A method for detecting abnormal network users based on behavioral intention constraints

Abstract

The present invention relates to an abnormal network user detection system based on behavioral intention constraints, and belongs to the field of network security technology. The present invention mainly analyzes the user's network malicious behavior intention, performs constraint detection on the associated attributes of a single user and a user group, network platform access connection behavior detection, network platform interactive trust index detection, network platform interactive active index detection, etc., through a multi-dimensional analysis and detection combining dynamic and static, timely discovers abnormal network behavior of a single user or user group, and improves the identification and detection of malicious network users.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an abnormal network user detection system based on behavior intention constraints. Background Art

[0002] With the popularization of network applications, the number of network platform users has increased exponentially, and forums and social media on network platforms have a large number of user groups. Among them, there are many network users who take advantage of the openness of network platforms to carry out related malicious operations, including spreading false information, stealing user privacy, etc., which seriously endangers the stability of user information security and Internet security. Therefore, it is particularly important to detect abnormal behavior of network users on network platforms. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is: how to design a network user anomaly detection system based on behavioral intention constraints in order to address the problem of malicious user information forgery and difficulty in identifying behavioral intentions in Internet network platforms.

[0005] (II) Technical solution

[0006] In order to solve the above technical problems, the present invention provides an abnormal network user detection system based on behavior intention constraint, comprising the following steps:

[0007] Step 1: Obtain the user's network role information, device / tool ​​information, and behavior action information;

[0008] Step 2: User attribute constraint detection: Extract the associated attribute information from the user's network behavior information, establish the constraint relationship of the associated attributes, and detect and analyze the associated attributes of single users and user groups to promptly discover abnormalities in user attribute information;

[0009] Step 3: Detection of network platform access connection behavior: Classify and count the information of the tools carried by users during network platform access, and analyze the information jump index and information homology to discover abnormal access behavior;

[0010] Step 4: Constraint analysis of the interactive trust index of the network platform: The constraint analysis of the interactive trust index of the network platform is to sample the interactive operation information of users in the network platform, and adopt different fitting functions at different stages to analyze whether the behavior action pattern of users in the network is a normal behavior pattern;

[0011] Step 5: Constraint analysis of user network behavior action activity index; the user network behavior action activity index is the user U in period T iThe comprehensive evaluation index of the network behavior action type, frequency, and duration is used to comprehensively calculate the user's network behavior action activity index. If the calculated value of the user's network behavior action activity index is between the preset upper and lower thresholds, it indicates that the user's network behavior is more compliant;

[0012] Step 6: User abnormal behavior intention assessment: Based on the results of steps 2 to 5, the abnormal situation of network users is calculated and assessed by integrating user identity, access behavior, and interactive operation information;

[0013] Step 7: Long-term monitoring and analysis of suspicious user networks: For the abnormal user network behaviors analyzed in steps 3, 4, 5, and 6, dynamically adjust the corresponding analysis parameters and thresholds according to the actual situation, and repeat steps 3 to 6 for long-term monitoring and analysis.

[0014] Preferably, in step 1, the role information, access connection information, and behavior action information of the user network are obtained through an API interface or a data crawler tool, which are represented by R, E, and A respectively;

[0015] R represents the user's identity information on the network, R = (name, sex, bir, address, nt, job, lan, hob), name represents name, sex represents gender, bir represents date of birth, address represents address, nt represents online time, job represents occupation, lan represents language, and hob represents hobbies;

[0016] E represents the information carried by the user during the access connection process of the network platform, E = (host, os, ie, ip), host represents the host, os represents the operating system, ie represents the browser, and ip represents the network address;

[0017] A represents the interactive operation information between the user and the network platform, A = (login, logout, like, follow, repost, browse, search, post, comment, add friend, join group).

[0018] Preferably, in step 2, constraint checks are performed on the associated attributes of a single user and on the same attribute information of multiple users, wherein the constraint check on the associated attributes of a single user analyzes whether there is inconsistency in the constraint relationship between the associated attributes; and the constraint check on the same attribute information of multiple users includes similarity detection and analysis of multi-user naming rules and naming content.

[0019] Preferably, the method for similarity detection and analysis of multi-user naming rules is as follows: by calculating the similarity of multiple user name attribute information to find possible malicious network users, detection and analysis are performed from two aspects: similarity of naming content and similarity of pattern:

[0020] ① User naming content similarity detection: i.name , Uj.name Convert to string str i , str j , assuming str i.length <str j.length , calculate str i with str j The similarity between them is calculated as follows:

[0021]

[0022] ② User naming pattern similarity detection: The characters in the user's name are divided into three categories: letters, numbers, and special characters, which are marked with Z, 0, and @ respectively. Consecutive characters of the same type are replaced with corresponding character marks, as follows:

[0023] wangluo145@163.com→Z0@0@Z,

[0024] Finally, a new string is formed and the similarity calculation method in ① is used;

[0025] Among them, dis is str i By adding, deleting, and modifying its own characters, it can achieve the same as str j If they are the same, the accumulated number of operations; the calculated similarity SR is assigned to the user U respectively i , U j , and the final similarity of each user is obtained by accumulating similarities.

[0026] Preferably, the method for checking the constraint of the associated attribute of a single user is as follows: normal users have certain correlation in the attribute information content, and can establish constraint rules for the attributes with associated relationships, that is, the value of one attribute will affect the selectable value of another attribute. The constraint rules between two associated attributes x and y can be expressed as:

[0027]

[0028] Rf(x) represents the range of values ​​of y corresponding to the value of attribute x;

[0029] During the detection and analysis process, multiple associated attribute constraint rules are established for the user. If the violation ratio of the constraint rule is higher than the threshold, r is 1, otherwise it is 0.

[0030] Preferably, in step 3, similarity calculation and analysis are performed on the information carried by a single user or multiple users during access to the network platform, and abnormal users are identified.

[0031] Preferably, step 3 is as follows:

[0032] Detection and analysis of information changes carried by a single user: Analyze user Ui In the change of all access connection information E, hash calculations are performed on host, os, ie, and ip information respectively. The category with the same host and os hash values ​​and different ie and ip hash values ​​and the highest proportion in all categories is recorded as E', and the others are divided into another category E", and the user-carried information change rate ρ is calculated:

[0033]

[0034] If ρ is greater than the information change threshold, ρ is assigned a value of 1, otherwise it is 0;

[0035] Multi-user information carrying detection and analysis: Calculate the two network users U i , U j The similarity of the information carried in the access connection process. The similarity calculation formula is as follows:

[0036]

[0037] Assign the calculated similarity SE to user U respectively i , U j .

[0038] Preferably, in step 4, different functions are used to fit the user network behavior action growth curve according to the user's network access time, and the time t and the network platform interaction index fc' are used as sampling data, wherein time is used as the horizontal coordinate and the action frequency is used as the vertical coordinate. A fitting function is selected to fit the curve between the behavior action trust index and time. According to the error between the sampling data and the fitting curve, it is judged whether the user network behavior belongs to malicious user network behavior. According to the interactive operation sequence in the user interactive operation set A, the trust index w is assigned to the network platform interactive action in sequence from high to low. i , and w i <w j (i <j);

[0039]

[0040] f i For user U i The behavior of A i The frequency of the corresponding behavior action is used to fit the calculated discrete data fc' and t using the least squares method to form a continuous function relationship between fc and t. The output formula after fitting the curve is as follows:

[0041] 1) If user U i The online time t is less than 30 days, and a logarithmic curve is selected for fitting. The output formula after fitting the curve is:

[0042] fc=aln(t)+b

[0043] 2) If user U i The network access time t≥30 days, the user's behavior in the network tends to be stable, and a linear curve is selected for fitting. The output formula after fitting the curve is:

[0044] fc=a*t+b

[0045] In the two cases of 1) and 2), the following steps are performed respectively: the values ​​of a and b parameters are automatically determined during the curve fitting process, and the minimum Euler distance after curve fitting is recorded as

[0046] Preferably, in step 5, the low threshold of the trust index of all user network behavior actions is set to lc, and the high threshold is set to hc, and the trust index of user U is calculated within a period T. i The activity index of all actions is accumulated, using acount i Indicates that acount i =∑f i ;

[0047] 1) User U i .t≥7, if the user's network behavior actions only include the first five types of network behavior actions in set A, it is judged as abnormal user network behavior, and λ is assigned a value of 1, otherwise it is 0.

[0048] 2) If acount i <lc or acount i >hc, then λ is assigned the value of 1, otherwise it is 0.

[0049] Only when the values ​​of λ in 1) and 2) are both 0, the final value of λ is 0, otherwise it is 1.

[0050] Preferably, in step 6, the network user U is evaluated i The calculation formula for abnormal behavior intention is as follows:

[0051]

[0052] The larger the SU(R, E, B) value is, the higher the user's abnormal behavior intention is.

[0053] (III) Beneficial effects

[0054] The present invention mainly analyzes the user's intention of malicious network behavior, performs constraint detection on the associated attributes of single users and user groups, network platform access connection behavior detection, network platform interactive trust index detection, network platform interactive activity index detection, etc. Through multi-dimensional analysis and detection combining dynamic and static, abnormal network behavior of single users or user groups can be discovered in time, thereby improving the identification and detection of malicious network users. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is a flow chart of the method of the present invention;

[0056] Figure 2 This is a schematic diagram of the attribute value range constraints. DETAILED DESCRIPTION

[0057] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0058] Aiming at the problem that malicious user information forgery and behavioral intentions are difficult to identify in the Internet network platform, the present invention designs a network user anomaly detection system based on behavioral intention constraints. The network user identity information and behavior information are obtained through a network data acquisition device or tool, including user network identity information, network platform access connection information, interactive operation information, etc. By extracting the key elements in the user's network role information, analyzing the similarity of the same attribute content and detecting the constraint relationship between multiple attributes, it is determined whether the user's network identity information is suspicious or abnormal. Secondly, the host, operating system, browser and other information carried by the user during the network access process are detected and analyzed to determine whether the user has malicious network behaviors such as homology and jump during the network access connection process. Thirdly, the user's behavior trust index and activity index in the network are analyzed to determine whether the user's network behavior has malicious intentions. Finally, by comprehensively calculating the suspicious situation of the user in terms of identity and behavior, it is determined whether it is an abnormal network user.

[0059] refer to Figure 1 The present invention provides a method for detecting abnormal behavior of network users under multiple constraints, comprising the following steps:

[0060] Step 1: Obtain user network behavior information and extract key elements. Obtain user network behavior information through API interfaces, cookies, and network platforms, including user network role information, device / tool ​​information, behavior action information, etc.

[0061] Specifically, the user network role information, access connection information, behavior action information, etc. are obtained through the API interface or data crawling tools, which are represented by R, E, and A respectively.

[0062] R represents the user's identity information on the Internet, R = (name, sex, bir, address, nt, job, lan, hob), name represents name, sex represents gender, bir represents date of birth, address represents address, nt represents online time, job represents occupation, lan represents language, and hob represents hobbies.

[0063] E represents the information carried by the user during the access connection process of the network platform, E = (host, os, ie, ip), host represents the host, os represents the operating system, ie represents the browser, and ip represents the network address.

[0064] A represents the interactive operation information between the user and the network platform, A = (login, logout, like, follow, repost, browse, search, post, comment, add friend, join group).

[0065] Step 2: User attribute constraint detection. Extract the associated attribute information from the user behavior information, establish the constraint rules of the associated attributes, and detect and analyze the associated attributes of single users and user groups (including the consistency of associated attribute information, the similarity of the same attribute content, etc.) to promptly detect abnormalities in user attribute information.

[0066] Malicious network users usually falsify identity information. In this step, constraints are checked for the associated attributes of a single user and the same attribute information of multiple users. The constraint check for the same attribute information of multiple users mainly includes similarity detection and analysis such as naming rules and naming content. The constraint check for the associated attributes of a single user mainly analyzes whether there is inconsistency in the constraint relationship between the associated attributes.

[0067] 1) User name similarity detection and analysis. By calculating the similarity of multiple user name attribute information, possible malicious network users can be found. The detection and analysis are mainly based on the similarity of naming content and pattern.

[0068] ① User naming content similarity detection: i.name , U j.name Convert to string str i , str j , assuming str i.length <str j.length , calculate str i with str j The similarity between them is calculated as follows:

[0069]

[0070] ② User naming pattern similarity detection: The characters in the user's name are divided into three categories: letters (a-z, A-Z), numbers (0-9), and special characters (such as @, ~, ', ^, etc.), which are marked with Z, 0, and @ respectively. Consecutive characters of the same type are replaced with corresponding character marks, as shown below:

[0071] wangluo145@163.com→Z0@0@Z,

[0072] Finally, a new string is formed and the similarity calculation method in ① is used.

[0073] Among them, dis is str i By adding, deleting, and modifying its own characters, it can achieve the same as str j If they are the same, the accumulated number of operations. The calculated similarity SR is assigned to the user U i , U j , and the final similarity of each user is obtained by accumulating similarities.

[0074] 2) User-related attribute constraint detection. Normal users have certain correlations in attribute information content. Constraint rules can be established for attributes with association relationships, that is, the value of one attribute will affect the selectable value of another attribute. The constraint rules between two associated attributes x and y can be expressed as:

[0075]

[0076] Rf(x) represents the value range of y corresponding to the value of attribute x. The attribute constraint relationship diagram is as follows: Figure 2 shown.

[0077] During the detection and analysis process, multiple associated attribute constraint rules can be established for the user. If the violation ratio of the constraint rule is higher than the threshold, r is 1, otherwise it is 0.

[0078] Step 3: Detection of network platform access connection behavior. Classify, count and analyze the detailed information carried by users during network platform access, and discover abnormal access behaviors by analyzing changes in user access connection information and similarity of information sources.

[0079] During the process of accessing the network platform, users will carry host information, operating system information, browser information, network information, etc. Detailed information includes host CPU, graphics card, screen resolution, operating system name, version, font, browser name, version, plug-in, network IP, time zone, etc. During the process of accessing the network platform, the host information and operating system information of normal users are relatively fixed, but the information carried by network information, browser information, etc. is quite different. However, abnormal users are often restricted by resources and environment, and there are situations where resources such as hosts and browsers are shared. The relevant information carried during the access to the network platform has relatively similar or even identical content. In this step, the information carried by single users and multiple users during the access to the network platform is similarly calculated, analyzed, and abnormal users are identified.

[0080] 1) Detection and analysis of information changes carried by a single user. Analysis of user U iIn the changes of all access connection information E, hash calculations are performed on host, os, ie, ip and other information respectively. The category with the same host and os hash values ​​and different ie and ip hash values ​​and the highest proportion in all categories is recorded as E', and the others are divided into another category E", and the change rate of user-carried information ρ is calculated:

[0081]

[0082] If ρ is greater than the information change threshold, ρ is assigned a value of 1, otherwise it is 0.

[0083] 2) Detection and analysis of multi-user information. Calculate the information of two network users U i , U j The similarity of the information carried in the access connection process is calculated as follows:

[0084]

[0085] 3) Assign the calculated similarity SE to user U i , U j .

[0086] Step 4: Constraint analysis of the interactive trust index of the network platform. The constraint analysis of the interactive trust index of the network platform mainly samples the interactive operation information of users in the network platform, and according to the normal interaction mode, at different stages, fits the curve according to the collected discrete operation information to form a fitting function, and analyzes whether the user's behavior action mode in the network is a normal behavior mode through the fitting curve.

[0087] The user network platform interaction trust index mainly analyzes whether the user's behavior action pattern on the network conforms to normal user behavior. According to the length of time the user has been online, different functions are used to fit the user's network behavior action growth curve. Time t and network platform interaction index fc' are used as sampling data, where time is used as the horizontal axis and the action frequency is used as the vertical axis. The fitting function is selected to fit the curve between the behavior action trust index and time. According to the error between the sampling data and the fitting curve, it is judged whether the user's network behavior belongs to malicious user network behavior. According to the order of interactive operations in the user interactive operation set A, the trust index w is assigned to the network platform interactive actions in turn from high to low. i , and w i <w j (i <j)。

[0088]

[0089] f i For user U i The behavior of A iThe frequency of the corresponding behavior action is used to fit the calculated discrete data fc' and t using the least squares method to form a continuous function relationship between fc and t. The output formula after fitting the curve is as follows:

[0090] 1) If user U i The online time t is less than 30 days, and a logarithmic curve is selected for fitting. The output formula after fitting the curve is:

[0091] fc=aln(t)+b

[0092] 2) If user U i The network access time t≥30 days, the user's behavior in the network tends to be stable, and a linear curve is selected for fitting. The output formula after fitting the curve is:

[0093] fc=a*t+b

[0094] In the two cases of 1) and 2), the following steps are performed respectively: the values ​​of a and b parameters are automatically determined during the curve fitting process, and the minimum Euler distance after curve fitting is recorded as

[0095] Step 5: Constraint analysis of user network behavior action activity index. The user network behavior action activity index is the number of users U in period T. i The comprehensive evaluation index of the network behavior action type, frequency, duration, etc. of the user is calculated comprehensively. If the calculated value of the user's network behavior action activity index is between the preset upper and lower thresholds, it indicates that the user's network behavior is more compliant. Set the low threshold of the trust index of all user network behavior actions to lc and the high threshold to hc. i The activity index of all actions is accumulated, using acount i Indicates that acount i =∑f i .

[0096] 1) User U i .t≥7, if the user's network behavior actions only include the first five types of network behavior actions in set A, it is judged as abnormal user network behavior, and λ is assigned a value of 1, otherwise it is 0.

[0097] 2) If acount i <lc or acount i >hc, then λ is assigned the value of 1, otherwise it is 0.

[0098] Only when the values ​​of λ in 1) and 2) are both 0, the final value of λ is 0, otherwise it is 1.

[0099] Step 6: User abnormal behavior intention assessment: Based on the results of steps 2 to 5, the abnormal situation of network users is calculated and assessed by combining information such as user identity, access behavior, and interactive operations.

[0100] In this step, the network user U is evaluated i The calculation formula for abnormal behavior intention is as follows:

[0101]

[0102] The larger the SU(R, E, B) value is, the higher the user's abnormal behavior intention is.

[0103] Step 7: Long-term monitoring and analysis of suspicious user networks. For abnormal user network behaviors analyzed in steps 3, 4, 5, and 6, dynamically adjust the corresponding analysis parameters and thresholds according to the actual situation, and repeat steps 3 to 6 for long-term monitoring and analysis.

[0104] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting abnormal network users based on behavioral intention constraints, characterized in that: The following steps are involved: Step 1: Obtain the user's network role information, device / tool ​​information, and behavior action information; Step 2: User attribute constraint detection: Extract the associated attribute information from the user's network behavior information, establish the constraint relationship of the associated attributes, and detect and analyze the associated attributes of single users and user groups to promptly discover abnormalities in user attribute information; Step 3: Detection of network platform access connection behavior: Classify and count the information of the tools carried by users during network platform access, and analyze the information jump index and information homology to discover abnormal access behavior; Step 4: Constraint analysis of the interactive trust index of the network platform: The constraint analysis of the interactive trust index of the network platform is to sample the interactive operation information of users in the network platform, and adopt different fitting functions at different stages to analyze whether the behavior action pattern of users in the network is a normal behavior pattern; Step 5: Constraint analysis of user network behavior action activity index; the user network behavior action activity index is the user U in period T i The comprehensive evaluation index of the network behavior action type, frequency, and duration is used to comprehensively calculate the user's network behavior action activity index. If the calculated value of the user's network behavior action activity index is between the preset upper and lower thresholds, it indicates that the user's network behavior is more compliant; Step 6: User abnormal behavior intention assessment: Based on the results of steps 2 to 5, the abnormal situation of network users is calculated and assessed by integrating user identity, access behavior, and interactive operation information; Step 7: Long-term monitoring and analysis of suspicious user networks: For the abnormal user network behaviors analyzed in steps 3, 4, 5, and 6, dynamically adjust the corresponding analysis parameters and thresholds according to the actual situation, and repeat steps 3 to 6 for long-term monitoring and analysis; In step 1, the user's identity information in the network, the information carried by the user during the access connection process of the network platform, and the interactive operation information between the user and the network platform are obtained through the API interface or data crawling tools, which are represented by R, E, and A respectively; R = (name, sex, bir, address, nt, job, lan, hob), where name indicates name, sex indicates gender, bir indicates date of birth, address indicates address, nt indicates time online, job indicates occupation, lan indicates language, and hob indicates hobbies; E = (host, os, ie, ip), where host represents the host, os represents the operating system, ie represents the browser, and ip represents the network address; A=(login, logout, like, follow, repost, browse, search, post, comment, add friend, join group); In step 2, constraint checks are performed on the associated attributes of a single user and on the same attribute information of multiple users, wherein the constraint check of the associated attributes of a single user analyzes whether there is inconsistency in the constraint relationship between the associated attributes; the constraint check of the same attribute information of multiple users includes similarity detection and analysis of multi-user naming rules and naming contents; The method for similarity detection and analysis of multi-user naming rules is as follows: by calculating the similarity of multiple user name attribute information to find possible malicious network users, detection and analysis are performed from two aspects: naming content similarity and pattern similarity: ① User naming content similarity detection: i.name , U j.name Convert to string str i , str j , assuming str i.length <str j.length , calculate str i with str j The similarity between them is calculated as follows: ② User naming pattern similarity detection: The characters in the user's name are divided into three categories: letters, numbers, and special characters, which are marked with Z, 0, and @ respectively. Consecutive characters of the same type are replaced with corresponding character marks. Finally, a new string is formed and the similarity calculation method in ① is used; Among them, dis is str i By adding, deleting, and modifying its own characters, it can achieve the same as str j If they are the same, the accumulated number of operations; the calculated similarity SR is assigned to the user U respectively i , U j , and the final similarity of each user is obtained by accumulating similarities; The method for checking the constraints of the associated attributes of a single user is as follows: Normal users have certain correlations in the content of attribute information, and can establish constraint rules for attributes with associated relationships, that is, the value of one attribute will affect the selectable value of another attribute. The constraint rules between two associated attributes x and y can be expressed as: Rf(x) represents the range of values ​​of y corresponding to the value of attribute x; During the detection and analysis process, multiple associated attribute constraint rules are established for the user. If the violation ratio of the constraint rule is higher than the threshold, r is 1, otherwise it is 0; In step 3, similarity calculation and analysis are performed on the information carried by a single user or multiple users during access to the network platform, and abnormal users are identified; Step 3 is as follows: Detection and analysis of information changes carried by a single user: Analyze user U i In the change of all access connection information E, hash calculations are performed on host, os, ie, and ip information respectively. The category with the same host and os hash values ​​and different ie and ip hash values ​​and the highest proportion in all categories is recorded as E', and the others are divided into another category E", and the user-carried information change rate ρ is calculated: If ρ is greater than the information change threshold, ρ is assigned a value of 1, otherwise it is 0; Multi-user information carrying detection and analysis: Calculate the two network users U i , U j The similarity of the information carried in the access connection process. The similarity calculation formula is as follows: Assign the calculated similarity SE to user U respectively i , U j ; In step 4, different functions are used to fit the user network behavior action growth curve according to the user's network access time. The time t and the network platform interaction index fc' are used as sampling data, where time is used as the horizontal axis and the action frequency is used as the vertical axis. The fitting function is selected to fit the curve between the behavior action trust index and time. According to the error between the sampling data and the fitting curve, it is judged whether the user's network behavior belongs to malicious user network behavior. According to the interactive operation sequence in the user interactive operation set A, the trust index w is assigned to the network platform interactive action in turn from high to low. i , and w i <w j (i <j); f i For user U i The behavior of A i The frequency of the corresponding behavior action is used to fit the calculated discrete data fc' and t using the least squares method to form a continuous function relationship between fc and t. The output formula after fitting the curve is as follows: 1) If user U i The online time t is less than 30 days, and a logarithmic curve is selected for fitting. The output formula after fitting the curve is: fc=aln(t)+b 2) If user U i The network access time t≥30 days, the user's behavior in the network tends to be stable, and a linear curve is selected for fitting. The output formula after fitting the curve is: fc=a*t+b In the two cases of 1) and 2), the following steps are performed respectively: the values ​​of a and b parameters are automatically determined during the curve fitting process, and the minimum Euler distance after curve fitting is recorded as 2. The method according to claim 1, characterized in that In step 5, the lower threshold of the trust index of all user network behavior actions is set to lc, and the upper threshold is set to hc. i The activity index of all actions is accumulated, using acount i Indicates that acount i =∑f i ; 1) User U i .t≥7, the user's network behavior actions only include the first five types of network behavior actions in set A, then it is judged as abnormal user network behavior, and λ is assigned a value of 1, otherwise it is 0; 2) If acount i <lc or acount i >hc, then λ is assigned the value of 1, otherwise it is 0; Only when the values ​​of λ in 1) and 2) are both 0, the final value of λ is 0, otherwise it is 1.

Images