User continuous behavior abnormality monitoring method based on dual features

Abstract

The present invention relates to a method for monitoring abnormal continuous user behavior based on dual features, which belongs to the field of big data. The method collects user access behavior sequence data from the historical log file of the information system for preprocessing, generates a starting sequence and a subsequent sequence vector as training sample data; initializes the starting sequence and the subsequent sequence LSTM model, and inputs the starting sequence and the subsequent sequence vector into the corresponding model for training respectively; uses the trained model to calculate the abnormal score of each instance element in the starting sequence and the subsequent sequence vector in the two models, and calculates the abnormal detection threshold based on the abnormal score of each instance element in the two models; generates the starting sequence and the subsequent sequence vector from the access operation data collected in real time, and inputs them into the two trained models, and calculates the abnormal score of each instance element in the starting sequence and the subsequent sequence vector in the two models to judge the abnormal continuous user behavior. The method solves the high false alarm rate and monitoring delay caused by the static rule limitation of the continuous user behavior monitoring.

Description

Technical Field

[0001] The present invention relates to the technical field of big data analysis, and in particular to a method for monitoring abnormal continuous behavior of users based on dual features. Background Art

[0002] User behavior monitoring and anomaly detection have always been an important issue in the field of network security. When it comes to data security and business security, it becomes particularly critical to monitor the continuous behavior of users to identify abnormal behavior. This monitoring mainly includes the following aspects:

[0003] In the field of digital security, cloud computing environments, e-commerce platforms, industry application platforms, and financial transactions all require monitoring of user behavior to ensure the normal operation of the system and the security of data;

[0004] Users’ behaviors in the system are diverse, including login, data access, file download, query, transaction, communication, etc. Therefore, to monitor these behaviors, it is necessary to consider various types of user operations;

[0005] Abnormal behavior may be a sign of malicious attacks, data leaks, backdoors, or other potential problems. Therefore, being able to identify and respond to abnormal behavior early is critical to the stability and security of the system.

[0006] User behavior usually involves time series data, such as user login time, access time, data transmission time, etc. These time series data can be used to analyze and detect abnormal behavior.

[0007] Although there are some existing technologies for user behavior monitoring and anomaly detection, they still have the following shortcomings:

[0008] Methods based on limited features: Some traditional methods only focus on some limited features, such as the number of logins or access frequency, ignoring more complex user behavior characteristics, resulting in low sensitivity to abnormal behavior;

[0009] Limitations of static rules: Some technologies use static rules to define abnormal behaviors, which cannot adapt well to changing user behavior patterns;

[0010] High false positive rate: Some methods are prone to false positives, i.e. misidentifying normal behavior as abnormal behavior, which causes unnecessary trouble to system administrators;

[0011] Monitoring delays: Failure to provide real-time monitoring results in delayed responses to potential threats, whereas in areas such as cybersecurity, time criticality is extremely important.

[0012] Therefore, there is an urgent need for a dual-feature based user continuous behavior anomaly monitoring method to improve the detection and accuracy of abnormal behavior, thereby improving the security and stability of the system. Summary of the invention

[0013] In view of the above analysis, an embodiment of the present invention aims to provide a method for monitoring user continuous behavior anomalies based on dual features, so as to solve the technical problems of limited feature attention, static rule restrictions, high false alarm rate and monitoring delay in the prior art of user continuous behavior monitoring technology.

[0014] The embodiment of the present invention provides a method for monitoring abnormal user continuous behavior based on dual features, comprising the following steps:

[0015] Collect user access behavior sequence data from the information system history log file and pre-process it to generate the starting sequence vector and subsequent sequence vector as training sample data;

[0016] Initialize the starting sequence LSTM model and the subsequent sequence LSTM model, input the starting sequence vector and the subsequent sequence vector into the starting sequence LSTM model and the subsequent sequence LSTM model for training respectively; calculate the abnormality score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models by using the trained models, and calculate the abnormality detection thresholds of the two models based on the abnormality score of each instance element in the two models;

[0017] The access operation data collected in real time generates a starting sequence vector and a subsequent sequence vector, which are input into the trained starting sequence LSTM model and subsequent sequence LSTM model, and the anomaly score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models is calculated. The user continuous behavior anomaly judgment is performed based on the anomaly score and the anomaly detection threshold of the two models.

[0018] Further, the user access behavior sequence data includes access sequences of multiple users, and each user's access sequence includes multiple operations;

[0019] The generating of the starting sequence vector and the subsequent sequence vector comprises:

[0020] The first N operations of each user access sequence are used as an instance element of the starting sequence vector, and the first N operations of multiple user access sequences are combined into the starting sequence vector;

[0021] Each user access sequence is sequentially followed after excluding the first N operations. Every N operations are used as an instance element in the subsequent sequence vector. If there are less than N operations, empty operations are added.

[0022] Multiple user access sequences are combined into the subsequent sequence vector excluding operations after the first N operations.

[0023] Furthermore, the abnormality score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models is calculated by using the trained model, including:

[0024] For the starting behavior sequence vector, take the first half of the operation of each instance element and input it into the starting sequence LSTM model to obtain the predicted value of the second half of the operation of each instance element, and take the second half of the operation of each instance element in the starting behavior sequence vector as the true value;

[0025] For the subsequent behavior sequence vector, take the first half of the operation of each instance element and input it into the subsequent sequence LSTM model to obtain the predicted value of the second half of the operation of each instance element, and take the second half of the operation of each instance element in the subsequent behavior sequence vector as the true value;

[0026] The abnormality score of each instance element is obtained based on the actual value and predicted value of the second half operation of each instance element in the initial behavior sequence vector; the abnormality score of each instance element is obtained based on the actual value and predicted value of the second half operation of each instance element in the subsequent behavior sequence vector.

[0027] Further, the abnormal score e of each instance element in the starting sequence vector is calculated by the following formula: s :

[0028]

[0029] Among them, y i is the i-th operation in the instance element, is the i-th operation output by the starting sequence LSTM model, and N is the number of operations in an instance element;

[0030] The abnormal score e of each instance element in the subsequent sequence vector is calculated by the following formula l :

[0031]

[0032] Among them, y i is the jth operation in an instance element of the subsequent behavior sequence vector; The jth prediction operation for an instance element output by the subsequent sequence LSTM model.

[0033] Further, the calculating the anomaly detection thresholds of the two models based on the anomaly score of each instance element in the two models includes:

[0034] Calculate the starting sequence threshold b s ,as follows:

[0035]

[0036] in, is the average of the anomaly scores of all instance elements of the starting sequence LSTM model, a s is the coefficient, K is the number of instance elements in the starting sequence vector, e si is the anomaly score of the i-th instance element;

[0037] Calculate the subsequent sequence threshold b l ,as follows:

[0038]

[0039] in, is the average of the anomaly scores of all instance elements of the subsequent sequence LSTM model, a l is the coefficient, L is the number of instance elements in the subsequent sequence vector, e lj is the anomaly score of the jth instance.

[0040] Furthermore, the abnormality determination of the user's continuous behavior based on the abnormality score and the abnormality detection thresholds of the two models includes:

[0041] If there is an instance element in the starting sequence vector whose abnormality score is greater than the starting sequence threshold, then output that the user starting sequence is abnormal, otherwise output that the user starting sequence is normal;

[0042] If there is an instance element in the subsequent sequence vector whose abnormal score is greater than the subsequent sequence threshold, the user's subsequent sequence is output as abnormal, otherwise the user's subsequent sequence is output as normal;

[0043] If the user's initial sequence is normal and the user's subsequent sequence is normal, the user's behavior is normal;

[0044] If the user's starting sequence is abnormal or the user's subsequent sequence is abnormal, the user behavior is abnormal.

[0045] Furthermore, the training sample data are all normal user behavior data.

[0046] Furthermore, the collecting of user access behavior sequence data from the information system history log file and preprocessing includes:

[0047] De-duplicate the user access behavior sequence data, remove invalid data, fill in missing values, and correct erroneous data;

[0048] For each access operation in each user's access sequence data, the attributes thereof are data standardized; and then the user behavior sequence data after data standardization is labeled with a normal data label.

[0049] Furthermore, the user access sequence data is judged from the beginning to the end. When a new target resource attribute is found and the URL click time interval attribute is more than T minutes from the last access time, a new user access behavior sequence is started.

[0050] The user access sequence data is judged one by one to obtain multiple user access behavior sequences. Further, N is 15 times, T is 15 minutes; coefficient a s and a l The average value is 1.6.

[0051] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0052] 1. More accurate anomaly detection: By combining the analysis of dual feature sequences, more accurate anomaly detection of continuous user behavior is provided. This will help reduce the false alarm rate, thereby reducing the workload of system administrators and improving the credibility of anomaly detection;

[0053] 2. Comprehensive user behavior analysis: By capturing the user's continuous behavior sequence, it provides a more comprehensive user behavior analysis, focuses on the development process of events, and captures the user's overall behavior pattern step by step. It helps to better understand user behavior and discover hidden patterns and trends;

[0054] 3. Real-time monitoring and response: It has the ability to monitor the continuous behavior of users in real time, detect abnormal behavior in time and take necessary response measures. This is particularly important in areas such as network security and helps reduce the risk of potential threats;

[0055] 4. Adaptability and dynamism: This method adapts to the ever-changing user behavior patterns and avoids the limitations of static rules in traditional methods. It automatically adjusts the detection strategy to adapt to the changes in behavior patterns in different situations;

[0056] 5. Maintain system stability and security: Through more accurate anomaly detection, it helps maintain system stability and security. It helps identify potential internal threats, cyber attacks, data leaks, etc., thereby protecting the integrity of the system and data.

[0057] In the present invention, the above-mentioned technical solutions can also be combined with each other to achieve more preferred combination solutions. Other features and advantages of the present invention will be described in the subsequent description, and some advantages can become obvious from the description, or can be understood by practicing the present invention. The purpose and other advantages of the present invention can be achieved and obtained through the contents particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The drawings are only for the purpose of illustrating particular embodiments and are not to be considered limiting of the present invention. Like reference symbols denote like components throughout the drawings.

[0059] Figure 1 It is a flow chart of the abnormal monitoring and method of continuous user behavior based on dual features;

[0060] Figure 2 A schematic diagram of generating a starting sequence vector and a subsequent sequence vector for a user behavior sequence based on the preprocessed user behavior sequence data;

[0061] Figure 3 This is a schematic diagram of determining whether user behavior is abnormal based on the initial sequence LSTM model and the subsequent sequence LSTM model. DETAILED DESCRIPTION

[0062] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0063] A specific embodiment of the present invention discloses a method for abnormal monitoring of user continuous behavior profiles based on dual feature sequences, such as Figure 1 As shown, the following steps are included:

[0064] Step S1, collecting user access behavior sequence data from the information system history log file and preprocessing it to generate a starting sequence vector and a subsequent sequence vector as training sample data;

[0065] Step S2, initializing the starting sequence LSTM model and the subsequent sequence LSTM model, inputting the starting sequence vector and the subsequent sequence vector into the starting sequence LSTM model and the subsequent sequence LSTM model for training respectively; using the trained models to calculate the abnormality score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models, and calculating the abnormality detection thresholds of the two models based on the abnormality score of each instance element in the two models;

[0066] Step S2: The access operation data collected in real time generates a starting sequence vector and a subsequent sequence vector, which are input into the trained starting sequence LSTM model and subsequent sequence LSTM model, and the abnormality score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models is calculated. Based on the abnormality score and the abnormality detection threshold of the two models, the user continuous behavior abnormality judgment is performed.

[0067] Wherein, the training sample data are all normal user behavior data.

[0068] Step S1, includes steps S11-S13, specifically.

[0069] The purpose of this step is to obtain data from the data source and preprocess the data so that the data can be input into the corresponding LSTM model.

[0070] Step S11, collecting user access behavior sequence data from the historical log file of the information system that needs to record user behavior;

[0071] The data comes from the log files of information systems that need to record user behavior. These log files include user attributes and various behaviors of users in the information system, such as user ID, timestamp, URL (Uniform Resource Locator) visited, request type, server response, etc.

[0072] The data sources are wide-ranging and can cover information systems in different business fields that need to record user behavior, and can be multiple data sources.

[0073] Collect log data of information systems that need to record user behavior within a certain historical period. For example, collect three months of historical log data.

[0074] Log files are stored in plain text or binary format, depending on the actual application and system requirements. Log files include: system logs, application logs, user logs, web server (network server) logs, database logs, application error logs, etc.

[0075] Data collection: Use collection tools or scripts to extract log records from the information system that needs to record user behavior, which involves accessing log files, querying databases, and using APIs (Application Program Interface) to obtain data.

[0076] By comprehensively analyzing multiple log records when users access information systems that need to record user behaviors, we can obtain the behavior sequence data of users accessing services when they access the system. We combine these user access behavior sequence data to form a continuous behavior sequence of user access. An access behavior sequence includes multiple operations, and an access operation includes multiple attributes. Attributes include attributes 1-9, as follows:

[0077] (1) Attribute 1

[0078] Source IP, the IP address of the page that the user is currently visiting. Record the starting IP address of the user accessing the system.

[0079] (2) Attribute 2

[0080] Source URL, the URL of the previous page visited by the user. Records the previous page visited by the user. If there is no URL of the previous page, the attribute value is empty.

[0081] (3) Attribute 3

[0082] The target host domain name indicates the host domain name in the URL visited by the user, and records the address visited by the user.

[0083] (4) Attribute 4

[0084] The target resource is usually the resource file name in the target URL, which indicates the different resources accessed by the user and records the identifier of the resource accessed by the user.

[0085] The target resource identifier may be that the user has downloaded a PDF document, queried a table in a database, or accessed a CSS style sheet in the system.

[0086] For example:

[0087] For http: / / www.hnnydsjzx.com / dataPublish / dataPublish.html, www.hnnydsjzx.com represents the target host domain name, and dataPublish / dataPublish.htm represents the file name of the target resource.

[0088] (5) Attribute 5

[0089] URL click interval, the time between the last click.

[0090] For example,

[0091] User A enters the information system that needs to record user behavior and clicks on the link of Announcement B. User A spends 5 minutes reading Announcement B and then returns to the homepage.

[0092] 10 minutes later, user A clicks on notification B again to continue reading;

[0093] User A continues to spend 2 minutes reading announcement B and then closes the browser.

[0094] In this example, the URL click interval of user A is:

[0095] From clicking on notification B to returning to the home page: 5 minutes;

[0096] From returning to the home page to clicking on notification B again: 10 minutes;

[0097] From clicking notification B again to closing the browser: 2 minutes.

[0098] URL click interval is used to measure the time difference between user actions in continuous behavior.

[0099] (6) Attribute 6

[0100] The type of request behavior that the user makes to the server.

[0101] Exemplarily, HTTP request method.

[0102] GET: Get the specified resource from the server;

[0103] POST: Submits specified resources to the server;

[0104] PUT: upload the specified resource to the server;

[0105] DELETE: Delete the specified resource from the server;

[0106] HEAD: Gets the same response as GET, but without the response body.

[0107] CONNECT: Establish a network connection with the server;

[0108] OPTIONS: Get information about the request methods and resources supported by the server;

[0109] TRACE: Performs a remote diagnostic so that the client can see what happened in the request / response chain;

[0110] PATCH: Upload part of the specified resource to the server, used to update the resource.

[0111] (7) Attribute 7

[0112] The type of processing result returned by the server: The server responds to the user's request and returns different types of corresponding data or information, and may also return access failure information.

[0113] Successful response: The user's request is successfully processed and the required data or information is returned, which is recorded as a successful response. The user successfully obtains the requested file or page;

[0114] Error response: The user's request cannot be successfully processed for some reason, and the server returns an error response, such as 404 page does not exist or resource not found, 500 internal server error;

[0115] Data response type: The response includes different types of data: HTML pages, JSON data, XML documents, image files, etc.

[0116] Redirect response: The server sometimes redirects the user's access to another URL;

[0117] Access failure information: The server cannot process the user request and returns a failure message.

[0118] Exemplary:

[0119] 200OK: Indicates that the request has been successfully processed and the requested data is returned;

[0120] 201Created: Indicates that the request has been successfully processed and a new resource has been created on the server.

[0121] 204 No Content: Indicates that the request was successfully processed, but no content was returned;

[0122] 301 Moved Permanently: Indicates that the requested resource has been permanently moved to a new location;

[0123] 400 Bad Request: Indicates that the client sent an invalid request that the server could not understand;

[0124] 401Unauthorized: Indicates that the client is not authorized to access the requested resource;

[0125] 403Forbidden: Indicates that the server has denied the client access to the requested resource;

[0126] 404 Not Found: Indicates that the requested resource does not exist;

[0127] 500 Internal Server Error: Indicates that an error occurred while the server was trying to process the request.

[0128] 503 Service Unavailable: Indicates that the server is currently unable to process the request, usually due to server overload, maintenance, or network connection problems.

[0129] (8) Attribute 8

[0130] Uplink traffic data packet size, records the size of user request content.

[0131] (9) Attribute 9

[0132] Downlink traffic data packet size, records the user's download resource status.

[0133] Step S12: preprocessing the user access behavior sequence data:

[0134] (1) De-duplication of the user access behavior sequence data, removal of invalid data, filling of missing values, and correction of erroneous data;

[0135] Automatically remove duplicate data to ensure data uniqueness; identify and delete invalid data, including data with incorrect format or missing key information; fill in missing values ​​to maintain data integrity; correct possible erroneous data, such as timestamp errors or inconsistent data.

[0136] (2) For each access operation in each user's access sequence data, the attributes thereof are standardized;

[0137] The attribute values ​​of attributes 1-7, namely, source IP, source URL, target host domain name, target resource, URL click time interval, user request behavior type to the server, and processing result type returned by the server, are recorded in character type.

[0138] The attribute values ​​of attributes 8-9, ie, the upstream traffic data packet size and the downstream traffic data packet size, are recorded in integer type.

[0139] (3) Then, the user behavior sequence data after data standardization is labeled with a normal data label.

[0140] When collecting sample training data sets, abnormal data is removed through review, leaving normal data as sample data sets, and the data attributes of user access sequence data are marked as normal data labels.

[0141] Step S13, generating a starting sequence vector and a subsequent sequence vector as sample training data for the user behavior sequence data marked with normal data labels.

[0142] Combine attributes 1 to 9 to form an access operation action vector x, expressed as

[0143] x={attribute 1, attribute 2, ..., attribute 9}

[0144] The access behavior sequence vector X formed by a series of access operation action vectors x of each user is expressed as:

[0145] X={χ1,χ2,...,χ p}

[0146] Among them, p represents that the user's access behavior sequence vector has a total of p access operations, p ≥ 1.

[0147] like Figure 2 As shown, the user access sequence data is judged from the front to the back. When a new target resource attribute is found and the URL click time interval attribute is more than T minutes from the last access time, a new user access behavior sequence is started;

[0148] The user access sequence data is judged successively to obtain a plurality of user access behavior sequences.

[0149] Exemplarily, T is selected as 15 minutes.

[0150] The user access behavior sequence data includes access sequences of multiple users, and each user's access sequence includes multiple operations;

[0151] The generating of the starting sequence vector and the subsequent sequence vector comprises:

[0152] The first N operations of each user access sequence are used as an instance element of the starting sequence vector, and the first N operations of multiple user access sequences are combined into the starting sequence vector;

[0153] Each user access sequence is sequentially followed after excluding the first N operations. Every N operations are used as an instance element in the subsequent sequence vector. If there are less than N operations, empty operations are added.

[0154] Multiple user access sequences are combined into the subsequent sequence vector excluding operations after the first N operations.

[0155] Exemplarily, the number of operations N is selected to be 15. The number of operations is adjusted according to actual application requirements.

[0156] The starting sequence vector is represented as: X s , the information system has multiple access users, and the first N operations of each user behavior sequence correspond to X s An example of . N operations in a user behavior sequence are X s The first N operations of multiple users constitute the starting sequence vector X s For example Figure 2 shown.

[0157] The first N operations of each user behavior sequence are taken as an instance of the starting sequence vector. The first N operations are excluded from each user behavior sequence, and each subsequent N operations are taken as instances of the subsequent sequence vector. If the number is less than N, empty operations are used to fill the gap.

[0158] The subsequent sequence vector is represented as: X l .

[0159] The starting sequence vector represents the user's initial behavior, and the subsequent sequence vectors represent the user's continuous behavior. Representing user behavior as a sequence vector helps visualize the data.

[0160] Starting sequence vector X s and the subsequent sequence vector X l ,as follows:

[0161] X s ={Xs1 , X s2 , . . . , X sK}

[0162] X l ={X l1 , X l2 , . . . , X lL}

[0163] There are K instance elements in the starting sequence vector, and L instance elements in the subsequent sequence vector; each instance element has N operations.

[0164] At this point, the initial sequence vector and the subsequent sequence vector are obtained as sample training data. The sample training data are all normal user behavior data and are consistent with the continuous behavior characteristics of describing the user in accessing information system services.

[0165] Step S2, includes steps S21-S23, specifically.

[0166] Step S21, initializing the starting sequence LSTM model and the subsequent sequence LSTM model;

[0167] The two sequence models are consistent after initialization. At the beginning, the initialization states of the starting sequence LSTM model and the subsequent sequence LSTM model are the same, with the same weights and parameters.

[0168] Step S22, inputting the starting sequence vector and the subsequent sequence vector into the starting sequence LSTM model and the subsequent sequence LSTM model respectively for training;

[0169] According to the sequence identifier (i.e., the starting sequence or the subsequent sequence), the two sequences of the training sample data are respectively sent to the starting sequence LSTM model and the subsequent sequence LSTM model to learn the features of the starting sequence vector and the subsequent sequence vector. Figure 3 shown.

[0170] During the training process, the two models receive different input data and process the initial sequence vector and subsequent sequence vector respectively. Due to the different processed data, the two sequence models are different after the training is completed.

[0171] Step S23, the trained model is used to calculate the abnormality score of each instance element in the initial sequence vector and the subsequent sequence vector in the two models.

[0172] For the starting behavior sequence vector, take the first half of the operation of each instance element and input it into the starting sequence LSTM model to obtain the predicted value of the second half of the operation of each instance element, and take the second half of the operation of each instance element in the starting behavior sequence vector as the true value;

[0173] For the subsequent behavior sequence vector, take the first half of the operation of each instance element and input it into the subsequent sequence LSTM model to obtain the predicted value of the second half of the operation of each instance element, and take the second half of the operation of each instance element in the subsequent behavior sequence vector as the true value;

[0174] The abnormality score of each instance element is obtained based on the actual value and predicted value of the second half operation of each instance element in the initial behavior sequence vector; the abnormality score of each instance element is obtained based on the actual value and predicted value of the second half operation of each instance element in the subsequent behavior sequence vector.

[0175] N is the starting behavior sequence vector X s and the subsequent sequence vector X l The number of operations in each instance element of .

[0176] Exemplarily, for the starting behavior sequence vector, each instance element N is 15 operations, 1 to 8 operations are selected to input into the starting sequence model, and the predicted value of the second half of the operations of each instance element is obtained, and the second half of 9 to 15 operations of each instance element in the starting behavior sequence vector is taken as the true value.

[0177] The abnormal score e of each instance element in the starting sequence vector is calculated by the following formula s :

[0178]

[0179] Among them, y i is the ith actual access behavior in the actual access behavior sequence, is the i-th predicted behavior output by the starting sequence LSTM model, and N is the number of operations in an instance element.

[0180] Exemplarily, i is the behavior sequence operation of 9 to 15 times in the second half of each instance element in the starting behavior sequence vector.

[0181] The average of the anomaly scores of all instances of the starting sequence LSTM model The calculation is as follows:

[0182]

[0183] Where K is the number of instances of the starting sequence vector.

[0184] The abnormal score e of each instance element in the subsequent sequence vector is calculated by the following formula l :

[0185]

[0186] Among them, yi is the jth actual access behavior of the actual access sequence, The j-th predicted behavior output by the subsequent sequence LSTM model.

[0187] The average of the anomaly scores of all instances of the subsequent sequence LSTM model The calculation is as follows:

[0188]

[0189] Where L is the number of instances of the subsequent sequence vector.

[0190] Step S24, calculating the anomaly detection thresholds of the two models based on the anomaly score of each instance element in the two models.

[0191] Calculate the standard deviation of the mean of the anomaly scores for the starting sequence LSTM model And the number of instances of the starting sequence vector, using coefficient a s Adjust to get the starting sequence threshold;

[0192] Calculate the standard deviation of the mean of the anomaly scores of the subsequent sequence LSTM model And the number of instances of the starting sequence vector, using the coefficient b s Adjustments are made to obtain subsequent sequence thresholds.

[0193] The starting sequence threshold b is calculated by the following formula s :

[0194]

[0195] in, is the average of the anomaly scores of all instance elements of the starting sequence LSTM model, a s is the coefficient, K is the number of instances in the starting sequence vector, e si is the anomaly score of the i-th instance element.

[0196] Coefficient a s The value of affects the accuracy and recall rate of the starting sequence LSTM model. According to practice a s The value range is usually between 1.0 and 2.0. For example, a s The value is 1.6, and the prediction effect and performance of the entire model are better. s Affects the sensitivity of detecting abnormal user behavior.

[0197] The subsequent sequence threshold b is calculated by the following formula l :

[0198]

[0199] in, is the average of the anomaly scores of all instance elements of the subsequent sequence LSTM model, a l is the coefficient, L is the number of instances in the subsequent sequence vector, e lj is the anomaly score of the jth instance element.

[0200] Coefficient a l The value range of affects the accuracy and recall rate of the subsequent sequence LSTM model. According to practice a l The value range of is usually between 1.0 and 2.0. For example, a l When the value is 1.6, the prediction effect and performance of the entire model are better.

[0201] Step S3, includes steps S31-S32, specifically.

[0202] Step S31, the starting sequence vector and the subsequent sequence vector of the user access operation collected in real time are input into the trained starting sequence LSTM model and the subsequent sequence LSTM model to obtain the abnormality score of each instance;

[0203] During the operation of the information system, the access operations collected in real time are pre-processed.

[0204] During the operation of the information system, the access operations collected in real time are serialized to generate a user continuous behavior sequence, and a starting sequence vector and a subsequent sequence vector are generated;

[0205] According to the starting sequence identifier and the subsequent sequence identifier, the starting sequence vector and the subsequent sequence vector corresponding to the access operation collected in real time are sent to the parallel starting sequence LSTM model and the subsequent sequence LSTM model.

[0206] According to the above formula, the anomaly score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models is calculated, e s With e l ;

[0207] Step S32: making abnormal judgment on the user's continuous behavior based on the abnormality score and the abnormality detection thresholds of the two models.

[0208] If there is an instance element in the starting sequence vector whose abnormality score is greater than the starting sequence threshold, then output that the user starting sequence is abnormal, otherwise output that the user starting sequence is normal;

[0209] If there is an instance element in the subsequent sequence vector whose abnormal score is greater than the subsequent sequence threshold, the user's subsequent sequence is output as abnormal, otherwise the user's subsequent sequence is output as normal;

[0210] The abnormal judgments of continuous user behavior based on OR logic include:

[0211] If the user's initial sequence is normal and the user's subsequent sequence is normal, the user's behavior is normal;

[0212] If the user's starting sequence is abnormal or the user's subsequent sequence is abnormal, the user behavior is abnormal.

[0213] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0214] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for monitoring abnormal user continuous behavior based on dual features, characterized in that: The steps include: Collect user access behavior sequence data from the information system history log file and pre-process it to generate the starting sequence vector and subsequent sequence vector as training sample data; Initialize the starting sequence LSTM model and the subsequent sequence LSTM model, input the starting sequence vector and the subsequent sequence vector into the starting sequence LSTM model and the subsequent sequence LSTM model for training respectively; calculate the abnormality score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models by using the trained models, and calculate the abnormality detection thresholds of the two models based on the abnormality score of each instance element in the two models; The access operation data collected in real time generates a starting sequence vector and a subsequent sequence vector, which are input into the trained starting sequence LSTM model and the subsequent sequence LSTM model, and the abnormality score of each instance element in the starting sequence vector and the subsequent sequence vector in the two models is calculated, and the abnormality judgment of the user's continuous behavior is performed based on the abnormality score and the abnormality detection threshold of the two models; The user access behavior sequence data includes access sequences of multiple users, and each user's access sequence includes multiple operations; The generating of the starting sequence vector and the subsequent sequence vector comprises: The first N operations of each user access sequence are used as an instance element of the starting sequence vector, and the first N operations of multiple user access sequences are combined into the starting sequence vector; Each user access sequence is sequentially followed after excluding the first N operations. Every N operations are used as an instance element in the subsequent sequence vector. If there are less than N operations, empty operations are added. Multiple user access sequences are combined into the subsequent sequence vector excluding the operations after the first N operations; The abnormality score of each instance element in the initial sequence vector and the subsequent sequence vector in the two models calculated by using the trained model includes: For the starting sequence vector, the first half of the operation of each instance element is input into the starting sequence LSTM model to obtain the predicted value of the second half of the operation of each instance element, and the second half of the operation of each instance element in the starting sequence vector is taken as the true value; For the subsequent sequence vector, the first half of the operation of each instance element is input into the subsequent sequence LSTM model to obtain the predicted value of the second half of the operation of each instance element, and the second half of the operation of each instance element in the subsequent sequence vector is taken as the true value; Obtaining an abnormality score for each instance element based on the actual value and the predicted value of the second half operation of each instance element in the starting sequence vector; Obtaining an abnormality score for each instance element based on the actual value and the predicted value of the second half operation of each instance element in the subsequent sequence vector; The abnormal score e of each instance element in the starting sequence vector is calculated by the following formula s : Among them, y i is the i-th operation in the instance element, is the i-th operation output by the starting sequence LSTM model, and N is the number of operations in an instance element; The abnormal score e of each instance element in the subsequent sequence vector is calculated by the following formula l : Among them, y j is the jth operation in an instance element of the subsequent sequence vector; The jth prediction operation for an instance element output by the subsequent sequence LSTM model.

2. The method according to claim 1, characterized in that: The calculating of the anomaly detection thresholds of the two models based on the anomaly score of each instance element in the two models comprises: The starting sequence threshold b is calculated by the following formula s : in, is the average of the anomaly scores of all instance elements of the starting sequence LSTM model, a s is the coefficient, K is the number of instance elements in the starting sequence vector, e si is the anomaly score of the i-th instance element; The subsequent sequence threshold b is calculated by the following formula l : in, is the average of the anomaly scores of all instance elements of the subsequent sequence LSTM model, a l is the coefficient, L is the number of instance elements in the subsequent sequence vector, e lj is the anomaly score of the jth instance.

3. The method according to claim 2, characterized in that The abnormality determination of the user's continuous behavior based on the abnormality score and the abnormality detection thresholds of the two models includes: If there is an instance element in the starting sequence vector whose abnormality score is greater than the starting sequence threshold, then output that the user starting sequence is abnormal, otherwise output that the user starting sequence is normal; If there is an instance element in the subsequent sequence vector whose abnormal score is greater than the subsequent sequence threshold, the user's subsequent sequence is output as abnormal, otherwise the user's subsequent sequence is output as normal; If the user's initial sequence is normal and the user's subsequent sequence is normal, the user's behavior is normal; If the user's starting sequence is abnormal or the user's subsequent sequence is abnormal, the user behavior is abnormal.

4. The method according to any one of claims 1 to 3, characterized in that: The training sample data are all normal user behavior data.

5. The method according to claim 4, characterized in that The collecting of user access behavior sequence data from the information system history log file and preprocessing includes: De-duplicate the user access behavior sequence data, remove invalid data, fill in missing values, and correct erroneous data; For each access operation in each user access behavior sequence data, the attributes thereof are data standardized; and then the user access behavior sequence data after data standardization is labeled with a normal data label.

6. The method according to claim 5, characterized in that The user access behavior sequence data is judged from the beginning to the end. When a new target resource attribute is found and the URL click time interval attribute is more than T minutes from the last access time, a new user access behavior sequence is started; The user access behavior sequence data is judged successively to obtain multiple user access behavior sequences.

7. The method according to claim 6, characterized in that The N is 15 times, the T is 15 minutes; the coefficient a s and a l The average value is 1.6.

Images