A user behavior prediction method based on immune genetic algorithm optimization log audit

Abstract

The application discloses a user behavior prediction method based on immune genetic algorithm optimization log audit, including S1, information collection: the behavior characteristics of the user are collected from the log file of the system, and the behavior characteristics include basic information data, operation behavior data and expenditure level data of the user; S2, a prediction model is constructed: a user behavior prediction model is constructed through an immune genetic algorithm; S3, data identification: the log file of the target user is analyzed, and the target user behavior data is identified.The application collects the behavior characteristics of the user from the log file of the system, constructs a user behavior prediction model through an immune genetic algorithm, identifies the behavior data of the target user, predicts whether the user behavior is normal, predicts the user behavior abnormality through setting three to five unqualified items, can reduce the influence of some occasional factors on the user behavior, leads to the user behavior abnormality alarm, and thus the false positive rate of the user abnormal behavior alarm is reduced.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, in particular to a user behavior prediction method based on an immune genetic algorithm optimized log audit. BACKGROUND

[0002] With the development of the Internet, people's work and life increasingly rely on the network, search engines have become the main way for people to obtain information, network search logs contain user behaviors and demands, and user behavior refers to the way in which a user interacts with a specific product, to analyze user behavior, various user indicators need to be set to measure usability and intuitive design, a person's character can be judged from network logs, and even user behavior can be predicted.

[0003] In the prior art, for example, a user abnormal behavior detection method and device based on user behavior log data (patent number: CN108509793A) comprises the following steps: collecting user log data and performing normalization processing; performing score evaluation on newly collected user behavior logs through an LDA analysis model; when the evaluation score is lower than a predetermined score, determining that the newly collected user behavior logs are suspicious user behavior logs; determining the user terminal and application software corresponding to the suspicious user behavior logs, and generating an alarm information.

[0004] In the above-mentioned patent, the collected users are evaluated, and the users with low evaluation scores are determined as suspicious users, but when user behavior is abnormal due to some occasional factors affecting user behavior, it is inconvenient to verify and correct the abnormal user behavior, so that the abnormal user behavior is still alarmed, and the false positive rate of the abnormal user behavior alarm is increased.

[0005] Therefore, the application provides a user behavior prediction method based on an immune genetic algorithm optimized log audit to solve the problems in the above-mentioned background. SUMMARY

[0006] The application aims to provide a user behavior prediction method based on an immune genetic algorithm optimized log audit to solve the problems in the above-mentioned background, that is, when user behavior is abnormal due to some occasional factors affecting user behavior, it is inconvenient to verify and correct the abnormal user behavior, so that the abnormal user behavior is still alarmed, and the false positive rate of the abnormal user behavior alarm is increased.

[0007] To achieve the above-mentioned purpose, the application provides the following technical scheme: a user behavior prediction method based on an immune genetic algorithm optimized log audit, comprising the following steps:

[0008] S1, information collection: collecting behavior characteristics of users from log files of a system, the behavior characteristics including basic information data, operation behavior data and expenditure level data of the users;

[0009] S2, constructing a prediction model: constructing a user behavior prediction model by an immune genetic algorithm;

[0010] S3, data identification: analyzing the log files of the target user and identifying the target user behavior data;

[0011] S4, behavior alarm: when the user behavior is predicted to be abnormal, the user behavior is marked, the user corresponding to the marked user behavior is determined as an abnormal user, and an alarm notification is sent to the user.

[0012] Preferably, in step S1, the basic information data refers to the gender, work situation and job description of the user.

[0013] Preferably, in step S1, the operation behavior data refers to the keyword search record, daily browsing information and daily hobby of the user.

[0014] Preferably, in step S1, the expenditure level data is calculated according to the proportion of the user's daily expense expenditure in the user's income.

[0015] Preferably, in step S1, the log files of the system support network security devices, network devices, databases, web server logs, virtualization platform logs, and custom logs.

[0016] Preferably, in step S1, the information collection provides multiple log collection methods such as distributed external collector and Agent, and supports IPv4, IPv6 log collection, analysis and retrieval query.

[0017] Preferably, in step S2, the immune genetic algorithm for constructing the user behavior prediction model includes the following contents:

[0018] S20, adding the user behavior characteristics collected in step S1 to the memory storage database, backing up the user behavior characteristics, enriching the data of the memory storage database, and improving the coverage range of the memory storage database;

[0019] S21, performing genetic operation on the user behavior characteristics, crossing and mutating to generate the first possible behavior characteristics of the user, and storing the new log files generated by the first possible behavior characteristics of the user in the memory storage database;

[0020] S22, generating the second possible behavior of the user from other user behaviors similar to the user behavior characteristics in the memory storage database, and storing the new log files generated by the second possible behavior characteristics of the user in the memory storage database;

[0021] S23, combine the initial behavior characteristics of the user in the memory storage database, the first possible behavior of the user and the second possible behavior characteristics of the user, and generate a user behavior prediction model.

[0022] Preferably, in step S3, the data recognition comprises the following contents:

[0023] S30, analyze the log file of the target user, traverse the user data, filter irrelevant data, reduce the spatial redundancy of the log file, compare the effective data with the prediction data, identify the target user behavior data, and filter the user behavior prediction model suitable for the data;

[0024] S31, call the filtered user behavior prediction model, compare the user's operation behavior with the user behavior in the user behavior prediction model, and predict whether the user behavior is normal.

[0025] Preferably, in step S30, the user behavior data comprises the login location, login time, login device, operation correlation and operation behavior of the user.

[0026] Preferably, in step S31, if the predicted user behavior is normal, the user behavior is updated to the memory storage database, a new log is generated, the coverage range of the memory storage database is improved, if the predicted user behavior is abnormal, the user is alarmed in step S4, the login time, login location, operation device, operation behavior and operation function of the user are compared, if all the compared data are matched, it is predicted that the user behavior is normal, if one to two items are not matched, the user is asked for a verification code for verification, if the verification is successful, it is predicted that the user behavior is normal, if the verification fails, it is predicted that the user behavior is abnormal, if three to five items are not matched, it is predicted that the user behavior is abnormal.

[0027] Compared with the prior art, the method has the following advantages:

[0028] In the method, when the user behavior based on the immune genetic algorithm is predicted, the behavior characteristics of the user are collected from the log file of the system, the user behavior prediction model is constructed through the immune genetic algorithm after the behavior characteristics of the user are obtained, the user behavior prediction model is generated by combining the collected user behavior characteristics, the first possible behavior characteristics of the user and the second possible behavior characteristics of the user in the process of establishing the user behavior prediction model, the target user behavior data in the log file of the target user is identified, the user behavior prediction model is called, and whether the user behavior is normal is predicted.

[0029] Meanwhile, based on the immune genetic algorithm, whether the user behavior is normal is predicted according to the generated user behavior prediction model, and whether the login time, login location, operation equipment, operation behavior and operation function of the user match the user is compared, when one to two items do not match in the user data comparison, the user is asked to provide a verification code for verification, and the user behavior is predicted to be normal when the verification is successful, and the user behavior is predicted to be abnormal when the verification fails, and the user behavior is predicted to be abnormal when three to five items do not match in the user data comparison, the user behavior is predicted to be abnormal when three to five items do not match, the user behavior is predicted to be abnormal, and alarm information is sent to the user with abnormal behavior, which can reduce the influence of some occasional factors on the user behavior, so as to reduce the false positive rate of the user abnormal behavior alarm. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 A flowchart of the user behavior prediction method based on the immune genetic algorithm optimization log audit of the application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0032] Please refer to Figure 1 The application provides a technical solution: a user behavior prediction method based on an immune genetic algorithm optimization log audit, comprising the following steps:

[0033] Step 1, information collection: the behavior characteristics of the user are collected from the log file of the system, and the behavior characteristics include basic information data, operation behavior data and expenditure level data of the user.

[0034] The basic information data refers to the gender, work situation and job details of the user.

[0035] The operation behavior data refers to the keyword search record, daily browsing information and daily hobby of the user.

[0036] The expenditure level data is calculated according to the proportion of daily expense expenditure in the user's income.

[0037] The log file of the system supports network security equipment, network equipment, database, web server log, virtualization platform log and custom log.

[0038] Information collection offers multiple log collection methods, including distributed external collectors and agents, and supports IPv4 and IPv6 log collection, analysis, and retrieval queries.

[0039] Step 2: Construct a prediction model: Construct a user behavior prediction model using an immune genetic algorithm.

[0040] 20. Add the user behavior features collected in step S1 to the memory storage database, back up the user behavior features, enrich the data in the memory storage database, and improve the coverage of the memory storage database.

[0041] 21. Perform genetic operations on user behavior characteristics, crossover and mutation to generate the first possible behavior characteristics of the user, and generate a new log file from the first possible behavior characteristics of the user and store it in the memory storage database.

[0042] 22. Generate the user's second possible behavior from other user behaviors in the memory storage database that are similar to the user's behavior characteristics, and generate a new log file from the user's second possible behavior characteristics and store it in the memory storage database;

[0043] 23. Combine the user's initial behavioral characteristics, the user's first possible behavior, and the user's second possible behavior characteristics stored in the memory database to generate a user behavior prediction model.

[0044] Step 3: Data Identification: Analyze the target user's log files and identify the target user's behavioral data.

[0045] 30. Analyze the target user's log files, traverse the user data, filter out irrelevant data, reduce the space redundancy of the log files, compare the effective data with the predicted data, identify the target user's behavior data, and select the user behavior prediction model suitable for the data.

[0046] 31. Retrieve the filtered user behavior prediction model, compare the user's operation behavior with the user behavior in the user behavior prediction model, and predict whether the user behavior is normal.

[0047] User behavior data includes the user's login location, login time, login device, operation association, and operation behavior.

[0048] If the predicted user behavior is normal, update the user behavior in the memory storage database, generate new logs, and improve the coverage of the memory storage database. If the predicted user behavior is abnormal, proceed to step four and issue an alert to the user.

[0049] When predicting user behavior, the system compares the user's login time, login location, operating device, operating behavior, and operating function to see if they match the user. If all the data matches, the user behavior is predicted to be normal. If one or two data points do not match, the system needs to request a verification code from the user to verify the user. If the verification is successful, the user behavior is predicted to be normal. If the verification fails, the user behavior is predicted to be abnormal. If three to five data points do not match, the user behavior is predicted to be abnormal.

[0050] Step 4, Behavior Alerts: When abnormal user behavior is predicted, the user behavior is marked, the user corresponding to the marked user behavior is identified as an abnormal user, and an alert notification is sent to the user.

[0051] In this method, when predicting user behavior based on the immune genetic algorithm, the user's behavioral characteristics are first collected from the system's log files. After obtaining the user's behavioral characteristics, a user behavior prediction model is constructed using the immune genetic algorithm. During the establishment of the user behavior prediction model, the collected user behavior characteristics, the user's first possible behavior characteristics, and the user's second possible behavior characteristics are combined to generate the user behavior prediction model. The target user behavior data in the target user's log file is identified, the user behavior prediction model is retrieved, and the user behavior is predicted to be normal. When the user behavior is predicted to be normal, a new log is generated for the user behavior and updated in the memory storage database. When the user behavior is predicted to be abnormal, the user behavior is marked, the user corresponding to the marked user behavior is identified as an abnormal user, and an alarm notification is sent to the user.

[0052] Meanwhile, based on the immune genetic algorithm, the generated user behavior prediction model predicts whether user behavior is normal. It compares the user's login time, login location, operating device, operating behavior, and operating function to see if they match the user. If one or two items do not match the user data comparison, the system requests a verification code from the user for verification. If the verification is successful, the user behavior is predicted to be normal; if the verification fails, the user behavior is predicted to be abnormal. If three to five items do not match the user data comparison, the system predicts abnormal user behavior. By setting three to five non-compliance items to predict abnormal user behavior, the system sends alarm information to users with abnormal behavior. This reduces the likelihood of occasional factors affecting user behavior and causing abnormal user behavior alarms. When occasional factors cause abnormal user behavior, user verification can be used to correct the abnormal user behavior, thereby reducing the false alarm rate of abnormal user behavior alarms.

[0053] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A user behavior prediction method based on immune genetic algorithm for optimizing log auditing, characterized in that, Includes the following steps: S1. Information Collection: Collect user behavior characteristics from the system's log files. Behavioral characteristics include basic user information, operational behavior data, and expenditure level data. S2. Constructing a prediction model: Constructing a user behavior prediction model using an immune genetic algorithm; S3. Data Identification: Analyze the target user's log files and identify the target user's behavioral data; S4. Behavior Alert: When abnormal user behavior is predicted, the user behavior is marked, the user corresponding to the marked user behavior is identified as an abnormal user, and an alert notification is sent to the user. In step S2, the immune genetic algorithm constructs a user behavior prediction model, including the following: S20. Add the user behavior features collected in step S1 to the memory storage database, back up the user behavior features, enrich the data in the memory storage database, and improve the coverage of the memory storage database. S21. Perform genetic operations on user behavior characteristics, crossover and mutation to generate the first possible behavior characteristics of the user, and generate a new log file from the first possible behavior characteristics of the user and store it in the memory storage database. S22. Generate the user's second possible behavior characteristics from other user behaviors in the memory storage database that are similar to the user's behavior characteristics, and generate a new log file from the user's second possible behavior characteristics and store it in the memory storage database. S23. Combine the user's initial behavioral characteristics, the user's first possible behavior, and the user's second possible behavior characteristics in the memory storage database to generate a user behavior prediction model; In step S3, the data identification includes the following: S30. Analyze the target user's log file, traverse the user data, filter irrelevant data, reduce the space redundancy of the log file, compare the effective data with the predicted data, identify the target user's behavior data, and select a user behavior prediction model suitable for the data. S31. Retrieve the filtered user behavior prediction model, compare the user's operation behavior with the user behavior in the user behavior prediction model, and predict whether the user behavior is normal.

2. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S1, the basic information data refers to the user's gender, work status, and job details.

3. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S1, the operational behavior data refers to the user's keyword search records, daily browsing information, and daily hobbies.

4. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S1, the expenditure level data is calculated based on the proportion of the user's daily expenses in the user's income.

5. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S1, the system's log files support network security device logs, network device logs, database logs, web server logs, virtualization platform logs, and custom logs.

6. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S1, the information collection provides multiple log collection methods using distributed external collectors and agents, supporting IPv4 and IPv6 log collection, analysis, and retrieval queries.

7. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S30, the user behavior data includes the user's login location, login time, login device, operation association, and operation behavior.

8. The user behavior prediction method based on immune genetic algorithm for optimizing log auditing according to claim 1, characterized in that, In step S31, if the user behavior is predicted to be normal, the user behavior is updated in the memory storage database to generate a new log and improve the coverage of the memory storage database. If the user behavior is predicted to be abnormal, then proceed to step S4 and issue an alarm to the user.

Images