An abnormal behavior detection method and device, and a storage medium

Abstract

The application discloses an abnormal behavior detection method and device and a storage medium. The method comprises the following steps: obtaining M first sequence sets of M users, one first sequence set comprising N first sequences, the N first sequences representing N operation behaviors of a user, and the N first sequences representing N operation time lengths corresponding to the N operation behaviors of the user. The first sequences representing the operation behaviors and the first sequences representing the operation time lengths in the M first sequence sets are respectively clustered to obtain R first sequences. Group abnormal behaviors of the M users are determined according to the R first sequences, and group abnormal behaviors of a first user are determined according to the group abnormal behaviors of the M users. Individual abnormal behaviors of the first user are determined according to a first sequence set of the first user. Whether the next behavior of the first user is an abnormal behavior is predicted according to the group abnormal behaviors and the individual abnormal behaviors of the first user. The abnormal behavior can be accurately detected by the method.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to an abnormal behavior detection method, device, and storage medium. Background Technology

[0002] Normally, when a user wants to access a system or application, they need to perform a series of operations such as logging in, browsing, querying, downloading, and logging out. Each user's behavior is different. For example, user A might perform multiple browsing and querying operations after logging in, but not downloading; user B might perform multiple browsing and downloading operations after logging in, but not querying. Abnormal behavior can be determined by analyzing user actions. For example, if user C performs an excessive number of queries after logging in, exceeding the system's capacity, user C's behavior might be a network attack. In other words, abnormal user behavior can be determined by collecting data on user actions and their duration.

[0003] Currently, the analysis mainly focuses on the operational behavior of individual users, using certain standards to determine whether the user's behavior is abnormal. This method has certain limitations and often cannot accurately identify abnormal user behavior. Summary of the Invention

[0004] This application provides an abnormal behavior detection method, device, and storage medium, which can accurately identify abnormal user behavior.

[0005] Firstly, this application provides a method for detecting abnormal behavior. This method, applicable to electronic devices, includes: the electronic device acquiring M sets of first sequences from M users, one first sequence set corresponding to one user, and each first sequence set comprising N first sequences, where the N first sequences represent N user actions, and the N first sequences represent the N durations of the user's N actions, where M and N are both positive integers. The electronic device clusters the first sequences representing actions and the first sequences representing durations from the M sets of first sequences to obtain R classes of first sequences, where R is a positive integer. The electronic device determines the group abnormal behavior of the M users based on the R classes of first sequences, and determines the group abnormal behavior of the first user among the M users based on the group abnormal behavior of the M users. The electronic device determines the individual abnormal behavior of the first user based on the first user's first sequence set. The electronic device predicts whether the first user's next action is abnormal based on the group abnormal behavior and the individual abnormal behavior of the first user.

[0006] In this embodiment, by obtaining M sets of first sequences from M users, and clustering the first sequences in the M sets of first sequences to obtain R classes of first sequences, the electronic device can determine the group abnormal behavior of the M users based on the R classes of first sequences obtained from the clustering. Then, the group abnormal behavior of the first user is determined based on the group abnormal behavior of the M users, and the individual abnormal behavior of the first user is determined by clustering the first sequence sets of the first user separately. Then, based on the group abnormal behavior and individual abnormal behavior of the first user, the accuracy of abnormal behavior detection can be improved.

[0007] Optionally, a single operation includes login, browsing, querying, downloading, and logout operations, with the login, browsing, querying, downloading, and logout operations arranged in sequence to form a first sequence; and the duration corresponding to the login, browsing, querying, downloading, and logout operations arranged in sequence to form the first sequence.

[0008] Optionally, the electronic device determines the abnormal group behavior of M users based on the first sequence of class R, including: the electronic device determines the user corresponding to each first sequence in each class of the first sequence of class R. The electronic device determines that if the number of first sequences corresponding to any user in each class of the first sequence is less than a first preset threshold, then the operation behavior and operation duration corresponding to the first sequence of any user are abnormal group behavior; and / or, the electronic device determines that the operation behavior and operation duration corresponding to at least one class of first sequences where the number of first sequences in class R is less than a second preset threshold are abnormal group behavior.

[0009] In this embodiment, for the obtained R-class first sequences, the electronic device can further determine the user corresponding to each first sequence in each class of first sequences. Based on the users corresponding to each first sequence in each class of first sequences, if the number of first sequences corresponding to any user in each class of first sequences is less than a first preset threshold, then the operation behavior and operation duration corresponding to the first sequence of any user are considered abnormal group behavior. That is, even if the number of first sequences in a class is large, the operation behavior corresponding to the first sequence of users with a smaller number of first sequences in that class can still be filtered out as abnormal behavior, improving the accuracy of abnormal behavior filtering. Alternatively, the electronic device can determine that the operation behavior and operation duration corresponding to at least one class of first sequences in R-class first sequences where the number of first sequences is less than a second preset threshold are abnormal group behavior, further improving the accuracy of abnormal behavior filtering.

[0010] Optionally, the electronic device determines the individual abnormal behavior of the first user based on the first sequence set of the first user, including: the electronic device clusters the first sequence set corresponding to the first user among M users to obtain S classes of first sequences for the first user, where S is a positive integer. The electronic device determines the operation behavior corresponding to at least one class of first sequences in the S classes where the number of first sequences is less than a third preset threshold as the individual abnormal behavior of the first user.

[0011] Optionally, the electronic device predicts whether the first user's next behavior is abnormal based on the first user's group abnormal behavior and the first user's individual abnormal behavior. This includes: the electronic device acquiring the first user's next behavior outside of a first sequence set to form a second sequence, where the next behavior includes an operation and its duration. The electronic device calculates a first Euclidean distance between the second sequence and the center of the first set, where the first set includes the union of the first user's individual abnormal behavior (where both the single operation and its corresponding duration are abnormal) and the first user's abnormal behavior within a group of M users (where both the single operation and its corresponding duration are abnormal). If the first Euclidean distance is not greater than a fourth preset threshold, then the next behavior is considered abnormal.

[0012] Optionally, if the first Euclidean distance is greater than a fourth preset threshold, the method further includes: the electronic device calculating a second Euclidean distance between the operation behavior in the second sequence and the center of the second set, and a third Euclidean distance between the operation duration in the second sequence and the center of the third set, wherein the second set is the intersection of the operation behavior in the individual abnormal behavior of the first user and the operation behavior in the abnormal behavior of the first user in a group of M users, and the third set is the intersection of the operation duration in the individual abnormal behavior of the first user and the operation duration in the abnormal behavior of the first user in a group of M users. The electronic device performs a weighted summation of the first Euclidean distance, the second Euclidean distance, and the third Euclidean distance to obtain a fourth Euclidean distance. If the fourth Euclidean distance is less than or equal to a fifth preset threshold, the next behavior is considered an abnormal behavior.

[0013] In this embodiment of the application, the accuracy of detection can be improved by determining whether the user's next behavior is abnormal by checking whether the weighted sum of the Euclidean distances between the second sequence and the first set, the second set, and the third set is less than a fifth preset threshold.

[0014] Secondly, this application provides an abnormal behavior detection device. The device includes an acquisition module, a clustering module, a determination module, and a prediction module. The acquisition module acquires M sets of first sequences from M users, with one first sequence set corresponding to one user. Each first sequence set includes N first sequences, representing N user actions and N operation durations corresponding to those actions, where M and N are positive integers. The clustering module clusters the first sequences representing user actions and the first sequences representing operation durations from the M sets of first sequences to obtain R classes of first sequences, where R is a positive integer. The determination module determines the group abnormal behavior of the M users based on the R classes of first sequences, and further determines the group abnormal behavior of the first user among the M users based on the group abnormal behavior. The determination module also determines the individual abnormal behavior of the first user based on the first user's first sequence set. The prediction module predicts whether the first user's next action will be abnormal based on the group abnormal behavior and the individual abnormal behavior of the first user.

[0015] Optionally, a single operation includes login, browsing, querying, downloading, and logout operations, with the login, browsing, querying, downloading, and logout operations arranged in sequence to form a first sequence; and the duration corresponding to the login, browsing, querying, downloading, and logout operations arranged in sequence to form the first sequence.

[0016] Optionally, the determining module is specifically used to: determine the user corresponding to each first sequence in each class of first sequences of R-type first sequences. The electronic device determines, based on the users corresponding to the first sequences in each class of first sequences, that if the number of first sequences corresponding to any user in each class of first sequences is less than a first preset threshold, then the operation behavior and operation duration corresponding to the first sequence of any user are considered abnormal group behavior; and / or, the electronic device determines that the operation behavior and operation duration corresponding to at least one class of first sequences where the number of first sequences in R-type first sequences is less than a second preset threshold are considered abnormal group behavior.

[0017] Optionally, the clustering module is specifically used to: cluster the set of first sequences corresponding to the first user among M users to obtain S classes of first sequences for the first user, where S is a positive integer. It determines the operational behavior corresponding to at least one class of first sequences in the S classes where the number of first sequences is less than a third preset threshold as the individual abnormal behavior of the first user.

[0018] Optionally, the prediction module is specifically used to: obtain the next action of the first user outside the first sequence set to form a second sequence, the next action including the operation and its duration; calculate the first Euclidean distance between the second sequence and the center of the first set, the first set including the operation and its duration where both the single operation and its corresponding duration are abnormal in the individual abnormal behavior of the first user, and the union of the operation and its duration where both the single operation and its corresponding duration are abnormal in the abnormal behavior of the first user in a group of M users. If the first Euclidean distance is not greater than a fourth preset threshold, then the next action is an abnormal behavior.

[0019] Optionally, the prediction module is further configured to: calculate a second Euclidean distance between the operation behavior in the second sequence and the center of the second set, and a third Euclidean distance between the operation duration in the second sequence and the center of the third set, where the second set is the intersection of the operation behavior in the individual abnormal behavior of the first user and the operation behavior in the abnormal behavior of the first user in a group of M users, and the third set is the intersection of the operation duration in the individual abnormal behavior of the first user and the operation duration in the abnormal behavior of the first user in a group of M users. A fourth Euclidean distance is obtained by weighted summing of the first, second, and third Euclidean distances. If the fourth Euclidean distance is less than or equal to a fifth preset threshold, the next behavior is considered an abnormal behavior.

[0020] Thirdly, embodiments of this application provide an electronic device including at least one processor and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in any one of the first aspects.

[0021] Fourthly, embodiments of this application provide a computer storage medium storing computer program instructions for performing the method described in any one of the first aspects.

[0022] Fifthly, embodiments of this application also provide a computer program product, which includes computer program code that, when run on a computer, causes the computer to perform the steps described in the first aspect and the various optional steps.

[0023] In a sixth aspect, embodiments of this application also provide a chip, the chip including a processor and an interface, the interface being used to communicate with the processor and receive information from other devices; the processor being used to execute the methods described in the first aspect and any possible implementation thereof. Attached Figure Description

[0024] Figure 1 This is an application scenario diagram of the abnormal behavior detection method provided in the embodiments of this application;

[0025] Figure 2 A flowchart illustrating the abnormal behavior detection method provided in this application embodiment;

[0026] Figure 3 Another flowchart illustrating the abnormal behavior detection method provided in this application embodiment;

[0027] Figure 4 This is a schematic diagram of the abnormal behavior detection device provided in the embodiments of this application;

[0028] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0029] To better understand the solutions provided in the embodiments of the present invention, some technical concepts involved in the embodiments of the present invention will first be introduced. It should be noted that in the technical solutions of this application, the collection, dissemination, and use of data all comply with the requirements of relevant national laws and regulations.

[0030] Please see Figure 1 This illustration depicts an application scenario according to an embodiment of this application. A server runs a web service, and users (including user A, user B, user C, user D, etc.) can access the server through a terminal and use the web service provided by the server. When a user accesses the server, they can typically authenticate by logging in. After successful authentication, they can access the web service interface to browse, query, download, and perform other operations. If they wish to stop using the web service, they can log out, thus completing a full operation.

[0031] Typically, different users have different operational habits, such as different sequences of actions and durations of actions. For example, User A, when accessing a server, habitually performs multiple browsing and query operations after logging into the system, browsing and querying relatively fixed content, but without downloading anything, before logging out and disconnecting from the server. Similarly, User B, when accessing a server, frequently performs browsing and download operations after logging into the system, stays on the web service interface for a short time, downloads a small amount of content from the server, and then logs out and disconnects from the server. And again, User C, when accessing a server, frequently performs browsing and download operations after logging into the system, stays on the web service interface for a longer time, downloads a large amount of content from the server, and then logs out and disconnects from the server.

[0032] Therefore, abnormal user behavior can be identified based on user habits. If a user's action is completely different from their usual behavior—for example, a user typically performs multiple browsing and query operations after logging into the system but does not perform download operations—and then performs a download operation during a particular visit, this action can be considered abnormal. However, the drawback of this method is that it is not accurate enough and may miss abnormal actions.

[0033] Therefore, this application provides an abnormal behavior detection method. By combining the abnormal behavior of multiple users as a group and the abnormal behavior of individuals to detect abnormal behavior in the next behavior of a user, the accuracy of abnormal behavior detection can be improved.

[0034] Please see Figure 2 The diagram shows a flowchart of the abnormal behavior detection method provided in the embodiments of this application. Figure 2 The illustrated process takes the detection of abnormal behavior by an electronic device as an example, specifically, the execution of the abnormal behavior detection method provided in this application by an electronic device. The electronic device can be any terminal device or server; for example, the electronic device can be... Figure 1 The server or terminal shown is such as a smartphone, tablet, or desktop computer.

[0035] In the embodiments of this application, there are "first sequence" and "second sequence". The first sequence is used to represent the currently acquired behavior sequence, and the second sequence can represent the behavior sequence of the user's next operation. The terms "first" and "second" mentioned here are only used to distinguish between the acquired behavior sequence and the user's most recent behavior sequence, and are not used to limit the size, content, order, timing, priority, or importance of the sequence.

[0036] S201. The electronic device obtains M sets of first sequences for M users. Each user corresponds to one set of first sequences. Each set of first sequences includes N first sequences. The N first sequences represent N operation behaviors of the user and N operation durations corresponding to the N operation behaviors of the user. M and N are both positive integers.

[0037] The first sequence is the currently acquired user behavior sequence. When M users access the server individually, the server saves a record of each user's actions. For a complete action, which includes login, browsing, querying, downloading, and logging out, the user's actions can be arranged in the order of login, browsing, querying, downloading, and logging out to obtain a behavior sequence, which represents the user's complete action. An example of a behavior sequence is [a1, a2, a3, a4…an], where a1 can represent a single login, a2 can represent a single browsing, a3 can represent a single query, a4 can represent a single download, and a5 can represent a single logging out. Since a single action usually only has two possibilities: executed or not executed, the behavior sequence can be simplified by using the number 1 to represent that the action was performed and the number 0 to represent that the action was not performed. For example, a complete user action typically includes login, browsing, querying, downloading, and logging out, and its behavior sequence can be represented as [1,1,1,1,1]. Alternatively, the duration of each action can be recorded in a manner similar to that of the action sequence, called a duration sequence. For example, the duration sequence corresponding to the action sequence [1,1,1,1,1] is [t1,t2,t3,t4,t5]. Each item in the duration sequence corresponds one-to-one with each item in the action sequence; t1 is the duration corresponding to action a1 in the action sequence, t2 is the duration corresponding to action a2 in the action sequence, and so on. In other words, the first sequence includes both the action sequence and the duration sequence.

[0038] If a user's complete action sequence contains consecutive repetitions of a particular action, such as logging in, browsing, querying, downloading, downloading again, and logging out, the consecutive repetitions can be merged and their corresponding durations summed when generating the action sequence. For example, if the action sequence is represented as [1,1,1,1,1], then the corresponding duration sequence is [t1,t2,t3,t41+t42+t43,t5], where t1 is the duration of the login action, t2 is the duration of the browsing action, t3 is the duration of the query action, t41+t42+t43 is the duration of the download action, and t5 is the duration of the logout action. It is evident that the duration of the download action is the sum of three durations t41, t42, and t43. If a user's complete action involves multiple non-continuous repetitions of actions, such as logging in, browsing, querying, downloading, querying again, downloading again, and logging out, the action sequence for this action can be rebuilt based on the repeated actions without accumulating the action durations. In other words, a new action sequence can be built starting from the position where the actions are repeated, resulting in an initial action sequence and the sequence of the repeated actions. The repeated action sequence is then concatenated after the initial action sequence to fully represent the action. For example, if the action is repeated after the first "download," the initial action sequence can be represented as [1,1,1,1,0], indicating that "logout" was not performed in this action sequence. Then, the repeated action sequence of "query" and "download" is [0,0,1,1,1]. By concatenating [1,1,1,1,0] with [0,0,1,1,1], we obtain [1,1,1,1,0,0,0,1,1,1]. As can be seen from [1,1,1,1,0,0,0,1,1,1], this complete operation did not perform "logout" after the first "download," but instead performed "query" and "download" again before "logout" was performed. It should be understood that there are multiple ways to represent the sequence of actions, and this application embodiment does not specifically limit it.

[0039] A user's behavior sequence represents a complete user action, and a user's duration sequence represents the duration of that complete user action. These behavior sequences and duration sequences can be collectively referred to as first sequences. In other words, a first sequence can represent a complete user action and its corresponding duration. After a user performs N complete user actions, the generated N first sequences can represent the N user actions and their corresponding N durations. An electronic device stores N first sequences; if there are M users, it stores N first sequences for all M users.

[0040] A user's N first sequences can be represented by a set of first sequences. If the N first sequences are sequences corresponding to operation actions, then the set of first sequences can be represented as X = [x11, ..., x1n]. Here, x1n represents a single action sequence. If the N first sequences are sequences of duration corresponding to operation actions, then the set of first sequences can be represented as Y = [y11, ..., y1n]. Here, y1n represents a single duration sequence. An electronic device acquires M sets of first sequences from M users. If the set of first sequences represents a set of sequences corresponding to operation actions, then the M sets of first sequences are [x11, ..., x1n], [x21, ..., x2n], ..., [xm1, ..., xmn]. The M sets of first sequences can be combined into a single sequence set, which can be represented as X' = [x11, ..., x1n, ..., xm1, ..., xmn]. If the first sequence set represents the sequence set of durations corresponding to the operation, then the M first sequence sets are [y11,……,y1n], [y21,……,y2n]…[ym1,……,ymn]. The M first sequence sets can be combined into a sequence set, which can be represented as Y'=[y11,……,y1n,…ym1,……,ymn].

[0041] S202. The electronic device clusters the first sequence representing the operation behavior and the first sequence representing the operation duration in the M sets of first sequences to obtain R classes of first sequences, where R is a positive integer.

[0042] The electronic device clusters the first sequences representing operational behaviors and the first sequences representing operational durations from M sets of first sequences. If the first sequence set represents the set of sequences corresponding to operational behaviors, the electronic device clusters the first sequences representing operational behaviors from the M sets of first sequences X'. If the first sequence set represents the set of sequences representing operational durations, the electronic device clusters the first sequences representing operational durations from the M sets of first sequences Y'. After clustering the first sequences representing operational behaviors and the first sequences representing operational durations from the M sets of first sequences, the electronic device obtains R classes of first sequences. It should be understood that each class of first sequences in the R classes includes one or more first sequences, and the number of first sequences included in different classes may differ.

[0043] S203. The electronic device determines the abnormal behavior of the group of M users based on the first sequence of class R, and determines the abnormal behavior of the first user among the M users based on the abnormal behavior of the group of M users. Then, the electronic device determines the abnormal behavior of the first user based on the first sequence set of the first user, and predicts whether the first user's next behavior is abnormal based on the abnormal behavior of the group of the first user and the abnormal behavior of the first user.

[0044] Since the M sets of first sequences include the first sequences of M users, we can cluster these M sets of first sequences to obtain R classes of first sequences. We can analyze these R classes of first sequences; if the number of first sequences in a certain class of R classes is small, then that class of first sequences can be considered different from the first sequences of the M user groups. Since the first sequence represents a user's operation behavior and the corresponding operation duration, if the first sequence represents a user's operation behavior, then the class of first sequences with a small number of first sequences in R classes can be considered as operation behaviors that occur less frequently in the M user groups, i.e., abnormal behavior of the M user groups. In other words, the operation behaviors of the M user groups are generally normal; if there are certain operation behaviors that occur less frequently in the M user groups, these operation behaviors can be considered abnormal, i.e., anomalous behavior.

[0045] If the first sequence represents the operation time corresponding to the user's operation behavior, then the first sequence with fewer first sequences in class R can be considered as the behavior of the operation behavior corresponding to the operation time being too long or too short in the M user group. Since the operation time is too long or too short, it can also be considered as abnormal, that is, it is also an abnormal behavior of the M user group.

[0046] Electronic devices can set a preset threshold (e.g., a second preset threshold) for the number of first sequences in each class of R-type first sequences. If the number of first sequences in that class is less than the second preset threshold, then the operation behavior and operation duration corresponding to at least one class of first sequences in R-type first sequences where the number of first sequences is less than the second preset threshold can be determined as abnormal group behavior. It should be understood that multiple preset thresholds are involved in the embodiments of this application, and the specific values ​​of the multiple preset thresholds can be flexibly set according to the specific situation. The embodiments of this application do not specifically limit the specific values ​​of the mentioned preset thresholds.

[0047] After obtaining the first sequence of class R, the electronic device can further filter out abnormal group behaviors within a class of first sequences where the number of first sequences exceeds a second preset threshold. The electronic device determines the user corresponding to each first sequence in each class of first sequences within the class R. For example, for a class of first sequences in the class R that includes the first sequences of users A, B, and C, the electronic device can determine the individual first sequences of users A, B, and C.

[0048] Since the number of first sequences for users A, B, and C are different, if the number of first sequences for user A is significantly less than the number of first sequences for users B and C, then the operation behavior and operation duration corresponding to user A's first sequence can be considered as abnormal group behavior. In other words, the electronic device can determine that if the number of first sequences corresponding to any user in each of the R types of first sequences is less than a preset threshold (e.g., a first preset threshold), then the operation behavior and operation duration corresponding to the first sequence for that user are considered abnormal group behavior. By determining the users corresponding to each first sequence in each of the R types of first sequences, and identifying the operation behavior and operation duration corresponding to the first sequence of any user whose number of corresponding first sequences is less than a first preset threshold as abnormal group behavior, abnormal group behavior in the M sets of first sequences can be further detected, improving the accuracy of abnormal behavior detection.

[0049] After identifying the abnormal behavior of M users as a group, the electronic device can determine the abnormal behavior of the first user among the M users based on the group's abnormal behavior. It then combines the first user's abnormal behavior with the first user's individual abnormal behavior to predict whether the first user's next action will be abnormal. This process is described in detail below.

[0050] The electronic device identifies both individual and group abnormal behaviors of the first user. It clusters the first user's set of first sequences to obtain S classes of first sequences. Then, the electronic device can determine that the operation behavior and operation duration corresponding to at least one class of first sequences in the S classes, where the number of first sequences is less than a third preset threshold, constitute individual abnormal behavior of the first user. In other words, clustering the first user's set of first sequences can identify individual abnormal behaviors of the first user.

[0051] The electronic device can also determine the abnormal behavior of the first user by identifying the abnormal behavior of the group of M users in the M first sequence sets. The electronic device can further determine whether the first user's abnormal behavior exists by associating the abnormal behavior with the user corresponding to each abnormal behavior in the group of M users. If the first user's abnormal behavior exists, it can be considered as the first user's group abnormal behavior.

[0052] The electronic device predicts the next action based on the first user's individual and group abnormal behaviors. The electronic device can determine a first set, which includes the union of the first user's individual abnormal behaviors (including both the single operation and its duration) and the first user's abnormal behaviors within a group of M users (including both the single operation and its duration). This first set is denoted by O. The electronic device acquires the first user's next action and forms a second sequence based on the operation and duration of that next action. The electronic device calculates a first Euclidean distance between the second sequence of the next action and the center of the first set. If this first Euclidean distance is not greater than a fourth preset threshold, the first user's next action is considered abnormal. It should be noted that the center of the first set is obtained by standardizing the data format of the elements in the first set and then calculating the class center of the first set. In other words, the first set O integrates the first user's abnormal behaviors within the group of M users and the first user's individual abnormal behaviors, thus improving the accuracy of abnormal behavior detection when using the first set O to detect the first user's next action.

[0053] Since abnormal behavior includes both operational actions and operation durations, when detecting the next action of the first user, if the first Euclidean distance is greater than the fourth preset threshold, in addition to constructing the first set O, sets can also be established for the operational actions and operation durations within the abnormal behavior. The electronic device can determine that the intersection of the operational actions in the first user's individual abnormal behavior and the operational actions of the first user in the group of M users constitutes the second set P. The electronic device can determine that the intersection of the operation duration in the first user's individual abnormal behavior and the operation duration of the first user in the group of M users constitutes the third set Q. The electronic device calculates the second Euclidean distance between the operational actions in the second sequence and the center of the second set P, and the third Euclidean distance between the operation duration in the second sequence and the center of the third set Q. Then, the first, second, and third Euclidean distances are weighted and summed to obtain the fourth Euclidean distance. If the fourth Euclidean distance is less than or equal to the fifth preset threshold, then the first user's next action is an abnormal behavior.

[0054] Please see Figure 3 The following example illustrates how to determine whether the first user's next action is abnormal.

[0055] S301. Cluster the M first sequence sets X' and Y' of M users respectively, and determine the sets A and B of the first sequences corresponding to the abnormal group behavior in the M first sequence sets. Based on A and B, determine the sets Aj and Bj of the first sequences corresponding to the abnormal group behavior of user j in the M first sequence sets.

[0056] S302. Cluster the first sequence sets W' and Z' of user j to determine the sets Cj and Dj of the first sequences corresponding to the abnormal behaviors of individuals in the first sequence set of user j.

[0057] In this set, the first sequence A represents the operational behavior in the abnormal behavior of the group, the first sequence B represents the operation duration in the abnormal behavior of the group, the first sequence C represents the operational behavior in the abnormal behavior of the individual, and the first sequence D represents the operation duration in the abnormal behavior of the individual.

[0058] S303. Determine the union of the first set O, which includes the sets Cj and Dj of the first sequence, where a single operation behavior and its corresponding operation duration are both abnormal behaviors, and the set Aj and Bj of the first sequence, where a single operation behavior and its corresponding operation duration are both abnormal behaviors, and the set Aj and Bj of the first sequence.

[0059] S304. Obtain the second sequence [xj1, yj1] of user j's next action, and calculate the first Euclidean distance d1 between [xj1, yj1] and the center of the first set O. If d1 is not greater than the fourth preset threshold, then [xj1, yj1] is an abnormal behavior.

[0060] S305. If d1 is greater than the fourth preset threshold, determine the second set P = (Aj∩Cj) and the third set P = (Bj∩Dj). Calculate the second Euclidean distance d2 between [xj1] and the center of the second set P, and the third Euclidean distance d3 between [yj1] and the center of the third set Q.

[0061] S306. The weighted sum of d1, d2, and d3 yields the fourth Euclidean distance L = w1*d1 + w2*d2 + w3*d3, where w1, w2, and w3 are adjustable weights. If the fourth Euclidean distance L is less than or equal to the fifth preset threshold, the next action is considered abnormal.

[0062] Please see Figure 4 Based on the same inventive concept, this application also provides an anomaly detection device 400. The device 400 includes: an acquisition module 401, a clustering module 402, and a determination module 403. The acquisition module 401 acquires M sets of first sequences from M users, with one first sequence set corresponding to one user. Each first sequence set includes N first sequences, where the N first sequences represent N user actions and the N operation durations corresponding to those actions, where M and N are positive integers. The clustering module 402 clusters the first sequences representing user actions and the first sequences representing operation durations from the M sets of first sequences to obtain R classes of first sequences, where R is a positive integer. The determination module 403 determines the group abnormal behavior of the M users based on the R classes of first sequences, and further determines the group abnormal behavior of the first user among the M users based on the group abnormal behavior of the M users. The determination module 403 also determines the individual abnormal behavior of the first user based on the first sequence set of the first user. The prediction module 404 is used to predict whether the first user's next action will be abnormal based on the first user's group abnormal behavior and the first user's individual abnormal behavior. Optionally, an operation includes login, browsing, querying, downloading, and logout operations, with the login, browsing, querying, downloading, and logout operations arranged in sequence to form a first sequence; and the duration corresponding to the login, browsing, querying, downloading, and logout operations arranged in sequence to form the first sequence.

[0063] Optionally, the determining module 403 is specifically used to: determine the user corresponding to each first sequence in each class of the first sequence of R-type first sequences. The electronic device determines, based on the users corresponding to each first sequence in each class of first sequences, that if the number of first sequences corresponding to any user in each class of first sequences is less than a first preset threshold, then the operation behavior and operation duration corresponding to the first sequence of any user are considered abnormal group behavior; and / or, the electronic device determines that the operation behavior and operation duration corresponding to at least one class of first sequences in R-type first sequences where the number of first sequences is less than a second preset threshold are considered abnormal group behavior.

[0064] Optionally, the clustering module 402 is specifically used to: cluster the set of first sequences corresponding to the first user among the M users to obtain S classes of first sequences for the first user, where S is a positive integer. It determines that the operational behavior corresponding to at least one class of first sequences in the S classes, where the number of first sequences is less than a third preset threshold, is the individual abnormal behavior of the first user.

[0065] Optionally, the prediction module 404 is specifically used to: obtain the next behavior of the first user outside the first sequence set to form a second sequence, the next behavior including the operation and operation duration; calculate the first Euclidean distance between the second sequence and the center of the first set, the first set including the operation behavior and operation duration of the first user's individual abnormal behavior where both the single operation behavior and the corresponding operation duration are abnormal, and the union of the operation behavior and operation duration of the first user in the abnormal behavior of the group of M users where both the single operation behavior and the corresponding operation duration are abnormal. If the first Euclidean distance is not greater than a fourth preset threshold, then the next behavior is an abnormal behavior.

[0066] Optionally, the prediction module 404 is further configured to: calculate a second Euclidean distance between the operation behavior in the second sequence and the center of the second set, and a third Euclidean distance between the operation duration in the second sequence and the center of the third set, wherein the second set is the intersection of the operation behavior in the individual abnormal behavior of the first user and the operation behavior in the abnormal behavior of the first user in the group of M users, and the third set is the intersection of the operation duration in the individual abnormal behavior of the first user and the operation duration in the abnormal behavior of the first user in the group of M users. A fourth Euclidean distance is obtained by weighted summing of the first, second, and third Euclidean distances. If the fourth Euclidean distance is less than or equal to a fifth preset threshold, the next behavior is considered an abnormal behavior.

[0067] Based on the same inventive concept, embodiments of this application provide an electronic device including at least one processor 501 and a memory 502 communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods described in any of the above embodiments.

[0068] This application embodiment does not limit the specific connection medium between the processor 501 and the memory 502. Figure 5 Taking the connection between processor 501 and memory 502 via bus 500 as an example, bus 500 in... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 500 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0069] The computing device in this embodiment may also include a communication interface 503, such as a network port, through which the computing device can receive or send data.

[0070] The processor 501 serves as the control center of the computing device. It connects to various parts of the device via various interfaces and lines, executing instructions stored in the memory 502 and accessing data stored in the memory 502 to perform various functions and process data, thereby providing overall monitoring of the computing device. Optionally, the processor 501 may include one or more processing units. The processor 501 may integrate an application processor and a modem processor. The application processor primarily handles the operating system and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0071] Optionally, the processor 501 may be a general-purpose processor, such as a central processing unit, an application-specific integrated circuit (ASIC), one or more integrated circuits for controlling program execution, hardware circuits developed using a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the abnormal behavior detection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0072] By designing and programming the processor 501, the code corresponding to the abnormal behavior detection method described in the foregoing embodiments can be embedded into the chip, so that the chip can execute the steps of the aforementioned abnormal behavior detection method during operation. How to design and program the processor 501 is a well-known technique to those skilled in the art, and will not be described in detail here.

[0073] Optionally, in this embodiment, the memory 502 stores instructions executable by at least one processor 501. The at least one processor 501 can execute the steps included in the aforementioned abnormal behavior detection method by executing the instructions stored in the memory 502. The memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. The memory 502 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. The memory 502 in this embodiment can also be a circuit or any other device capable of performing storage functions, used to store program instructions and / or data. The number of memories 502 can be one or more. The memory 502 is used in... Figure 5 It is shown together, but it should be noted that memory 502 is not a mandatory functional module, therefore in Figure 5 It is shown in dashed lines.

[0074] Based on the same inventive concept, embodiments of this application provide a computer storage medium storing computer program instructions for executing the methods in any of the above embodiments. In specific implementations, the computer-readable storage medium includes various storage media capable of storing program code, such as a Universal Serial Bus flash drive (USB), a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0075] In some possible implementations, various aspects of the abnormal behavior detection method provided in this application can also be implemented in the form of a program product, which includes program code that, when the program product is run on a computing device, causes the computing device to perform the steps in the abnormal behavior detection method according to the various exemplary embodiments of this application described above.

[0076] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0078] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0079] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0080] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: Universal Serial Bus flash disks, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0081] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting abnormal behavior, characterized in that, include: Obtain M sets of first sequences for M users, with one first sequence set corresponding to one user. Each first sequence set includes N first sequences, where the N first sequences represent N user operations and the N first sequences represent the N operation durations corresponding to the user's N operations. M and N are both positive integers. Cluster the first sequence representing the operation behavior and the first sequence representing the operation duration in the M first sequence sets respectively to obtain R first sequences, where R is a positive integer; Determine the user corresponding to each first sequence in each class of the first sequence of the R class; If the number of first sequences corresponding to any user in each first sequence is less than a first preset threshold, then the operation behavior and operation duration corresponding to the first sequence of any user are considered abnormal group behavior. And / or, determine the operation behavior and operation duration corresponding to at least one type of first sequence in the R-class first sequence where the number of first sequences is less than a second preset threshold as abnormal group behavior; Based on the abnormal group behavior of the M users, determine the abnormal group behavior of the first user among the M users; Cluster the first sequence set corresponding to the first user to obtain the first sequence of the first user in S classes, where S is a positive integer; The operation behavior and operation duration corresponding to at least one type of first sequence in the S-class first sequence where the number of first sequences is less than a third preset threshold are determined as the individual abnormal behavior of the first user. Predict whether the first user's next behavior will be abnormal based on the group abnormal behavior and the individual abnormal behavior of the first user.

2. The method as described in claim 1, characterized in that, A single operation includes login, browsing, querying, downloading, and logging out, and the login, browsing, querying, downloading, and logging out operations are arranged in sequence to form the first sequence; and the durations corresponding to the login, browsing, querying, downloading, and logging out operations are arranged in sequence to form the first sequence.

3. The method as described in claim 1 or 2, characterized in that, Predicting whether the first user's next behavior will be abnormal based on the group abnormal behavior and the individual abnormal behavior of the first user includes: The next action of the first user, outside the first sequence set, is obtained to form a second sequence, wherein the next action includes the operation action and the operation duration; Calculate the first Euclidean distance between the second sequence and the center of the first set, the first set including the operation behavior and operation duration that are both abnormal behaviors in the individual abnormal behavior of the first user, and the union of the operation behavior and operation duration that are both abnormal behaviors in the abnormal behavior of the first user in the group of M users; If the first Euclidean distance is not greater than the fourth preset threshold, then the next action is an abnormal action.

4. The method as described in claim 3, characterized in that, If the first Euclidean distance is greater than the fourth preset threshold, the method further includes: Calculate the second Euclidean distance between the operation behavior in the second sequence and the center of the second set, and the third Euclidean distance between the operation duration in the second sequence and the center of the third set. The second set is the intersection of the operation behavior in the individual abnormal behavior of the first user and the operation behavior in the abnormal behavior of the first user in the group of M users. The third set is the intersection of the operation duration in the individual abnormal behavior of the first user and the operation duration in the abnormal behavior of the first user in the group of M users. The fourth Euclidean distance is obtained by weighted summation of the first, second, and third Euclidean distances; If the fourth Euclidean distance is less than or equal to the fifth preset threshold, then the next action is an abnormal action.

5. An abnormal behavior detection device, characterized in that, include: The acquisition module is used to acquire M sets of first sequences for M users, with one first sequence set corresponding to one user. Each first sequence set includes N first sequences, where the N first sequences represent N operation behaviors of the user and the N operation durations corresponding to the N operation behaviors of the user. M and N are both positive integers. The clustering module is used to cluster the first sequence representing the operation behavior and the first sequence representing the operation duration in the M first sequence sets respectively, to obtain R first sequences, where R is a positive integer; The determination module is used to determine the user corresponding to each first sequence in each class of the first sequence of the R class; if the number of first sequences corresponding to any user in each class of the first sequence is less than a first preset threshold, then the operation behavior and operation duration corresponding to the first sequence of any user are abnormal group behavior. And / or, determine the operation behavior and operation duration corresponding to at least one type of first sequence in the R-class first sequence where the number of first sequences is less than a second preset threshold as abnormal group behavior; The determining module is further configured to determine the abnormal behavior of the first user among the M users based on the abnormal behavior of the M users. The determining module is further configured to cluster the first sequence set corresponding to the first user to obtain the first sequence of the first user in S classes, where S is a positive integer; The operation behavior and operation duration corresponding to at least one type of first sequence in the S-class first sequence where the number of first sequences is less than a third preset threshold are determined as the individual abnormal behavior of the first user. The prediction module is used to predict whether the next behavior of the first user will be abnormal based on the group abnormal behavior of the first user and the individual abnormal behavior of the first user.

6. The apparatus as claimed in claim 5, characterized in that, A single operation includes login, browsing, querying, downloading, and logging out, and the login, browsing, querying, downloading, and logging out operations are arranged in sequence to form the first sequence; and the durations corresponding to the login, browsing, querying, downloading, and logging out operations are arranged in sequence to form the first sequence.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-4.

Images