A User Management Method and System for a Structured Platform

Abstract

This application discloses a user management method and system for a structured platform, relating to the field of platform user management technology. It defines user roles and permissions in the user registry, configures access behavior standards and traffic behavior standards for users, analyzes users' past access records to obtain past access behavior information and past traffic behavior information, generates a first user behavior dataset, performs first and second indicator evaluations, determines the degree of anomaly and anomaly scaling ratio of the first user behavior dataset, continuously acquires current access request information of users at several time points, determines a third and fourth difference feature, determines a second user behavior dataset, compares the dataset difference features of the first and second user behavior datasets, and determines the degree of anomaly of user access requests, thereby improving the accuracy of judging the degree of anomaly in current user behavior.

Description

Technical Field

[0001] This invention relates to the field of platform user management technology, and in particular to a user management method and system for a structured platform. Background Technology

[0002] With the rapid development of the internet, structured platform user management is increasingly important for meeting users' needs to log in and perform various operations, thus enhancing user experience and protecting data security. However, as the number of users and the complexity and diversity of their access behaviors continue to increase, traditional user management methods still suffer from a lack of precision and flexibility, and low accuracy in identifying abnormal user behavior.

[0003] To address the shortcomings of traditional user management methods, such as poor accuracy and flexibility and inability to accurately identify abnormal user behavior, there is an urgent need for a structured platform-based user management method and system that can improve accuracy, flexibility, and the accuracy of identifying abnormal user behavior. Summary of the Invention

[0004] The purpose of this invention is to provide a user management method and system for a structured platform. To solve the problems of poor accuracy and flexibility of traditional user management methods and their inability to accurately judge abnormal user behavior, the user management method and system provided by this invention can perform difference feature analysis based on user behavior and user behavior standards, and perform indicator evaluation to achieve accurate assessment of the degree of abnormal user behavior.

[0005] The technical solution adopted in this invention is: a user management method for a structured platform, comprising:

[0006] Define the user's role and permissions in the user registry, and configure access behavior standards and traffic behavior standards for the user based on the defined user permissions and role definitions.

[0007] Analyze users’ past access records to obtain users’ past access behavior information and past traffic behavior information. Calculate the first difference feature between past access behavior information and access behavior standard, and the second difference feature between past traffic behavior information and traffic behavior standard. Then, associate the first difference feature and the second difference feature in time order to generate the first user behavior dataset.

[0008] The first user behavior dataset is evaluated by the first indicator and the second indicator in sequence, and the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset are determined based on the first indicator evaluation and the second indicator evaluation.

[0009] The system continuously acquires the current access request information of users at several time points, and analyzes the current access request information at each time point to obtain the current access behavior information and current traffic behavior information at each time point.

[0010] The second user behavior dataset is determined based on the third difference feature between the current access behavior information and the access behavior standard corresponding to several consecutive preset time nodes, and the fourth difference feature between the current traffic behavior information and the traffic behavior standard.

[0011] By comparing the dataset differences between the first user behavior dataset and the second user behavior dataset, and based on the degree of anomaly and the scaling ratio of the anomaly in the first user behavior dataset, the degree of anomaly of the current user access request corresponding to the second user behavior dataset is determined.

[0012] In some embodiments of this application, the method for defining user roles and permissions in the user registry, and configuring access behavior standards and traffic behavior standards for users includes:

[0013] Analyze the user information in the user registry, and determine the role definition and permissions of each registered user based on the user role definition information and the corresponding role permission information in the registry;

[0014] Based on the preset standard user behavior table, the user access behavior standard and traffic behavior standard are determined by comparing and analyzing the user role definition and permissions in the standard user behavior table, and standard reference values ​​are configured for the user access behavior standard and traffic behavior standard respectively.

[0015] In some embodiments of this application, the method for analyzing a user's past access records to obtain the user's past access behavior information and past traffic behavior information includes:

[0016] Analyze users' past access records to extract access behavior information and past traffic behavior information at different nodes;

[0017] User access behavior information includes: the frequency of user access to different data, the time period of user access, and the type of data accessed by the user;

[0018] User traffic behavior information includes: user network bandwidth usage information and user server access frequency information.

[0019] In some embodiments of this application, the method for calculating a first difference feature between past access behavior information and access behavior standards, and a second difference feature between past traffic behavior information and traffic behavior standards, includes:

[0020] Configure a first feature value for the access behavior information of past users, calculate the difference between the first feature value and the access behavior standard reference value, and determine the difference between the first feature value and the access behavior standard reference value as the first difference feature;

[0021] Configure a second feature value for the traffic behavior information of past users, calculate the difference between the second feature value and the traffic behavior standard reference value, and determine the difference between the second feature value and the traffic behavior standard reference value as the second difference feature.

[0022] In some embodiments of this application, the method for sequentially evaluating a first indicator and a second indicator on a first user behavior dataset includes:

[0023] When evaluating the first indicator on the first user behavior dataset, based on the system's preset role-data anomaly-anomaly degree correspondence, the abnormal data intervals corresponding to each behavior factor in the first user behavior dataset are defined, and the anomaly degree is defined for each abnormal data interval.

[0024] Based on the abnormal data interval to which each behavioral factor in the first user behavior dataset belongs, determine the first indicator evaluation of the first user behavior dataset.

[0025] When evaluating the second indicator on the first user behavior dataset, human management instructions are obtained, and based on the system's preset management instructions - abnormal scaling ratio, the abnormal scaling ratio of the abnormal part of the data corresponding to each behavior factor in the first user behavior dataset that exceeds the standard data boundary is determined.

[0026] The first user behavior data is processed based on several determined abnormal scaling ratios, and the abnormal data range and degree of abnormality of the scaled behavior factors are determined to obtain the second indicator evaluation.

[0027] In some embodiments of this application, the method for determining the second user behavior dataset based on the third and fourth difference features includes:

[0028] Obtain current access behavior information and current traffic behavior information corresponding to several preset time nodes, and perform differential analysis with the access behavior standard reference value and traffic behavior standard reference value respectively to obtain the third difference feature and the fourth difference feature. Associate the third difference feature and the fourth difference feature in time order to generate the second user behavior dataset.

[0029] In some embodiments of this application, the method for determining the degree of anomaly of the current user access request corresponding to the second user behavior dataset based on the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset includes:

[0030] Each behavioral factor in the second user behavior dataset is compared and analyzed with the corresponding behavioral factor in the first user behavior dataset. The abnormal data intervals in which each behavioral factor in the second user behavior dataset is located are defined, as well as the abnormal data intervals in which each behavioral factor in the second user behavior dataset is located after scaling the abnormal data intervals. The degree of abnormality of each behavioral factor in the second user behavior dataset is then determined.

[0031] Based on the degree of abnormality of each behavioral factor in the second user behavior dataset, determine the degree of abnormality of the current user access request corresponding to the second user behavior dataset.

[0032] In some embodiments of this application, a user management system for a structured platform is also disclosed, comprising:

[0033] The user behavior standard configuration module is used to determine the user's role definition and permissions in the user registry, and to configure access behavior standards and traffic behavior standards for the user based on the determined user permissions and role definitions.

[0034] The first user behavior dataset generation module is used to analyze the user's past access records, obtain the user's past access behavior information and past traffic behavior information, calculate the first difference feature between the past access behavior information and the access behavior standard, and the second difference feature between the past traffic behavior information and the traffic behavior standard, and associate the first difference feature and the second difference feature in time order to generate the first user behavior dataset.

[0035] An anomaly assessment module is used to sequentially assess the first user behavior dataset using a first indicator and a second indicator, and based on the first and second indicator assessments, determine the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset.

[0036] The second user behavior dataset generation module is used to continuously acquire the current access request information of users at several time points, and analyze the current access request information at each time point to obtain the current access behavior information and current traffic behavior information at each time point. Based on the third difference feature between the current access behavior information and the access behavior standard corresponding to several consecutive preset time points, and the fourth difference feature between the current traffic behavior information and the traffic behavior standard, the second user behavior dataset is determined.

[0037] The current anomaly detection module is used to compare the differences between the first user behavior dataset and the second user behavior dataset, and determine the degree of anomaly of the current user access request corresponding to the second user behavior dataset based on the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset.

[0038] The beneficial effects of this invention are:

[0039] This invention provides a user management method for a structured platform. By refining the definition of user roles and user permissions, configuring user behavior standards, and performing differential feature analysis on user behavior and user behavior standards, the method sequentially evaluates the first and second indicators to accurately assess the degree of abnormality in user behavior. This method improves the accuracy and flexibility of user management, greatly enhances the accuracy of judging the degree of abnormality in current user behavior, and effectively protects data security. Attached Figure Description

[0040] Figure 1 This is a schematic diagram illustrating the steps of a user management method for a structured platform according to an embodiment of this application;

[0041] Figure 2 This is a schematic diagram of the module connections of a user management system for a structured platform according to an embodiment of this application. Detailed Implementation

[0042] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0043] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific embodiments. It should be understood that the preferred embodiments described herein are only for illustration and explanation of the present invention and should not be construed as limiting the scope of protection of the present invention. Those skilled in the art can make some non-essential improvements and adjustments based on the following content of the present invention. In this invention, unless otherwise expressly specified and limited, the technical terms used in this application should have the ordinary meaning understood by those skilled in the art.

[0044] Example:

[0045] The purpose of this invention is to provide a user management method and system for a structured platform.

[0046] A user management method for a structured platform, see [link / reference]. Figure 1 ,include:

[0047] S1: Define the user's role and permissions in the user registry, and configure access behavior standards and traffic behavior standards for the user based on the defined user permissions and role definitions.

[0048] S2: Analyze the user's past access records to obtain the user's past access behavior information and past traffic behavior information. Calculate the first difference feature between the past access behavior information and the access behavior standard, and the second difference feature between the past traffic behavior information and the traffic behavior standard. Then, associate the first difference feature and the second difference feature in time order to generate the first user behavior dataset.

[0049] It is important to understand that a user's past access behavior information and past traffic behavior information are records of the user's access to data on the platform. There is a standard value for this behavior record. For example, if the number of times a user accesses the platform exceeds the standard value, it means that the user may have abnormal access behavior. If the number of times a user accesses the platform does not exceed the standard value, it means that the user's access behavior is normal.

[0050] S3: Perform first indicator evaluation and second indicator evaluation on the first user behavior dataset in sequence, and determine the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset based on the first indicator evaluation and the second indicator evaluation.

[0051] It is important to understand that the user behavior dataset is evaluated using the first indicator and the second indicator in sequence. That is, an abnormal range of abnormal behavior is configured according to the system's preset role-data anomaly-abnormality correspondence. User behavior that exceeds this range is judged as abnormal and undergoes secondary scaling, which is equivalent to expanding the abnormal range. If the user behavior is within the expanded abnormal range, the abnormality is relatively small.

[0052] S4: Continuously acquire the current access request information of users at several time points, and analyze the current access request information at each time point to obtain the current access behavior information and current traffic behavior information at each time point.

[0053] The second user behavior dataset is determined based on the third difference feature between the current access behavior information and the access behavior standard corresponding to several consecutive preset time nodes, and the fourth difference feature between the current traffic behavior information and the traffic behavior standard.

[0054] S5: Compare the dataset difference features of the first user behavior dataset and the second user behavior dataset, and determine the degree of abnormality of the current user access request corresponding to the second user behavior dataset based on the degree of abnormality and the abnormal scaling ratio of the first user behavior dataset.

[0055] It should be understood that the user management method and system of the structured platform proposed in this application has an organizational structure and user management, which can meet the needs of users to log in to the platform to use multiple systems. Based on the multi-organizational user permission management of different systems, it can realize the degree of freedom of users to switch permissions during the use of different systems.

[0056] In some embodiments of this application, the method for defining user roles and permissions in the user registry, and configuring access behavior standards and traffic behavior standards for users includes:

[0057] Analyze the user information in the user registry, and determine the role definition and permissions of each registered user based on the user role definition information and the corresponding role permission information in the registry;

[0058] Based on the preset standard user behavior table, the user access behavior standard and traffic behavior standard are determined by comparing and analyzing the user role definition and permissions in the standard user behavior table, and standard reference values ​​are configured for the user access behavior standard and traffic behavior standard respectively.

[0059] In some embodiments of this application, the method for analyzing a user's past access records to obtain the user's past access behavior information and past traffic behavior information includes:

[0060] Analyze users' past access records to extract access behavior information and past traffic behavior information at different nodes;

[0061] User access behavior information includes: the frequency of user access to different data, the time period of user access, and the type of data accessed by the user;

[0062] User traffic behavior information includes: user network bandwidth usage information and user server access frequency information.

[0063] In some embodiments of this application, the method for calculating a first difference feature between past access behavior information and access behavior standards, and a second difference feature between past traffic behavior information and traffic behavior standards, includes:

[0064] Configure a first feature value for the access behavior information of past users, calculate the difference between the first feature value and the access behavior standard reference value, and determine the difference between the first feature value and the access behavior standard reference value as the first difference feature;

[0065] Configure a second feature value for the traffic behavior information of past users, calculate the difference between the second feature value and the traffic behavior standard reference value, and determine the difference between the second feature value and the traffic behavior standard reference value as the second difference feature.

[0066] In some embodiments of this application, the method for sequentially evaluating a first indicator and a second indicator on a first user behavior dataset includes:

[0067] When evaluating the first indicator on the first user behavior dataset, based on the system's preset role-data anomaly-anomaly degree correspondence, the abnormal data intervals corresponding to each behavior factor in the first user behavior dataset are defined, and the anomaly degree is defined for each abnormal data interval.

[0068] Based on the abnormal data interval to which each behavioral factor in the first user behavior dataset belongs, determine the first indicator evaluation of the first user behavior dataset.

[0069] When evaluating the second indicator on the first user behavior dataset, human management instructions are obtained, and based on the system's preset management instructions - abnormal scaling ratio, the abnormal scaling ratio of the abnormal part of the data corresponding to each behavior factor in the first user behavior dataset that exceeds the standard data boundary is determined.

[0070] The first user behavior data is processed based on several determined abnormal scaling ratios, and the abnormal data range and degree of abnormality of the scaled behavior factors are determined to obtain the second indicator evaluation.

[0071] In some embodiments of this application, the method for determining the second user behavior dataset based on the third and fourth difference features includes:

[0072] Obtain current access behavior information and current traffic behavior information corresponding to several preset time nodes, and perform differential analysis with the access behavior standard reference value and traffic behavior standard reference value respectively to obtain the third difference feature and the fourth difference feature. Associate the third difference feature and the fourth difference feature in time order to generate the second user behavior dataset.

[0073] In some embodiments of this application, the method for determining the degree of anomaly of the current user access request corresponding to the second user behavior dataset based on the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset includes:

[0074] Each behavioral factor in the second user behavior dataset is compared and analyzed with the corresponding behavioral factor in the first user behavior dataset. The abnormal data intervals in which each behavioral factor in the second user behavior dataset is located are defined, as well as the abnormal data intervals in which each behavioral factor in the second user behavior dataset is located after scaling the abnormal data intervals. The degree of abnormality of each behavioral factor in the second user behavior dataset is then determined.

[0075] Based on the degree of abnormality of each behavioral factor in the second user behavior dataset, determine the degree of abnormality of the current user access request corresponding to the second user behavior dataset.

[0076] In some embodiments of this application, a user management system for a structured platform is also disclosed, see [link / reference]. Figure 2 It includes: a user behavior standard configuration module, a first user behavior dataset generation module, an anomaly assessment module, a second user behavior dataset generation module, and a current anomaly judgment module.

[0077] The user behavior standard configuration module is used to determine the user's role definition and permissions in the user registry, and to configure access behavior standards and traffic behavior standards for the user based on the determined user permissions and role definitions.

[0078] The first user behavior dataset generation module is used to analyze the user's past access records to obtain the user's past access behavior information and past traffic behavior information, calculate the first difference feature between the past access behavior information and the access behavior standard, and the second difference feature between the past traffic behavior information and the traffic behavior standard, and associate the first difference feature and the second difference feature in time order to generate the first user behavior dataset.

[0079] The anomaly assessment module is used to sequentially perform a first indicator assessment and a second indicator assessment on the first user behavior dataset, and determine the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset based on the first indicator assessment and the second indicator assessment.

[0080] The second user behavior dataset generation module is used to continuously acquire the current access request information of users at several time nodes, and analyze the current access request information at each time node to obtain the current access behavior information and current traffic behavior information at each time node. Based on the third difference feature between the current access behavior information and the access behavior standard corresponding to several consecutive preset time nodes, and the fourth difference feature between the current traffic behavior information and the traffic behavior standard, the second user behavior dataset is determined.

[0081] The current anomaly judgment module is used to compare the dataset difference features of the first user behavior dataset and the second user behavior dataset, and determine the anomaly degree of the current user access request corresponding to the second user behavior dataset based on the anomaly degree and anomaly scaling ratio of the first user behavior dataset.

[0082] The beneficial effects of this invention are:

[0083] This invention provides a user management method for a structured platform. By refining the definition of user roles and user permissions, configuring user behavior standards, and performing differential feature analysis on user behavior and user behavior standards, the method sequentially evaluates the first and second indicators to accurately assess the degree of abnormality in user behavior. This method improves the accuracy and flexibility of user management, greatly enhances the accuracy of judging the degree of abnormality in current user behavior, and effectively protects data security.

[0084] The above description is merely one embodiment of the present invention, and should not be construed as limiting the scope of the invention. Any structural changes made based on the present invention, as long as they do not depart from the essence of the invention, should be considered as falling within the protection scope of the present invention and subject to its restrictions. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process and related descriptions of the system described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0085] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent in such process, method, article, or apparatus / device.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A user management method for a structured platform, characterized in that, include: Define the user's role and permissions in the user registry, and configure access behavior standards and traffic behavior standards for the user based on the defined user permissions and role definitions. Analyze users’ past access records to obtain users’ past access behavior information and past traffic behavior information. Calculate the first difference feature between past access behavior information and access behavior standard, and the second difference feature between past traffic behavior information and traffic behavior standard. Then, associate the first difference feature and the second difference feature in time order to generate the first user behavior dataset. The first user behavior dataset is evaluated using a first indicator and a second indicator in sequence. Based on the first and second indicator evaluations, the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset are determined. Specifically, based on the system's preset role-data anomaly-degree of anomaly correspondence, anomaly data intervals are defined for the data corresponding to each behavior factor in the first user behavior dataset, and the degree of anomaly is defined for each anomaly data interval. Based on the anomaly data interval to which each behavior factor in the first user behavior dataset belongs, the first indicator evaluation of the first user behavior dataset is determined. Based on several determined anomaly scaling ratios, the first user behavior data is operated on, and the anomaly data interval and degree of anomaly to which the scaled behavior factor data belongs are determined, resulting in the second indicator evaluation. The system continuously acquires the current access request information of users at several time points, and analyzes the current access request information at each time point to obtain the current access behavior information and current traffic behavior information at each time point. Obtain current access behavior information and current traffic behavior information corresponding to several preset time nodes, and perform differential analysis with the access behavior standard reference value and the traffic behavior standard reference value respectively to obtain the third differential feature and the fourth differential feature obtained through differential analysis. Then, associate the third differential feature and the fourth differential feature in time order to generate the second user behavior dataset. By comparing the dataset differences between the first user behavior dataset and the second user behavior dataset, and based on the degree of anomaly and the scaling ratio of the anomaly in the first user behavior dataset, the degree of anomaly of the current user access request corresponding to the second user behavior dataset is determined.

2. The user management method for a structured platform according to claim 1, characterized in that, The method for determining the role definition and permissions of users in the user registry, and configuring access behavior standards and traffic behavior standards for users includes: analyzing the user information in the user registry, and determining the role definition and permissions of each registered user based on the user role definition information and the corresponding role's permission information in the registry; Based on the preset standard user behavior table, the user access behavior standard and traffic behavior standard are determined by comparing and analyzing the user role definition and permissions in the standard user behavior table, and standard reference values ​​are configured for the user access behavior standard and traffic behavior standard respectively.

3. The user management method for a structured platform according to claim 1, characterized in that, Methods for analyzing a user's past access records to obtain the user's past access behavior information and past traffic behavior information include: analyzing the user's past access records and extracting the user's access behavior information and past traffic behavior information at different nodes; User access behavior information includes: the frequency of user access to different data, the time period of user access, and the type of data accessed by the user; User traffic behavior information includes: user network bandwidth usage information and user server access frequency information.

4. The user management method for a structured platform according to claim 1, characterized in that, The method for calculating the first difference feature between past access behavior information and access behavior standards, and the second difference feature between past traffic behavior information and traffic behavior standards, includes: configuring a first feature value for past user access behavior information, calculating the difference between the first feature value and the access behavior standard reference value, and determining the difference between the first feature value and the access behavior standard reference value as the first difference feature; Configure a second feature value for the traffic behavior information of past users, calculate the difference between the second feature value and the traffic behavior standard reference value, and determine the difference between the second feature value and the traffic behavior standard reference value as the second difference feature.

5. The user management method for a structured platform according to claim 1, characterized in that, The method for sequentially evaluating the first and second metrics on the first user behavior dataset also includes: When evaluating the second indicator on the first user behavior dataset, human management instructions are obtained, and based on the system's preset management instructions - abnormal scaling ratio, the abnormal scaling ratio of the abnormal part of the data corresponding to each behavior factor in the first user behavior dataset that exceeds the standard data boundary is determined.

6. The user management method for a structured platform according to claim 1, characterized in that, The method for determining the degree of abnormality of the current user access request corresponding to the second user behavior dataset based on the degree of abnormality and the abnormal scaling ratio of the first user behavior dataset includes: comparing and analyzing each behavior factor in the second user behavior dataset with the corresponding behavior factor in the first user behavior dataset, defining the abnormal data interval in which each behavior factor in the second user behavior dataset is located, and after scaling the abnormal data interval, determining the abnormal data interval in which each behavior factor in the second user behavior dataset is located, and judging the degree of abnormality of each behavior factor in the second user behavior dataset respectively. Based on the degree of abnormality of each behavioral factor in the second user behavior dataset, determine the degree of abnormality of the current user access request corresponding to the second user behavior dataset.

7. A user management system for a structured platform, applied to the user management method for a structured platform as described in any one of claims 1-6, characterized in that... include: The user behavior standard configuration module is used to determine the user's role definition and permissions in the user registry, and to configure access behavior standards and traffic behavior standards for the user based on the determined user permissions and role definitions. The first user behavior dataset generation module is used to analyze the user's past access records, obtain the user's past access behavior information and past traffic behavior information, calculate the first difference feature between the past access behavior information and the access behavior standard, and the second difference feature between the past traffic behavior information and the traffic behavior standard, and associate the first difference feature and the second difference feature in time order to generate the first user behavior dataset. An anomaly assessment module is used to sequentially assess the first user behavior dataset using a first indicator and a second indicator, and based on the first and second indicator assessments, determine the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset. The second user behavior dataset generation module is used to continuously acquire the current access request information of users at several time points, and analyze the current access request information at each time point to obtain the current access behavior information and current traffic behavior information at each time point. Based on the third difference feature between the current access behavior information and the access behavior standard corresponding to several consecutive preset time points, and the fourth difference feature between the current traffic behavior information and the traffic behavior standard, the second user behavior dataset is determined. The current anomaly detection module is used to compare the differences between the first user behavior dataset and the second user behavior dataset, and determine the degree of anomaly of the current user access request corresponding to the second user behavior dataset based on the degree of anomaly and the anomaly scaling ratio of the first user behavior dataset.

Images