A user operation log data anomaly identification method, device, medium and product

Abstract

The application discloses a user operation log data exception identification method and device, medium and product, wherein different logs in acquired user operation log data are taken as network nodes, mutual information between different nodes is calculated, a non-directional edge is determined according to the mutual information between different nodes, a non-directional minimum support tree is constructed, nodes in the non-directional minimum support tree are oriented, a preliminary minimum support tree structure is determined, node sequence groups are obtained by performing node sequence search in the minimum support tree structure, different node sequences are taken as different individuals in an initial population, the fitness of different individuals in the initial population is calculated, the initial population is updated according to the fitness of different individuals and a preset population optimization strategy, and the node sequence of an individual with the maximum fitness in the updated population is taken as a user operation exception log. The application can improve the optimization efficiency and optimization accuracy.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and more specifically, to a method, apparatus, medium, and product for identifying anomalies in user operation log data. Background Technology

[0002] Telecommunications companies generate massive amounts of business data, which harbors inherent data security risks. To identify potential and accumulated data security issues, data mining analysis methods are needed to identify abnormal operation data and implement security governance. Bayesian networks are an important method in the field of data mining, capable of solving problems of uncertainty. Bayesian network structure learning algorithms can be used to analyze abnormal operation logs generated under uncertain user behavior.

[0003] However, existing methods for detecting abnormal operation logs in communication services mainly rely on improving text classification algorithms or classifying based on data statistical analysis. They select key fields from user logs for analysis based on established rules, but they cannot effectively mine and analyze logs generated under uncertain user behavior. They are overly dependent on existing data and have poor learning performance on small datasets, resulting in low optimization accuracy and efficiency. Summary of the Invention

[0004] Compared with existing technologies, this invention proposes a method, device, medium, and product for identifying anomalies in user operation log data, which can improve the efficiency and accuracy of optimization.

[0005] This invention provides a method for identifying anomalies in user operation log data, the method comprising:

[0006] The different logs in the acquired user operation log data are used as network nodes, and the mutual information between different nodes is calculated.

[0007] Undirected edges are determined based on the mutual information between different nodes, an undirected minimum support tree is constructed, and the nodes in the undirected minimum support tree are oriented to determine the preliminary minimum support tree structure.

[0008] In the minimum support tree structure, a node order search is performed to obtain a node order group. Different node orders are used as different individuals in the initial population, and the fitness of different individuals in the initial population is calculated.

[0009] The initial population is updated based on the fitness of different individuals and a preset population optimization strategy;

[0010] The node order of the individual with the highest fitness in the updated population is used as the user operation exception log.

[0011] Preferably, the initial population is updated according to the fitness of different individuals and a preset population optimization strategy, including:

[0012] From the initial population, select a predetermined first number of individuals in descending order of fitness to form a headhunting group, and select a predetermined second number of individuals outside the headhunting group to form a wandering group.

[0013] Calculate the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group within the wandering group;

[0014] The individuals in the initial population are updated based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group;

[0015] When the preset update termination condition is not met, select the headhunter group and the wandering group from the initial population of the update, and update the individuals in the initial population according to the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group until the update termination condition is met.

[0016] When the update termination condition is met, stop the initial population update.

[0017] Further, updating the individuals in the initial population based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group includes:

[0018] When the fitness of the first individual in the wandering group is greater than that of the second individual in the headhunting group, the first individual is updated to the headhunting group.

[0019] When the fitness of all individuals in the headhunter group is not less than the fitness of the third individual in the wandering group, the third individual is updated.

[0020] Preferably, updating the individuals in the initial population based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group further includes:

[0021] In the initial population, a predetermined third number of individuals are selected as the aggressive group, excluding the headhunting group and the wandering group.

[0022] Calculate the fitness of individuals in the aggressive group within the aggressive group;

[0023] When the fitness of the fourth individual in the aggressive group is greater than the fitness of the second individual in the headhunting group, the fitness of the individual in the initial population is recalculated, and the first number of individuals are reselected from the initial population in descending order of fitness to form the headhunting group.

[0024] Preferably, updating the individuals in the initial population based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group further includes:

[0025] Calculate the absolute value of the difference between the fitness of the fourth individual in the aggressive group and the fitness of the second individual in the headhunter group;

[0026] When the calculated absolute value is within the range determined based on the fitness of the fourth individual and the fitness of the second individual, select a portion of the node fragments of the second individual, replace the mapped node fragments at the same position in the fourth individual, and update the fourth individual.

[0027] Preferably, updating the individuals in the initial population based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group further includes:

[0028] When a node in the fourth individual, excluding the mapped node fragment, is duplicated with a node at the first position in the partial node fragment, the node corresponding to the first position in the fourth individual is retained.

[0029] Preferably, updating the third individual includes:

[0030] The dynamic mutation probability is calculated based on the preset dynamic self-mutation strategy;

[0031] The length of the mutated node segment is determined based on the dynamic mutation probability.

[0032] The positions of all mutations in the third body are determined based on the length of the mutated node fragment;

[0033] Determine mutated node fragments by locating nodes;

[0034] By iterating through and replacing each mutation position in the third individual based on the mutation node fragment, multiple new mutated individuals are obtained;

[0035] Calculate the fitness of the mutated new individual in the wandering group, and determine the mutated new individual with the highest fitness as the third individual after the update.

[0036] Preferably, orienting the nodes in the undirected minimum support tree to determine the preliminary minimum support tree structure includes:

[0037] Each element in the set of potential parent nodes of each node in the undirected minimum support tree is taken as the parent node of that node, and different substructures are constructed; the matching score of different substructures and the preset standard training dataset is calculated; the node with the highest matching score in the substructure of that node is taken as the parent node of that node.

[0038] Connect each node of the undirected minimum support tree to its corresponding parent node to obtain the minimum support tree structure.

[0039] This invention also provides a device for identifying abnormal user operation log data, the device comprising:

[0040] The mutual information calculation module is used to calculate the mutual information between different nodes by taking different logs in the acquired user operation log data as network nodes.

[0041] The support tree determination module is used to determine undirected edges based on the mutual information between different nodes, construct an undirected minimum support tree, orient the nodes in the undirected minimum support tree, and determine the preliminary minimum support tree structure.

[0042] The population determination module is used to perform node order search in the minimum support tree structure to obtain a node order group, take different node orders as different individuals in the initial population, and calculate the fitness of different individuals in the initial population.

[0043] The population update module is used to update the initial population based on the fitness of different individuals and a preset population optimization strategy.

[0044] The results output module is used to take the node order of the individual with the highest fitness in the updated population as the user operation exception log.

[0045] Preferably, the population update module is specifically used for:

[0046] From the initial population, select a predetermined first number of individuals in descending order of fitness to form a headhunting group, and select a predetermined second number of individuals outside the headhunting group to form a wandering group.

[0047] Calculate the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group within the wandering group;

[0048] The individuals in the initial population are updated based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group;

[0049] When the preset update termination condition is not met, select the headhunter group and the wandering group from the initial population of the update, and update the individuals in the initial population according to the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group until the update termination condition is met.

[0050] When the update termination condition is met, stop the initial population update.

[0051] Preferably, the population update module is specifically used for:

[0052] When the fitness of the first individual in the wandering group is greater than that of the second individual in the headhunting group, the first individual is updated to the headhunting group.

[0053] When the fitness of all individuals in the headhunter group is not less than the fitness of the third individual in the wandering group, the third individual is updated.

[0054] Preferably, the population update module is specifically used for:

[0055] In the initial population, a predetermined third number of individuals are selected as the aggressive group, excluding the headhunting group and the wandering group.

[0056] Calculate the fitness of individuals in the aggressive group within the aggressive group;

[0057] When the fitness of the fourth individual in the aggressive group is greater than the fitness of the second individual in the headhunting group, the fitness of the individual in the initial population is recalculated, and the first number of individuals are reselected from the initial population in descending order of fitness to form the headhunting group.

[0058] Preferably, the population update module is specifically used for:

[0059] Calculate the absolute value of the difference between the fitness of the fourth individual in the aggressive group and the fitness of the second individual in the headhunter group;

[0060] When the calculated absolute value is within the range determined based on the fitness of the fourth individual and the fitness of the second individual, select a portion of the node fragments of the second individual, replace the mapped node fragments at the same position in the fourth individual, and update the fourth individual.

[0061] Preferably, the population update module is specifically used for:

[0062] When a node in the fourth individual, excluding the mapped node fragment, is duplicated with a node at the first position in the partial node fragment, the node corresponding to the first position in the fourth individual is retained.

[0063] Preferably, the population update module is specifically used for:

[0064] The dynamic mutation probability is calculated based on the preset dynamic self-mutation strategy;

[0065] The length of the mutated node segment is determined based on the dynamic mutation probability.

[0066] The positions of all mutations in the third body are determined based on the length of the mutated node fragment;

[0067] Determine mutated node fragments by locating nodes;

[0068] By iterating through and replacing each mutation position in the third individual based on the mutation node fragment, multiple new mutated individuals are obtained;

[0069] Calculate the fitness of the mutated new individual in the wandering group, and determine the mutated new individual with the highest fitness as the third individual after the update.

[0070] Preferably, orienting the nodes in the undirected minimum support tree to determine the preliminary minimum support tree structure includes:

[0071] Each element in the set of potential parent nodes of each node in the undirected minimum support tree is taken as the parent node of that node, and different substructures are constructed; the matching score of different substructures and the preset standard training dataset is calculated; the node with the highest matching score in the substructure of that node is taken as the parent node of that node.

[0072] Connect each node of the undirected minimum support tree to its corresponding parent node to obtain the minimum support tree structure.

[0073] This invention also provides a user operation log data anomaly identification device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a user operation log data anomaly identification method as described in any of the above embodiments.

[0074] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute a user operation log data anomaly identification method as described in any of the above embodiments.

[0075] This invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0076] Compared with existing technologies, this invention provides a method, apparatus, medium, and product for identifying anomalies in user operation log data. The method involves treating different logs in the acquired user operation log data as network nodes and calculating the mutual information between these nodes. Based on the magnitude of the mutual information, undirected edges are determined, and an undirected minimum support tree is constructed. The nodes in the undirected minimum support tree are oriented to determine a preliminary minimum support tree structure. A node order search is performed within the minimum support tree structure to obtain a node order group. Different node orders are used as different individuals in the initial population, and the fitness of each individual in the initial population is calculated. The initial population is updated based on the fitness of different individuals and a preset population optimization strategy. The node order of the individual with the highest fitness in the updated population is used as the user operation anomaly log. This solution improves the efficiency and accuracy of optimization. Attached Figure Description

[0077] Figure 1 This is a flowchart illustrating a method for identifying abnormal user operation log data provided in an embodiment of the present invention;

[0078] Figure 2 This is another flowchart illustrating the user operation log data anomaly identification method provided in this embodiment of the invention;

[0079] Figure 3 This is a schematic diagram illustrating the principle of removing abnormal nodes in individual mutation updates provided in an embodiment of the present invention;

[0080] Figure 4 This is a schematic diagram of the structure of a user operation log data anomaly identification device provided in an embodiment of the present invention;

[0081] Figure 5 This is another structural schematic diagram of a user operation log data anomaly identification device provided in an embodiment of the present invention. Detailed Implementation

[0082] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0083] Existing methods for classifying abnormal operation logs based on improved text classification algorithms often suffer from low processing efficiency and inaccurate results. They fail to consider the correlation between individual log entries related to user operations, instead treating each entry as a separate entity for feature calculation. For example, log classification analysis using the DBSCAN algorithm requires re-clustering all data each time new log data is updated, consuming significant time and resulting in low efficiency. Traditional K-means clustering algorithms exhibit randomness, with results varying depending on the initial randomly selected cluster centers. This algorithm necessitates continuous adjustments and recalculations of new cluster centers, leading to substantial time overhead when dealing with large datasets and failing to meet the demands of processing massive amounts of communication service log data.

[0084] Regarding the aforementioned technical problems of the prior art, see [link to relevant documentation]. Figure 1 This is a flowchart illustrating a method for identifying abnormal user operation log data provided in an embodiment of the present invention, the method comprising steps S1 to S5;

[0085] S1, using different logs in the acquired user operation log data as network nodes, calculate the mutual information between different nodes;

[0086] S2, determine undirected edges based on the mutual information between different nodes, construct an undirected minimum support tree, orient the nodes in the undirected minimum support tree, and determine the preliminary minimum support tree structure;

[0087] S3, perform node order search in the minimum support tree structure to obtain the node order group, take different node orders as different individuals in the initial population, and calculate the fitness of different individuals in the initial population.

[0088] S4, update the initial population based on the fitness of different individuals and the preset population optimization strategy;

[0089] S5 uses the node order of the individual with the highest fitness in the updated population as the user operation exception log.

[0090] In the specific implementation of this embodiment, in communication services, user operation log data is continuous and has no fixed pattern or characteristics. Depending on whether the user operates continuously or intermittently, the number of log datasets constructed by the generated log data changes over time.

[0091] When identifying anomalies in user operation log data, the different access resources and equipment types within various operators result in inconsistent log formats, making unified analysis difficult. Therefore, the user operation log data is first standardized. The standardized log data includes fields such as organization affiliation, user name, operation time, operation content, and data sensitivity level. The data sensitivity level indicates the importance of the user's operation; a higher level indicates greater importance of the log entry.

[0092] The log dataset generated by a certain business user X's operation is as follows: If each log entry is considered a network node, then the log dataset is a set of Bayesian network nodes. Based on the mutual information formula, the following calculations can be performed. The mutual information value between each log entry.

[0093] Bayesian networks, also known as confidence networks, are an extension of the Bayesian method and are among the most effective theoretical models for representing and reasoning about uncertain knowledge. A Bayesian network is a directed acyclic graph consisting of nodes representing variables and directed edges connecting these nodes, used to represent and analyze uncertain and probabilistic events. It is commonly applied to decision-making that conditionally depends on multiple control factors and can make inferences from incomplete, imprecise, or uncertain knowledge or information.

[0094] Mutual information is a useful information measure in information theory. It can be viewed as the amount of information contained in one random variable about another random variable, or as the reduction in uncertainty of one random variable due to the knowledge of another random variable.

[0095] For abnormal logs, which generally differ from regular operation logs, the smaller the value calculated using mutual information, the more pronounced the abnormal characteristics of the log entry. Traverse the log dataset. Given any node in the tree and retaining the undirected edges with the minimum mutual information, construct an undirected minimum support tree.

[0096] At this point, there are undirected edges between the nodes in the minimum support tree structure. It is necessary to determine the sequence between the nodes, that is, to orient the nodes, so as to obtain the oriented minimum support tree structure and obtain the node sequence group as the input for population optimization.

[0097] In the minimum support tree structure Learn the node order in the middle, and randomly select it. One of the starting vertices Get the directed edges connecting this point. This allows us to connect the edge to the next node. All nodes that have a path to the starting point are visited until there are no more directed edges, indicating that the path search is complete, and a node order is obtained.

[0098] For directional minimum support tree structure The node sequence group obtained by the search is used as different individuals in the initial population, and the fitness of different individuals in the initial population is calculated.

[0099] As a preferred implementation, the node order scoring function FIT is used to... The fitness of all nodes in the sequence is calculated, and the calculated fitness is: ,in , This is the weight matrix.

[0100] It should be noted that the node order scoring function FIT mentioned above is one way to calculate fitness. In other embodiments, other functions can be used to calculate fitness.

[0101] An initial population is constructed by establishing a node order, and individuals are updated using a population optimization strategy to update the initial population.

[0102] The node order of the individual with the highest fitness in the updated population is used to obtain an optimal node sequence. All nodes in this sequence are the abnormal logs, thus achieving the classification of abnormal logs in the log group.

[0103] This application's solution treats each log generated by the user as a node in a Bayesian network structure, constructs a node order to build an initial population, and learns based on the population algorithm to quickly find the optimal solution with a high probability, thereby finding the global optimal solution and identifying abnormal operation logs. It also has good global convergence and high efficiency in large data structures.

[0104] In yet another embodiment provided by the present invention, see Figure 2 This is another flowchart illustrating the user operation log data anomaly identification method provided in this embodiment of the invention. When identifying abnormal operation log data, the following steps are performed:

[0105] Standardizing logs is crucial because different operators provide logs in different formats, making unified analysis difficult. The first step is to standardize the user operation log data.

[0106] Construct a log dataset based on the normalized logs.

[0107] Calculate the mutual information between different logs in the log dataset.

[0108] The structure and orientation of the support tree are determined. Undirected edges are determined based on the mutual information between different nodes. An undirected minimum support tree is constructed. The nodes in the undirected minimum support tree are oriented to determine the preliminary minimum support tree structure.

[0109] Generate the initial population G ( l ).

[0110] When updating the initial population based on the fitness of different individuals and a preset population optimization strategy, a headhunting group and a wandering group are divided from the initial population. In the initial population G( l Select the first one from ) The node order is used as the headhunter group, where n is the initial population size, and nodes outside the headhunter group are randomly selected. The node order is used as a walk group.

[0111] Calculate the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group.

[0112] Select one individual from the headhunter group and the roaming group respectively. , .

[0113] The individuals in the initial population are updated based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group.

[0114] Output update population G ( l )', calculate the fitness FIT value of all individuals in the population.

[0115] When the preset update termination condition is not met, select the headhunter group and the wandering group from the initial population of the update, and update the individuals in the initial population according to the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group until the update termination condition is met.

[0116] It should be noted that, as a preferred embodiment, the update termination condition can be set to no further user operations. In other embodiments, the update termination condition can also be set to the number of update iterations.

[0117] Individuals obtained through the above strategies form a new population. Then, the fitness values ​​of all individuals are calculated. When user actions no longer update the values, it indicates that the algorithm has reached its maximum iteration value, and the algorithm terminates. Output the updated population. The order of nodes with the highest fitness value Each node in this node sequence corresponds to a user operation exception log.

[0118] Based on user action log data, this proposal designs and constructs a minimum support tree structure model and proposes a substructure scoring orientation node method. Each log entry in the user action dataset is mapped to a Bayesian network structure, treating each log entry as a node. A minimum support tree structure is constructed through mutual information calculation, and substructure matching is used for scoring orientation. The method designed in this proposal can effectively detect operation logs with abnormal characteristics under uncertain user behavior, improving classification accuracy.

[0119] In another embodiment of the present invention, updating individuals in the initial population specifically includes:

[0120] The fitness of individuals in the wandering population is compared with that of individuals in the headhunting population, and individuals are updated by comparing the fitness (FIT) values ​​of individuals in other populations with the FIT values ​​of individuals in the headhunting population.

[0121] When the fitness of the first individual in the wandering group is greater than the fitness of the second individual in the headhunting group, that is... Superior This indicates that there are individuals in the roaming group who are superior to those in the headhunting group. Therefore, the first individual... Updated to the headhunter group.

[0122] When the fitness of all individuals in the headhunting group is not less than that of the third individual in the wandering group, it indicates that the individuals in the headhunting group are superior, and the third individual is updated according to the population strategy.

[0123] It should be noted that when updating individuals in the population, other population update strategies or optimization algorithms in the prior art can also be used. This embodiment only provides a preferred implementation method. This embodiment is not limited to the population update scheme provided in this embodiment.

[0124] The final result is obtained by optimizing the evolutionary strategy of the population algorithm. This enables the mining and analysis of log data generated by users under uncertain behaviors, and the classification efficiency is not affected by the size of the dataset.

[0125] In another embodiment of the present invention, when updating the population by dividing it into a headhunting group and a wandering group, an aggressive group is added for individual updating, specifically:

[0126] In the initial population Select from individuals other than headhunter groups and wandering groups For each individual, forming an aggressive group, calculate the fitness of the individuals in that aggressive group.

[0127] Select any individual and compare its fitness value with the fitness values ​​of the entire headhunter group. The second individual Compare them.

[0128] When the fitness of the fourth individual is greater than that of the second individual, that is, if Its fitness is better than The fitness of individuals in the initial population is used to update the headhunting group. This involves recalculating the fitness of individuals in the initial population and selecting the first number of individuals from the initial population in descending order of fitness as the headhunting group; otherwise, the headhunting group is not updated.

[0129] By increasing the number of aggressive groups for population updates, the optimization efficiency during the population update process is improved.

[0130] In another embodiment of the present invention, when performing population updates, considering that updating only the headhunter group may lead to a local optimum, a node fragment mutation method for individuals is provided to increase global search capability. Specifically:

[0131] Calculate the fourth individual in the aggressive group. The absolute value of the difference between the fitness of the first individual and the fitness of the second individual in the headhunter group. , .

[0132] The absolute value is calculated based on the fitness of the fourth individual. fitness of the second individual Within a defined range, i.e. Between and In between, for the fourth individual Update and select the second body. Middle part of the gene segment and the fourth individual Perform selective mutation.

[0133] Randomly select the fourth individual A segment of the mapped node is used as the mutation region in the second individual. Select the corresponding node fragments at the same position and replace them. The mutated region was updated to the fourth individual. .

[0134] Right now: .

[0135] get .

[0136] This case uses a mutation strategy to mutate individuals, preventing the headhunter group from getting stuck in local optima during updates and increasing global search capabilities.

[0137] In another embodiment of the present invention, in the above-mentioned mutation update, it is necessary to ensure that there are no duplicate nodes in the node order of the updated individual, that is, in the above-mentioned mutation update, the nodes in the node mutation fragment do not duplicate the nodes other than the replaced nodes, and the updated individual node order is not duplicated. That is the correct node order.

[0138] Duplicate nodes may occur during the individual mutation update process. Therefore, it is necessary to remove duplicate nodes based on illegal node mapping detection during the optimal mutation.

[0139] Compare the nodes in the fourth individual (excluding the mapped node fragment) with the node at the first position in the aforementioned partial node fragment, see [link to relevant documentation]. Figure 3 This is a schematic diagram illustrating the principle of removing abnormal nodes in individual mutation updates provided in this embodiment of the invention.

[0140] For the fourth node In addition to the mapped node fragments, nodes d1 and d2 are retained, along with the second node. The node segments h1, h2, and h3 in the middle are mapped one by one to compare whether there are duplicates.

[0141] Nodes were found to exist. and Repeat, then remove the node from some node fragments, and keep the node corresponding to that position on the fourth individual. Received updated , .

[0142] By detecting and removing duplicate nodes based on illegal node mappings during the optimal mutation process, the accuracy of the final result is prevented from being affected by incorrect node order.

[0143] In another embodiment of the present invention, a dynamic self-mutation strategy is proposed for individual updates, specifically including the following steps:

[0144] Calculate the dynamic mutation probability based on the dynamic self-mutation strategy. ;

[0145] The length of the mutated node segment is determined by using the dynamic mutation probability.

[0146] It should be noted that when determining the length of the mutated node fragment, the corresponding mutated node fragment length is matched by the dynamic mutation probability and a preset correspondence table.

[0147] Based on the length of the mutated node fragment, the mutated node fragment is determined through node localization.

[0148] Based on the mutated node fragment, each mutated position in the third entity is replaced, and multiple new mutated individuals are obtained by traversing all mutated positions in the third entity. w 1 ~ l w n ;

[0149] Calculate the fitness of the mutated new individual in the walking group, and select the individual with the highest fitness value as the final updated individual. ,Right now:

[0150] ;

[0151] A dynamic self-mutation strategy is proposed to "optimize" individuals within the population, yielding the optimal result. This population-based optimization method is used to detect and classify abnormal logs. The proposed individual optimization strategy improves global convergence performance and increases search efficiency.

[0152] In another embodiment of the present invention, when determining the preliminary minimum support tree structure through node positioning, the following steps are specifically performed:

[0153] For each node of the undirected minimum spanning tree, define the minimum spanning tree structure. A certain node The set of potential parent nodes is Each element in the set is treated as Parent node constructs child structure The substructure and standard training dataset were calculated. degree of matching The calculation formula is as follows:

[0154] ;

[0155] Where N is the training dataset Number of nodes, m j For training dataset The j-th node in the middle.

[0156] Update the supporting tree structure by taking the node in the highest-scoring substructure as its parent node. Given all nodes, obtain the updated set of parent nodes.

[0157] Connect each node of the undirected minimum support tree to its corresponding parent node to obtain the minimum support tree structure.

[0158] In another embodiment of the present invention, mutual information is a statistic used to measure the correlation between two random variables. Since user-generated logs are random variables, mutual information can be used to calculate the degree of correlation between nodes. The specific formula for calculating mutual information is as follows:

[0159] ;

[0160] in, I ( l i , l j ) is the first i Mutual information between the j-th node and the j-th node For the first i The joint probability between the j-th node and the j-th node and The first The and the first The marginal probabilities of nodes, i, j = 1, 2, ..., n, where n is the number of nodes.

[0161] This application's solution considers the correlation between each log entry generated by the user, treating each log entry as a node in a Bayesian network structure. An initial population is constructed by establishing a node sequence, and individuals are updated through a population optimization strategy, ultimately yielding an "optimal" node sequence. All nodes in this sequence are considered anomalous logs, thus achieving the classification of anomalous logs within the log group. This approach effectively detects operation logs with anomalous characteristics under uncertain user behavior, improving classification accuracy.

[0162] This proposal employs a population optimization method to detect and classify abnormal logs. The individual optimization strategy improves global convergence performance and increases search efficiency. This solution can be used to diagnose system fault nodes.

[0163] See Figure 4 This is a schematic diagram of a user operation log data anomaly identification device provided in an embodiment of the present invention. The device includes:

[0164] The mutual information calculation module is used to calculate the mutual information between different nodes by taking different logs in the acquired user operation log data as network nodes.

[0165] The support tree determination module is used to determine undirected edges based on the mutual information between different nodes, construct an undirected minimum support tree, orient the nodes in the undirected minimum support tree, and determine the preliminary minimum support tree structure.

[0166] The population determination module is used to perform node order search in the minimum support tree structure to obtain a node order group, take different node orders as different individuals in the initial population, and calculate the fitness of different individuals in the initial population.

[0167] The population update module is used to update the initial population based on the fitness of different individuals and a preset population optimization strategy.

[0168] The results output module is used to take the node order of the individual with the highest fitness in the updated population as the user operation exception log.

[0169] It should be noted that the user operation log data anomaly identification device provided in this embodiment can execute all the steps and functions of the user operation log data anomaly identification method provided in any of the above embodiments, and the specific functions of the device will not be described in detail here.

[0170] See Figure 5 This is another structural schematic diagram of a user operation log data anomaly identification device provided in an embodiment of the present invention. The user operation log data anomaly identification device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a user operation log data anomaly identification program. When the processor executes the computer program, it implements the steps in each of the above-described user operation log data anomaly identification method embodiments, for example... Figure 1 The steps S1 to S5 are shown. Alternatively, when the processor executes the computer program, it implements the functions of each module in the above-described device embodiments.

[0171] For example, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the user operation log data anomaly identification device. For example, the computer program can be divided into several modules, the specific functions of which have been described in detail in the user operation log data anomaly identification method provided in any of the above embodiments; therefore, the specific functions of the device will not be repeated here.

[0172] The aforementioned user operation log data anomaly identification device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. This device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the illustrated diagram is merely an example of a user operation log data anomaly identification device and does not constitute a limitation on such a device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the device may also include input / output devices, network access devices, buses, etc.

[0173] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the user operation log data anomaly identification device, connecting all parts of the device via various interfaces and lines.

[0174] The memory can be used to store the computer program and / or modules. The processor implements various functions of the user operation log data anomaly identification device by running or executing the computer program and / or modules stored in the memory and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD card), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0175] The module integrated into the user operation log data anomaly identification device, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0176] This invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0177] It should be noted that the computer program product provided in this embodiment can execute all the steps and functions of the user operation log data anomaly identification method provided in any of the above embodiments, and the specific functions of the device will not be described in detail here.

[0178] It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered to be within the scope of protection of this invention.

Claims

1. A method for identifying anomalies in user operation log data, characterized in that, The method includes: The different logs in the acquired user operation log data are used as network nodes, and the mutual information between different nodes is calculated; the smaller the mutual information between different nodes, the more abnormal the corresponding log is. Undirected edges are determined based on the mutual information between different nodes. By retaining the undirected edges with the minimum mutual information, an undirected minimum support tree is constructed. The nodes in the undirected minimum support tree are oriented to determine the preliminary minimum support tree structure. In the minimum support tree structure, a node order search is performed to obtain a node order group. Different node orders are used as different individuals in the initial population, and the fitness of different individuals in the initial population is calculated. The initial population is updated based on the fitness of different individuals and a preset population optimization strategy; Use the node order of the individual with the highest fitness in the updated population as the user operation exception log; Orienting the nodes in the undirected minimum support tree to determine the preliminary minimum support tree structure includes: Each element in the set of potential parent nodes of each node in the undirected minimum support tree is taken as the parent node of that node, and different substructures are constructed; the matching score of different substructures and the preset standard training dataset is calculated; the node with the highest matching score in the substructure of that node is taken as the parent node of that node. Connect each node of the undirected minimum support tree to its corresponding parent node to obtain the minimum support tree structure; The initial population is updated based on the fitness of different individuals and a preset population optimization strategy, including: From the initial population, select a predetermined first number of individuals in descending order of fitness to form a headhunting group, and select a predetermined second number of individuals outside the headhunting group to form a wandering group. Calculate the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group within the wandering group; The individuals in the initial population are updated based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group; When the preset update termination condition is not met, select the headhunter group and the wandering group from the initial population of the update, and update the individuals in the initial population according to the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group until the update termination condition is met. When the update termination condition is met, the initial population update stops; the step of updating the individuals in the initial population based on the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group includes: When the fitness of the first individual in the wandering group is greater than that of the second individual in the headhunting group, the first individual is updated to the headhunting group. When the fitness of all individuals in the headhunter group is not less than the fitness of the third individual in the wandering group, the third individual is updated.

2. The user operation log data anomaly identification method according to claim 1, characterized in that, The step of updating the individuals in the initial population based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group also includes: In the initial population, a predetermined third number of individuals are selected as the aggressive group, excluding the headhunting group and the wandering group. Calculate the fitness of individuals in the aggressive group within the aggressive group; When the fitness of the fourth individual in the aggressive group is greater than the fitness of the second individual in the headhunting group, the fitness of the individual in the initial population is recalculated, and the first number of individuals are reselected from the initial population in descending order of fitness to form the headhunting group.

3. The user operation log data anomaly identification method according to claim 2, characterized in that, The step of updating the individuals in the initial population based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group also includes: Calculate the absolute value of the difference between the fitness of the fourth individual in the aggressive group and the fitness of the second individual in the headhunter group; When the calculated absolute value is within the range determined based on the fitness of the fourth individual and the fitness of the second individual, select a portion of the node fragments of the second individual, replace the mapped node fragments at the same position in the fourth individual, and update the fourth individual; When a node in the fourth individual, excluding the mapped node fragment, is duplicated with a node at the first position in the partial node fragment, the node corresponding to the first position in the fourth individual is retained.

4. The user operation log data anomaly identification method according to claim 1, characterized in that, Individual updates for the third individual include: The dynamic mutation probability is calculated based on the preset dynamic self-mutation strategy; The length of the mutated node segment is determined based on the dynamic mutation probability. The positions of all mutations in the third body are determined based on the length of the mutated node fragment; Determine mutated node fragments by locating nodes; By iterating through and replacing each mutation position in the third individual based on the mutation node fragment, multiple new mutated individuals are obtained; Calculate the fitness of the mutated new individual in the wandering group, and determine the mutated new individual with the highest fitness as the third individual after the update.

5. A device for identifying abnormal user operation log data, characterized in that, The device includes: The mutual information calculation module is used to treat different logs in the acquired user operation log data as network nodes and calculate the mutual information between different nodes; the smaller the mutual information between different nodes, the more abnormal the corresponding log is. The support tree determination module is used to determine undirected edges based on the mutual information between different nodes, construct an undirected minimum support tree by retaining the undirected edges with the minimum mutual information, orient the nodes in the undirected minimum support tree, and determine the preliminary minimum support tree structure. The population determination module is used to perform node order search in the minimum support tree structure to obtain a node order group, take different node orders as different individuals in the initial population, and calculate the fitness of different individuals in the initial population. The population update module is used to update the initial population based on the fitness of different individuals and a preset population optimization strategy. The results output module is used to take the node order of the individual with the highest fitness in the updated population as the user operation exception log. Orienting the nodes in the undirected minimum support tree to determine the preliminary minimum support tree structure includes: Each element in the set of potential parent nodes of each node in the undirected minimum support tree is taken as the parent node of that node, and different substructures are constructed; the matching score of different substructures and the preset standard training dataset is calculated; the node with the highest matching score in the substructure of that node is taken as the parent node of that node. Connect each node of the undirected minimum support tree to its corresponding parent node to obtain the minimum support tree structure; The initial population is updated based on the fitness of different individuals and a preset population optimization strategy, including: From the initial population, select a predetermined first number of individuals in descending order of fitness to form a headhunting group, and select a predetermined second number of individuals outside the headhunting group to form a wandering group. Calculate the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group within the wandering group; The individuals in the initial population are updated based on the fitness of individuals in the headhunting group and the fitness of individuals in the wandering group; When the preset update termination condition is not met, select the headhunter group and the wandering group from the initial population of the update, and update the individuals in the initial population according to the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group until the update termination condition is met. When the update termination condition is met, the initial population update stops; the step of updating the individuals in the initial population based on the fitness of individuals in the headhunter group and the fitness of individuals in the wandering group includes: When the fitness of the first individual in the wandering group is greater than that of the second individual in the headhunting group, the first individual is updated to the headhunting group. When the fitness of all individuals in the headhunter group is not less than the fitness of the third individual in the wandering group, the third individual is updated.

6. A device for identifying abnormal user operation log data, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the user operation log data anomaly identification method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the user operation log data anomaly identification method as described in any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 4.

Images