a normal user group and a unique user group, the number of users in the normal user group is greater than or equal to a preset percentage of the total number of users, and the number of users in the unique user group is less than the preset percentage of the total number of users; uniformly assigning labels to all users in the normal user group or individually assigning labels to each user in the normal user group, wherein the label for abnormal users is -1 and the label for normal users is 1; individually assigning labels to each user in the unique user group; and training an AdaBoost binary classifier based on the user feature vectors, user response vectors, and labels corresponding to the user feature vectors of all user groups.

[0010] Optionally, the step of grouping all users into multiple user groups using the OPTICS clustering algorithm based on user feature vectors and user response vectors includes: calculating a first similarity between the target user and other users based on the cosine similarity of user feature vectors between the target user and other users; calculating a second similarity between the target user and other users based on the cosine similarity of user response vectors between the target user and other users; calculating a sample similarity between the target user and other users based on the product of the first similarity and the second similarity; calculating a sample distance between the target user and other users based on the difference between the first and second similarities; and grouping all users into multiple user groups using the OPTICS clustering algorithm based on the sample distance between the target user and other users.

[0011] According to a second aspect of the present invention, an abnormal user identification method is also provided. The method includes: obtaining a feature vector of a user to be identified; and inputting the feature vector of the user to be identified into an abnormal user identification model constructed by the abnormal user identification model construction method according to any one of the first aspects of the present invention to obtain an abnormal user.

[0012] Optionally, the abnormal user identification method further includes: generating a first histogram based on the data packet transmission frequency information in the associated log data under the first statistical interval and the target time period; generating a second histogram based on the user response data packet information in the associated log data under the second statistical interval and the target time period; and visually displaying the first histogram and the second histogram.

[0013] Optionally, the abnormal user identification method further includes: arranging the elements in the user response vector of the abnormal user in descending order; obtaining the average value of the first preset number of elements as the communication jitter level of the abnormal user; and summing the communication jitter levels of all abnormal users to obtain the overall communication jitter level.

[0014] According to a third aspect of the present invention, an apparatus for constructing an abnormal user identification model is also provided. The apparatus includes: a first acquisition module for acquiring associated log data of all users during a target time period; a first construction module for constructing user feature vectors based on data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data; a training module for training a classification neural network based on the user feature vectors and corresponding labels; and a second construction module for constructing an abnormal user identification model based on the trained classification neural network.

[0015] According to a fourth aspect of the present invention, an abnormal user identification device is also provided, the abnormal user identification device comprising: a second acquisition module for acquiring a feature vector of a user to be identified; and a obtaining module for inputting the feature vector of the user to be identified into an abnormal user identification model constructed by the abnormal user identification model construction method according to any one of the first aspects of the present invention to obtain an abnormal user.

[0016] According to a fifth aspect of the present invention, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; wherein the memory is used to store a computer program; and the processor is used to execute the method steps of any of the above embodiments by running the computer program stored in the memory.

[0017] According to a sixth aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to execute the method steps of any of the above embodiments when running.

[0018] In this embodiment of the invention, associated log data of all users within a target time period is obtained; user feature vectors are constructed based on the data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data; a classification neural network is trained based on the user feature vectors and corresponding labels; and an abnormal user identification model is constructed based on the trained classification neural network. Because the construction of the user feature vectors comprehensively considers the data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data, and uses these user feature vectors to train the classification neural network and construct the abnormal user identification model, the abnormal user identification model achieves higher accuracy.

[0019] In this embodiment of the invention, the feature vector of the user to be identified is input into the abnormal user identification model to obtain the abnormal user. Compared with the traditional identification method that analyzes the data features of each unit user in the industrial Internet separately according to preset rules, it has the advantages of fast analysis, simplicity and high accuracy.

[0020] In this embodiment of the invention, a first histogram is generated based on the number of data packets transmitted in the associated log data during a preset sampling time and a target time period; a second histogram is generated based on the user response data packet information in the associated log data during a second statistical interval and a target time period; and the first and second histograms are then visualized. Through the visualization of the data distribution in the first and second histograms, the purpose of quickly understanding the user's work status and the data packet jitter characteristics of a single user is achieved, thus demonstrating behaviors such as sudden communication events and intermittent communication incidents. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the hardware environment of an optional abnormal user identification model construction method and / or abnormal user identification method according to an embodiment of the present invention;

[0024] Figure 2 This is a flowchart illustrating an optional abnormal user identification model construction method according to an embodiment of the present invention;

[0025] Figure 3 This is a flowchart illustrating an optional abnormal user identification method according to an embodiment of the present invention;

[0026] Figure 4 This is a structural block diagram of an optional abnormal user identification model construction device according to an embodiment of the present invention;

[0027] Figure 5 This is a structural block diagram of an optional abnormal user identification device according to an embodiment of the present invention;

[0028] Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that in the description of this invention, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus. The terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention.

[0031] The terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections via an intermediate medium; internal connections between two components; and wireless or wired connections. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances. Furthermore, the use of "and / or" in this application includes three parallel solutions. For example, "A and / or B" includes solution A, solution B, or a solution that simultaneously satisfies A and B. Additionally, the technical solutions of the various embodiments can be combined, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0032] According to one aspect of the present invention, a method for constructing an abnormal user identification model is provided. Optionally, in this embodiment, the above-described method for constructing an abnormal user identification model can be applied to, for example... Figure 1 In the hardware environment shown. For example... Figure 1 As shown, terminal 102 may include memory 104, processor 106, and display 108 (optional component). Terminal 102 can communicate with server 112 via network 110. Server 112 can provide services (such as application services) to the terminal or clients installed on the terminal. Database 114 can be set up on or independently of server 112 to provide data storage services to server 112. In addition, server 112 may run a processing engine 116, which can be used to execute the steps performed by server 112.

[0033] Optionally, terminal 102 may be, but is not limited to, a terminal capable of computing data, such as a mobile terminal (e.g., mobile phone, tablet computer), laptop computer, PC (Personal Computer), etc. The aforementioned network may include, but is not limited to, a wireless network or a wired network. The wireless network includes Bluetooth, Wi-Fi (Wireless Fidelity), and other networks that enable wireless communication. The aforementioned wired network may include, but is not limited to, a wide area network (WAN), a metropolitan area network (MAN), and a local area network (LAN). The aforementioned server 112 may include, but is not limited to, any hardware device capable of computing.

[0034] Furthermore, in this embodiment, the above-described abnormal user identification model construction method can also be applied to, but is not limited to, a powerful independent processing device without data interaction. For example, the processing device can be, but is not limited to, a powerful terminal device; that is, the various operations in the above-described abnormal user identification model construction method can be integrated into a single independent processing device. The above is merely an example, and no limitation is made in this embodiment.

[0035] Optionally, in this embodiment, the above-described abnormal user identification model construction method can be executed by server 112, by terminal 102, or jointly by server 112 and terminal 102. The abnormal user identification model construction method of this embodiment can also be executed by a client installed on terminal 102.

[0036] Taking the application of the abnormal user identification model construction method to the central processing unit as an example, Figure 2 This is a flowchart illustrating an optional abnormal user identification model construction method according to an embodiment of the present invention, as shown below. Figure 2 As shown, the process of this method may include the following steps:

[0037] Step S201: Obtain the associated log data for all users within the target time period. Optionally, logs are generated by computer systems, devices, software, etc., in response to certain stimuli. For example, Unix operating systems record user login and logout messages, and disk storage systems generate logs when a failure occurs or when some systems anticipate a failure. The associated log data is obtained based on log associations from a historical experience database or from abnormal log information. The target time period is any time period during which abnormal user analysis is desired.

[0038] Step S202: Construct a user feature vector based on the packet transmission quantity information, packet transmission frequency information, and user response packet information in the associated log data. Optionally, the associated log data obtained in step S201 includes: packet transmission quantity information, packet transmission frequency information, and user response packet information. In a packet-switched network, a single message is divided into multiple data blocks, which are called packets. These packets are transmitted along different paths in one or more networks and reassembled at the destination. In this embodiment, data transmission uses the Siemens protocol. The packet transmission quantity information refers to the number of S7comm packet headers for each unit user; the packet transmission frequency information refers to the number of times packets are transmitted per unit time, also known as the packet rate; the user response packet information can be the user's response information to the packets, such as response time or response order. The above information is used to construct the user feature vector. It should be noted that in this embodiment of the invention, a unit user can be a specific user device in the Industrial Internet, or a subnetwork in a room or area.

[0039] Step S203: Train a classification neural network based on user feature vectors and their corresponding labels. Optionally, the classification neural network is trained using labeled samples, i.e., labels are generated for the user feature vectors corresponding to each user. The user feature vectors are generated according to step S202. Specifically, the label corresponding to the feature vector of a normal user is set to 1, and the label corresponding to the feature vector of an abnormal user is set to -1. Then, the classification neural network is trained based on the user feature vectors and their corresponding labels.

[0040] Step S204: Construct an abnormal user identification model based on the trained classification neural network. Optionally, the classification neural network trained in step S203 can be used as the abnormal user identification model, meaning that the user feature vector corresponding to the input user can identify whether the user is an abnormal user.

[0041] In this embodiment of the invention, associated log data of all users within a target time period is acquired; user feature vectors are constructed based on the data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data; a classification neural network is trained based on the user feature vectors and corresponding labels; and an abnormal user identification model is constructed based on the trained classification neural network. Because the construction of user feature vectors comprehensively considers the data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data, and uses these user feature vectors to train the classification neural network and construct the abnormal user identification model, the abnormal user identification model has higher accuracy. Furthermore, compared to analyzing the data characteristics of each unit user in the industrial internet separately using preset rules, it has the advantages of being faster and simpler.

[0042] As an optional embodiment, a user feature vector is constructed based on the data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data. This includes: calculating network instability based on a preset sampling time and data packet transmission quantity information, where network instability represents the transmission quantity characteristics of data packet headers; calculating a first atypicality using cosine distance based on a first statistical interval and data packet transmission frequency information, where the first atypicality represents the transmission quantity characteristics of data packets; calculating a second atypicality using cosine distance based on a second statistical interval and user response data packet information, where the second atypicality represents the latency and jitter characteristics of data packets; and constructing a user feature vector based on network instability, the first atypicality, and the second atypicality.

[0043] Optionally, analyzing abnormal users requires analyzing the overall network environment. During normal network communication, information transmission between users is typically fixed or falls within an empirical range, without significant fluctuations. In this embodiment, the Industrial Internet uses the Siemens protocol, calculating network instability by statistically analyzing the number of S7comm packet headers for each user at a preset sampling time. Since a large number of data packets are transmitted and communicated within the network when it is under attack, network instability can represent the overall state of the current internet and can be used as a component of subsequent feature vectors.

[0044] Further analysis for each user reveals that the sequence of associated log data packet rates (i.e., data packet transmission frequency) for each user within the target time period is used to represent the frequency changes of associated log data packets for the current user within the target time period. It should be noted that if a user experiences a large number of retransmissions, queries, or out-of-order data packet interference at certain moments within the target time period, a large number of associated log interactions will occur at the corresponding moments, increasing the data packet transmission frequency (i.e., the number of data packet transmissions) at that moment. Therefore, the associated log data packet transmission frequency information can characterize the working status of a user; that is, the higher the data packet transmission frequency, the more abnormal the user. The target time period is uniformly divided according to the first statistical interval, and the difference between data packet transmission frequency information is calculated using cosine distance as the first degree of atypicality, which is then used as a component of the feature vector.

[0045] User response data packet information includes response time and response order. Similar to calculating the first atypicality, the target time period is evenly divided according to the second statistical interval using cosine distance. The difference between user response data packet information is calculated using cosine distance as the second atypicality. The second atypicality can represent the user's data packet jitter characteristics and the anomalousness of communication characteristics. Therefore, the second atypicality is also included as a component of the feature vector. In this embodiment of the invention, three different features are used to construct the user feature vector, which enriches the useful information in the user feature vector. Using this user feature vector to train a classification neural network, the accuracy of the user identification model is improved.

[0046] As an optional embodiment, network instability is calculated based on a preset sampling time and data packet transmission quantity information. Network instability is used to represent the transmission quantity characteristics of data packet headers, including: generating an active user quantity sequence based on the preset sampling time and data packet transmission quantity information in associated log data during the target time period, wherein an active user is a user whose data packet transmission rate is greater than a preset data packet transmission rate threshold at any preset sampling time during the target time period; and calculating network instability based on the difference between the average of the maximum value of a preset number of elements in the active user quantity sequence and the average of all element values ​​in the active user quantity sequence.

[0047] The first atypicality is calculated using cosine distance based on a first statistical interval and data packet transmission frequency information. The first atypicality represents the quantity characteristic of data packet transmission. This includes: generating a data packet transmission frequency vector based on the first statistical interval and data packet transmission frequency information in the associated log data during the target time period; calculating the first difference between the target user and other users based on the cosine distance between the target user's data packet transmission frequency vector and the data packet transmission frequency vectors of other users; and calculating the first atypicality based on the average of a reference first difference and a minimum first difference, where the reference first difference and the minimum first difference are the values ​​of the first reference position and the first difference corresponding to the first digit after sorting the first differences between the target user and other users in ascending order.

[0048] The second atypicality is calculated using cosine distance based on the second statistical interval and user response data packet information. The second atypicality is used to represent the latency and jitter characteristics of the data packets. This includes: generating a user response vector based on the user response data packet information in the associated log data under the second statistical interval and the target time period; calculating the second difference between the target user and other users based on the cosine distance between the target user's user response vector and the user response vectors of other users; and calculating the second atypicality based on a reference second difference, where the reference second difference is the value of the second reference bit after sorting the second differences between the target user and other users in ascending order.

[0049] Optionally, when calculating network instability, the active user count sequence represents the temporal change in the number of active users. An active user is defined as a user whose packet transmission rate exceeds a preset packet transmission rate threshold at any preset sampling time within the target time period. Specifically, 100pps (packets per second) is set as the preset packet transmission rate threshold. The packet transmission rate of a user within the first 10 seconds of the preset sampling time is calculated, i.e., the sampling frequency is once every 10 seconds. If the calculated packet transmission rate exceeds the preset packet transmission rate threshold, the user is considered an active user. In a normal and stable industrial internet, the elements in the active user count sequence are usually fixed values ​​without significant fluctuations. However, if the internet is attacked, a large number of packets will be transmitted in the network, altering the data pattern and content logic of internet environment event-related logs, causing the element values ​​in the active user count sequence to increase, i.e., the element distribution in the active user count sequence becomes abnormal. Therefore, network instability within the target time period is calculated based on the element values ​​in the active user count sequence. Specifically, network instability Q can be calculated using the following formula:

[0050]

[0051] In the formula, Mean(v) represents the average of the N largest elements (N is a positive integer) in the sequence of active users. client ) represents the average value of all elements in the sequence of active user counts. In this embodiment of the invention, N is set to 10, but in other embodiments, it can be specifically set according to the number of users per unit on the Internet.

[0052] It's important to note that Q represents the overall network instability and is highly sensitive to situations where the overall activity level exceeds the capacity. Excessive activity can lead to sudden data transmissions, which may represent network attacks such as brute-force attacks, data collisions, or broadcast storms. These attacks negatively impact the quality and controllability of network services. Therefore, the Q value characterizes the current network instability; a larger difference indicates greater network instability.

[0053] When calculating the first degree of atypicality, a data packet transmission frequency vector is first generated based on the data packet transmission frequency information in the first statistical interval and the associated log data during the target time period. In this embodiment of the invention, the target time period is evenly divided into 5 first statistical intervals, and the data packet transmission frequency in each first statistical interval is calculated, thereby generating a data packet transmission frequency vector containing 5 values ​​arranged by time. According to prior knowledge, abnormal users are a minority in the industrial internet, so the data packet transmission frequency vector of abnormal users has a large characteristic difference from that of normal users. Therefore, the first degree of atypicality, i.e., the difference between the target user and other users, is calculated based on the data packet transmission frequency vector. Specifically, the cosine distance between the data packet transmission frequency vector of the target user and the data packet transmission frequency vector of other users is calculated as the first difference. The first differences are sorted in ascending order, and the Kth first difference after ascending order is selected as the reference first difference, i.e., the first reference position is K, where K is a positive integer and can be specifically set according to the number of users in the internet, which is not limited here. The first position after ascending order is selected as the minimum first difference, and then the average of the reference first difference and the minimum first difference is used as the first degree of atypicality.

[0054] It should be noted that a higher degree of atypicality indicates a greater difference in the data packet transmission frequency vector between the target user and other users, meaning the target user is more abnormal. Using the average of the reference first difference and the minimum first difference as the first degree of atypicality avoids the possibility of other abnormal users causing the minimum first difference to be too small, thus preventing errors in the representation of the first degree of atypicality.

[0055] Similarly, when calculating the second degree of atypicality, user response vectors are first generated based on the user response data packets in the associated log data within the second statistical interval and the target time period. After obtaining the user response vectors, the second difference between users is calculated based on the cosine distance between the user response vectors. Then, the second differences are sorted in ascending order, and the K'th second difference in ascending order is used as the reference second difference, i.e., the second reference position is K', where K' is a positive integer and can be specifically set according to the number of users in the Internet, without limitation here. Finally, the second degree of atypicality is calculated based on the reference second difference. Specifically, the second degree of atypicality F can be calculated using the following formula:

[0056] F = 1 - Similarity(F) v ,F v normal )

[0057] In the formula, Similarity() is the cosine similarity function used to calculate the cosine distance, F v F is the user response vector of the target user. vnormal Similarity(F) is used as a reference for the user response vector. v ,F v normal That is, refer to the second difference. Finally, the calculated network instability, first atypicality, and second atypicality are denoted as Q, P, and F, respectively. Therefore, the user feature vector U constructed using these three features can be represented as {Q, P, F}.

[0058] This invention uses the number of active users in the network to characterize the overall stability of the current network. Further analysis of the packet transmission frequency characteristics and user response packet characteristics of the associated log data for each user unit, combined with other user units in the network, yields a first and second degree of atypicality for each user. The first and second degrees of atypicality together reflect the anomaly of each user unit. Further analysis of the overall network instability yields a user feature vector representing the characteristics of the associated log data for each user unit.

[0059] As an optional embodiment, generating a user response vector based on user response data packet information in the associated log data under the second statistical interval and the target time period includes: obtaining the time interval of each user response data packet in the user response data packet information; arranging the time intervals according to the user response order to obtain a response time interval sequence; modifying the time intervals where the order of user response data packets is inconsistent with the transmission order of the data packets to zero; calculating the modified time interval of each user response data packet; and generating a user response vector based on the second statistical interval and the modified time interval of each user response data packet.

[0060] Optionally, in network attacks, not only will the number of data packets transmitted in the associated log data be abnormal, but the response time and order of individual users to data packets will also be abnormal. Therefore, this embodiment obtains the time interval of user response data packets within the target time period and arranges the time intervals according to the user response order to generate a response time interval sequence. If the user response data packets are sent normally and in order, there will be no data packet response jitter, and the element values ​​in the generated response time interval sequence will show a fixed or regular distribution. If the response of the associated log data packets is out of order, i.e., data packet response jitter occurs, in order to reflect the out-of-order distribution in the time interval, the time interval at the out-of-order position is set to 0, and the actual interval between the sequentially arranged associated log data packets is recalculated. For example, if the data packet transmission order is {0,1,2,3}, and the user response data packet order is {0,2,1,3}, where sequence number 2 is an out-of-order position, that is, the user response data packet order at this position is inconsistent with the data packet transmission order. Therefore, the time interval at sequence number 2 is modified to 0, and the time interval between sequence number 0 and sequence number 1 is recalculated. The user response vector is generated based on the modified user response data packet time interval and the second statistical interval. In this embodiment of the invention, by processing the response time interval data, if packet header jitter or data packet disorder occurs when the current unit user responds to the associated log, there will be multiple large element value distributions and multiple element value distributions of 0 in the response time interval sequence.

[0061] This invention analyzes the time interval information of user response data packets and modifies the time interval corresponding to out-of-order associated log data packets to 0, so that the time interval sequence can more clearly characterize the data packet jitter characteristics of the current user.

[0062] As an optional embodiment, training a classification neural network based on user feature vectors and corresponding labels includes: using the OPTICS clustering algorithm to group all users according to user feature vectors and user response vectors to obtain multiple user groups, including a normal user group and a unique user group. The number of users in the normal user group is greater than or equal to a preset percentage of the total number of users, and the number of users in the unique user group is less than a preset percentage of the total number of users; assigning a uniform label to all users in the normal user group or assigning a separate label to each user in the normal user group, wherein the label of abnormal users is -1 and the label of normal users is 1; assigning a separate label to each user in the unique user group; and training an AdaBoost binary classifier based on the user feature vectors, user response vectors, and labels corresponding to the user feature vectors of all user groups.

[0063] Optionally, the OPTICS clustering algorithm is used to group all users into multiple user groups. It should be noted that the OPTICS clustering algorithm is a well-known technique in the art. In this embodiment, the search radius is set to 0.5, and the minimum number of values ​​within a cluster is set to 4. After obtaining multiple user groups, some user groups will have a small number of samples; these user groups will be designated as unique user groups, while the remaining user groups will be designated as ordinary user groups.

[0064] The user groups, which are considered "ordinary user groups," may consist entirely of normal users, entirely of abnormal users, or include both. Therefore, labels can be uniformly assigned to all users within a user group, or individual labels can be assigned to each user. For example, a user group consisting entirely of normal users could be labeled 1; a user group consisting entirely of abnormal users could be labeled -1; and a user group containing both normal and abnormal users could be labeled individually, with abnormal users labeled -1 and normal users labeled 1. It's worth noting that uniformly labeling user groups consisting entirely of normal users can speed up the labeling process. For user groups containing abnormal users, individual labels can be assigned to each user within the group. For user groups with small sample sizes, which may not consist entirely of abnormal users but represent a unique segment of the network, each user within such unique user groups should be individually labeled to avoid labeling errors. In this embodiment of the invention, user groups representing less than 5% of the total sample size are designated as unique user groups and are specifically labeled. Finally, an AdaBoost binary classifier is trained based on the user feature vectors, user response vectors, and corresponding labels of all user groups and unique user groups.

[0065] In this embodiment of the invention, the AdaBoost binary classifier uses not only user feature vectors but also user response vectors during training. Since the response vectors can represent user communication characteristics, such as packet jitter and latency, to a certain extent, this further improves the classifier's accuracy. By learning common communication state features, the AdaBoost binary classifier can achieve a sufficiently reliable response to normal samples, thus enabling rapid and accurate classification when identifying abnormal users. Because there are various user units with different operating conditions and corresponding data transmission characteristics in the Industrial Internet, grouping users with similar communication characteristics not only facilitates label processing during subsequent training but also expands the training data volume of the classification neural network, making the classification results more accurate. Using the classification neural network to process real-time user data in the Industrial Internet enables rapid and accurate identification of abnormal users. Through learning from historical data, the classification neural network can not only classify and organize abnormal user units in typical data streams such as network attacks but also promptly identify suspected interference behaviors in the network caused by user performance or configuration errors.

[0066] As an optional embodiment, the OPTICS clustering algorithm is used to group all users based on user feature vectors and user response vectors to obtain multiple user groups. This includes: calculating a first similarity between the target user and other users based on the cosine similarity of user feature vectors between the target user and other users; calculating a second similarity between the target user and other users based on the cosine similarity of user response vectors between the target user and other users; calculating a sample similarity between the target user and other users based on the product of the first and second similarities; calculating a sample distance between the target user and other users based on the difference between the first and second sample similarities; and grouping all users based on the sample distance between the target user and other users using the OPTICS clustering algorithm to obtain multiple user groups.

[0067] Optionally, the OPTICS clustering algorithm is used to group users based on the similarity between each user's feature vector U and the user's response vector. Specifically, cosine distance is used to calculate the first similarity of user feature vectors and the second similarity of user response vectors among different user units. The product of the first and second similarities is used as the sample similarity between the target user and other users. The difference between the first and second similarities is used as the sample distance between the target user and other users. Finally, the OPTICS clustering algorithm is used to group all users based on this sample distance, resulting in multiple user groups. In the communication transmission process of the Industrial Internet, some user units may contain real-time control, distributed control, etc., and have unique latency distribution characteristics. If a user unit's associated log shows a consistently high data packet rate, resulting in high latency, it may be determined by the characteristics of the communication load, such as sliced ​​images from additive manufacturing or multimedia information. Therefore, combining user feature vectors and user response vectors when calculating sample distances avoids missed detections.

[0068] According to another aspect of the present invention, an abnormal user identification method is also provided. Optionally, in this embodiment, the above-described abnormal user identification method can also be applied to, for example... Figure 1 In the hardware environment shown, taking the application of abnormal user identification methods to the central processing unit as an example, Figure 3 This is a flowchart illustrating an optional abnormal user identification method according to an embodiment of the present invention, as shown below. Figure 3 As shown, the process of this method may include the following steps:

[0069] Step S301: Obtain the feature vector of the user to be identified. Optionally, the user feature vector U = {Q, P, F} is composed of network instability Q, first atypicality P, and second atypicality F.

[0070] Step S302: Input the feature vector of the user to be identified into the abnormal user identification model constructed by the abnormal user identification model construction method in any embodiment of the first aspect of the present invention to obtain the abnormal user. Optionally, input the feature vector of the user to be identified obtained in step S301 into the abnormal user identification model constructed by the abnormal user identification model construction method in any embodiment of the first aspect of the present invention to obtain the abnormal user. It should be noted that since the indicators of whether most event-related logs are abnormal are mainly behaviors in the early period of the day's work, and are accompanied by repetitive processes, performing abnormal user identification when the time period after the factory starts work reaches 30% of the overall time period can ensure that there is enough data to judge abnormal users and achieve the effect of timely and rapid judgment of abnormal users.

[0071] In this embodiment of the invention, the feature vector of the user to be identified is input into the abnormal user identification model to obtain the abnormal user. Compared with the traditional identification method that analyzes the data features of each unit user in the industrial Internet separately according to preset rules, it has the advantages of fast analysis, simplicity and high accuracy.

[0072] As an optional embodiment, the method further includes: generating a first histogram based on the data packet transmission frequency information in the associated log data under the first statistical interval and the target time period; generating a second histogram based on the user response data packet information in the associated log data under the second statistical interval and the target time period; and visually displaying the first and second histograms.

[0073] Optionally, the target time period is evenly divided using a first statistical interval. The number of bars in the first histogram is equal to the number of bars in the first statistical interval, and each bar corresponds to a data packet transmission frequency. Similarly, the target time period is evenly divided using a second statistical interval. The number of bars in the second histogram is equal to the number of bars in the second statistical interval, and each bar corresponds to a user response data packet. The first and second histograms are visualized. For the first histogram, if the current user is engaged in normal associated log communication, the data packet transmission frequency, i.e., the frequency between bars, will not differ significantly and will exhibit a fixed numerical distribution. That is, in the first histogram, there will not be a situation where one dimension has a large value while the values ​​of other dimensions are all small values. If the current user is an abnormal user, the data packet transmission frequency will have a large special value, i.e., the corresponding first histogram will show a high numerical distribution across different dimensions. For the second histogram, if packet header jitter or data packet out-of-order occurs when the user responds to associated logs, the second histogram will show a high numerical distribution across multiple dimensions or a dimension with a value of 0. In this embodiment of the invention, using histogram vectors instead of conventional data sequences can clearly and easily represent the characteristics of communication rate distribution, and more intuitively reflect behaviors such as burst communication time, intermittent communication events, data packet jitter, and data packet out-of-order.

[0074] As an optional embodiment, the method further includes: sorting the elements in the user response vector of the abnormal user in descending order; obtaining the average of the first preset number of elements as the communication jitter level of the abnormal user; and summing the communication jitter levels of all abnormal users to obtain the overall communication jitter level. Optionally, after obtaining the abnormal user, the elements in the user response vector of the abnormal user can be sorted in descending order, and the average of the first H data points can be obtained as the communication jitter level of the abnormal user. The overall communication jitter level is the sum of the communication jitter levels of all abnormal users. In this embodiment of the invention, H is set to 2, but it can also be specifically set according to the number of users in the Internet. The larger the value of the overall communication jitter level, the more severe the current communication jitter, the more severe the communication latency anomaly, and the more it affects the current Internet communication quality. Staff can perform corresponding maintenance based on the overall communication jitter level.

[0075] According to another aspect of the present invention, an apparatus for constructing an abnormal user identification model is also provided. Figure 4 This is a structural block diagram of an optional abnormal user identification model construction device according to an embodiment of the present invention, such as... Figure 4 As shown, the device may include: a first acquisition module 401, used to acquire associated log data of all users during a target time period; a first construction module 402, used to construct user feature vectors based on data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data; a training module 403, used to train a classification neural network based on the user feature vectors and corresponding labels; and a second construction module 404, used to construct an abnormal user identification model based on the trained classification neural network.

[0076] It should be noted that the first acquisition module 401 in this embodiment can be used to execute the above step S201, the first construction module 402 in this embodiment can be used to execute the above step S202, the training module 403 in this embodiment can be used to execute the above step S203, and the second construction module 404 in this embodiment can be used to execute the above step S204.

[0077] The above modules comprehensively consider the data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data when constructing the user feature vector. The user feature vector is used to train a classification neural network to construct an abnormal user identification model, thereby making the abnormal user identification model more accurate.

[0078] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1The hardware environment shown can be implemented through software or hardware, and the hardware environment includes the network environment.

[0079] According to another aspect of the present invention, an abnormal user identification device is also provided. Figure 5 This is a structural block diagram of an optional abnormal user identification device according to an embodiment of the present invention, such as... Figure 5 As shown, the device may include: a second acquisition module 501, used to acquire the feature vector of the user to be identified; and a obtaining module 502, used to input the feature vector of the user to be identified into the abnormal user identification model constructed by the abnormal user identification model construction method of any one of the first aspects of the present invention to obtain the abnormal user.

[0080] It should be noted that the second acquisition module 501 in this embodiment can be used to perform the above step S301, and the obtaining module 502 in this embodiment can be used to perform the above step S302.

[0081] The above modules input the feature vector of the user to be identified into the abnormal user identification model to obtain abnormal users. Compared with the traditional identification method that analyzes the data features of each unit user in the industrial Internet separately according to preset rules, it has the advantages of fast analysis, simplicity and high accuracy.

[0082] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented through software or hardware, and the hardware environment includes the network environment.

[0083] According to another aspect of the present invention, an electronic device for implementing the above-described abnormal user identification model construction method and abnormal user identification method is also provided. The electronic device may be a server, a terminal, or a combination thereof.

[0084] Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of the present invention, such as... Figure 6 As shown, the system includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604. The processor 601, communication interface 602, and memory 603 communicate with each other via the communication bus 604. The memory 603 stores computer programs. When the processor 601 executes the computer program stored in the memory 603, it performs the following steps:

[0085] Obtain associated log data for all users within the target time period; construct user feature vectors based on data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data; train a classification neural network based on the user feature vectors and corresponding labels; construct an abnormal user identification model based on the trained classification neural network; obtain the feature vectors of the users to be identified; input the feature vectors of the users to be identified into the abnormal user identification model to obtain the abnormal users.

[0086] Optionally, in this embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0087] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0088] The memory may include RAM, or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0089] As an example, such as Figure 6 As shown, the memory 603 may include, but is not limited to, the first acquisition module 401, the first construction module 402, the training module 403, the second construction module 404 in the abnormal user identification model construction device, and the second acquisition module 501 and the obtaining module 502 in the abnormal user identification device. Furthermore, it may include, but is not limited to, other module units in the abnormal user identification model construction device and the abnormal user identification device, which will not be elaborated further in this example.

[0090] The processors mentioned above can be general-purpose processors, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; they can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0091] In addition, the aforementioned electronic device also includes a display for showing the results of abnormal user identification.

[0092] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0093] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. The device implementing the above-described abnormal user identification model construction method can be a terminal device, such as a smartphone (e.g., Android phone, iOS phone), tablet computer, PDA, mobile Internet Devices (MID), PAD, etc. Figure 6 This does not limit the structure of the aforementioned electronic devices. For example, the terminal device may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0094] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, ROM, RAM, disk or optical disk, etc.

[0095] According to another aspect of the present invention, a storage medium is also provided. Optionally, in this embodiment, the storage medium can be used to execute the program code of the abnormal user identification model construction method and the abnormal user identification method.

[0096] Optionally, in this embodiment, the storage medium may be located on at least one of the multiple network devices in the network shown in the above embodiment.

[0097] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps:

[0098] Obtain associated log data for all users within the target time period; construct user feature vectors based on data packet transmission quantity, data packet transmission frequency, and user response data packet information in the associated log data; train a classification neural network based on the user feature vectors and corresponding labels; construct an abnormal user identification model based on the trained classification neural network; obtain the feature vectors of the users to be identified; input the feature vectors of the users to be identified into the abnormal user identification model to obtain the abnormal users.

[0099] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated in this embodiment.

[0100] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0101] According to another aspect of the present invention, a computer program product or computer program is also provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the steps of the abnormal user identification model construction method and the abnormal user identification method in any of the above embodiments.

[0102] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0103] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the abnormal user identification model construction method of the various embodiments of the present invention.

[0104] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0105] In the several embodiments provided by this invention, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0106] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the solution provided in this embodiment, depending on actual needs.

[0107] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0108] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for constructing an abnormal user identification model, characterized in that, The method for constructing the abnormal user identification model includes: Retrieve associated log data for all users within the target time period; A user feature vector is constructed based on the data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data; A classification neural network is trained based on the user feature vector and the corresponding label; An abnormal user identification model is constructed based on the trained classification neural network; The step of constructing a user feature vector based on the data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data includes: Network instability is calculated based on a preset sampling time and the number of data packets transmitted, wherein the network instability is used to represent the number of data packet headers transmitted. The first atypicality is calculated using the cosine distance based on the first statistical interval and the data packet transmission frequency information, wherein the first atypicality is used to represent the transmission quantity characteristics of data packets; The second atypicality is calculated using the cosine distance based on the second statistical interval and the user response data packet information, wherein the second atypicality is used to represent the delay and jitter characteristics of the data packet; Construct a user feature vector based on the network instability, the first degree of atypicality, and the second degree of atypicality; Network instability is calculated based on a preset sampling time and the number of data packets transmitted, wherein the network instability is used to represent the characteristics of the number of data packet headers transmitted, including: An active user count sequence is generated based on the data packet transmission count information in the associated log data at the preset sampling time and the target time period. Active users are those whose data packet transmission rate is greater than the preset data packet transmission rate threshold at any preset sampling time during the target time period. Network instability is calculated based on the difference between the average of the maximum values ​​of a preset number of elements in the active user count sequence and the average of all element values ​​in the active user count sequence. A first atypicality is calculated using cosine distance based on a first statistical interval and data packet transmission frequency information, wherein the first atypicality is used to represent the quantitative characteristics of data packet transmission, including: Generate a data packet transmission frequency vector based on the data packet transmission frequency information in the associated log data of the first statistical interval and the target time period; The first difference between the target user and other users is calculated based on the cosine distance between the target user's data packet transmission frequency vector and the data packet transmission frequency vector of other users; The first degree of atypicality is calculated based on the average of the reference first difference and the minimum first difference, wherein the reference first difference and the minimum first difference are the values ​​of the first reference position and the first position corresponding to the first difference after sorting the first differences of the target user with those of other users in ascending order; A second atypicality is calculated using cosine distance based on a second statistical interval and user response data packet information. This second atypicality represents the latency and jitter characteristics of the data packets, including: Generate a user response vector based on the user response data packet information in the associated log data of the second statistical interval and the target time period; The second difference between the target user and other users is calculated based on the cosine distance between the target user's user response vector and the user response vectors of other users; The second degree of atypicality is calculated based on the reference second difference, wherein the reference second difference is the value of the second reference bit after sorting the second differences between the target user and other users in ascending order.

2. The method for constructing an abnormal user identification model according to claim 1, characterized in that, The step of generating a user response vector based on user response data packet information in the associated log data within the second statistical interval and the target time period includes: Obtain the time interval between each data packet in the user response data packet information; The time intervals are arranged according to the user response order to obtain a response time interval sequence; Change the time interval when the order of user response data packets is inconsistent with the order in which the data packets are transmitted to zero; Calculate the time interval for each data packet in the modified user response; A user response vector is generated based on the second statistical interval and the time interval of each data packet in the modified user response.

3. The method for constructing an abnormal user identification model according to claim 2, characterized in that, The step of training a classification neural network based on the user feature vector and the corresponding label includes: The OPTICS clustering algorithm is used to group all users according to user feature vectors and user response vectors to obtain multiple user groups. The user groups include ordinary user groups and unique user groups. The number of users in the ordinary user group is greater than or equal to a preset percentage of the total number of users, and the number of users in the unique user group is less than the preset percentage of the total number of users. Set a uniform label for all users in the ordinary user group or set a separate label for each user in the ordinary user group, wherein the label for abnormal users is -1 and the label for normal users is 1; Set individual tags for each user in the unique user group; Train an AdaBoost binary classifier based on the user feature vectors, user response vectors, and the labels corresponding to the user feature vectors for all user groups.

4. The method for constructing an abnormal user identification model according to claim 3, characterized in that, The OPTICS clustering algorithm is used to group all users based on user feature vectors and user response vectors, resulting in multiple user groups, including: The first similarity between the target user and other users is calculated based on the cosine similarity of the user feature vectors between the target user and other users. The second similarity between the target user and other users is calculated based on the cosine similarity of the user response vectors between the target user and other users; The sample similarity between the target user and other users is calculated based on the product of the first similarity and the second similarity. The sample distance between the target user and other users is calculated based on the difference between the sample similarity and the sample similarity. The OPTICS clustering algorithm is used to group all users based on the sample distance between the target user and other users, resulting in multiple user groups.

5. A method for identifying abnormal users, characterized in that, The abnormal user identification method includes: Obtain the feature vector of the user to be identified; The abnormal user is obtained by inputting the feature vector of the user to be identified into the abnormal user identification model constructed by the abnormal user identification model construction method according to any one of claims 1-4.

6. The abnormal user identification method according to claim 5, characterized in that, The abnormal user identification method further includes: A first histogram is generated based on the data packet transmission frequency information in the associated log data of the first statistical interval and the target time period. A second histogram is generated based on the user response data packet information in the associated log data under the second statistical interval and the target time period. The first histogram and the second histogram are visualized.

7. The abnormal user identification method according to claim 6, characterized in that, The abnormal user identification method further includes: Sort the elements in the user response vector of the abnormal user in descending order; The average value of the first preset number of elements is used as the communication jitter level of the abnormal user; The overall communication jitter level is obtained by summing the communication jitter levels of all abnormal users.

8. An apparatus for constructing an abnormal user identification model, characterized in that, The abnormal user identification model construction device includes: The first acquisition module is used to acquire the associated log data of all users within the target time period; The first construction module is used to construct a user feature vector based on the data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data; The training module is used to train a classification neural network based on the user feature vector and the corresponding label; The second building module is used to construct an abnormal user identification model based on the trained classification neural network. The step of constructing a user feature vector based on the data packet transmission quantity information, data packet transmission frequency information, and user response data packet information in the associated log data includes: Network instability is calculated based on a preset sampling time and the number of data packets transmitted, wherein the network instability is used to represent the number of data packet headers transmitted. The first atypicality is calculated using the cosine distance based on the first statistical interval and the data packet transmission frequency information, wherein the first atypicality is used to represent the transmission quantity characteristics of data packets; The second atypicality is calculated using the cosine distance based on the second statistical interval and the user response data packet information, wherein the second atypicality is used to represent the delay and jitter characteristics of the data packet; Construct a user feature vector based on the network instability, the first degree of atypicality, and the second degree of atypicality; Network instability is calculated based on a preset sampling time and the number of data packets transmitted, wherein the network instability is used to represent the characteristics of the number of data packet headers transmitted, including: An active user count sequence is generated based on the data packet transmission count information in the associated log data at the preset sampling time and the target time period. Active users are those whose data packet transmission rate is greater than the preset data packet transmission rate threshold at any preset sampling time during the target time period. Network instability is calculated based on the difference between the average of the maximum values ​​of a preset number of elements in the active user count sequence and the average of all element values ​​in the active user count sequence. A first atypicality is calculated using cosine distance based on a first statistical interval and data packet transmission frequency information, wherein the first atypicality is used to represent the quantitative characteristics of data packet transmission, including: Generate a data packet transmission frequency vector based on the data packet transmission frequency information in the associated log data of the first statistical interval and the target time period; The first difference between the target user and other users is calculated based on the cosine distance between the target user's data packet transmission frequency vector and the data packet transmission frequency vector of other users; The first degree of atypicality is calculated based on the average of the reference first difference and the minimum first difference, wherein the reference first difference and the minimum first difference are the values ​​of the first reference position and the first position corresponding to the first difference after sorting the first differences of the target user with those of other users in ascending order; A second atypicality is calculated using cosine distance based on a second statistical interval and user response data packet information. This second atypicality represents the latency and jitter characteristics of the data packets, including: Generate a user response vector based on the user response data packet information in the associated log data of the second statistical interval and the target time period; The second difference between the target user and other users is calculated based on the cosine distance between the target user's user response vector and the user response vectors of other users; The second degree of atypicality is calculated based on the reference second difference, wherein the reference second difference is the value of the second reference bit after sorting the second differences between the target user and other users in ascending order.

9. An abnormal user identification device, characterized in that, The abnormal user identification device includes: The second acquisition module is used to acquire the feature vector of the user to be identified; The module is used to input the feature vector of the user to be identified into the abnormal user identification model constructed by the abnormal user identification model construction method according to any one of claims 1-4 to obtain the abnormal user.

10. An electronic device comprising a processor, a communication interface, a memory, and a communication bus, wherein, The processor, the communication interface, and the memory communicate with each other via the communication bus, characterized in that... The memory is used to store computer programs; The processor is configured to execute the steps of the abnormal user identification model construction method according to any one of claims 1-4 and the steps of the abnormal user identification method according to any one of claims 5-7 by running the computer program stored in the memory.

11. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the abnormal user identification model construction method according to any one of claims 1-4 and the steps of the abnormal user identification method according to any one of claims 5-7.

Images