Operation behavior detection method, device, equipment and storage medium

Abstract

The present application discloses a method, device, equipment and storage medium for detecting operation behavior. The method includes: for the current operation behavior of the target user on the target data, obtaining the behavior information of multiple operation behaviors before the current operation behavior, and the data information of multiple specified type data corresponding to the multiple operation behaviors; then performing feature extraction to obtain the first feature vector of each of the multiple specified type data and the second feature vector of each of the multiple operation behaviors; based on the first feature vector and the second feature vector, performing cluster analysis on the multiple operation behaviors to obtain the cluster categories corresponding to each of the multiple operation behaviors; based on the cluster categories corresponding to each of the multiple operation behaviors, performing probability prediction on the multiple operation behaviors to obtain the predicted probability value of the operation behavior with the same behavior type as the current operation behavior among the multiple operation behaviors; based on the predicted probability value of the current operation behavior and the preset probability threshold, determining the detection result of the current operation behavior.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for detecting operation behavior. Background Art

[0002] In the scenario of interconnection and digital transformation, massive amounts of user personal data are collected, stored and used on the Internet at all times. Operations that infringe on user personal data also show characteristics of diversity, concealment and complexity, which pose huge challenges to supervision.

[0003] With the development of technologies such as mobile Internet and cloud computing, a large amount of data such as text, pictures, and videos are being spread and shared on the Internet, which has also brought about serious problems of user personal data leakage. Current research on user personal data supervision mainly focuses on the detection and discovery of user personal data within a single modality such as pictures, texts, and videos, and lacks the ability to supervise user personal data within multiple modalities.

[0004] At the same time, the traditional supervision method is based on pre-configured infringement rules, and directly matches the rules one by one for the operations that infringe on the user's personal data. In scenarios where there are many infringement rules, the operations that infringe on the user's personal data are frequent, and the amount of data is large, the detection efficiency of the operations that infringe on the user's personal data is low, and it is difficult to adapt to the needs of rapid identification and supervision of operations that infringe on the user's personal data across industries and formats. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, device and storage medium for detecting operation behaviors, which are used to solve the problem of low efficiency in detecting operation behaviors that infringe user personal data, based on pre-configured infringement rules, directly performing one-to-one rule matching on operation behaviors that infringe user personal data, in scenarios where there are many infringement rules, operation behaviors that infringe user personal data are frequent, and the amount of data is large.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting an operation behavior, the method comprising:

[0007] For a current operation behavior of a target user on target data, obtain behavior information of multiple operation behaviors before the current operation behavior, and data information of multiple specified types of data corresponding to the multiple operation behaviors; the multiple specified types of data include the target data;

[0008] Performing feature extraction on the data information of the plurality of designated types of data respectively to obtain first feature vectors of the plurality of designated types of data respectively;

[0009] Extracting features from the behavior information of the multiple operation behaviors respectively to obtain second feature vectors of the multiple operation behaviors;

[0010] Based on the first feature vector and the second feature vector, cluster analysis is performed on the multiple operation behaviors to obtain cluster categories corresponding to the multiple operation behaviors;

[0011] Based on the cluster categories corresponding to the multiple operation behaviors, respectively, probability prediction is performed on the multiple operation behaviors to obtain prediction probability values ​​corresponding to the multiple operation behaviors respectively;

[0012] Determining the predicted probability value of the current operation behavior according to the predicted probability values ​​of the same type of operation behaviors; the same type of operation behavior refers to an operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors;

[0013] Based on the predicted probability value of the current operation behavior and a preset probability threshold, a detection result of the current operation behavior is determined.

[0014] In some embodiments, the extracting features of the data information of the plurality of specified types of data respectively to obtain first feature vectors of the plurality of specified types of data respectively includes:

[0015] The data information of the multiple specified types of data are respectively input into a pre-trained multimodal classification model to obtain the first feature vectors of the data information of the multiple specified types of data; each first feature vector is used to characterize the data type of the corresponding specified type of data.

[0016] In some embodiments, the training process of the multimodal classification model is as follows:

[0017] Acquire data information of a plurality of sample data and labeling information corresponding to the plurality of sample data; each labeling information is used to characterize a target data type of the corresponding sample data;

[0018] Inputting data information of the plurality of sample data into a multimodal classification model to be trained to obtain reference data types of the plurality of sample data;

[0019] Based on the gap between the reference data type and the target data type, the parameter information of the multimodal classification model to be trained is adjusted until the reference data type and the target data type are the same, thereby obtaining a trained multimodal classification model.

[0020] In some embodiments, the performing probability prediction on the multiple operation behaviors based on the cluster categories corresponding to the multiple operation behaviors to obtain the prediction probability values ​​corresponding to the multiple operation behaviors includes:

[0021] Based on the cluster categories corresponding to the multiple operation behaviors and the preset correspondence between the cluster categories and the cluster numbers, determine the cluster numbers corresponding to the multiple operation behaviors; the cluster numbers represent multiple operation behaviors of the same cluster category;

[0022] According to the operation time of the multiple operation behaviors, the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple specified types of data are sorted to obtain an operation behavior sequence corresponding to the multiple specified types of data; the operation behavior sequence includes the multiple operation behaviors corresponding to each specified type of data and the cluster numbers corresponding to the multiple operation behaviors;

[0023] The operation behavior sequences corresponding to the multiple specified type data are input into a pre-trained probabilistic suffix tree model, and probability prediction is performed on the multiple operation behaviors to obtain prediction probability values ​​corresponding to each of the multiple operation behaviors.

[0024] In some embodiments, the training process of the probabilistic suffix tree model is as follows:

[0025] Acquire multiple operation behavior sequences corresponding to multiple sample data; the operation behavior sequences are obtained by sorting the cluster numbers corresponding to the multiple operation behaviors according to the operation time of the multiple operation behaviors of each sample data;

[0026] The operation behavior sequences corresponding to the multiple sample data are input into the probabilistic suffix tree model to be trained, and the target probability values ​​corresponding to each of the multiple operation behaviors are determined according to the operation order of the multiple operation behaviors and the occurrence frequency of the multiple operation behaviors in the multiple operation behavior sequences, so as to obtain a trained probabilistic suffix tree model.

[0027] In some embodiments, determining the detection result of the current operation behavior based on the predicted probability value of the current operation behavior and a preset probability threshold includes:

[0028] If the predicted probability value of the current operation behavior is less than the preset probability threshold, determining that the detection result of the current operation behavior is an abnormal operation behavior;

[0029] If the predicted probability value of the current operation behavior is not less than the preset probability threshold, it is determined that the detection result of the current operation behavior is a normal operation behavior.

[0030] In some embodiments, the method further comprises:

[0031] If the detection result of the current operation behavior is an abnormal operation behavior, the infringement result of the current operation behavior is determined according to the preset infringement rules.

[0032] In some embodiments, determining the infringement result of the current operation behavior according to a preset infringement rule includes:

[0033] Acquire the number of abnormal operation behaviors among multiple operation behaviors of the target user on the target data within a preset time period; the multiple operation behaviors include the current operation behavior;

[0034] If the number of abnormal operation behaviors is greater than a preset number threshold, each abnormal operation behavior is matched with the preset infringement rule to determine the infringement result of each abnormal operation behavior;

[0035] If the number of the abnormal operation behaviors is not greater than the preset number threshold, each abnormal operation behavior will not be matched with the preset infringement rule until the number of the abnormal operation behaviors is greater than the preset number threshold.

[0036] In a second aspect, an embodiment of the present application provides a device for detecting an operation behavior, the device comprising:

[0037] an acquisition module, configured to acquire, based on a current operation behavior of a target user on target data, behavior information of multiple operation behaviors before the current operation behavior, and data information of multiple specified types of data corresponding to the multiple operation behaviors; the multiple specified types of data include the target data;

[0038] A first feature extraction module, used to extract features from the data information of the plurality of specified types of data respectively, to obtain first feature vectors of the plurality of specified types of data respectively;

[0039] A second feature extraction module is used to extract features from the behavior information of the multiple operation behaviors respectively to obtain second feature vectors of the multiple operation behaviors respectively;

[0040] A clustering module, configured to perform cluster analysis on the plurality of operation behaviors based on the first feature vector and the second feature vector to obtain cluster categories corresponding to the plurality of operation behaviors;

[0041] A probability prediction module, configured to perform probability prediction on the multiple operation behaviors based on the cluster categories corresponding to the multiple operation behaviors, and obtain prediction probability values ​​corresponding to the multiple operation behaviors;

[0042] A probability determination module, used to determine the predicted probability value of the current operation behavior according to the predicted probability values ​​of the same type of operation behaviors; the same type of operation behavior refers to the operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors;

[0043] The detection module is used to determine the detection result of the current operation behavior based on the predicted probability value of the current operation behavior and a preset probability threshold.

[0044] In some embodiments, the first feature extraction module is specifically used to:

[0045] The data information of the multiple specified types of data are respectively input into a pre-trained multimodal classification model to obtain the first feature vectors of the data information of the multiple specified types of data; each first feature vector is used to characterize the data type of the corresponding specified type of data.

[0046] In some embodiments, the apparatus further comprises a first training module; the first training module is used to train a multimodal classification model;

[0047] The training process of the multimodal classification model is as follows:

[0048] Acquire data information of a plurality of sample data and labeling information corresponding to the plurality of sample data; each labeling information is used to characterize a target data type of the corresponding sample data;

[0049] Inputting data information of the plurality of sample data into a multimodal classification model to be trained to obtain reference data types of the plurality of sample data;

[0050] Based on the gap between the reference data type and the target data type, the parameter information of the multimodal classification model to be trained is adjusted until the reference data type and the target data type are the same, thereby obtaining a trained multimodal classification model.

[0051] In some embodiments, the probability prediction module is specifically used to:

[0052] Based on the cluster categories corresponding to the multiple operation behaviors and the preset correspondence between the cluster categories and the cluster numbers, determine the cluster numbers corresponding to the multiple operation behaviors; the cluster numbers represent multiple operation behaviors of the same cluster category;

[0053] According to the operation time of the multiple operation behaviors, the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple specified types of data are sorted to obtain an operation behavior sequence corresponding to the multiple specified types of data; the operation behavior sequence includes the multiple operation behaviors corresponding to each specified type of data and the cluster numbers corresponding to the multiple operation behaviors;

[0054] The operation behavior sequences corresponding to the multiple specified type data are input into a pre-trained probabilistic suffix tree model, and probability prediction is performed on the multiple operation behaviors to obtain prediction probability values ​​corresponding to each of the multiple operation behaviors.

[0055] In some embodiments, the apparatus further comprises a second training module; the second training module is used to train a probabilistic suffix tree model;

[0056] The training process of the probabilistic suffix tree model is as follows:

[0057] Acquire multiple operation behavior sequences corresponding to multiple sample data; the operation behavior sequences are obtained by sorting the cluster numbers corresponding to the multiple operation behaviors according to the operation time of the multiple operation behaviors of each sample data;

[0058] The operation behavior sequences corresponding to the multiple sample data are input into the probabilistic suffix tree model to be trained, and the target probability values ​​corresponding to each of the multiple operation behaviors are determined according to the operation order of the multiple operation behaviors and the occurrence frequency of the multiple operation behaviors in the multiple operation behavior sequences, so as to obtain a trained probabilistic suffix tree model.

[0059] In some embodiments, the detection module is specifically used to:

[0060] If the predicted probability value of the current operation behavior is less than the preset probability threshold, determining that the detection result of the current operation behavior is an abnormal operation behavior;

[0061] If the predicted probability value of the current operation behavior is not less than the preset probability threshold, it is determined that the detection result of the current operation behavior is a normal operation behavior.

[0062] In some embodiments, the apparatus further comprises an infringement module;

[0063] The infringement module is used to determine the infringement result of the current operation behavior according to a preset infringement rule if the detection result of the current operation behavior is an abnormal operation behavior.

[0064] In some embodiments, the infringement module is specifically used to:

[0065] Acquire the number of abnormal operation behaviors among multiple operation behaviors of the target user on the target data within a preset time period; the multiple operation behaviors include the current operation behavior;

[0066] If the number of abnormal operation behaviors is greater than a preset number threshold, each abnormal operation behavior is matched with the preset infringement rule to determine the infringement result of each abnormal operation behavior;

[0067] If the number of the abnormal operation behaviors is not greater than the preset number threshold, each abnormal operation behavior will not be matched with the preset infringement rule until the number of the abnormal operation behaviors is greater than the preset number threshold.

[0068] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0069] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the above-mentioned operation behavior detection method.

[0070] In a fourth aspect, an embodiment of the present application provides a storage medium. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can perform the above-mentioned method for detecting the operation behavior.

[0071] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is executed by an electronic device, the electronic device can implement the above-mentioned operation behavior detection method provided in the present application.

[0072] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0073] In an embodiment of the present application, with respect to the current operation behavior of the target user on the target data, behavior information of multiple operation behaviors before the current operation behavior and data information of multiple specified types of data corresponding to the multiple operation behaviors are obtained; then feature extraction is performed to obtain a first feature vector of each of the multiple specified types of data and a second feature vector of each of the multiple operation behaviors; based on the first feature vector and the second feature vector, a cluster analysis is performed on the multiple operation behaviors to obtain cluster categories corresponding to each of the multiple operation behaviors; based on the cluster categories corresponding to each of the multiple operation behaviors, a probability prediction is performed on the multiple operation behaviors to obtain a predicted probability value of an operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors; based on the predicted probability value of the current operation behavior and a preset probability threshold, a detection result of the current operation behavior is determined.

[0074] Therefore, the clustering results of the first eigenvector and the second eigenvector are used as the symbol sequence construction model of the probabilistic suffix tree, and a new method for constructing the probabilistic suffix tree symbol system is proposed. The characteristics of the specified type of data and the multi-dimensional feature vectors of the operation behavior are integrated, which can greatly improve the accuracy and efficiency of the detection results of the operation behavior and enhance the supervision ability of user personal data in multimodality.

[0075] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0077] Figure 1 A flowchart of a method for detecting an operation behavior provided in an embodiment of the present application;

[0078] Figure 2 A schematic diagram of behavior information of multiple operation behaviors of a specified type of data provided in an embodiment of the present application;

[0079] Figure 3 A flowchart of a training process of a multimodal classification model provided in an embodiment of the present application;

[0080] Figure 4 A flowchart of a method for predicting predicted probability values ​​corresponding to a plurality of operation behaviors provided in an embodiment of the present application;

[0081] Figure 5 A flowchart of a training process of a probabilistic suffix tree model provided in an embodiment of the present application;

[0082] Figure 6 A schematic diagram of a probabilistic suffix tree model provided in an embodiment of the present application;

[0083] Figure 7 A schematic diagram of clustering and numbering multiple operation behaviors provided in an embodiment of the present application;

[0084] Figure 8 A schematic diagram of the structure of an operation behavior detection device provided in an embodiment of the present application;

[0085] Fig. 9 A schematic diagram of the structure of another operation behavior detection device provided in an embodiment of the present application;

[0086] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0087] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0088] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0089] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more.

[0090] In order to facilitate the understanding of this application, the technical terms involved in this application are:

[0091] BERT (Bidirectional Encoder Representations from Transformers): is a pre-trained language model that completes the task of representing words.

[0092] KMeans (K means, K mean): Kmeans algorithm is an iterative cluster analysis algorithm. Given a set of data points and the required number of clusters k, k is specified by the user. KMeans algorithm repeatedly divides the data into k clusters according to a distance function.

[0093] UNITER (UNiversal Image-TExt Representation Learning): is a multimodal pre-trained model that can meet cross-modal downstream tasks of vision and text in most cases.

[0094] ViLT (Vision-and-Language Transformer): is a concise single-stream multimodal Transformer model. The processing of visual input is greatly simplified to a convolution-free way. It is faster and has better performance than traditional models based on object detection and convolution.

[0095] Word2Vec (Word to Vector): is a related model used to generate word vectors. The model is a shallow neural network that can be used to map each word to a vector through training to represent the relationship between words.

[0096] In the scenario of interconnection and digital transformation, massive amounts of user personal data are collected, stored and used on the Internet at all times. Operations that infringe on user personal data also show characteristics of diversity, concealment and complexity, which pose huge challenges to supervision.

[0097] With the development of technologies such as mobile Internet and cloud computing, a large amount of data such as text, pictures, and videos are being spread and shared on the Internet, which also brings about serious problems of user personal data leakage.

[0098] Current research on user personal data supervision mainly focuses on the detection and discovery of user personal data within a single modality, such as images, texts, and videos, and lacks the ability to supervise user personal data within multiple modalities.

[0099] At the same time, traditional regulatory methods are based on pre-configured infringement rules, which directly match rules one by one for operational behaviors that infringe on users' personal data.

[0100] In scenarios where there are many infringement rules, operations that infringe on users' personal data are frequent, and the amount of data is large, traditional regulatory methods have low detection efficiency for operations that infringe on users' personal data, and are difficult to adapt to the needs of rapid identification and supervision of operations that infringe on users' personal data across industries and formats.

[0101] In view of this, the embodiments of the present application provide a method, apparatus, device and storage medium for detecting operation behaviors, which are used to solve the problem of low efficiency in detecting operation behaviors that infringe user personal data based on pre-configured infringement rules, directly performing one-to-one rule matching on operation behaviors that infringe user personal data, in scenarios where there are many infringement rules, operation behaviors that infringe user personal data are frequent, and the amount of data is large.

[0102] The inventive concept of the embodiment of the present application: In the embodiment of the present application, with respect to the current operation behavior of the target user on the target data, the behavior information of multiple operation behaviors before the current operation behavior and the data information of multiple specified type data corresponding to the multiple operation behaviors are obtained; then feature extraction is performed to obtain the first feature vector of each of the multiple specified type data and the second feature vector of each of the multiple operation behaviors; based on the first feature vector and the second feature vector, the multiple operation behaviors are clustered and analyzed to obtain the cluster categories corresponding to each of the multiple operation behaviors; based on the cluster categories corresponding to each of the multiple operation behaviors, the multiple operation behaviors are probability predicted to obtain the predicted probability value of the operation behavior with the same behavior type as the current operation behavior among the multiple operation behaviors; based on the predicted probability value of the current operation behavior and the preset probability threshold, the detection result of the current operation behavior is determined.

[0103] In this application, regulatory information evidence data of specified types of data is used to cluster the multidimensional vector composed of behavioral information (operation behavior data vector, scenario coding, operation behavior coding, operation device / IP / system coding, operation status, etc.) of normal operation behaviors for specified types of data to obtain cluster categories corresponding to each operation behavior; the operation behaviors for specified types of data are re-encoded into behavior sequences using cluster codes of corresponding cluster categories, and a probabilistic suffix tree model is trained to predict the probability of the current operation behavior. The current operation behavior with a probability lower than a preset probability threshold is then matched with the preset infringement rules to identify the infringement behavior.

[0104] This method integrates the attribute information of a single operation behavior of a specified type of data and the causal relationship between multiple operation behaviors. It can solve the efficiency problem of matching the operation behavior of massive specified type of data with preset infringement rules under the premise of high recognition rate.

[0105] This application can be used in designated data infringement supervision and enterprise operation and maintenance scenarios to quickly discover abnormal operating behaviors in massive designated data operations, and then locate infringement incidents.

[0106] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiment of the present application.

[0107] See also Figure 1 , is a flow chart of a method for detecting an operation behavior provided in an embodiment of the present application. The method includes: Figure 1 Steps shown:

[0108] In step 101, for the current operation behavior of the target user on the target data, behavior information of multiple operation behaviors before the current operation behavior and data information of multiple specified types of data corresponding to the multiple operation behaviors are obtained; the multiple specified types of data include the target data.

[0109] During specific implementation, behavioral information of multiple operation behaviors before the current operation behavior and data information of multiple specified types of data corresponding to the multiple operation behaviors are collected from the regulatory information evidence data.

[0110] Among them, the behavioral information of the operation behavior includes the content of the specified type of data corresponding to the operation behavior, the role code of the operating user, the usage scenario code, the code for controlling the operation behavior, the code for propagating the operation behavior, the algorithm code, the device / IP / system code, the operation frequency, the operation result status code, etc., which can be increased or decreased according to the application scenario, and the embodiments of the present application do not limit this.

[0111] Among them, the data information of the specified type of data in this application refers to the data information of the user's personal data, including but not limited to identification data, demographic data, family data, financial data, vehicle data, health data, purchase behavior data, social media data, face data, bank card number, telephone number, ID card number and other data information, which can be increased or decreased according to the application scenario, and the embodiments of this application do not limit this.

[0112] Among them, operation behaviors include but are not limited to copying, pasting, forwarding, cutting, modifying, desensitizing, classifying, deleting, etc.; algorithms include a set of one or more operations such as modular addition, modular multiplication, modular exponentiation, generalization, substitution, suppression, decoupling, scrambling, insertion, and deletion.

[0113] like Figure 2 As shown, assuming that the specified type of data is identity card information, the multiple operation behaviors of the specified type of data may include desensitizing, copying, forwarding, etc. The behavior information of the desensitizing operation includes replacement algorithm, administrator role, etc., the behavior information of the copying operation includes salesperson role, etc., and the behavior information of the forwarding operation includes non-registered user role, etc.

[0114] In step 102, feature extraction is performed on data information of multiple specified types of data respectively to obtain first feature vectors of each of the multiple specified types of data.

[0115] In some embodiments, feature extraction is performed on data information of multiple specified types of data respectively to obtain first feature vectors of each of the multiple specified types of data, which can be performed as follows:

[0116] The data information of multiple specified types of data are respectively input into a pre-trained multimodal classification model to obtain the first feature vectors of the data information of the multiple specified types of data; each first feature vector is used to represent the data type of the corresponding specified type of data.

[0117] In the specific implementation, data information of multiple specified types of data corresponding to multiple operation behaviors recorded in the business system is collected and stored for infringement analysis, tracing and evidence collection of the specified types of data of the operation behaviors. Then the data information of each specified type of data is input into a pre-trained multimodal classification model, and the middle layer weight of the model is used as the category vector representation of the specified type of data, that is, the first eigenvector, which represents the data type of the corresponding specified type of data.

[0118] Among them, there are many ways to implement multimodal classification models:

[0119] One is to use a multimodal model based on the transformer mechanism, such as UNITER and ViLT, which can input image and text data. The training target is to specify the data type of the type of data and extract the weight of the middle layer of the model as the category vector representation of the specified type of data.

[0120] The other is to use traditional vision and language pre-training methods, identify them separately and then fuse them. For example, use the yolov8 model to train a target detector to identify data information of specified types of data such as faces and identification documents in pictures, and then use natural language processing models such as Word2Vec and BERT to convert the text data of the recognition results into feature vectors.

[0121] In some embodiments, the training process of the multimodal classification model is as follows: Figure 3 Steps shown:

[0122] In step 301, data information of a plurality of sample data and labeling information corresponding to the plurality of sample data are obtained; each labeling information is used to characterize the target data type of the corresponding sample data;

[0123] In step 302, data information of the plurality of sample data is input into the multimodal classification model to be trained to obtain reference data types of the plurality of sample data;

[0124] In step 303, based on the gap between the reference data type and the target data type, the parameter information of the multimodal classification model to be trained is adjusted until the reference data type and the target data type are the same, thereby obtaining a trained multimodal classification model.

[0125] In specific implementation, data information of specified types of data in different formats such as text, image, video, and voice are collected from the regulatory information evidence data as sample data, and the target data type of each sample data is marked;

[0126] Then, the data information of all the sample data is input into the multimodal classification model to be trained, and the reference data type of the multiple sample data output by the model is obtained. The reference data type is compared with the target data type, so as to determine the loss function of the multimodal classification model to be trained, and various parameter information of the multimodal classification model to be trained is adjusted according to the loss function;

[0127] Then, the data information of all sample data is input into the multimodal classification model after the parameter information is modified, and the reference data type of multiple sample data output by the model is obtained. The reference data type is compared with the target data type, and the parameter information of the model is adjusted again until the reference data type output by the model is the same as the labeled target data type, and the multimodal classification model training is completed;

[0128] Finally, the intermediate layer weights of the trained multimodal classification model are used as the category vector representation of the sample data.

[0129] In this application, the existing multimodal classification model is used for pre-training and vector representation, so as to realize the recognition and detection of operation behaviors of multimodal specified type data.

[0130] In step 103, feature extraction is performed on the behavior information of the multiple operation behaviors respectively to obtain second feature vectors of the multiple operation behaviors respectively.

[0131] In specific implementation, the behavioral information of the operation behavior includes the content of the specified type of data corresponding to the operation behavior, the role code of the operating user, the usage scenario code, the code for controlling the operation behavior, the code for propagating the operation behavior, the algorithm code, the device / IP / system code, the operation frequency, the operation result status code and other information. Therefore, each information can be digitized and vectorized according to the correspondence between the preset information and the vector, thereby obtaining the second feature vector corresponding to each operation behavior.

[0132] Among them, the corresponding relationship between the preset information and the vector can be set according to actual needs or according to experience, and the embodiment of the present application does not limit this.

[0133] In step 104, cluster analysis is performed on the multiple operation behaviors based on the first feature vector and the second feature vector to obtain cluster categories corresponding to the multiple operation behaviors.

[0134] In one implementation, similarity calculation is performed based on a plurality of pre-configured target feature vectors and the first feature vector and the second feature vector of the operation behavior, and the category corresponding to the target feature vector with higher similarity is used as the cluster category corresponding to the operation behavior.

[0135] In another embodiment, a KMeans clustering model is pre-trained, and the first feature vector of the specified type of data corresponding to the multiple operation behaviors and the second feature vector of each of the multiple operation behaviors are input into the KMeans clustering model for KMeans clustering, and the multiple operation behaviors are grouped to characterize the feature grouping of the multiple operation behaviors of the specified type of data, so as to obtain cluster categories corresponding to each of the multiple operation behaviors.

[0136] In the specific implementation, the data information of the specified type of data and the behavioral information of multiple operation behaviors are input into the Kmeans clustering model from the regulatory information evidence data to obtain the cluster categories corresponding to the multiple operation behaviors, thereby obtaining the cluster numbers corresponding to the categories.

[0137] In this application, the number of anomaly detection alarms can be adjusted by adjusting the number of clusters. Increasing the number of clusters means stricter detection and a corresponding increase in anomaly alarms. Conversely, reducing the number of clusters also reduces anomaly alarms, thereby achieving a balance between detection accuracy and efficiency and adapting to the needs of different scenarios.

[0138] In step 105, probability prediction is performed on the multiple operation behaviors based on the cluster categories corresponding to the multiple operation behaviors, so as to obtain prediction probability values ​​corresponding to the multiple operation behaviors.

[0139] In some embodiments, based on the cluster categories corresponding to the multiple operation behaviors, probability prediction is performed on the multiple operation behaviors to obtain the predicted probability values ​​corresponding to the multiple operation behaviors. The following can be performed: Figure 4 Steps shown:

[0140] In step 401, based on the cluster categories corresponding to the multiple operation behaviors and the preset correspondence between the cluster categories and the cluster numbers, the cluster numbers corresponding to the multiple operation behaviors are determined; the cluster numbers represent multiple operation behaviors of the same cluster category;

[0141] In step 402, according to the operation time of the multiple operation behaviors, the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple specified type data are sorted to obtain the operation behavior sequence corresponding to the multiple specified type data; the operation behavior sequence includes the multiple operation behaviors corresponding to each specified type data and the cluster numbers corresponding to the multiple operation behaviors;

[0142] In step 403, the operation behavior sequences corresponding to the multiple specified type data are input into the pre-trained probabilistic suffix tree model, and the multiple operation behaviors are probability predicted to obtain the prediction probability values ​​corresponding to the multiple operation behaviors.

[0143] In some embodiments, the normal operation behavior of each specified type of data is sorted in the order of the operation events to form an operation behavior sequence of the specified type of data, wherein each operation behavior is represented by the cluster number after its feature clustering as a symbol, and multiple operation behavior sequences of the specified type of data are collected to form a training set, and a probabilistic suffix tree model based on the operation behavior feature clustering as a symbol is trained to predict the predicted probability value of the new operation behavior.

[0144] Then, during the actual detection, the trained probabilistic suffix tree model is used to predict the probability value of the current operation behavior based on multiple operation behaviors that have occurred before the current operation behavior of the target data.

[0145] In specific implementation, the data information of the specified type of data and the behavior information of multiple operation behaviors are input into the Kmeans clustering model from the regulatory information evidence data to obtain the cluster categories corresponding to the multiple operation behaviors, thereby obtaining the cluster numbers corresponding to the categories;

[0146] Then, the multiple operation behaviors of the specified type of data are sorted according to the cluster numbers of the multiple operation behaviors and the operation times of the multiple operation behaviors to obtain an operation behavior sequence of the specified type of data.

[0147] Then, the operation behavior sequence of the specified type of data is input into the pre-trained probabilistic suffix tree model, and the probability prediction of multiple operation behaviors is performed to obtain the prediction probability values ​​corresponding to each of the multiple operation behaviors.

[0148] In some embodiments, the training process of the probabilistic suffix tree model is as follows: Figure 5 Steps shown:

[0149] In step 501, multiple operation behavior sequences corresponding to multiple sample data are obtained; the operation behavior sequences are obtained by sorting the cluster numbers corresponding to the multiple operation behaviors according to the operation time of the multiple operation behaviors of each sample data;

[0150] In step 502, the operation behavior sequences corresponding to the multiple sample data are input into the probabilistic suffix tree model to be trained, and the target probability values ​​corresponding to the multiple operation behaviors are determined according to the operation order of the multiple operation behaviors and the occurrence frequency of the multiple operation behaviors in the multiple operation behavior sequences, so as to obtain a trained probabilistic suffix tree model.

[0151] In specific implementation, data information of designated types of data and behavior information of corresponding multiple operation behaviors are collected from the regulatory information evidence data, and then feature vectors are extracted and clustered. Then, according to the operation time of the multiple operation behaviors, the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple sample data are sorted to obtain the operation behavior sequence corresponding to the multiple sample data;

[0152] The operation behavior sequences of multiple specified types of data are used to form a training set, and the probabilistic suffix tree model to be trained is trained to predict the probability value of the new operation behavior;

[0153] A plurality of designated type data are used as sample data; the operation behavior sequence is obtained by sorting the cluster numbers corresponding to the plurality of operation behaviors according to the operation time of the plurality of operation behaviors of each sample data, and includes the cluster numbers corresponding to the plurality of operation behaviors and the operation order corresponding to the plurality of operation behaviors;

[0154] Afterwards, based on the operation behavior sequences corresponding to the multiple sample data, the occurrence frequencies of the multiple operation behaviors in the multiple operation behavior sequences can be calculated;

[0155] Then, according to the operation order of the multiple operation behaviors and the occurrence frequency of the multiple operation behaviors in the multiple operation behavior sequences, the target probability values ​​corresponding to the multiple operation behaviors are determined to obtain a trained probabilistic suffix tree model.

[0156] Among them, the process of training the probabilistic suffix tree model is the process of constructing the probabilistic suffix tree.

[0157] Exemplarily, first, according to the occurrence frequencies of multiple operation behaviors in the first operation sequence of multiple operation behavior sequences, target probability values, that is, occurrence frequencies, of multiple operation behaviors in the first operation sequence are calculated;

[0158] Then, based on the target probability values ​​of multiple operation behaviors in the first operation sequence, the target probability values ​​of multiple operation behaviors in the second operation sequence occurring simultaneously after the operation behaviors in the first operation sequence occur are calculated, and so on, until the target probability values ​​of multiple operation behaviors in the last operation sequence are determined, thereby obtaining a trained probabilistic suffix tree model.

[0159] For example, for a normal operation behavior sequence (a, b, c, d, e), training is performed. According to the operation time of multiple operation behaviors of each sample data, the cluster numbers corresponding to the multiple operation behaviors are sorted to obtain 5 operation behavior sequences (a, b, c), 2 operation behavior sequences (a, b, d), and 3 operation behavior sequences (a, c, e). Then, the target probability value of the operation behavior a in the first operation sequence is 100%, and the target probability values ​​of the operation behaviors b, c, d, and e are all 0;

[0160] On this basis, after the operation behavior a of the first operation sequence occurs, the target probability value of the operation behavior b of the second operation sequence occurring simultaneously is P(b|a)=7 / 10; after the operation behavior a of the first operation sequence occurs, the target probability value of the operation behavior c of the second operation sequence occurring simultaneously is P(c|a)=3 / 10; and after the operation behavior a of the first operation sequence occurs, the target probability values ​​of the operation behaviors a, d, and e of the second operation sequence occurring simultaneously are all 0, that is, P(a|a)=0, P(d|a)=0, and P(e|a=0;

[0161] On this basis, after the operation behavior a of the first operation sequence and the operation behavior b of the second operation sequence occur, the target probability value of the operation behavior c of the third operation sequence occurs is 1 / 2; after the operation behavior a of the first operation sequence and the operation behavior b of the second operation sequence occur, the target probability value of the operation behavior d of the third operation sequence occurs is 1 / 2; after the operation behavior a of the first operation sequence and the operation behavior b of the second operation sequence occur, the target probability values ​​of the operation behaviors a, b, and e of the third operation sequence occur are all 0;

[0162] On this basis, after the operation behavior a of the first operation sequence and the operation behavior c of the second operation sequence occur, the target probability value of the operation behavior e of the third operation sequence is 1; on this basis, after the operation behavior a of the first operation sequence and the operation behavior c of the second operation sequence occur, the target probability values ​​of the operation behaviors a, b, c, and d of the third operation sequence are all 0. Thus, the trained probabilistic suffix tree model is as follows: Figure 6 shown.

[0163] Afterwards, if the current operation behavior occurring after the operation behavior a is d, and the predicted probability value of the current operation behavior is P(d|a)=0, which is less than the preset probability threshold, it means that the current operation behavior d is an abnormal operation behavior.

[0164] The behavioral symbols of the last probabilistic suffix tree model of this application are derived from the probabilistic clustering results of the behavioral information of the operation behavior. Its behavioral symbols incorporate multidimensional behavioral information related to the infringement rules, such as the operation behavior, operation scenario and environment, and operation algorithm, rather than simply using the one-dimensional information of the operation behavior as the symbol. The clustering results of the multidimensional behavioral information of the operation behavior are used as the symbol sequence of the probabilistic suffix tree to construct a model. A new method for constructing a probabilistic suffix tree symbol system is proposed, which unifies the single-point spatial knowledge and multi-point temporal knowledge related to the infringement of specified types of data in one model, greatly improving the accuracy and computational efficiency of the model anomaly detection.

[0165] The method of constructing a probabilistic suffix tree model symbol system in this application can also be used in other similar scenarios, such as personal health monitoring, financial risk control and other fields, upgrading the traditional time dimension sequence detection to the sequence detection combining time and space information, thereby improving the detection effect.

[0166] In step 106, the predicted probability value of the current operation behavior is determined according to the predicted probability values ​​of the same type of operation behaviors; the same type of operation behavior refers to an operation behavior of the same behavior type as the current operation behavior among multiple operation behaviors.

[0167] Assuming that the behavior type of the current operation behavior is a copy operation, the predicted probability value of the forwarding operation is 0.4, the predicted probability value of the copy operation is 0.5, and the predicted probability value of the desensitization operation is 0.6, then the same type of operation behavior is a copy operation, and the predicted probability value of the current operation behavior is 0.5.

[0168] In step 107, based on the predicted probability value of the current operation behavior and a preset probability threshold, the detection result of the current operation behavior is determined.

[0169] In some embodiments, based on the predicted probability value of the current operation behavior and a preset probability threshold, determining the detection result of the current operation behavior includes:

[0170] If the predicted probability value of the current operation behavior is less than the preset probability threshold, the detection result of the current operation behavior is determined to be an abnormal operation behavior;

[0171] If the predicted probability value of the current operation behavior is not less than the preset probability threshold, the detection result of the current operation behavior is determined to be a normal operation behavior.

[0172] In specific implementation, if the predicted probability value of the actual operation behavior is lower than the preset probability threshold, the operation behavior is marked as an abnormal operation behavior, otherwise it is marked as a normal operation behavior.

[0173] Among them, the preset probability threshold can be set according to experience or according to actual needs, and the embodiments of the present application do not limit this.

[0174] In some embodiments, by matching abnormal operating behavior with preset infringement rules, it is possible to identify whether infringement has occurred. Therefore, in the operating behavior detection method provided in the embodiment of the present application, if the detection result of the current operating behavior is abnormal operating behavior, the infringement result of the current operating behavior is determined according to the preset infringement rules.

[0175] In some embodiments, according to the preset infringement rules, determining the infringement result of the current operation behavior can be specifically performed as follows:

[0176] Obtaining the number of abnormal operation behaviors among multiple operation behaviors of the target user on the target data within a preset time period; the multiple operation behaviors include the current operation behavior;

[0177] If the number of abnormal operation behaviors is greater than the preset number threshold, each abnormal operation behavior will be matched with the preset infringement rules to determine the infringement result of each abnormal operation behavior; if the number of abnormal operation behaviors is not greater than the preset number threshold, each abnormal operation behavior will not be matched with the preset infringement rules until the number of abnormal operation behaviors is greater than the preset number threshold.

[0178] In specific implementation, a time window can be set to represent the preset time length, and then the number of abnormal operation behaviors in the time window can be calculated. If it is greater than the preset number threshold of the window, multiple abnormal operation behaviors in the time window are matched with the preset infringement rules to perform infringement detection to reduce the false alarm rate.

[0179] For example, the duration of every 10 operation behaviors is taken as a window, and a probability prediction is made for each operation behavior in the window. If there are multiple abnormal operation behaviors exceeding the preset number threshold in a window, the multiple abnormal operation behaviors in the operation behavior sequence are matched with the preset infringement rules to determine the infringement results of each abnormal operation behavior.

[0180] For example, if only one abnormal operation behavior occurs in an operation behavior sequence within 10 minutes, it can be determined that the abnormality of this operation behavior sequence is not too serious, and the infringement rule detection is not performed temporarily; if three abnormal operation behaviors occur within 10 minutes, it is determined that the abnormality of this operation behavior sequence is more serious. According to the preset infringement rules, the three abnormal operation behaviors of the operation behavior sequence are matched separately to detect whether the three abnormal operation behaviors are infringement behaviors.

[0181] Therefore, on the basis of performing infringement detection when one abnormal operation occurs, infringement detection is added when a preset number of abnormal operations occur, further improving the infringement rule matching performance.

[0182] For ease of understanding, the following takes the specified data type as an ID card type as an example to describe the detection method of the operation behavior of this application in combination with specific data.

[0183] The pre-trained multimodal classification model is used to encode the data information of the ID card type into a first feature vector representation, such as 100101. Then the behavior information of multiple operation behaviors (such as Figure 2 The operation behavior shown: desensitization, operation algorithm: substitution, operation role: administrator, ..., etc.) is digitized and vectorized and encoded into a multi-dimensional vector, i.e., the second feature vector, such as (100101, 1, 2, 0, ...), where 1 is the desensitization operation code, 2 is the substitution algorithm code, 0 is the administrator role code, etc.;

[0184] Then, the first feature vectors of multiple specified types of data such as identity card privacy data (or other specified types of data, selected according to the application scenario) and the second feature vectors of multiple operation behaviors are clustered by Kmeans, such as clustering into 100 classes, and encoding each class from M001 to M100;

[0185] Afterwards, the operation behavior sequences of the specified type of data are re-labeled with cluster numbers, such as replacing a certain desensitized operation behavior with the M010 behavior symbol; multiple normal operation behavior sequences are re-labeled as input samples to train the probabilistic suffix tree model, and then the trained probabilistic suffix tree model is used to predict the probability of new operation behaviors occurring in M001 to M100 based on the operation behaviors that have occurred in multiple specified types of data;

[0186] like Figure 7 As shown in the figure, the probability of M010 predicted by the probabilistic suffix tree model is 0.6, the probability of M011 is 0.3, the probability of M075 is 0.001, and the preset probability threshold is 0.2. However, the current operation behavior is that the prediction probability of M075 is much lower than the preset probability threshold of 0.2. This shows that according to the prediction of historical normal data, the current operation behavior may be M010, and it is unlikely to be M075, so the current operation behavior is marked as abnormal operation behavior.

[0187] There is a certain correlation between the multi-dimensional behavior information of the operation behavior of the present application and the indicator items of the preset infringement rules. For example, the preset infringement rules prohibit the desensitized forwarding of identity cards and illegal IP address operations, etc., which are all recorded in the multi-dimensional behavior information of the operation behavior and used in clustering analysis, and then reflected in the symbol sequence prediction, so that the abnormal operation behavior and the preset infringement rules are more matched.

[0188] The model of this application is simple, does not require complex calculations, and has a fast detection speed. It is very suitable for personal rights protection and supervision scenarios with high performance requirements, large data processing volumes, and across enterprises.

[0189] In an embodiment of the present application, with respect to the current operation behavior of the target user on the target data, behavior information of multiple operation behaviors before the current operation behavior and data information of multiple specified types of data corresponding to the multiple operation behaviors are obtained; then feature extraction is performed to obtain a first feature vector of each of the multiple specified types of data and a second feature vector of each of the multiple operation behaviors; based on the first feature vector and the second feature vector, a cluster analysis is performed on the multiple operation behaviors to obtain cluster categories corresponding to each of the multiple operation behaviors; based on the cluster categories corresponding to each of the multiple operation behaviors, a probability prediction is performed on the multiple operation behaviors to obtain a predicted probability value of an operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors; based on the predicted probability value of the current operation behavior and a preset probability threshold, a detection result of the current operation behavior is determined.

[0190] Therefore, the clustering results of the first eigenvector and the second eigenvector are used as the symbol sequence construction model of the probabilistic suffix tree, and a new method for constructing the probabilistic suffix tree symbol system is proposed. The characteristics of the specified type of data and the multi-dimensional feature vectors of the operation behavior are integrated, which can greatly improve the accuracy and efficiency of the detection results of the operation behavior and enhance the supervision ability of user personal data in multimodality.

[0191] According to the operation behavior detection method of the present application, the operation behavior detection device is described below, specifically as follows: Figure 8 shown.

[0192] Specified type data operation behavior evidence storage module: collects and stores the specified type data operation behavior records in the business system, which is used for infringement analysis, tracing and evidence collection of specified type data operation behavior.

[0193] Operation behavior representation module for specified type of data: uses a pre-trained multimodal classification model to obtain the category vector representation of specified type of data.

[0194] The module for clustering the operational behavior characteristics of the specified type of data is used to extract the behavioral information of the operational behavior of the specified type of data from the operational behavior evidence storage module of the specified type of data, and then perform clustering after vectorization to characterize the characteristics of the operational behavior of the specified type of data.

[0195] Anomaly detection module: trains a probabilistic suffix tree model based on feature clustering of operation behaviors as symbols, predicts the predicted probability value of new operation behaviors, and determines whether the new operation behaviors that actually occur are abnormal or normal.

[0196] Infringement detection module: For abnormal operation behaviors, the preset infringement rules are matched to determine whether the abnormal operation behaviors are infringement behaviors.

[0197] Based on the same technical concept, an embodiment of the present application also provides an operation behavior detection device. The principle of solving the problem by the operation behavior detection device is similar to that of the above-mentioned operation behavior detection method. Therefore, the implementation of the operation behavior detection device can refer to the implementation of the operation behavior detection method, and the repeated parts will not be repeated.

[0198] Fig. 9 A structural schematic diagram of an operation behavior detection device provided in an embodiment of the present application, the device includes an acquisition module 901, a first feature extraction module 902, a second feature extraction module 903, a clustering module 904, a probability prediction module 905, a probability determination module 906, and a detection module 907.

[0199] The acquisition module 901 is used to acquire, based on the current operation behavior of the target user on the target data, the behavior information of multiple operation behaviors before the current operation behavior, and the data information of multiple specified types of data corresponding to the multiple operation behaviors; the multiple specified types of data include the target data;

[0200] A first feature extraction module 902 is used to extract features from the data information of the plurality of specified types of data respectively, to obtain first feature vectors of the plurality of specified types of data respectively;

[0201] A second feature extraction module 903 is used to extract features from the behavior information of the multiple operation behaviors respectively to obtain second feature vectors of the multiple operation behaviors respectively;

[0202] A clustering module 904 is used to perform cluster analysis on the multiple operation behaviors based on the first feature vector and the second feature vector to obtain cluster categories corresponding to the multiple operation behaviors;

[0203] A probability prediction module 905 is used to perform probability prediction on the multiple operation behaviors based on the cluster categories corresponding to the multiple operation behaviors, and obtain prediction probability values ​​corresponding to the multiple operation behaviors;

[0204] The probability determination module 906 is used to determine the predicted probability value of the current operation behavior according to the predicted probability values ​​of the same type of operation behaviors; the same type of operation behavior refers to the operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors;

[0205] The detection module 907 is used to determine the detection result of the current operation behavior based on the predicted probability value of the current operation behavior and a preset probability threshold.

[0206] In some embodiments, the first feature extraction module 902 is specifically used to:

[0207] The data information of the multiple specified types of data are respectively input into a pre-trained multimodal classification model to obtain the first feature vectors of the data information of the multiple specified types of data; each first feature vector is used to characterize the data type of the corresponding specified type of data.

[0208] In some embodiments, the apparatus further comprises a first training module; the first training module is used to train a multimodal classification model;

[0209] The training process of the multimodal classification model is as follows:

[0210] Acquire data information of a plurality of sample data and labeling information corresponding to the plurality of sample data; each labeling information is used to characterize a target data type of the corresponding sample data;

[0211] Inputting data information of the plurality of sample data into a multimodal classification model to be trained to obtain reference data types of the plurality of sample data;

[0212] Based on the gap between the reference data type and the target data type, the parameter information of the multimodal classification model to be trained is adjusted until the reference data type and the target data type are the same, thereby obtaining a trained multimodal classification model.

[0213] In some embodiments, the probability prediction module 905 is specifically used to:

[0214] Based on the cluster categories corresponding to the multiple operation behaviors and the preset correspondence between the cluster categories and the cluster numbers, determine the cluster numbers corresponding to the multiple operation behaviors; the cluster numbers represent multiple operation behaviors of the same cluster category;

[0215] According to the operation time of the multiple operation behaviors, the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple specified types of data are sorted to obtain an operation behavior sequence corresponding to the multiple specified types of data; the operation behavior sequence includes the multiple operation behaviors corresponding to each specified type of data and the cluster numbers corresponding to the multiple operation behaviors;

[0216] The operation behavior sequences corresponding to the multiple specified type data are input into a pre-trained probabilistic suffix tree model, and probability prediction is performed on the multiple operation behaviors to obtain prediction probability values ​​corresponding to each of the multiple operation behaviors.

[0217] In some embodiments, the apparatus further comprises a second training module; the second training module is used to train a probabilistic suffix tree model;

[0218] The training process of the probabilistic suffix tree model is as follows:

[0219] Acquire multiple operation behavior sequences corresponding to multiple sample data; the operation behavior sequences are obtained by sorting the cluster numbers corresponding to the multiple operation behaviors according to the operation time of the multiple operation behaviors of each sample data;

[0220] The operation behavior sequences corresponding to the multiple sample data are input into the probabilistic suffix tree model to be trained, and the target probability values ​​corresponding to each of the multiple operation behaviors are determined according to the operation order of the multiple operation behaviors and the occurrence frequency of the multiple operation behaviors in the multiple operation behavior sequences, so as to obtain a trained probabilistic suffix tree model.

[0221] In some embodiments, the detection module 907 is specifically used to:

[0222] If the predicted probability value of the current operation behavior is less than the preset probability threshold, determining that the detection result of the current operation behavior is an abnormal operation behavior;

[0223] If the predicted probability value of the current operation behavior is not less than the preset probability threshold, it is determined that the detection result of the current operation behavior is a normal operation behavior.

[0224] In some embodiments, the apparatus further comprises an infringement module;

[0225] The infringement module is used to determine the infringement result of the current operation behavior according to a preset infringement rule if the detection result of the current operation behavior is an abnormal operation behavior.

[0226] In some embodiments, the infringement module is specifically used to:

[0227] Acquire the number of abnormal operation behaviors among multiple operation behaviors of the target user on the target data within a preset time period; the multiple operation behaviors include the current operation behavior;

[0228] If the number of abnormal operation behaviors is greater than a preset number threshold, each abnormal operation behavior is matched with the preset infringement rule to determine the infringement result of each abnormal operation behavior;

[0229] If the number of the abnormal operation behaviors is not greater than the preset number threshold, each abnormal operation behavior will not be matched with the preset infringement rule until the number of the abnormal operation behaviors is greater than the preset number threshold.

[0230] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated in a processor, or may exist physically separately, or two or more modules may be integrated in one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0231] After introducing the method and device for detecting the operation behavior according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0232] Refer to the following Fig.10 The electronic device 130 implemented according to this embodiment of the present application is described. Fig.10 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0233] like Fig.10 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0234] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0235] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0236] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0237] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0238] In an exemplary embodiment, a storage medium is also provided, and when a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can perform the detection method of any of the above-mentioned operation behaviors. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0239] In an exemplary embodiment, the electronic device of the present application may include at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor may perform the steps of the detection method of any operation behavior provided in the embodiments of the present application.

[0240] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement any exemplary method provided in the present application.

[0241] Furthermore, the computer program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0242] The program product for device discovery in the embodiment of the present application may adopt a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0243] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0244] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0245] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0246] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0247] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0248] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0249] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0250] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0251] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0252] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0253] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application also includes these modifications and variations.

Claims

1. A method for detecting an operation behavior, characterized in that: The method comprises: For a current operation behavior of a target user on target data, obtain behavior information of multiple operation behaviors before the current operation behavior, and data information of multiple specified types of data corresponding to the multiple operation behaviors; the multiple specified types of data include the target data; Performing feature extraction on the data information of the plurality of designated types of data respectively to obtain first feature vectors of the plurality of designated types of data respectively; Extracting features from the behavior information of the multiple operation behaviors respectively to obtain second feature vectors of the multiple operation behaviors; Based on the first feature vector and the second feature vector, cluster analysis is performed on the multiple operation behaviors to obtain cluster categories corresponding to the multiple operation behaviors; Based on the cluster categories corresponding to the multiple operation behaviors, and the corresponding relationship between the preset cluster categories and cluster numbers, the cluster numbers corresponding to the multiple operation behaviors are determined; the cluster numbers represent multiple operation behaviors of the same cluster category; according to the operation time of the multiple operation behaviors, the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple specified type data are sorted to obtain the operation behavior sequence corresponding to the multiple specified type data; the operation behavior sequence includes the multiple operation behaviors corresponding to each specified type data and the cluster numbers corresponding to the multiple operation behaviors; the operation behavior sequence corresponding to the multiple specified type data is input into a pre-trained probabilistic suffix tree model, and the multiple operation behaviors are probability predicted to obtain the prediction probability values ​​corresponding to the multiple operation behaviors; Determining the predicted probability value of the current operation behavior according to the predicted probability values ​​of the same type of operation behaviors; the same type of operation behavior refers to an operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors; Based on the predicted probability value of the current operation behavior and a preset probability threshold, a detection result of the current operation behavior is determined.

2. The method according to claim 1, characterized in that The extracting features of the data information of the plurality of specified types of data respectively to obtain first feature vectors of the plurality of specified types of data respectively includes: The data information of the multiple specified types of data are respectively input into a pre-trained multimodal classification model to obtain the first feature vectors of the data information of the multiple specified types of data; each first feature vector is used to characterize the data type of the corresponding specified type of data.

3. The method according to claim 2, characterized in that The training process of the multimodal classification model is as follows: Acquire data information of a plurality of sample data and labeling information corresponding to the plurality of sample data; each labeling information is used to characterize a target data type of the corresponding sample data; Inputting data information of the plurality of sample data into a multimodal classification model to be trained to obtain reference data types of the plurality of sample data; Based on the gap between the reference data type and the target data type, the parameter information of the multimodal classification model to be trained is adjusted until the reference data type and the target data type are the same, thereby obtaining a trained multimodal classification model.

4. The method according to claim 1, characterized in that The training process of the probabilistic suffix tree model is as follows: Acquire multiple operation behavior sequences corresponding to multiple sample data; the operation behavior sequences are obtained by sorting the cluster numbers corresponding to the multiple operation behaviors according to the operation time of the multiple operation behaviors of each sample data; The operation behavior sequences corresponding to the multiple sample data are input into the probabilistic suffix tree model to be trained, and the target probability values ​​corresponding to each of the multiple operation behaviors are determined according to the operation order of the multiple operation behaviors and the occurrence frequency of the multiple operation behaviors in the multiple operation behavior sequences, so as to obtain a trained probabilistic suffix tree model.

5. The method according to claim 1, characterized in that The determining the detection result of the current operation behavior based on the predicted probability value of the current operation behavior and the preset probability threshold includes: If the predicted probability value of the current operation behavior is less than the preset probability threshold, determining that the detection result of the current operation behavior is an abnormal operation behavior; If the predicted probability value of the current operation behavior is not less than the preset probability threshold, it is determined that the detection result of the current operation behavior is a normal operation behavior.

6. The method according to claim 5, characterized in that The method further comprises: If the detection result of the current operation behavior is an abnormal operation behavior, the infringement result of the current operation behavior is determined according to the preset infringement rules.

7. The method according to claim 6, characterized in that Determining the infringement result of the current operation behavior according to the preset infringement rules includes: Acquire the number of abnormal operation behaviors among multiple operation behaviors of the target user on the target data within a preset time period; the multiple operation behaviors include the current operation behavior; If the number of abnormal operation behaviors is greater than a preset number threshold, each abnormal operation behavior is matched with the preset infringement rule to determine the infringement result of each abnormal operation behavior; If the number of the abnormal operation behaviors is not greater than the preset number threshold, each abnormal operation behavior will not be matched with the preset infringement rule until the number of the abnormal operation behaviors is greater than the preset number threshold.

8. A device for detecting operation behavior, characterized in that: The device comprises: an acquisition module, configured to acquire, based on a current operation behavior of a target user on target data, behavior information of multiple operation behaviors before the current operation behavior, and data information of multiple specified types of data corresponding to the multiple operation behaviors; the multiple specified types of data include the target data; A first feature extraction module, used to extract features from the data information of the plurality of specified types of data respectively, to obtain first feature vectors of the plurality of specified types of data respectively; A second feature extraction module is used to extract features from the behavior information of the multiple operation behaviors respectively to obtain second feature vectors of the multiple operation behaviors respectively; A clustering module, configured to perform cluster analysis on the plurality of operation behaviors based on the first feature vector and the second feature vector to obtain cluster categories corresponding to the plurality of operation behaviors; A probability prediction module, for determining the cluster numbers corresponding to the multiple operation behaviors based on the cluster categories corresponding to the multiple operation behaviors and the corresponding relationship between the preset cluster categories and cluster numbers; the cluster numbers represent multiple operation behaviors of the same cluster category; sorting the cluster numbers corresponding to the multiple operation behaviors corresponding to the multiple specified type data according to the operation time of the multiple operation behaviors to obtain the operation behavior sequence corresponding to the multiple specified type data; the operation behavior sequence includes the multiple operation behaviors corresponding to each specified type data and the cluster numbers corresponding to the multiple operation behaviors; inputting the operation behavior sequence corresponding to the multiple specified type data into a pre-trained probability suffix tree model, performing probability prediction on the multiple operation behaviors, and obtaining the prediction probability values ​​corresponding to the multiple operation behaviors; A probability determination module, used to determine the predicted probability value of the current operation behavior according to the predicted probability values ​​of the same type of operation behaviors; the same type of operation behavior refers to the operation behavior of the same behavior type as the current operation behavior among the multiple operation behaviors; The detection module is used to determine the detection result of the current operation behavior based on the predicted probability value of the current operation behavior and a preset probability threshold.

9. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the method as claimed in any one of claims 1 to 7.

Images