Abnormal behavior detection method, apparatus, device, storage medium, and program product

Abstract

The application relates to the technical field of federated learning, and provides an abnormal behavior detection method and device, equipment, a storage medium and a program product. The method is applied to a client and comprises the following steps: converting operation behavior data of a local user in a preset historical time period into a behavior vector, performing clustering analysis on the behavior vector based on a preset clustering model, obtaining private model parameters of the clustering model and sending the private model parameters to a federated server, receiving global model parameters determined by the federated server according to the private model parameters of each client; and updating the local clustering model according to the global model parameters to detect whether the operation behavior of the local user is abnormal. The model for detecting abnormal behavior is constructed through federated learning. In the model construction and detection process, only the transmission of model parameters is involved, the transmission of original data is avoided, the data leakage risk is reduced, the privacy protection of the original data is improved, and the data security of the abnormal behavior detection process is improved.

Description

Technical Field

[0001] This application relates to the field of federated learning technology, specifically to an abnormal behavior detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the rapid development of modern information technology and the increasing risk of cyberattacks, enterprises face more and more security threats. To ensure the security and reliability of business operations and prevent security incidents caused by malicious operations or negligence by internal employees, timely and accurate monitoring of abnormal employee behavior is particularly necessary for enterprise operations. Employee behavior anomaly detection refers to monitoring and analyzing the operational behavior of enterprise employees to identify potentially abnormal behaviors and provide timely warnings to prevent internal threat incidents.

[0003] Currently, commonly used methods for detecting abnormal employee behavior include rule-based detection methods, machine learning-based detection methods, and deep learning-based detection methods. Among them, rule-based detection methods are limited by fixed rules, lack flexibility, and are difficult to adapt to emerging new attack methods and covert abnormal behaviors, thus limiting their application scope. On the other hand, machine learning or deep learning-based detection methods can adaptively learn new attack methods and are more flexible, but they require a large amount of data as training samples. In the modeling and detection process, a large amount of raw data is needed, which lacks privacy protection for the raw data and poses a risk of data leakage. Summary of the Invention

[0004] This application provides an abnormal behavior detection method, apparatus, device, storage medium, and program product to solve the technical problem that existing abnormal behavior detection methods do not protect the privacy of raw data, which can easily lead to data leakage.

[0005] In a first aspect, embodiments of this application provide an abnormal behavior detection method applied to a client, the abnormal behavior detection method comprising:

[0006] Transform the operational behavior data of local target users within a preset historical time period into behavior vectors;

[0007] Cluster analysis is performed on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model;

[0008] The private model parameters are sent to the federation server, and the global model parameters are received from the federation server; the global model parameters are determined by the federation server based on the private model parameters sent by each client.

[0009] The clustering model is updated based on the global model parameters, and the updated clustering model is used to detect whether there are any abnormalities in the operation behavior of each target user.

[0010] In one embodiment, converting the operational behavior data of a local target user within a preset historical time period into a behavior vector includes:

[0011] Extract the operation behavior data of the local target user within a preset historical time period, as well as the operation object corresponding to the operation behavior;

[0012] The operation behavior and the operation object are concatenated to obtain the behavioral characteristics of the operation behavior data;

[0013] Based on a preset behavior library, the behavior features are mapped to obtain the behavior vector corresponding to the operation behavior data; the behavior library is obtained by concatenating all operation behaviors of each target user with all operation objects and taking the union.

[0014] In one embodiment, the clustering analysis of the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model includes:

[0015] Obtain the user roles of each target user, and classify the behavior vectors of the target users according to the user roles to obtain the behavior vector set corresponding to each user role;

[0016] Based on a preset clustering model, cluster analysis is performed on the behavior vectors in each set of behavior vectors to obtain the private model parameters of the clustering model; the private model parameters include the category center vectors corresponding to each user role.

[0017] In one embodiment, detecting whether the operational behavior of each target user is abnormal using the updated clustering model includes:

[0018] The target user's target operation behavior data is acquired, and the target operation behavior data is transformed into the target user's target behavior vector; the target operation behavior data is arranged in chronological order of operation time.

[0019] Based on a preset sliding step size, the target behavior vector is processed by a sliding window. During the sliding window processing, the cosine similarity between the target behavior vector within the time window and the model parameters of the updated clustering model is calculated to determine the threat level of the target user.

[0020] The target user's operational behavior is determined based on the threat level.

[0021] In one embodiment, after detecting whether the operational behavior of each target user is abnormal using the updated clustering model, the method further includes:

[0022] If the target user's operation behavior is abnormal, the alarm level corresponding to the abnormal operation behavior of the target user is determined according to the threat level;

[0023] According to the corresponding handling measures for the alarm level, alarm handling is carried out on the target user; the handling measures include forced account offline, account login restriction, and account ban.

[0024] Obtain the weight modification factor corresponding to the alarm level and send the weight modification factor to the federation server; the federation server modifies the weight of the private model parameters of the client corresponding to the target user according to the weight modification factor; the weight is used to calculate the global model parameters.

[0025] In one embodiment, before converting the local target user's operational behavior data within a preset historical time period into a behavior vector, the method further includes:

[0026] The historical operation behavior data of the local target user is processed in a structured manner to obtain the structured data corresponding to the operation behavior of the target user;

[0027] Based on the operation time sequence of the historical operation behavior data, the structured data is segmented according to a preset duration to obtain the target user's operation behavior data within a preset historical time period.

[0028] Secondly, embodiments of this application provide an abnormal behavior detection method applied to a federated server, the abnormal behavior detection method comprising:

[0029] Receive private model parameters sent by each client; the private model parameters are obtained by the client through cluster analysis of behavior vectors based on a preset clustering model; the behavior vectors are obtained by the client through transformation of the operation behavior data of local target users within a preset historical time period;

[0030] The global model parameters are determined based on the private model parameters, and the global model parameters are sent to each of the clients. The clients update the clustering model based on the global model parameters, and use the updated clustering model to detect whether there are any abnormalities in the target user's operation behavior.

[0031] Thirdly, embodiments of this application provide an abnormal behavior detection device, comprising:

[0032] The data processing module is used to process the operation behavior data of local target users within a preset historical time period and convert the operation behavior data into behavior vectors.

[0033] The model training module is used to perform cluster analysis on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model.

[0034] The parameter interaction module is used to send the private model parameters to the federation server and receive the global model parameters sent by the federation server; the global model parameters are determined by the federation server based on the private model parameters uploaded by each client.

[0035] An anomaly detection module is used to update the clustering model based on the global model parameters, and to use the updated clustering model to detect whether there are any anomalies in the operational behavior of each target user.

[0036] Fourthly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the abnormal behavior detection method described in the first and second aspects.

[0037] Fifthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the abnormal behavior detection method described in the first and second aspects.

[0038] Sixthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the abnormal behavior detection method described in the first and second aspects.

[0039] The abnormal behavior detection method, apparatus, device, and storage medium provided in this application embodiment involve a client converting local user operation behavior data into behavior vectors and performing cluster analysis on these behavior vectors based on a preset clustering model to obtain private model parameters for the local clustering model. These private model parameters are then sent to a federated server. The federated server determines global model parameters based on the private model parameters of each client and distributes these global model parameters to the clients. The clients receive the global model parameters from the federated server and update their local clustering model accordingly for anomaly detection of local user operations. By constructing a model for detecting abnormal behavior through federated learning, only the model parameters are transmitted during model construction and detection, avoiding the transmission of raw data, reducing the risk of data leakage, and improving the privacy protection of raw data, thereby enhancing the data security of the abnormal behavior detection process. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a flowchart illustrating the abnormal behavior detection method provided in the embodiments of this application;

[0042] Figure 2 This is a schematic diagram of the distributed architecture of federated learning provided in the embodiments of this application;

[0043] Figure 3 This is a schematic diagram of the modeling process provided in an embodiment of this application;

[0044] Figure 4 This is a schematic diagram of the abnormal behavior detection process provided in the embodiments of this application;

[0045] Figure 5 This is another flowchart illustrating the abnormal behavior detection method provided in the embodiments of this application;

[0046] Figure 6 This is a schematic diagram of the abnormal behavior detection device provided in the embodiments of this application;

[0047] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] It should be noted that in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Unless otherwise expressly specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly, for example, as a fixed connection, a detachable connection, or an integral connection; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; or a connection within two elements. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0050] The terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0051] Figure 1 This is a flowchart illustrating the abnormal behavior detection method provided in an embodiment of this application. (Refer to...) Figure 1 The abnormal behavior detection method provided in this application embodiment is applied to a client, which is a participant in federated learning. The abnormal behavior detection method may include:

[0052] Step 100: Convert the local target user's operational behavior data within a preset historical time period into behavior vectors;

[0053] Step 200: Perform cluster analysis on the behavior vector based on a preset clustering model to obtain the private model parameters of the clustering model;

[0054] Step 300: Send the private model parameters to the federation server and receive the global model parameters sent by the federation server; the global model parameters are determined by the federation server based on the private model parameters sent by each client.

[0055] Step 400: Update the clustering model according to the global model parameters, and use the updated clustering model to detect whether there are any abnormalities in the operation behavior of each target user.

[0056] Clients, as participants in federated learning, can include multiple entities. The abnormal behavior detection method provided in this embodiment is applied to any one of these clients. First, the local target user's operational behavior data within a preset historical time period is transformed into a behavior vector. This behavior vector characterizes the behavioral features of the target user's operations within the preset historical time period. It is understood that the target user can include one or more entities, each with a unique user identifier. When multiple target users are included, the local target user's operational behavior data within the preset historical time period includes the operational behavior data of each target user. The operational behavior data of different target users are distinguished based on the user identifier, and each target user's operational behavior data corresponds to a behavior vector. Optionally, the operational behavior data corresponding to the same target user within the preset historical time period can include one or more operational behaviors, each corresponding to the target user's behavior vector. In one embodiment, the behavior vectors of different target users have the same dimension. The dimension of the behavior vector is related to the duration of the preset historical time period. For example, the longer the duration, the more operational behaviors the target user can generate within that time period, and the larger the dimension of the corresponding behavior vector. The dimension of the behavior vector can be determined based on the maximum number of operational behaviors that the target user can generate within the preset time period.

[0057] Based on a pre-defined clustering model, cluster analysis is performed on the target user's behavior vectors. By clustering the behavior vectors corresponding to the target user's actions, the private model parameters of the clustering model are obtained. Different clients perform cluster analysis on their respective local target user behavior vectors, obtaining their local clustering model's private model parameters. These private model parameters are sent to the federated server, and global model parameters are received from the federated server. The local clustering model is updated based on these global model parameters, and the updated clustering model is used to detect any anomalies in the target user's actions. The global model parameters are determined by the federated server based on the private model parameters reported by each client. The client updates its local clustering model based on the global model parameters from the federated server, specifically updating the private model parameters of the local clustering model. Update methods include, but are not limited to, replacing the private model parameters with the global model parameters.

[0058] Specifically, the federated server is responsible for receiving the private model parameters from all clients participating in federated learning, determining the global model parameters based on the received private model parameters, and then distributing these global model parameters to each client. Optionally, the global model parameters for different clients can be the same or different. When different clients correspond to the same global model parameters, the global model parameters distributed by the federated server can be the optimal parameters selected by the federated server from the private model parameters reported by each client, or they can be model parameters obtained by the federated server through weighted calculation of the private model parameters reported by each client. When different clients correspond to different global model parameters, the global model parameters can also be obtained by the federated server adjusting the private model parameters reported by each client. The methods by which the federated server adjusts the private model parameters of clients include, but are not limited to, fine-tuning the private model parameters of other clients based on the optimal parameters among the private model parameters reported by each client.

[0059] Furthermore, each client participating in federated learning updates its local clustering model based on the global model parameters issued by the federated server. The updated clustering model is then used to detect whether there are any anomalies in the operational behavior of the target users on the local machine. Specifically, the global model parameters issued by the federated server are used to update the model parameters of the constructed clustering model, and the updated clustering model is used to detect the operational behavior data of the target users on the local machine, thereby determining whether there are any anomalies in the operational behavior of the target users on the local machine.

[0060] In federated learning, the construction of clustering models and the detection of abnormal behavior only involve the transmission of model parameters. The original data used exists only locally. Therefore, the privacy and security of the original data can be protected, the risk of data leakage can be reduced, and the data security in the modeling and detection process can be improved.

[0061] In this embodiment, the client transforms local user action data into action vectors and performs cluster analysis on these action vectors based on a preset clustering model to obtain private model parameters for the local clustering model. These private model parameters are then sent to the federated server. The federated server determines global model parameters based on the private model parameters of each client and distributes these global model parameters to the clients. The clients receive the global model parameters from the federated server and update their local clustering model accordingly. The updated clustering model is then used to detect anomalies in the actions of local target users. By constructing a clustering model for detecting abnormal behavior through federated learning, only the model parameters are transmitted during model construction and detection, avoiding the transmission of raw data, reducing the risk of data leakage, and improving the privacy protection of raw data, thereby enhancing the data security of the abnormal behavior detection process.

[0062] Optionally, before converting the local target user's operational behavior data within a preset historical time period into behavior vectors, step 100 may further include:

[0063] Step 101: Perform structured processing on the historical operation behavior data of the local target user to obtain the structured data corresponding to the operation behavior of the target user;

[0064] Step 102: Based on the operation time sequence of the historical operation behavior data, the structured data is segmented according to a preset duration to obtain the operation behavior data of the target user within a preset historical time period.

[0065] Before transforming the local target user's operational behavior data within a preset historical time period into behavior vectors, the local target user's historical operational behavior data can be preprocessed. Specifically, the local target user's historical operational behavior data is structured to obtain structured data corresponding to the target user's operational behavior. Based on the operational time sequence of the historical operational behavior data, the structured operational behavior data is segmented according to a preset duration to obtain the target user's operational behavior data within a preset historical time period, where the preset duration is the duration corresponding to the preset historical time period.

[0066] User actions on the client's local machine are generally recorded by the database. Local clients include various operation types such as local devices, remote hosts, and remote databases. Due to differences in the systems and host types of different clients, the data format of user actions recorded by different clients may also differ. By structuring user action data, it is beneficial to unify data standards and formats, facilitating subsequent processing. In one embodiment, structured action data includes data source, user, user identifier, operation time, action, and object. The data source is a local host, a remote host, or a remote database. For example, if the user is "Zhang San", the data source is a local host, the action is "open", the object is "Document / ", and the operation time is "xx year xx month xx day xx hour xx minute xx second", then the user "Zhang San's" action data is that at "xx year xx month xx day xx hour xx minute xx second", the user "Zhang San" "opened" "Document / " (file) on the local host.

[0067] Optionally, step 100, converting the local target user's operational behavior data within a preset historical time period into behavior vectors, may further include:

[0068] Step 103: Extract the operation behavior of the local target user in the operation behavior data within a preset historical time period, and the operation object corresponding to the operation behavior;

[0069] Step 104: The operation behavior and the operation object are concatenated to obtain the behavioral characteristics of the operation behavior data;

[0070] Step 105: Based on a preset behavior library, the behavior features are mapped to obtain the behavior vector corresponding to the operation behavior data; the behavior library is obtained by concatenating all operation behaviors of each target user with all operation objects and taking the union.

[0071] First, extract the target user's operational behaviors from the local target user's operational behavior data within a preset historical time period, along with the objects affected by each behavior. Each behavior can be one or more; multiple different behaviors can affect the same object, and multiple identical behaviors can affect different objects. The operational behaviors and their affected objects are then concatenated to obtain the behavioral features of the target user's operational behavior data. Based on a preset behavior library, the extracted behavioral features are mapped to obtain the corresponding behavior vectors for the target user's operational behavior data. The preset behavior library is obtained by concatenating and taking the union of all operational behaviors and all affected objects for each target user.

[0072] Specifically, the operation behavior data corresponding to the same target user may include one or more operation behaviors. Multiple operation behaviors can be applied to the same or different operation objects. The same repeated operation behavior can be performed multiple times on the same operation object. Different operation behaviors can also be performed multiple times on the same operation object. The same operation behavior can also be repeated multiple times and applied to different operation objects.

[0073] Each client has its own behavior library, which is obtained by collecting the behavioral characteristics of its local target users. Specifically, it acquires all the operation behaviors of all target users on the local client, as well as the operation objects to which each operation points. Each operation behavior and its corresponding operation object are then concatenated to obtain the behavioral characteristics of each target user. Finally, the union of the behavioral characteristics of different target users is taken to obtain the behavior library for that client. The behavior library of any client contains all possible operation behaviors that can be generated locally on that client, as well as all possible operation objects that any operation behavior can point to.

[0074] In one embodiment, the extraction of operational behaviors and objects can be based on structured operational behavior data. Optionally, the types of operational behaviors on different types of hosts are relatively limited, so operational behaviors and objects can be concatenated to obtain richer variations of operational behaviors and objects as markers for distinguishing user behaviors. User operational data is segmented by time period or login session, and the operational behavior data of a user within a certain time period is regarded as a sample, which is then converted into a behavior vector.

[0075] When transforming behavior vectors, all user actions and their objects on the client host are collected beforehand. The actions are then combined into a union and numbered to create a user behavior database. Samples are then mapped based on this behavior database.

[0076] For example, the behavior library of a certain client is shown in List 1 below:

[0077] Table 1:

[0078] serial number 1 2 3 4 5 ... N Operational behavior cd A vi B cat C scp D ssh E ... sudo

[0079] Table 2:

[0080] serial number 1 2 3 4 5 ... N Behavior Vector 1 0 1 0 1 ... 0

[0081] When performing vector transformation, if sample X represents Zhang San's actions within a certain historical time period, including the actions "cd A, cat C, ssh E", then sample X is mapped to a behavior vector. The corresponding behavior number column is marked as 1, indicating that sample X has performed this action. Other non-existent actions in sample X are marked as 0, as shown in Table 2 above. Therefore, the behavior vector corresponding to sample X is: "1,0,1,0,1,...,0".

[0082] Optionally, in step 200, cluster analysis is performed on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model, specifically including:

[0083] Step 201: Obtain the user role of each target user, and classify the behavior vector of the target user according to the user role to obtain the behavior vector set corresponding to each user role;

[0084] Step 202: Based on a preset clustering model, perform clustering analysis on the behavior vectors in each set of behavior vectors to obtain the private model parameters of the clustering model; the private model parameters include the category center vectors corresponding to each user role.

[0085] For the same client, different target users may have different user roles. Different user roles have significant differences in their operational behaviors, while the same user role has a lot of commonalities in their operational behaviors. Therefore, when performing cluster analysis on the behavioral vectors of target users based on a preset clustering model, the cluster analysis is performed on the behavioral vectors corresponding to the operational behaviors of the same user role.

[0086] Specifically, the process begins by acquiring the user roles of each target user. User roles can be categorized based on the target user's organization and / or position and / or job title. The target user's behavior vectors are then classified according to their user roles, resulting in a set of behavior vectors corresponding to each user role. Target users with the same user role are grouped into the same set of behavior vectors, while those with different user roles are grouped into different sets. For each set of behavior vectors, a pre-defined clustering model is used to perform cluster analysis on the behavior vectors within the same set, thereby obtaining the client's private model parameters for clustering. These private model parameters include the cluster center vectors corresponding to each user role, which are obtained through cluster analysis of the behavior vectors within the set corresponding to each user role.

[0087] Optionally, the local modeling process on the client side involves obtaining the cluster centroids of operational behavior data for each category based on user roles. The category centroids are calculated using Formula 1 below; for example, the cluster center for role category 1 is:

[0088]

[0089] In Formula 1, C1 represents the category center vector of the first user role, Num represents the number of users contained in this user role, and the dimension of the vector is N, which is the dimension of the user's behavior database. i1 It is the value of the first dimension of the i-th sample, x iN This is the value of the Nth dimension of the i-th sample. By aggregating and normalizing the behavior vectors of all users within a user role, the centroid of the cluster for that user role can be obtained; the centroid of the cluster is also the category center vector. By calculating the cluster center for each category corresponding to each user role in this way, the local modeling on the client side can be completed, and the private model parameters of the local clustering model can be obtained.

[0090] For example, a user role includes three users: Zhang A, Li B, and Wang C. After their operation behavior data is converted into behavior vectors, the three behavior vectors are: 1,0,1,0,1,...,0; 1,1,1,0,1,...,0; 1,0,1,0,0,...,0.

[0091] According to the cluster centroid calculation method, if the first dimension of the three behavioral vectors takes values ​​of "1,1,1", then the value of the first dimension of their cluster center is (1+1+1) / 3 = 1. If the first dimension takes values ​​of "0,1,0", then the value of the second dimension of their cluster center is (0+1+0) / 3 = 1 / 3. The values ​​of the cluster centers in other dimensions can be calculated in turn to obtain the cluster center vector for that category.

[0092] Optionally, after obtaining the category center vectors for each category, the client sends the category center vectors and the corresponding behavior vectors of the operational behavior data used as samples for cluster analysis to the federated server. The federated server performs modeling based on the category center vectors and behavior vectors sent by each client to obtain global model parameters.

[0093] Specifically, during the federated modeling process, the federated server first initializes the federated parameters. During the first execution, the weight parameters are set according to the number of hosts participating in the federated calculation and the number of host samples. Generally, the weight of the i-th host is calculated as shown in Formula 2 below:

[0094]

[0095] Where M represents the number of client hosts participating in federated learning. The more sample data a client host generates during the federated learning process, the greater its corresponding weight. Initially, the sum of the weights of all client hosts is 1.

[0096] When performing federated modeling, the federated server first loads the federated weights of each client host based on the obtained class center vectors of each client and the sample data. The private model parameters of the local model of the i-th client host are set to P. i Then in each P i Each includes a local clustering parameter for the j-th user role, denoted as P. ij For each user role j within the federated model, its cluster center vector is calculated as follows:

[0097]

[0098] In the federated modeling process, each user role category corresponds to a category center vector. This category center vector is calculated based on the private model parameters output by each client host, without directly using the original operational behavior data. Therefore, the modeling process can guarantee the privacy of user operational behavior. That is, the category center vector, which serves as a global model parameter, is obtained by weighted calculation of the category center vectors of the same user role reported by different clients.

[0099] Optionally, in step 400, the local clustering model is updated according to the global model parameters issued by the federated server, and the updated clustering model is used to detect whether there are any anomalies in the operational behavior of each target user locally, specifically including:

[0100] Step 401: Obtain the target operation behavior data of the target user to be detected, and convert the target operation behavior data into the target behavior vector of the target user; the target operation behavior data is arranged in the order of operation time;

[0101] Step 402: Based on a preset sliding step size, perform sliding window processing on the target behavior vector. During the sliding window processing, calculate the cosine similarity between the target behavior vector within the time window and the model parameters of the updated clustering model to determine the threat level of the target user.

[0102] Step 403: Determine whether the target user's operational behavior is abnormal based on the threat level.

[0103] When the client performs anomaly detection on the target user's actions locally, it first acquires the target user's action data as a sample to be detected. This action data can be a historical record of the target user's most recently generated actions. The action data used as the sample to be detected is then converted into a corresponding action vector, i.e., the target action vector. Based on a preset sliding step size, a sliding window process is applied to the target action vector. During the sliding window process, the cosine similarity between the target action vector within the time window and the updated clustering model parameters is calculated. Based on this cosine similarity, the threat level of the target user's abnormal action behavior is determined. The presence of anomalies in the target user's action behavior is then determined based on this threat level. For example, if the threat level of the target user is greater than a preset threshold, then the target user's action behavior is abnormal; conversely, if the threat level of the target user is less than or equal to the preset threshold, then the target user's action behavior is not abnormal.

[0104] Optionally, when the client performs anomaly detection on user actions locally, it first acquires the sample to be detected, along with a preset sliding window size and sliding step size. The client then arranges the user action data from each local user in the sample in chronological order. Taking a sliding window size of 10 as an example, using a sliding window approach, for each user i, the sliding window is moved to the earliest 10 actions of user i. The action vectors corresponding to the user actions within the sliding window are merged and denoted as action vector X. This is based on the global model parameters issued by the federated server. Calculate the cosine similarity between user i and the global model parameters using the following formula:

[0105]

[0106] The threat level of behavior vector X is given by: Threat level(X) = 1 - CS(X). Then, following the chronological order, the time window is slid one unit, removing the earliest behavior vector within the window and adding a new one. This threat level calculation process is repeated until all user behaviors in the sample to be tested have been detected. The sliding window size can be configured according to actual detection needs; that is, the size is determined based on the number of behaviors required to detect abnormal behavior. This allows for the detection of abnormal behavior by any user within the window.

[0107] Existing anomaly detection methods lack dynamic update and anomaly measurement mechanisms. Regarding dynamic update mechanisms, most methods analyze and detect anomalies according to predetermined rules. These methods are typically fixed, using specific algorithms or processing procedures, and perform deterministic anomaly detection, unable to be dynamically adjusted according to actual needs. Especially in distributed anomaly detection, they cannot effectively adjust the modeling process based on anomaly detection results, optimize the parameter weights of detection nodes, or establish feedback mechanisms for results. This leads to repeated anomaly reports for similar behaviors, and some anomalies may even affect the overall modeling accuracy. Regarding anomaly measurement mechanisms, some behaviors may not be offensive, but during detection, regardless of the risk level, the result only reports "normal" or "abnormal," lacking a measurement mechanism for anomalies. This makes it difficult to determine the importance and risk level of behaviors, causing confusion for security managers.

[0108] The abnormal behavior detection method provided in this application addresses privacy and data security issues during model building by establishing a distributed anomaly detection system under a federated learning architecture. It also establishes a model feedback mechanism to dynamically adjust and update model parameters based on anomaly identification results, making them better suited for anomaly detection in streaming data. Furthermore, it employs a sliding window approach for detection, performing multiple data validations and providing refined risk assessments based on the validation results, thereby improving the reliability and reliability of the anomaly detection results.

[0109] Specifically, in step 400, after updating the clustering model based on the global model parameters and using the updated clustering model to detect whether there are any anomalies in the operational behavior of each target user locally, it may further include:

[0110] Step 501: If the target user's operation behavior is abnormal, then determine the alarm level corresponding to the abnormal operation behavior of the target user based on the threat level.

[0111] Step 502: According to the handling measures corresponding to the alarm level, perform alarm handling on the target user; the handling measures include forced account offline, account login restriction, and account ban.

[0112] Step 503: Obtain the weight modification factor corresponding to the alarm level and send the weight modification factor to the federation server; the federation server modifies the weight of the private model parameters of the client corresponding to the target user according to the weight modification factor; the weight is used to calculate the global model parameters.

[0113] If the target user's operation behavior is abnormal, the alarm level corresponding to the abnormal operation behavior is determined based on the calculated threat level. The target user is then dealt with according to the corresponding handling measures, which include, but are not limited to, forced account shutdown, account login restriction, and account ban.

[0114] Furthermore, different alarm levels correspond to different weight modification factors. The weight modification factor corresponding to each alarm level is obtained and sent to the federation server. The federation server then modifies the weights of the private model parameters of the client corresponding to the target user based on this weight modification factor. The weight modified by the federation server is used to calculate the weights of the global model parameters, which is the parameter u involved in Formula 3 above. i It is understandable that for different clients, the weight modification factor corresponding to the same alarm level can be the same or different, and no specific limitation is made here.

[0115] By dynamically adjusting the weights of the model parameters, the impact of risk points on the class center vector during the modeling process can be identified. The higher the degree of behavioral abnormality, the further away from the cluster center, which will lead to the cluster center shift during the modeling process and ultimately affect the model accuracy.

[0116] In one embodiment, based on Figure 2 The distributed architecture of federated learning shown in this application embodiment presents an "one-to-many" approach in the overall detection process, where multiple clients' local hosts are connected to the federated server and cooperate to detect abnormal behavior.

[0117] Specifically, refer to Figure 3 The modeling process based on federated learning, as shown, involves multiple client local hosts with physical and data isolation. They only transmit model parameters to the federated server. The federated server performs federated modeling based on the private model parameters reported by each client, forming a model parameter matrix, and determines the global model parameters to distribute to each client. For anomaly detection on the user client's local machine, a sliding window approach is used, validating the sample multiple times. When anomaly is detected, a corresponding weight modification factor is reported to the federated server based on the alarm level of the anomaly. The federated server dynamically adjusts the client's weights based on this factor, thus establishing a model feedback mechanism. During the modeling process, the impact of risky data on model accuracy is eliminated.

[0118] Furthermore, referring to Figure 4The abnormal behavior detection process shown involves the client's local host preprocessing the user's operational behavior data. This preprocessing includes structuring and standardizing the data from different sources. Based on the preprocessed data, behavior mapping transforms it into behavior vectors for local modeling, resulting in private model parameters for the local clustering model. These parameters are then transmitted to the federated server. It's important to note that to ensure the consistency of the data format received by the federated server, each client must convert the transmitted model parameters to the federated server's preset federated data format. The federated server initializes or updates the weights of each client host based on the private model parameters and calculates global model parameters, which are then returned to the client. The client's local host updates its local clustering model based on the global model parameters from the federated server. This updated model is used to detect anomalies in the user's operational behavior. Upon detecting anomalies, the host issues alerts according to the alert level and transmits the corresponding weight modification factor to the federated server. The federated server modifies and updates the client's weight based on the weight modification factor provided by the client.

[0119] During the transmission of model parameters, differential privacy, homomorphic encryption, or other methods can be used to encrypt the model parameters before transmission. The local modeling process on the client's local host and the federated modeling process on the federated server can be referred to the descriptions in the above embodiments, and will not be repeated here.

[0120] In this embodiment, based on the federated learning architecture, no raw data is transmitted during the modeling process of abnormal behavior detection. Only model parameters are transmitted. The transmission of model parameters can also be encrypted using non-plaintext data to avoid data leakage caused by transmitting raw data during the modeling process.

[0121] Furthermore, a dynamic adjustment mechanism for model parameters based on abnormal behavior detection results updates cluster centers in real time, continuously optimizes model detection performance, further reduces the impact of abnormal behavior on cluster centers during the modeling process, and improves detection accuracy.

[0122] For abnormal behavior, the evaluation of the degree of abnormality has been refined, multiple alarm levels have been set, and different handling measures have been adopted according to different alarm levels. At the same time, the modeling process has been optimized and adjusted according to different alarm levels, which has improved the ability to express alarm results and enhanced the ability to interpret and handle abnormal behavior alarms.

[0123] Figure 5This is another flowchart illustrating the abnormal behavior detection method provided in the embodiments of this application, based on Figure 5 This application also provides an abnormal behavior detection method applied to a federated server, the abnormal behavior detection method comprising:

[0124] S1, Receive private model parameters sent by each client; the private model parameters are obtained by the client performing cluster analysis on the behavior vector based on a preset clustering model; the behavior vector is obtained by the client transforming the operation behavior data of the local target user within a preset historical time period;

[0125] S2, determine the global model parameters based on the private model parameters, and send the global model parameters to each client; the client updates the clustering model based on the global model parameters, and uses the updated clustering model to detect whether there are any abnormalities in the operation behavior of the target user on the local machine.

[0126] The system retrieves private model parameters sent by each client. These parameters are obtained by the client through cluster analysis of the behavior vectors of local target users based on a preset clustering model. The private model parameters are the model parameters of this clustering model. The behavior vectors used for cluster analysis are obtained by the client from the operational behavior data of local target users within a preset historical time period. The client retrieves operational behavior data of one or more local target users within a preset historical time period, transforms the operational behavior data of each target user into a corresponding behavior vector, and performs cluster analysis on the transformed behavior vectors based on a preset local clustering model to obtain the private model parameters of the local clustering model, thus completing local modeling.

[0127] Furthermore, global model parameters are determined based on the private model parameters of each client, and these global model parameters are then distributed to each client. The client updates its local clustering model based on the global model parameters distributed by the federated server, and uses the updated clustering model to detect whether there are any anomalies in the operational behavior of each target user locally.

[0128] In this embodiment, federated learning in the modeling and detection of abnormal behavior only involves the transmission of model parameters, avoiding the transmission of original operational behavior data. This avoids data leakage caused by data transmission during the modeling and detection process, reduces the risk of data leakage, and improves data security.

[0129] The abnormal behavior detection method for federated servers described in this application embodiment can be referred to in conjunction with the abnormal behavior detection methods for clients described in the above embodiments, and will not be repeated here.

[0130] The abnormal behavior detection device provided in the embodiments of this application is described below. The abnormal behavior detection device described below can be referred to in correspondence with the abnormal behavior detection method described above.

[0131] Reference Figure 6 The abnormal behavior detection device provided in this application includes:

[0132] Data processing module 10 is used to convert the operation behavior data of local target users within a preset historical time period into behavior vectors;

[0133] The model training module 20 is used to perform cluster analysis on the behavior vector based on a preset clustering model to obtain the private model parameters of the clustering model.

[0134] The parameter interaction module 30 is used to send the private model parameters to the federation server and receive the global model parameters sent by the federation server; the global model parameters are determined by the federation server based on the private model parameters uploaded by each client.

[0135] The anomaly detection module 40 is used to update the clustering model according to the global model parameters, and to use the updated clustering model to detect whether there are any anomalies in the operation behavior of each target user.

[0136] In one embodiment, the abnormal behavior detection device further includes a data preprocessing module, which is also used for:

[0137] The historical operation behavior data of the local target user is processed in a structured manner to obtain the structured data corresponding to the operation behavior of the target user;

[0138] Based on the operation time sequence of the historical operation behavior data, the structured data is segmented according to a preset duration to obtain the target user's operation behavior data within a preset historical time period.

[0139] In one embodiment, the data processing module 10 is further configured to:

[0140] Extract the operation behavior from the local target's operation behavior data within a preset historical time period, and the operation object corresponding to the operation behavior;

[0141] The operation behavior and the operation object are concatenated to obtain the behavioral characteristics of the operation behavior data;

[0142] Based on a preset behavior library, the behavior features are mapped to obtain the behavior vector corresponding to the operation behavior data; the behavior library is obtained by concatenating all operation behaviors of each target user with all operation objects and taking the union.

[0143] In one embodiment, the model training module 20 is further configured to:

[0144] Obtain the user roles of each target user, and classify the behavior vectors of the target users according to the user roles to obtain the behavior vector set corresponding to each user role;

[0145] Cluster analysis is performed on the behavior vectors in each of the aforementioned behavior vector sets to construct a cluster model corresponding to the target user; the private model parameters of the cluster model include the category center vectors corresponding to each of the aforementioned user roles.

[0146] In one embodiment, the anomaly detection module 40 is further configured to:

[0147] The target user's target operation behavior data is acquired, and the target operation behavior data is transformed into the target user's target behavior vector; the target operation behavior data is arranged in chronological order of operation time.

[0148] Based on a preset sliding step size, the target behavior vector is processed by a sliding window. During the sliding window processing, the cosine similarity between the target behavior vector within the time window and the model parameters of the updated clustering model is calculated to determine the threat level of the target user.

[0149] The target user's operational behavior is determined based on the threat level.

[0150] In one embodiment, the abnormal behavior detection device further includes an alarm handling module, used for:

[0151] If the target user's operation behavior is abnormal, the alarm level corresponding to the abnormal operation behavior of the target user is determined according to the threat level;

[0152] According to the corresponding handling measures for the alarm level, alarm handling is carried out on the target user; the handling measures include forced account offline, account login restriction, and account ban.

[0153] Obtain the weight modification factor corresponding to the alarm level and send the weight modification factor to the federation server; the federation server modifies the weight of the private model parameters of the client corresponding to the target user according to the weight modification factor; the weight is used to calculate the global model parameters.

[0154] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call a computer program in the memory 730 to execute steps of an abnormal behavior detection method applied to the client, such as including:

[0155] Transform the operational behavior data of local target users within a preset historical time period into behavior vectors;

[0156] Cluster analysis is performed on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model;

[0157] The private model parameters are sent to the federation server, and the global model parameters are received from the federation server; the global model parameters are determined by the federation server based on the private model parameters sent by each client.

[0158] The clustering model is updated based on the global model parameters, and the updated clustering model is used to detect whether there are any abnormalities in the operation behavior of each target user.

[0159] Alternatively, steps can be performed using methods for detecting abnormal behavior applied to the federated server, such as:

[0160] Receive private model parameters sent by each client; the private model parameters are obtained by the client through cluster analysis of behavior vectors based on a preset clustering model; the behavior vectors are obtained by the client through transformation of the operation behavior data of local target users within a preset historical time period;

[0161] The global model parameters are determined based on the private model parameters, and the global model parameters are sent to each of the clients. The clients update the clustering model based on the global model parameters, and use the updated clustering model to detect whether there are any abnormalities in the target user's operation behavior.

[0162] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0163] On the other hand, embodiments of this application also provide a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the abnormal behavior detection method for a client provided in the above embodiments, such as including:

[0164] Transform the operational behavior data of local target users within a preset historical time period into behavior vectors;

[0165] Cluster analysis is performed on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model;

[0166] The private model parameters are sent to the federation server, and the global model parameters are received from the federation server; the global model parameters are determined by the federation server based on the private model parameters sent by each client.

[0167] The clustering model is updated based on the global model parameters, and the updated clustering model is used to detect whether there are any abnormalities in the operation behavior of each target user.

[0168] Alternatively, the steps of the abnormal behavior detection method for federated servers provided in the above embodiments can be performed, including, for example:

[0169] Receive private model parameters sent by each client; the private model parameters are obtained by the client through cluster analysis of behavior vectors based on a preset clustering model; the behavior vectors are obtained by the client through transformation of the operation behavior data of local target users within a preset historical time period;

[0170] The global model parameters are determined based on the private model parameters, and the global model parameters are sent to each of the clients. The clients update the clustering model based on the global model parameters, and use the updated clustering model to detect whether there are any abnormalities in the target user's operation behavior.

[0171] On the other hand, embodiments of this application also provide a processor-readable storage medium storing a computer program, the computer program being used to cause a processor to execute the steps of the abnormal behavior detection method applied to a client provided in the above embodiments, for example including:

[0172] Transform the operational behavior data of local target users within a preset historical time period into behavior vectors;

[0173] Cluster analysis is performed on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model;

[0174] The private model parameters are sent to the federation server, and the global model parameters are received from the federation server; the global model parameters are determined by the federation server based on the private model parameters sent by each client.

[0175] The clustering model is updated based on the global model parameters, and the updated clustering model is used to detect whether there are any abnormalities in the operation behavior of each target user.

[0176] Alternatively, the steps of the abnormal behavior detection method for federated servers provided in the above embodiments can be performed, including, for example:

[0177] Receive private model parameters sent by each client; the private model parameters are obtained by the client through cluster analysis of behavior vectors based on a preset clustering model; the behavior vectors are obtained by the client through transformation of the operation behavior data of local target users within a preset historical time period;

[0178] The global model parameters are determined based on the private model parameters, and the global model parameters are sent to each of the clients. The clients update the clustering model based on the global model parameters, and use the updated clustering model to detect whether there are any abnormalities in the target user's operation behavior.

[0179] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0180] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0181] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An abnormal behavior detection method, applied to a client, characterized in that, The abnormal behavior detection method includes: Transform the operational behavior data of local target users within a preset historical time period into behavior vectors; Cluster analysis is performed on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model; The private model parameters are sent to the federation server, and the global model parameters are received from the federation server; the global model parameters are determined by the federation server based on the private model parameters sent by each client. The clustering model is updated based on the global model parameters, and the updated clustering model is used to detect whether there are any abnormalities in the operational behavior of each target user. The step of using the updated clustering model to detect whether the operational behavior of each target user is abnormal includes: The target user's target operation behavior data is acquired, and the target operation behavior data is transformed into the target user's target behavior vector; the target operation behavior data is arranged in chronological order of operation time. Based on a preset sliding step size, the target behavior vector is processed by a sliding window. During the sliding window processing, the cosine similarity between the target behavior vector within the time window and the model parameters of the updated clustering model is calculated to determine the threat level of the target user. Determine whether the target user's operational behavior is abnormal based on the threat level; After detecting whether the operational behavior of each target user is abnormal using the updated clustering model, the method further includes: If the target user's operation behavior is abnormal, the alarm level corresponding to the abnormal operation behavior of the target user is determined according to the threat level; According to the corresponding handling measures for the alarm level, alarm handling is carried out on the target user; the handling measures include forced account offline, account login restriction, and account ban. Obtain the weight modification factor corresponding to the alarm level and send the weight modification factor to the federation server; the federation server modifies the weight of the private model parameters of the client corresponding to the target user according to the weight modification factor; the weight is used to calculate the global model parameters.

2. The abnormal behavior detection method of claim 1, wherein, The step of converting local target user's operational behavior data within a preset historical time period into behavior vectors includes: Extract the operation behavior data of the local target user within a preset historical time period, as well as the operation object corresponding to the operation behavior; The operation behavior and the operation object are concatenated to obtain the behavioral characteristics of the operation behavior data; Based on a preset behavior library, the behavior features are mapped to obtain the behavior vector corresponding to the operation behavior data; the behavior library is obtained by concatenating all operation behaviors of each target user with all operation objects and taking the union.

3. The abnormal behavior detection method of claim 1, wherein, The clustering analysis of the behavior vectors based on a preset clustering model yields the private model parameters of the clustering model, including: Obtain the user roles of each target user, and classify the behavior vectors of the target users according to the user roles to obtain the behavior vector set corresponding to each user role; Based on a preset clustering model, cluster analysis is performed on the behavior vectors in each set of behavior vectors to obtain the private model parameters of the clustering model; the private model parameters include the category center vectors corresponding to each user role.

4. The abnormal behavior detection method of claim 1, wherein, Before converting the local target user's operational behavior data within a preset historical time period into a behavior vector, the method further includes: The historical operation behavior data of the local target user is processed in a structured manner to obtain the structured data corresponding to the operation behavior of the target user; Based on the operation time sequence of the historical operation behavior data, the structured data is segmented according to a preset duration to obtain the target user's operation behavior data within a preset historical time period. 5.A method of anomaly behavior detection, applied to a federation server, comprising: The abnormal behavior detection method includes: Receive private model parameters sent by each client; the private model parameters are obtained by the client through cluster analysis of behavior vectors based on a preset clustering model; the behavior vectors are obtained by the client through transformation of the operation behavior data of local target users within a preset historical time period; The global model parameters are determined based on the private model parameters, and the global model parameters are sent to each of the clients; the clients update the clustering model based on the global model parameters, and use the updated clustering model to detect whether there are any abnormalities in the target user's operation behavior; The step of using the updated clustering model to detect whether the target user's operational behavior is abnormal includes: The target user's target operation behavior data is acquired, and the target operation behavior data is transformed into the target user's target behavior vector; the target operation behavior data is arranged in chronological order of operation time. Based on a preset sliding step size, the target behavior vector is processed by a sliding window. During the sliding window processing, the cosine similarity between the target behavior vector within the time window and the model parameters of the updated clustering model is calculated to determine the threat level of the target user. Determine whether the target user's operational behavior is abnormal based on the threat level; After detecting whether the target user's operational behavior is abnormal using the updated clustering model, the method further includes: If the target user's operation behavior is abnormal, the alarm level corresponding to the abnormal operation behavior of the target user is determined according to the threat level; According to the corresponding handling measures for the alarm level, alarm handling is carried out on the target user; the handling measures include forced account offline, account login restriction, and account ban. Obtain the weight modification factor corresponding to the alarm level and send the weight modification factor to the federation server; the federation server modifies the weight of the private model parameters of the client corresponding to the target user according to the weight modification factor; the weight is used to calculate the global model parameters.

6. An abnormal behavior detection apparatus characterized by comprising: include: The data processing module is used to transform the operational behavior data of local target users within a preset historical time period into behavior vectors; The model training module is used to perform cluster analysis on the behavior vectors based on a preset clustering model to obtain the private model parameters of the clustering model. The parameter interaction module is used to send the private model parameters to the federation server and receive the global model parameters sent by the federation server; the global model parameters are determined by the federation server based on the private model parameters uploaded by each client. An anomaly detection module is used to update the clustering model according to the global model parameters, and to use the updated clustering model to detect whether there are any anomalies in the operation behavior of each target user. The anomaly detection module is also used for: The target user's target operation behavior data is acquired, and the target operation behavior data is transformed into the target user's target behavior vector; the target operation behavior data is arranged in chronological order of operation time. Based on a preset sliding step size, the target behavior vector is processed by a sliding window. During the sliding window processing, the cosine similarity between the target behavior vector within the time window and the model parameters of the updated clustering model is calculated to determine the threat level of the target user. Determine whether the target user's operational behavior is abnormal based on the threat level; The abnormal behavior detection device also includes an alarm handling module, used for: If the target user's operation behavior is abnormal, the alarm level corresponding to the abnormal operation behavior of the target user is determined according to the threat level; According to the corresponding handling measures for the alarm level, alarm handling is carried out on the target user; the handling measures include forced account offline, account login restriction, and account ban. Obtain the weight modification factor corresponding to the alarm level, and send the weight modification factor to the federation server; The federated server modifies the weights of the private model parameters of the client corresponding to the target user according to the weight modification factor; the weights are used to calculate the global model parameters.

7. An electronic device comprising a processor and a memory having a computer program stored therein, characterized in that When the processor executes the computer program, it implements the steps of the abnormal behavior detection method according to any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal behavior detection method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal behavior detection method as described in any one of claims 1 to 5.

Images