A method for internal user association analysis

Abstract

This invention relates to the field of network and information security technology, specifically to an internal user association analysis method. The method includes: preprocessing collected user attribute information to obtain multi-source user information; extracting information from the multi-source user information to obtain user entities, relationships between users, and user attributes; constructing an ontology from top to bottom using a semi-automatic construction technique based on user entities, relationships between users, and user attributes to obtain a user attribute ontology; constructing a knowledge graph using a graph database based on the user attribute ontology; exporting the graph data from the knowledge graph to obtain user attribute features; and inputting the user attribute features into a graph clustering model to obtain the final similar user groups. This invention establishes connections between user nodes by constructing a knowledge graph and provides user attribute features as input data for the subsequent graph clustering model, enhancing interpretability and solving the problem of insufficient internal user attribute analysis in existing analysis methods.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and in particular to an internal user association analysis method. Background Technology

[0002] Internal user attribute features are characterized by multi-source heterogeneity, non-linearity, and lack of correlation. Clustering and association analysis based on a single user attribute suffers from drawbacks such as insufficient feature simplification, one-sidedness, and poor interpretability. The key issue in achieving internal user association analysis is how to fully utilize the inherent attributes of internal users, structure heterogeneous knowledge in the domain through knowledge representation, and then obtain similar user groups using deep graph clustering methods. Existing user clustering techniques in the insider threat domain are insufficient in analyzing internal user attributes, and most studies focus on clustering using single user attributes, neglecting social attribute information such as job title, position, and department. Furthermore, traditional clustering methods are sensitive to outliers and noise; some excessively large outliers lead to poor clustering results and cannot be used with sparse graph data, ultimately resulting in insufficient analysis of internal user attributes. Summary of the Invention

[0003] The purpose of this invention is to provide an internal user association analysis method, which aims to solve the problem that existing analysis methods are insufficient in analyzing internal user attributes.

[0004] To achieve the above objectives, the present invention provides an internal user association analysis method, comprising the following steps:

[0005] The collected user attribute information is preprocessed to obtain multi-source user information;

[0006] Information extraction is performed on the user multi-source information to obtain user entities, relationships between users, and user attributes;

[0007] Based on the user entity, the relationship between the users and the user attributes, a semi-automatic construction technique is used to construct the ontology from top to bottom to obtain the user attribute ontology.

[0008] A knowledge graph is constructed using a graph database based on the user attribute ontology;

[0009] Export the graph data from the knowledge graph to obtain user attribute features;

[0010] The user attribute features are input into a graph clustering model to obtain the final similar user groups.

[0011] The user attribute information includes resume information, personality information, and work information;

[0012] The preprocessing includes redundancy removal, missing value completion, and numerical normalization.

[0013] The graph database in question is the Neo4j graph database.

[0014] The graph clustering model includes a graph embedding network and an improved graph convolutional network.

[0015] The graph convolutional network includes a GCN layer and a DMoN pooling layer.

[0016] The step of inputting the user attribute features into a graph clustering model to obtain the final similar user groups includes:

[0017] The user attribute features are input into the graph embedding network for dimensionality reduction to obtain the state matrix and the adjacency matrix of the general graph structure. Then, the state matrix is ​​normalized.

[0018] The state matrix and the normalized adjacency matrix are passed as input to the improved graph convolutional network to obtain the final similar user groups.

[0019] The step of passing the state matrix and the normalized adjacency matrix as input to the improved graph convolutional network to obtain the final similar user groups includes:

[0020] The state matrix and the normalized adjacency matrix are passed as input to the GCN layer. The GCN layer aggregates the neighbor information of the nodes and divides the state matrix and the adjacency matrix into different clusters according to the similarity between the neighbor information to obtain the clustering assignment matrix.

[0021] The clustering assignment matrix is ​​input into the DMoN pooling layer, where the spectral modularity function is used to optimize the clustering model to obtain the final similar user groups.

[0022] This invention discloses an internal user association analysis method. It preprocesses collected user attribute information to obtain multi-source user information; extracts information from this multi-source information to obtain user entities, relationships between users, and user attributes; constructs an ontology from top to bottom using a semi-automatic construction technique based on the user entities, relationships between users, and user attributes to obtain a user attribute ontology; constructs a knowledge graph using a graph database based on the user attribute ontology; exports the graph data from the knowledge graph to obtain user attribute features; and inputs these user attribute features into a graph clustering model to obtain the final similar user groups. This invention establishes connections between user nodes by constructing the knowledge graph and provides user attribute features as input data for the subsequent graph clustering model, enhancing interpretability and solving the problem of insufficient internal user attribute analysis in existing methods. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of an internal user association analysis method provided by the present invention.

[0025] Figure 2 This is a framework diagram of the overall research approach for user association analysis.

[0026] Figure 3 This is a flowchart of an internal user association analysis method provided by the present invention. Detailed Implementation

[0027] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0028] Please see Figures 1 to 3 This invention provides an internal user association analysis method, comprising the following steps:

[0029] S1 preprocesses the collected user attribute information to obtain multi-source user information;

[0030] Specifically, the user attribute information includes resume information, personality information, and work information; the preprocessing includes redundancy removal, missing value completion, and numerical normalization processing.

[0031] The definition and collection of basic user attribute information is fundamental to this work. The information is mainly organized and improved from the following aspects: The first category is resume information, including relatively static and immutable information such as name, age, gender, and marital status; the second category is personality information, including Big Five personality test results and psychological assessment results; the third category is work information, including job position, team, and superior-subordinate relationships. Basic user attribute information can be collected through various means such as questionnaires, psychological tests, and field observations. Data preprocessing includes data screening and data sampling. Because data sources often contain incomplete, heterogeneous, and noisy data, the comprehensiveness and completeness of the data are affected. To ensure data quality, the following preprocessing methods are used: 1) Screening information data and removing redundant content; 2) Completing missing data; 3) Numericalizing and normalizing the raw data and removing erroneous information.

[0032] S2 extracts information from the user's multi-source information to obtain user entities, relationships between users, and user attributes;

[0033] Specifically, information extraction is the foundation of knowledge graph construction, mainly including three aspects: entity extraction, relation extraction, and attribute extraction. In this invention, since entities and relations are deterministic, the entity extraction scheme requires little semantic recognition; therefore, a rule-based entity extraction method is adopted. The relation extraction scheme uses linguistic knowledge and the characteristics of the corpus to create templates and match entities with specific relations from the text. The attribute extraction scheme collects attribute information of specific entities from the information source and extracts attributes based on manually written rules tailored to the task scenario of this invention.

[0034] S3 uses a semi-automatic construction technique to construct the ontology from top to bottom based on the user entity, the relationship between the users and the user attributes, and obtains the user attribute ontology.

[0035] Specifically, ontology construction is crucial for knowledge graph construction. It refers to building conceptual templates for knowledge at the schema layer, standardizing the description of concepts and relationships within a specified domain. This process includes concept extraction and the extraction of relationships between concepts. Semi-automatic construction technology refers to a method that combines automation and human intervention in the knowledge graph construction process to extract knowledge elements from raw data and store them in the data and schema layers of the knowledge base.

[0036] S4 constructs a knowledge graph using a graph database based on the user attribute ontology;

[0037] Specifically, the graph database is the Neo4j graph database.

[0038] Based on a predefined user attribute ontology, a knowledge graph is constructed using the Neo4j graph database to represent and analyze the relationships between users. The graph includes three entities: employees, departments, and positions; social relationships and hierarchical / colleague relationships; and attributes such as name, gender, and psychological state. This invention extracts and integrates user attribute-related information from multi-source heterogeneous data, populates the entities and relationships in the ontology, constructs the knowledge graph, and uses user attribute features as data input for the graph clustering model. The graph data obtained from the knowledge graph is converted into an n×s matrix, where n represents the number of users and s represents the number of attribute features for each user.

[0039] S5 exports the graph data from the knowledge graph to obtain user attribute features;

[0040] S6 inputs the user attribute features into the graph clustering model to obtain the final similar user groups.

[0041] Specifically, the graph clustering model includes a graph embedding network and an improved graph convolutional network. The graph convolutional network includes GCN layers and DMoN pooling layers.

[0042] The specific method is as follows:

[0043] S61 inputs the user attribute features into the graph embedding network for dimensionality reduction to obtain the state matrix and the adjacency matrix of the general graph structure, and then performs a normalization operation on the state matrix.

[0044] Specifically, this invention employs a graph embedding network combined with an improved GCN network to achieve efficient and high-quality clustering and grouping. The graph embedding network can reduce the dimensionality of the input data. By inputting the constructed user attribute features into the graph embedding network as graph data, a low-dimensional representation of the original data can be obtained. Compared to the original data elements, the output of the hidden layer can yield data elements with more obvious features and lower dimensionality. First, the input data is reduced in dimensionality using a SAE-based graph embedding network. The graph G = (V, E) is represented by the node set V = (v1, ..., v...). n ),|V|=n and edge Let A denote the n×n adjacency matrix of G, where A ij =1 if and only if {v i ,v j}∈E (otherwise, the elements of A are equal to 0). v i The "degree" is its number of connections. D is the degree matrix of A, denoted as D ij =Σ j A ij Normalize the adjacency matrix A. Obtain the normalized adjacency matrix Measurement map division function Quality: It divides the node set V into k partitions Let the number of neurons in the input layer be r, and set the number of neurons in the hidden layer to u, where 0 < u < r, to obtain the user feature state matrix of the hidden layer output The backpropagation formula in SAE is as follows

[0045]

[0046] Among them, b is the bias value, z represents the input neuron, l represents the layer number, and W (l) represents the weight from the neurons in the (l - 1)-th layer to the neurons in the l-th layer

[0047] S62 takes the state matrix and the normalized adjacency matrix as inputs and passes them to the improved graph convolutional network to obtain the final similar user groups

[0048] Specifically, take the state matrix and the normalized adjacency matrix as inputs and pass them to the GCN layer. The GCN layer aggregates the neighbor information of the nodes and divides the state matrix and the adjacency matrix into different clusters according to the similarity between the neighbor information to obtain the clustering assignment matrix; input the clustering assignment matrix into the DMoN pooling layer, and use the spectral modularity function in the DMoN pooling layer to optimize the clustering model to obtain the final similar user groups

[0049] Obtain the state matrix of user attribute features through SAE Then take X and as inputs and pass them to the improved GCN network, including the GCN layer and the DMoN pooling layer. The GCN layer aggregates the neighbor information of the nodes and divides into different clusters according to the similarity between the node information to obtain the clustering assignment matrix C, and then input it into the DMoN pooling layer for processing, thereby realizing end-to-end graph clustering and discovering nodes with potential associations. The KL divergence formula of its loss function is as follows

[0050]

[0051] Among them, ρ is a constant h j is the average value of the hidden layer weights

[0052] The GCN layer first trains and X, and then obtains C through the activation function softmax. At the same time, the objective function of C can be optimized. The input of C can be any differentiable information transfer function, so use the graph convolutional network to obtain the soft clustering matrix of each node. Its inter-layer propagation formula is as follows

[0053]

[0054] The output of the GCN layer is passed through a softmax layer to obtain the clustering assignment matrix C, as shown in the following formula.

[0055]

[0056] Then, in the unsupervised pooling layer DMoN, the clustering result is obtained by performing argmax processing on the soft clustering assignment matrix C output by the GCN layer. The formula is as follows.

[0057] F = argmax(C) (5)

[0058] This invention uses a differentiable spectral modularity function as the loss function for the improved GCN network. By maximizing this function, weights and biases are trained, automatically determining the number of user groups. Furthermore, to address the pseudo-local minima problem commonly found in spectral clustering, a relaxed collapse regularization term is added to the spectral modularity function. This regularization term effectively avoids over-subdivision or coarse-subdivision of clusters, achieving appropriate cluster partitioning. The formula is as follows.

[0059]

[0060] Finally, output the clustering result user group set F i =(f1,f2,…,f t+1 ), t∈n. User groups are extracted from the output using dictionary mapping, where F i It is the set of all user groups, f1, f2, ..., f t+1 These represent user groups that have potential similarities after clustering.

[0061] The beneficial effects are:

[0062] 1. This invention uses user attribute features to establish relationships between user nodes in the form of a knowledge graph, which is used to represent and analyze the correlation between users, and to provide user attribute features as model input for subsequent clustering models;

[0063] 2. After inputting user attribute features into the model, the data dimensionality is first reduced using a sparse autoencoder (SAE) graph embedding network to obtain the state matrix and normalized adjacency matrix of user features. Compared with the original data elements, the output of the hidden layer can obtain data elements with more obvious features and lower dimensionality. Then, a graph convolutional network (GCN) is used to train the state matrix and adjacency matrix, and the clustering assignment matrix is ​​obtained through the softmax activation function. Finally, the clustering assignment matrix is ​​input into an unsupervised DMoN pooling layer to perform argmax processing on the clustering assignment matrix output from the GCN layer, and user groups are extracted from the output results through dictionary mapping. Simultaneously, this invention also uses a differentiable spectral modularity function as the loss function of the improved GCN network, which can automatically determine the number of user groups. A relaxed collapse regularization term is added to the spectral modularity function to achieve appropriate cluster partitioning, solving the pseudo-local minima problem in spectral clustering. This invention can effectively process complex and multi-source user attribute data and accurately segment similar user groups based on it, providing a method for organizations to effectively monitor similar users.

[0064] The above-disclosed embodiments are merely preferred embodiments of the internal user association analysis method of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. An internal user association analysis method, characterized in that, Includes the following steps: The collected user attribute information is preprocessed to obtain multi-source user information, including resume information, personality information, and work information; the preprocessing includes redundancy removal, missing value completion, and numerical normalization. Information extraction is performed on the user multi-source information to obtain user entities, relationships between users, and user attributes; Based on the user entity, the relationship between the users and the user attributes, a semi-automatic construction technique is used to construct the ontology from top to bottom to obtain the user attribute ontology. A knowledge graph is constructed using a graph database based on the user attribute ontology, wherein the graph database is the Neo4j graph database; Export the graph data from the knowledge graph to obtain user attribute features; The process of inputting the user attribute features into a graph clustering model to obtain the final similar user groups includes: inputting the user attribute features into the graph embedding network for dimensionality reduction to obtain a state matrix and an adjacency matrix of the generalized graph structure, followed by normalization of the state matrix; passing the state matrix and the normalized adjacency matrix as input to the improved graph convolutional network to obtain the final similar user groups, wherein the state matrix and the normalized adjacency matrix are passed as input to the GCN layer, the GCN layer aggregates the neighbor information of nodes and divides the state matrix and the adjacency matrix into different clusters according to the similarity between the neighbor information to obtain a clustering assignment matrix; and inputting the clustering assignment matrix into the DMoN pooling layer, where the clustering model is optimized using a spectral modularity function to obtain the final similar user groups. Among them, the graph clustering model includes a graph embedding network and an improved graph convolutional network. The graph convolutional network includes a GCN layer and a DMoN pooling layer, including: reducing the dimension of the input data through the graph embedding network based on SAE. The graph G=(V, E) passes through the node set V=(v1,…,v n ), |V| = n and the edge Use A to represent the n×n adjacency matrix of G, where A ij = 1 if and only if {v i , v j} ∈ E (otherwise the elements of A are equal to 0). The "degree" of v i is the number of its connections D is the degree matrix of A, denoted as D ij = Σ j A ij , perform normalization on the adjacency matrix A to obtain the normalized adjacency matrix Measure the quality of the graph partitioning function : It partitions the node set V into k partitions Let the number of neurons in the input layer be r, and set the number of neurons in the hidden layer to u, 0 < u < r, to obtain the user feature state matrix output by the hidden layer In SAE, the reverse The propagation formula is as follows: Where b is the bias value, z represents the input neuron, l represents the layer number, and W (l) This represents the weights from neurons in layer l-1 to neurons in layer l; The state matrix of user attribute features is obtained through SAE. Then X and The data is fed into the improved GCN network, which includes a GCN layer and a DMoN pooling layer. The GCN layer aggregates the neighbor information of nodes and divides them into different clusters based on the similarity between the node information. After obtaining the clustering assignment matrix C, it is fed into the DMoN pooling layer for processing, thereby achieving end-to-end graph clustering and discovering nodes with potential associations. The loss function, KL divergence, is formulated as follows: Where ρ is a constant, h j It is the average value of the hidden layer weights. The GCN layer first... We train with X, and then obtain C through the softmax activation function. Simultaneously, we can optimize the objective function of C. The input to C is any differentiable information transfer function; therefore, we use a graph convolutional network to obtain the soft clustering matrix for each node. Its inter-layer propagation formula is as follows: The output of the GCN layer is passed through a softmax layer to obtain the clustering assignment matrix C, which is calculated using the following formula: (4) Then, in the unsupervised pooling layer DMoN, the clustering result is obtained by argmax processing the soft clustering assignment matrix C output by the GCN layer. The formula is as follows: F=argmax(C)(5); A differentiable spectral modularity function is used as the loss function of the improved GCN network. The weights and biases are trained by maximizing it, and the number of user groups is automatically determined. At the same time, in order to solve the pseudo-local minimum problem that is common in spectral clustering, a relaxed collapse regularization term is added to the spectral modularity function. This regularization term can effectively avoid over-subdivision or coarse division of clusters and achieve appropriate cluster partitioning. The formula is as follows: Finally, output the clustering result user group set F i =(f1,f2,…,f t+1 ), t∈n, extract user groups from the output through dictionary mapping, where F i It is the set of all user groups, f1, f2, ..., f t+1 These represent user groups that have potential similarities after clustering.

Images