User behavior classification method, device, equipment and storage medium

Abstract

The application discloses a user behavior classification method and device, equipment and storage medium, the method comprises the following steps: obtaining deep packet inspection data and user behavior traffic data from the terminal equipment of a target user, and obtaining user portrait features and corresponding environment features of the target user; vectorizing the deep packet inspection data and the user behavior traffic data to obtain an access sequence embedding vector and a simulated access feature embedding vector; adaptively discretizing and vectorizing the user portrait features and the environment features to obtain a user portrait feature vector and an environment feature vector; and determining a behavior category of the target user according to the access sequence embedding vector, the simulated access feature embedding vector, the user portrait feature vector and the environment feature vector. The behavior category of the target user can be determined according to the vector obtained after the vectorization of the multi-source features, and the accuracy of the user behavior classification is improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a user behavior classification method, apparatus, device, and storage medium. Background Technology

[0002] With the advent of the Internet era, the amount of behavioral data generated by users on the Internet is increasing exponentially. It is becoming increasingly difficult to analyze user behavior based on user behavior data. Currently, the general approach is to clean and transform the collected user behavior data, extract features through feature engineering by business personnel, and then use machine learning technology to build relevant models. The established models are then used for behavior classification. However, current behavior classification methods cannot effectively utilize the data and have limited representation capabilities, resulting in low accuracy in user behavior classification.

[0003] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this invention is to provide a user behavior classification method, apparatus, device, and storage medium, aiming to solve the technical problem of low accuracy in existing user behavior classification technologies.

[0005] To achieve the above objectives, the present invention provides a user behavior classification method, the method comprising the following steps:

[0006] The system obtains deep packet inspection data and user behavior traffic data from the target user's terminal device, and acquires the user profile features and corresponding environmental features of the target user.

[0007] The deep packet detection data and the user behavior traffic data are vectorized to obtain access sequence embedding vectors and simulated access feature embedding vectors.

[0008] The user profile features and the environmental features are respectively subjected to adaptive discretization vector representation to obtain user profile feature vector and environmental feature vector;

[0009] The behavioral category of the target user is determined based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector.

[0010] Optionally, the step of vectorizing the deep packet inspection data and the user behavior traffic data to obtain an access sequence embedding vector and a simulated access feature embedding vector includes:

[0011] The user access sequence is obtained by extracting features from the deep message detection data through the feature extraction layer of the preset time-series deep model.

[0012] The user behavior traffic data is simulated in a sandbox using the feature extraction layer to obtain sandbox access simulation features.

[0013] The user access sequence is converted into access sequence ASCII code through the embedding layer of the preset time-series deep model, and the access sequence ASCII code is converted into access sequence embedding vector;

[0014] The embedding layer converts the sandbox simulated access features into simulated access feature ASCII codes, and then converts the simulated access feature ASCII codes into simulated access feature embedding vectors.

[0015] Optionally, the step of adaptively discretizing the user profile features and the environmental features into vector representations to obtain user profile feature vectors and environmental feature vectors includes:

[0016] The user profile features and the environmental features are discretized into a preset number of buckets through the embedding layer of a preset time-series deep model;

[0017] Obtain the first bucket probability distribution of the user profile features discrete into each bucket and the second bucket probability distribution of the environmental features discrete into each bucket;

[0018] The embedding layer performs a weighted summation of the first bucket probability distribution and the first-ary representation corresponding to each bucket to obtain the user profile feature vector corresponding to the user profile features; and

[0019] The embedding layer performs a weighted summation of the second bucket probability distribution and the second element representation corresponding to each bucket to obtain the environmental feature vector corresponding to the environmental feature.

[0020] Optionally, determining the target user's behavior category based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector includes:

[0021] By using the modeling layer of a preset time series model, behavioral modeling is performed on the access sequence embedding vector and the simulated access feature embedding vector respectively to obtain the access sequence feature vector and the simulated access feature vector;

[0022] The access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environmental feature vector are input into the output layer of the preset time series model to obtain the probability distribution output by the output layer.

[0023] The target user's behavior category is determined based on the probability distribution.

[0024] Optionally, the modeling layer includes a first gated recurrent neural network, an attention mechanism neural network, and a second gated recurrent neural network;

[0025] The process of modeling the access sequence embedding vector and the simulated access feature embedding vector through a pre-defined time-series modeling layer to obtain access sequence feature vector and simulated access feature vector includes:

[0026] The first hidden state vector corresponding to the access sequence embedding vector and the second hidden state vector corresponding to the simulated access feature embedding vector are calculated using the first gated recurrent neural network.

[0027] The first hidden layer state vector and the second hidden layer state vector are input into the attention mechanism neural network;

[0028] Obtain the first attention weight corresponding to the first hidden layer state vector and the second attention weight corresponding to the second hidden layer state vector in the attention mechanism neural network;

[0029] The update gate of the second gated recurrent neural network is replaced with the first attention weight to obtain the third update-gated recurrent neural network;

[0030] The third updated gated recurrent neural network outputs the access sequence feature vector corresponding to the access sequence embedding vector; and

[0031] The update gate of the second gated recurrent neural network is replaced with the second attention weight to obtain the fourth update-gated recurrent neural network;

[0032] The simulated access feature vector corresponding to the simulated access feature embedding vector is output by the fourth updated gated recurrent neural network.

[0033] Optionally, the output layer includes a splicing module, a PReLU function, and a Softmax function;

[0034] The step of inputting the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environmental feature vector into the output layer of the preset time series model to obtain the probability distribution output by the output layer includes:

[0035] The splicing module splices the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environment feature vector to obtain a spliced ​​feature vector.

[0036] The concatenated feature vector is sequentially input into the PReLU function and the Softmax function to obtain the probability distribution.

[0037] Optionally, before obtaining deep packet inspection data and user behavior traffic data from the target user's terminal device, and obtaining the target user's user profile features and corresponding environmental features, the method further includes:

[0038] The test user behavior traffic data packets are obtained from the test terminal device using a preset network analysis tool, and a regular expression file is extracted from the test user behavior traffic data packets;

[0039] The test terminal device obtains test depth packet detection data, and performs MapReduce matching based on the domain name information in the test depth packet detection data to obtain matching detection data;

[0040] The matching detection data is matched with the regular expression file using MapReduce to obtain a user behavior labeled dataset.

[0041] The initial temporal deep model is trained using the user behavior annotation dataset, and a preset temporal deep model is obtained when the number of iterations reaches a preset number.

[0042] Furthermore, to achieve the above objectives, the present invention also proposes a user behavior classification device, the device comprising:

[0043] The acquisition module is used to acquire deep packet inspection data and user behavior traffic data from the target user's terminal device, and to acquire the user profile features and corresponding environmental features of the target user;

[0044] The first vectorization module is used to vectorize the deep message detection data and the user behavior traffic data to obtain an access sequence embedding vector and a simulated access feature embedding vector.

[0045] The second vectorization module is used to adaptively discretize the user profile features and the environmental features into vector representations to obtain user profile feature vectors and environmental feature vectors.

[0046] The classification module is used to determine the behavior category of the target user based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector.

[0047] Furthermore, to achieve the above objectives, the present invention also proposes a user behavior classification device, the device comprising: a memory, a processor, and a user behavior classification program stored in the memory and executable on the processor, the user behavior classification program being configured to implement the steps of the user behavior classification method as described above.

[0048] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing a user behavior classification program, which, when executed by a processor, implements the steps of the user behavior classification method as described above.

[0049] This invention acquires deep packet inspection data and user behavior traffic data from the target user's terminal device, and obtains the target user's user profile features and corresponding environmental features. The deep packet inspection data and user behavior traffic data are vectorized to obtain access sequence embedding vectors and simulated access feature embedding vectors. The user profile features and environmental features are respectively subjected to adaptive discretization vector representation to obtain user profile feature vectors and environmental feature vectors. The behavior category of the target user is determined based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector. This invention improves the accuracy of user behavior classification by determining the target user's behavior category based on vectors obtained after vectorizing multi-source features. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the structure of a user behavior classification device in the hardware operating environment involved in the embodiments of the present invention;

[0051] Figure 2 This is a flowchart illustrating the first embodiment of the user behavior classification method of the present invention;

[0052] Figure 3 This is a schematic diagram of the structure of a preset temporal depth model in one embodiment of the user behavior classification method of the present invention;

[0053] Figure 4 This is a flowchart illustrating the second embodiment of the user behavior classification method of the present invention;

[0054] Figure 5 This is a flowchart illustrating the third embodiment of the user behavior classification method of the present invention;

[0055] Figure 6 This is a schematic diagram of the process for obtaining a user behavior labeled dataset in one embodiment of the user behavior classification method of the present invention;

[0056] Figure 7 This is a structural block diagram of the first embodiment of the user behavior classification device of the present invention.

[0057] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0058] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0059] Reference Figure 1 , Figure 1 This is a schematic diagram of the user behavior classification device structure in the hardware operating environment involved in the embodiments of the present invention.

[0060] like Figure 1 As shown, the user behavior classification device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0061] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the user behavior classification device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0062] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a user behavior classification program.

[0063] exist Figure 1In the user behavior classification device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the user behavior classification device of the present invention can be set in the user behavior classification device, and the user behavior classification device calls the user behavior classification program stored in the memory 1005 through the processor 1001 and executes the user behavior classification method provided in the embodiment of the present invention.

[0064] This invention provides a user behavior classification method, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the user behavior classification method of the present invention.

[0065] In this embodiment, the user behavior classification method includes the following steps:

[0066] Step S10: Obtain deep packet inspection data and user behavior traffic data from the target user's terminal device, and obtain the user profile features and corresponding environmental features of the target user.

[0067] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or user behavior classification device capable of performing the above functions. The following uses a user behavior classification device (hereinafter referred to as the classification device) as an example to illustrate this embodiment and the following embodiments.

[0068] Understandably, target users can be users whose behavior is categorized; deep packet inspection data can also be called DPI (Deep Packet Inspection) data; user behavior traffic data can be data generated when target users use terminal devices, and user behavior traffic data can be obtained through network packet analysis software, such as obtaining user behavior traffic data of terminal devices through Wireshark; user profile features can be obtained from a user profile feature system, which can be a pre-established system that stores user profile features; environmental features can be features of the environment in which the target user is located, such as weather, date, whether it is a holiday, and geographical location.

[0069] In practice, the classification device obtains DPI data from the target user's terminal device, acquires user behavior traffic data from the terminal device through WireShark, obtains user profile features of the target user from the user profile feature system, and obtains environmental features such as weather, date, whether it is a holiday, and geographical location.

[0070] Step S20: Vectorize the deep packet detection data and the user behavior traffic data to obtain the access sequence embedding vector and the simulated access feature embedding vector.

[0071] In practice, access sequence embedding vectors are obtained by representing deep message detection data with vectors, and simulated access feature embedding vectors are obtained by representing user behavior traffic data with vectors.

[0072] Step S30: Perform adaptive discretization vector representation on the user profile features and the environmental features respectively to obtain user profile feature vector and environmental feature vector.

[0073] In practice, user profile features are adaptively discretized into vector representations to obtain user profile feature vectors, and environmental features are adaptively discretized into vector representations to obtain environmental feature vectors.

[0074] Step S40: Determine the behavior category of the target user based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector.

[0075] In practice, the probability distribution of user behavior is determined based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector. The behavior category of the target user is then determined based on the probability distribution. When classifying user behavior, the correspondence between cyberspace and real-world behavior is established by incorporating user profile features and environmental features. This provides a more relevant module for intelligent identification of user behavior on the mobile Internet and saves human resources.

[0076] Furthermore, to improve the accuracy of user behavior classification, step S20 includes: extracting features from the deep packet detection data through the feature extraction layer of a preset temporal deep model to obtain a user access sequence; performing sandbox simulation access on the user behavior traffic data through the feature extraction layer to obtain sandbox access simulation features; converting the user access sequence into access sequence ASCII codes through the embedding layer of the preset temporal deep model, and converting the access sequence ASCII codes into access sequence embedding vectors; converting the sandbox simulation access features into simulation access feature ASCII codes through the embedding layer, and converting the simulation access feature ASCII codes into simulation access feature embedding vectors.

[0077] It should be noted that, referring to Figure 3 , Figure 3This is a schematic diagram of the structure of a pre-defined temporal deep model. The pre-defined temporal deep model includes a feature extraction layer, an embedding layer, a modeling layer, and an output layer. The embedding layer includes a Self-Adaptive Discretization Embedding (SAD) unit (SAD Embedding) and an Encoding Embedding (ASCII) unit (ASCII Embedding). SAD Embedding vectorizes user profile features and environmental features. ASCII Embedding vectorizes user access sequences and sandbox simulation access features. This embodiment extracts useful dense information from the original redundant DPI data, improving the ability to process and integrate data resources.

[0078] Understandably, the feature extraction layer of the pre-defined time-series deep model can obtain user access sequences from DPI data. The feature extraction layer can also perform sandbox simulation of user behavior traffic data to obtain sandbox simulation access features. The ASCII Embedding in the embedding layer first converts the user access sequence into the corresponding access sequence ASCII code (0-127), and then learns the embedding vector of the access sequence ASCII to obtain the access sequence embedding vector. The ASCII Embedding in the embedding layer converts the sandbox simulation access features into simulation access feature ASCII code, and then learns the embedding vector of the simulation access feature ASCII code to obtain the simulation access feature embedding vector. Due to the completeness of the character encoding table, the pre-defined time-series deep model can implicitly learn knowledge that may not exist in the existing samples, thereby enhancing the generalization performance of the pre-defined time-series deep model.

[0079] Furthermore, to improve the accuracy of user behavior classification in the preset temporal deep model, step S30 includes: discretizing the user profile features and the environment features into a preset number of buckets through the embedding layer of the preset temporal deep model; obtaining the first bucket probability distribution of the user profile features discretized into each bucket and the second bucket probability distribution of the environment features discretized into each bucket; performing a weighted summation of the first bucket probability distribution and the first meta-representation corresponding to each bucket through the embedding layer to obtain the user profile feature vector corresponding to the user profile features; and performing a weighted summation of the second bucket probability distribution and the second meta-representation corresponding to each bucket through the embedding layer to obtain the environment feature vector corresponding to the environment features.

[0080] It is understandable that the probability distribution of the first bucket can be the probability distribution of the feature values ​​of the user profile features in each bucket; the probability distribution of the second bucket can be the probability distribution of the feature values ​​of the environment features in each bucket; the first-ary representation and the second-ary representation can be the same or different; SAD embedding is differentiable, adaptive, and has strong representation capabilities, enabling end-to-end model training, and its strong characterization capabilities for user profile features and environment features are pluggable.

[0081] In specific implementation, we will continue to refer to Figure 3 This paper takes the vectorization of user profile features using SAD Embedding as an example. To balance the capacity and complexity of the pre-defined time-series deep model, a shared set of first-order representations (denoted as MEmb) is used. j The feature domain j of the user profile features is represented by ), and the feature values ​​x of the user profile features are combined using a two-layer neural network and residual connections. j Discretize to K j In each bucket, there is a first-order representation MEmb. j Then, the eigenvalues ​​x are obtained by normalization using the softmax function with a temperature coefficient τ. j Discretize to K j The probability distribution of the first bucket of each bucket is expressed as follows:

[0082]

[0083] Then, based on the probability distribution of the first bucket, the probability of each bucket is determined. The probability of each bucket and the first-ary representation corresponding to each bucket are weighted and summed to obtain the final representation vector of the user profile features, i.e., the user profile feature vector e. j :

[0084]

[0085] The process of representing environmental features as environmental feature vectors is the same as the process of representing user profile features as user profile feature vectors, and will not be repeated here in this embodiment; ASCII embedding draws on RGB values ​​in image recognition. Due to the completeness of the character encoding table, the model can implicitly learn knowledge that may not exist in the existing samples, thereby enhancing the generalization performance of the model.

[0086] This embodiment acquires deep packet inspection data and user behavior traffic data from the target user's terminal device, and obtains the target user's user profile features and corresponding environmental features. The deep packet inspection data and user behavior traffic data are vectorized to obtain access sequence embedding vectors and simulated access feature embedding vectors. The user profile features and environmental features are respectively subjected to adaptive discretization vector representation to obtain user profile feature vectors and environmental feature vectors. The behavior category of the target user is determined based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector. This invention vectorizes deep packet inspection data and user behavior traffic data to obtain access sequence embedding vectors and simulated access feature embedding vectors, and performs adaptive discretization vector representation on user profile features and environmental features to obtain user profile feature vectors and environmental feature vectors. The user's behavior category is determined based on the access sequence embedding vector, simulated access feature embedding vector, user profile feature vector, and environmental feature vector. This allows for the determination of the target user's behavior category based on vectors obtained after vectorizing multi-source features, improving the accuracy of user behavior classification.

[0087] refer to Figure 4 , Figure 4 This is a flowchart illustrating the second embodiment of the user behavior classification method of the present invention.

[0088] Based on the first embodiment described above, in this embodiment, step S40 includes:

[0089] Step S401: Perform behavioral modeling on the access sequence embedding vector and the simulated access feature embedding vector respectively through the modeling layer of the preset time series model to obtain the access sequence feature vector and the simulated access feature vector.

[0090] In practice, the behavior of the access sequence embedding vector is modeled by the modeling layer to obtain the access sequence vector, and the behavior of the simulated access feature vector is modeled by the modeling layer to obtain the simulated access feature vector.

[0091] Step S402: Input the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environment feature vector into the output layer of the preset time series model to obtain the probability distribution output by the output layer;

[0092] Step S403: Determine the behavior category of the target user based on the probability distribution.

[0093] In practice, the access sequence feature vector, simulated access feature vector, user profile feature vector, and environmental feature vector are input into the output layer of the preset time-series deep model. The output layer outputs the probability distribution of user behavior, and the behavior category of the target user is determined based on the probability distribution.

[0094] Furthermore, to improve the accuracy of user behavior classification in the model, the modeling layer includes a first gated recurrent neural network, an attention mechanism neural network, and a second gated recurrent neural network. Step S401 includes: calculating a first hidden state vector corresponding to the access sequence embedding vector and a second hidden state vector corresponding to the simulated access feature embedding vector through the first gated recurrent neural network; inputting the first hidden state vector and the second hidden state vector into the attention mechanism neural network; obtaining a first attention weight corresponding to the first hidden state vector and a second attention weight corresponding to the second hidden state vector in the attention mechanism neural network; replacing the update gate of the second gated recurrent neural network with the first attention weight to obtain a third update gated recurrent neural network; outputting the access sequence feature vector corresponding to the access sequence embedding vector through the third update gated recurrent neural network; and replacing the update gate of the second gated recurrent neural network with the second attention weight to obtain a fourth update gated recurrent neural network; outputting the simulated access feature vector corresponding to the simulated access feature embedding vector through the fourth update gated recurrent neural network.

[0095] It should be noted that, considering that feature engineering directly on the user's historical behavior representation cannot fully restore the user's network access status, GRU and attention mechanisms are introduced on the basis of temporal behavior to reflect the order and relevance of user access. The temporal modeling method and attention mechanism make DPI data more effectively reflect the user's online trajectory, enhancing the accuracy and expressive power of the model.

[0096] It is understandable that the first gated recurrent neural network and the second gated recurrent neural network can be GRU recurrent neural networks; the number of the first gated recurrent neural network, the attention mechanism neural network and the second gated recurrent neural network are equal, and the specific number can be set according to the specific application scenario; the access sequence feature vector can be the hidden state vector of the third update gated recurrent neural network; the simulated access feature vector can be the hidden state vector of the fourth update gated recurrent neural network.

[0097] In specific implementation, we will continue to refer to Figure 3Taking the acquisition of the access sequence feature vector corresponding to the access sequence embedding vector as an example, let's assume the first gated recurrent neural network (RNN) has one node, denoted as RGU1, the attention mechanism neural network is denoted as Att1, and the second gated recurrent neural network is denoted as RGU2. First, the access sequence embedding vector is input into RGU1, and the first hidden state vector of RGU1 is calculated. Then, the first hidden state vector is input into Att1, and the first attention weight of Att1 is obtained. The first attention weight is used to replace the update gate of RGU2 to obtain the third update-gated recurrent neural network (simply replace the update gate of RGU2 with the first attention weight). The first hidden state vector is input into the third update-gated recurrent neural network, and the hidden state vector of the third update-gated recurrent neural network is calculated. This hidden state vector is the access sequence feature vector corresponding to the access sequence embedding vector. If the number of first gated recurrent neural networks is multiple, refer to... Figure 3 Multiple first-gated recurrent neural networks (RNNs) are connected in series, and multiple second-gated recurrent neural networks (RNNs) are connected in series. The first-gated RNNs receive the first hidden state vector and the access sequence embedding vector from the previous-level network. The update gates of the second-gated RNNs are replaced with the corresponding first attention weights to obtain a third-update-gated RNN. The third-update-gated RNN receives the first hidden state vector of the first-gated RNN and the hidden state vector of the previous-level network. Finally, the hidden state vector of the third-update-gated RNN is calculated, which is the access sequence feature vector corresponding to the access sequence embedding vector. The process of obtaining the simulated access feature vector corresponding to the simulated access feature embedding vector is the same as the above process, and will not be described again in this embodiment.

[0098] Furthermore, to improve the accuracy of user behavior classification, the output layer includes a concatenation module, a PReLU function, and a Softmax function; step S402 includes: concatenating the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environment feature vector through the concatenation module to obtain a concatenated feature vector; and sequentially inputting the concatenated feature vector into the PReLU function and the Softmax function to obtain a probability distribution.

[0099] In specific implementation, we will continue to refer to Figure 3 The output layer includes a concatenation module (Concat & Flatten), a PReLU function, and a Softmax function. Concat & Flatten concatenates the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environment feature vector to obtain a concatenated vector. The concatenated vector is then input into the PReLU function and the Softmax function in sequence to obtain the probability distribution of user behavior. The user behavior with the highest probability is the target user's behavior category.

[0100] This embodiment performs behavioral modeling on the access sequence embedding vector and the simulated access feature embedding vector respectively through the modeling layer of a preset time series model, obtaining access sequence feature vector and simulated access feature vector. The access sequence feature vector, simulated access feature vector, user profile feature vector, and environmental feature vector are input to the output layer of the preset time series model to obtain the probability distribution output by the output layer. The behavior category of the target user is determined based on the probability distribution. This embodiment determines the behavior category of the target user based on the access sequence feature vector, simulated access feature vector, user profile feature vector, and environmental feature vector, establishing a correspondence between cyberspace and real-world behavior, and improving the accuracy of user behavior classification.

[0101] refer to Figure 5 , Figure 5 This is a flowchart illustrating the third embodiment of the user behavior classification method of the present invention.

[0102] Based on the above embodiments, in this embodiment, before step S10, the method further includes:

[0103] Step S01: Obtain test user behavior traffic data packets from the test terminal device using a preset network analysis tool, and extract regular expression files from the test user behavior traffic data packets.

[0104] It is understandable that the default network analysis tool could be Wireshark; the test user behavior traffic data packets could be traffic data packets generated by simulating user behavior through test terminal devices; and the regular expression file could also be called URL text.

[0105] Step S02: Obtain test depth packet detection data from the test terminal device, and perform MapReduce matching based on the domain name information in the test depth packet detection data to obtain matching detection data.

[0106] It is understandable that the test depth packet detection data can be depth packet detection data obtained from the test terminal device.

[0107] Step S03: Perform MapReduce matching between the matching detection data and the regular expression file to obtain the user behavior annotation dataset.

[0108] In practice, the corresponding rule file is determined based on the regular expression file, and the rule file is matched with the matching detection data using MapReduce to obtain the user behavior annotation dataset. The user behavior annotation dataset can be a dataset that annotates user behavior categories, or it can also be called an annotated user behavior record dataset.

[0109] Step S04: Train the initial temporal deep model using the user behavior annotation dataset, and obtain the preset temporal deep model when the number of iterations reaches the preset number.

[0110] Understandably, when training the model, it is also necessary to obtain user profile features and environmental features. The initial time-series deep model is trained using user profile features, environmental features, and user behavior annotation datasets. When the number of iterations or the maximum probability value of the probability distribution is greater than the preset probability value, the preset time-series deep model is obtained.

[0111] It should be understood that during the training of the model, if the maximum probability value of the probability distribution output by the model is less than the preset probability value, the rule file corresponding to the URL text is corrected according to the preset expert knowledge base to obtain the corrected rule file. The corrected rule file is then matched with the matching detection data using MapReduce to obtain the user behavior labeled dataset, until the maximum probability value of the probability distribution output by the model is greater than or equal to the preset probability value.

[0112] In specific implementation, refer to Figure 6 , Figure 6 To obtain the user behavior annotation dataset, a flowchart is provided. User behavior is simulated using an app on a test terminal device. Traffic data is collected via Wireshark. Upon completion of traffic data collection, Wireshark is closed and the data packets are saved to obtain test user behavior traffic data packets. URL text is extracted from the traffic packets of the test user behavior traffic data packets. The rule file for the URL text is corrected according to a preset expert knowledge base to obtain a corrected rule file. DPI data is obtained from the test terminal device. MapReduce matching is performed based on the domain name information of the DPI data to obtain matching detection data. The corrected rule file and the matching detection data are then matched using MapReduce to obtain the user behavior annotation dataset. The initial time-series deep model is trained using the user behavior annotation dataset, user profile features, and environmental features. A preset time-series deep model is obtained when the maximum probability value of the probability distribution output by the model is greater than or equal to a preset probability value. The operation of correcting the rule file for the URL text can also be performed manually, which is not limited in this embodiment. Invalid data in the user behavior annotation dataset with user access durations less than a preset duration threshold can also be filtered out. The filtered dataset is then used for model training to improve the efficiency of model training.

[0113] This embodiment acquires test user behavior traffic data packets from a test terminal device using a preset network analysis tool, and extracts a regular expression file from the test user behavior traffic data packets; it acquires test deep packet inspection data from the test terminal device, and performs MapReduce matching based on the domain name information in the test deep packet inspection data to obtain matching inspection data; it then performs MapReduce matching between the matching inspection data and the regular expression file to obtain a user behavior labeled dataset; finally, it trains an initial temporal deep model using the user behavior labeled dataset, and obtains a preset temporal deep model when the number of iterations reaches a preset number. This embodiment incorporates expert knowledge into the training process based on a deep learning model, which can significantly improve the situation of low confidence in classification results and improve the efficiency of model training.

[0114] Furthermore, this embodiment of the invention also proposes a storage medium storing a user behavior classification program, which, when executed by a processor, implements the steps of the user behavior classification method described above.

[0115] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the user behavior classification device of the present invention.

[0116] like Figure 7 As shown, the user behavior classification device proposed in this embodiment of the invention includes:

[0117] The acquisition module 10 is used to acquire deep packet inspection data and user behavior traffic data from the target user's terminal device, and to acquire the user profile features and corresponding environmental features of the target user.

[0118] The first vectorization module 20 is used to vectorize the deep message detection data and the user behavior traffic data to obtain an access sequence embedding vector and a simulated access feature embedding vector.

[0119] The second vectorization module 30 is used to perform adaptive discretization vector representation on the user profile features and the environmental features respectively to obtain user profile feature vector and environmental feature vector;

[0120] The classification module 40 is used to determine the behavior category of the target user based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector.

[0121] This embodiment acquires deep packet inspection data and user behavior traffic data from the target user's terminal device, and obtains the target user's user profile features and corresponding environmental features. The deep packet inspection data and user behavior traffic data are vectorized to obtain access sequence embedding vectors and simulated access feature embedding vectors. The user profile features and environmental features are respectively subjected to adaptive discretization vector representation to obtain user profile feature vectors and environmental feature vectors. The behavior category of the target user is determined based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector. This embodiment improves the accuracy of user behavior classification by determining the target user's behavior category based on vectors obtained after vectorizing multi-source features.

[0122] Based on the first embodiment of the user behavior classification device of the present invention described above, a second embodiment of the user behavior classification device of the present invention is proposed.

[0123] In this embodiment, the first vectorization module 20 is further configured to extract features from the deep packet detection data through the feature extraction layer of a preset temporal depth model to obtain a user access sequence; perform sandbox simulation access on the user behavior traffic data through the feature extraction layer to obtain sandbox access simulation features; convert the user access sequence into access sequence ASCII code through the embedding layer of the preset temporal depth model, and convert the access sequence ASCII code into an access sequence embedding vector; convert the sandbox simulation access features into simulation access feature ASCII code through the embedding layer, and convert the simulation access feature ASCII code into a simulation access feature embedding vector.

[0124] The second vectorization module 30 is further configured to discretize the user profile features and the environment features into a preset number of buckets through the embedding layer of a preset temporal deep model; obtain the first bucket probability distribution of the user profile features discretized into each bucket and the second bucket probability distribution of the environment features discretized into each bucket; obtain the user profile feature vector corresponding to the user profile features by weighted summation of the first bucket probability distribution and the first meta-representation corresponding to each bucket through the embedding layer; and obtain the environment feature vector corresponding to the environment features by weighted summation of the second bucket probability distribution and the second meta-representation corresponding to each bucket through the embedding layer.

[0125] The classification module 40 is further configured to perform behavioral modeling on the access sequence embedding vector and the simulated access feature embedding vector respectively through the modeling layer of the preset time series model to obtain the access sequence feature vector and the simulated access feature vector; input the access sequence feature vector, the simulated access feature vector, the user profile feature vector and the environmental feature vector to the output layer of the preset time series model to obtain the probability distribution output by the output layer; and determine the behavior category of the target user based on the probability distribution.

[0126] The classification module 40 is further configured to: calculate the first hidden state vector corresponding to the access sequence embedding vector and the second hidden state vector corresponding to the simulated access feature embedding vector using the first gated recurrent neural network; input the first hidden state vector and the second hidden state vector into the attention mechanism neural network; obtain the first attention weight corresponding to the first hidden state vector and the second attention weight corresponding to the second hidden state vector in the attention mechanism neural network; replace the update gate of the second gated recurrent neural network with the first attention weight to obtain a third update gated recurrent neural network; output the access sequence feature vector corresponding to the access sequence embedding vector through the third update gated recurrent neural network; and replace the update gate of the second gated recurrent neural network with the second attention weight to obtain a fourth update gated recurrent neural network; output the simulated access feature vector corresponding to the simulated access feature embedding vector through the fourth update gated recurrent neural network; the modeling layer includes the first gated recurrent neural network, the attention mechanism neural network, and the second gated recurrent neural network.

[0127] The classification module 40 is further configured to concatenate the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environment feature vector through the concatenation module to obtain a concatenated feature vector; and to input the concatenated feature vector sequentially into the PReLU function and the Softmax function to obtain a probability distribution; the output layer includes the concatenation module, the PReLU function, and the Softmax function.

[0128] The acquisition module 10 is further configured to acquire test user behavior traffic data packets from the test terminal device using a preset network analysis tool, and extract a regular expression file from the test user behavior traffic data packets; acquire test deep packet detection data from the test terminal device, and perform MapReduce matching based on the domain name information in the test deep packet detection data to obtain matching detection data; perform MapReduce matching between the matching detection data and the regular expression file to obtain a user behavior labeled dataset; train an initial time-series deep model using the user behavior labeled dataset, and obtain a preset time-series deep model when the number of iterations reaches a preset number.

[0129] Other embodiments or specific implementations of the user behavior classification device of the present invention can be referred to the above-described method embodiments, and will not be repeated here.

[0130] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0131] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0133] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A user behavior classification method, characterized in that, The method includes: The system obtains deep packet inspection data and user behavior traffic data from the target user's terminal device, and acquires the user profile features and corresponding environmental features of the target user. The deep packet detection data and the user behavior traffic data are vectorized to obtain access sequence embedding vectors and simulated access feature embedding vectors. The user profile features and the environmental features are respectively subjected to adaptive discretization vector representation to obtain user profile feature vector and environmental feature vector; The behavior category of the target user is determined based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector; Determining the target user's behavior category based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector includes: By using the modeling layer of a preset time series model, behavioral modeling is performed on the access sequence embedding vector and the simulated access feature embedding vector respectively to obtain the access sequence feature vector and the simulated access feature vector; The access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environmental feature vector are input into the output layer of the preset time series model to obtain the probability distribution output by the output layer. The behavioral category of the target user is determined based on the probability distribution; The modeling layer includes a first gated recurrent neural network, an attention mechanism neural network, and a second gated recurrent neural network; The process of modeling the access sequence embedding vector and the simulated access feature embedding vector through a pre-defined time-series modeling layer to obtain access sequence feature vector and simulated access feature vector includes: The first hidden state vector corresponding to the access sequence embedding vector and the second hidden state vector corresponding to the simulated access feature embedding vector are calculated using the first gated recurrent neural network. The first hidden layer state vector and the second hidden layer state vector are input into the attention mechanism neural network; Obtain the first attention weight corresponding to the first hidden layer state vector and the second attention weight corresponding to the second hidden layer state vector in the attention mechanism neural network; The update gate of the second gated recurrent neural network is replaced with the first attention weight to obtain the third update-gated recurrent neural network; The third updated gated recurrent neural network outputs the access sequence feature vector corresponding to the access sequence embedding vector; and The update gate of the second gated recurrent neural network is replaced with the second attention weight to obtain the fourth update-gated recurrent neural network; The simulated access feature vector corresponding to the simulated access feature embedding vector is output by the fourth updated gated recurrent neural network.

2. The method as described in claim 1, characterized in that, The step of vectorizing the deep packet detection data and the user behavior traffic data to obtain access sequence embedding vectors and simulated access feature embedding vectors includes: The user access sequence is obtained by extracting features from the deep message detection data through the feature extraction layer of the preset time-series deep model. The user behavior traffic data is simulated in a sandbox using the feature extraction layer to obtain sandbox access simulation features. The user access sequence is converted into access sequence ASCII code through the embedding layer of the preset time-series deep model, and the access sequence ASCII code is converted into access sequence embedding vector; The embedding layer converts the sandbox simulated access features into simulated access feature ASCII codes, and then converts the simulated access feature ASCII codes into simulated access feature embedding vectors.

3. The method as described in claim 1, characterized in that, The step of adaptively discretizing the user profile features and the environmental features into vector representations to obtain user profile feature vectors and environmental feature vectors includes: The user profile features and the environmental features are discretized into a preset number of buckets through the embedding layer of a preset time-series deep model; Obtain the first bucket probability distribution of the user profile features discrete into each bucket and the second bucket probability distribution of the environmental features discrete into each bucket; The embedding layer performs a weighted summation of the first bucket probability distribution and the first-ary representation corresponding to each bucket to obtain the user profile feature vector corresponding to the user profile features; and The embedding layer performs a weighted summation of the second bucket probability distribution and the second element representation corresponding to each bucket to obtain the environmental feature vector corresponding to the environmental feature.

4. The method as described in claim 1, characterized in that, The output layer includes a splicing module, a PReLU function, and a Softmax function; The step of inputting the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environmental feature vector into the output layer of the preset time series model to obtain the probability distribution output by the output layer includes: The splicing module splices the access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environment feature vector to obtain a spliced ​​feature vector. The concatenated feature vector is sequentially input into the PReLU function and the Softmax function to obtain the probability distribution.

5. The method according to any one of claims 1-4, characterized in that, Before obtaining deep packet inspection data and user behavior traffic data from the target user's terminal device, and obtaining the target user's user profile features and corresponding environmental features, the method further includes: The test user behavior traffic data packets are obtained from the test terminal device using a preset network analysis tool, and a regular expression file is extracted from the test user behavior traffic data packets; The test terminal device obtains test depth packet detection data, and performs MapReduce matching based on the domain name information in the test depth packet detection data to obtain matching detection data; The matching detection data is matched with the regular expression file using MapReduce to obtain a user behavior labeled dataset. The initial temporal deep model is trained using the user behavior annotation dataset, and a preset temporal deep model is obtained when the number of iterations reaches a preset number.

6. A user behavior classification device, characterized in that, The device includes: The acquisition module is used to acquire deep packet inspection data and user behavior traffic data from the target user's terminal device, and to acquire the user profile features and corresponding environmental features of the target user; The first vectorization module is used to vectorize the deep message detection data and the user behavior traffic data to obtain an access sequence embedding vector and a simulated access feature embedding vector. The second vectorization module is used to adaptively discretize the user profile features and the environmental features into vector representations to obtain user profile feature vectors and environmental feature vectors. The classification module is used to determine the behavior category of the target user based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector; Determining the target user's behavior category based on the access sequence embedding vector, the simulated access feature embedding vector, the user profile feature vector, and the environmental feature vector includes: By using the modeling layer of a preset time series model, behavioral modeling is performed on the access sequence embedding vector and the simulated access feature embedding vector respectively to obtain the access sequence feature vector and the simulated access feature vector; The access sequence feature vector, the simulated access feature vector, the user profile feature vector, and the environmental feature vector are input into the output layer of the preset time series model to obtain the probability distribution output by the output layer. The behavioral category of the target user is determined based on the probability distribution; The modeling layer includes a first gated recurrent neural network, an attention mechanism neural network, and a second gated recurrent neural network; The process of modeling the access sequence embedding vector and the simulated access feature embedding vector through a pre-defined time-series modeling layer to obtain access sequence feature vector and simulated access feature vector includes: The first hidden state vector corresponding to the access sequence embedding vector and the second hidden state vector corresponding to the simulated access feature embedding vector are calculated using the first gated recurrent neural network. The first hidden layer state vector and the second hidden layer state vector are input into the attention mechanism neural network; Obtain the first attention weight corresponding to the first hidden layer state vector and the second attention weight corresponding to the second hidden layer state vector in the attention mechanism neural network; The update gate of the second gated recurrent neural network is replaced with the first attention weight to obtain the third update-gated recurrent neural network; The third updated gated recurrent neural network outputs the access sequence feature vector corresponding to the access sequence embedding vector; and The update gate of the second gated recurrent neural network is replaced with the second attention weight to obtain the fourth update-gated recurrent neural network; The simulated access feature vector corresponding to the simulated access feature embedding vector is output by the fourth updated gated recurrent neural network.

7. A user behavior classification device, characterized in that, The device includes: a memory, a processor, and a user behavior classification program stored in the memory and executable on the processor, the user behavior classification program being configured to implement the steps of the user behavior classification method as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium stores a user behavior classification program, which, when executed by a processor, implements the steps of the user behavior classification method as described in any one of claims 1 to 5.

Images