Business system user behavior relativity abnormity detection method and system and related equipment

Abstract

The invention discloses a service system user behavior relativity abnormity detection method and system and related equipment, and the method comprises the steps: firstly obtaining user behavior log data from a plurality of service systems, carrying out the preprocessing, and extracting key features corresponding to different service systems; then, corresponding business knowledge is extracted, a knowledge graph is constructed according to the business knowledge, and entities and relationships in user behavior logs of different business systems are mapped into the knowledge graph; then, based on the constructed corresponding user behavior knowledge graph, learning features in the user behavior knowledge graph in a learning mode; then, on the basis of feature values extracted through learning, deep anomaly detection model training is completed in an unsupervised learning mode; and carrying out anomaly detection on user behavior logs collected in real time based on the trained depth anomaly detection model so as to intelligently judge user behaviors corresponding to the logs. According to the scheme, complex user behavior data in a multi-service system can be effectively processed, and efficient and accurate anomaly detection is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer science, and in particular to technologies related to user behavior analysis and security management. Background Art

[0002] With the popularization of Internet applications, a large amount of user behavior data has been generated in various business systems. These user behavior data are not only large in size, but also diverse and complex. The main characteristics of user behavior data in current business systems are as follows:

[0003] (1) The formats and characteristics of behavior data generated by different business systems vary, and the large amount of user behavior data generated is diverse and complex;

[0004] (2) User behavior patterns in business systems change with interactions and environments, and the corresponding user behavior patterns are complex;

[0005] (3) Existing business systems generate massive amounts of real-time data streams.

[0006] For such user behavior data, traditional anomaly detection methods are often based on a single business system or use a small number of features for static rule or pattern matching analysis, which makes it difficult to cope with the anomaly detection needs of multiple business systems, complex behavior patterns and large-scale data.

[0007] Traditional anomaly detection methods are unable to effectively integrate and unify user behavior data for effective analysis due to its diversity and complexity; they are also difficult to effectively capture and analyze complex behavior patterns; faced with massive real-time data streams, traditional anomaly detection methods have significant limitations in terms of the real-time and accuracy of abnormal behavior detection, and are unable to promptly discover new abnormal behavior patterns.

[0008] Therefore, there is a need for a new anomaly detection solution that can integrate multi-dimensional data and perform cross-system analysis, which is an urgent problem to be solved in this field. Summary of the invention

[0009] In view of the problems existing in the existing business system user behavior data anomaly detection solutions, the purpose of the present invention is to provide a business system user behavior relative anomaly detection solution that can integrate multi-dimensional data and perform cross-system analysis, which can effectively solve the problems existing in the prior art.

[0010] In order to achieve the above object, the present invention provides a method for detecting relative abnormality of user behavior in a business system, the detection method comprising:

[0011] Real-time collection and processing of user behavior data: Obtain user behavior log data from multiple business systems, perform preprocessing, and extract key features corresponding to different business systems;

[0012] Knowledge graph construction steps:

[0013] Based on the extracted key features of different business systems, the corresponding business knowledge is extracted and a knowledge graph is constructed accordingly. The entities and relationships in the user behavior logs of different business systems are mapped to the knowledge graph.

[0014] User behavior feature learning steps:

[0015] Based on the user behavior knowledge graphs built for different business systems, the features in the user behavior knowledge graphs are learned using graph representation-based learning methods;

[0016] Deep anomaly detection model training steps:

[0017] Based on the feature values ​​extracted through user behavior feature learning, the deep anomaly detection model training is completed without supervised learning mode;

[0018] Deep anomaly detection steps:

[0019] Based on the trained deep anomaly detection model, anomaly detection is performed on the user behavior logs collected in real time to intelligently identify the user behavior corresponding to the corresponding log.

[0020] In some embodiments of the present invention, the detection method includes, when collecting and processing user behavior data in real time:

[0021] Data collection and cleaning steps: obtaining user behavior log data from multiple business systems, and performing cleaning and preprocessing to remove noise and inconsistent data;

[0022] Feature extraction step, extracting key features based on the data features of different business systems;

[0023] In the data integration step, the acquired raw user behavior log data is integrated into a unified data representation based on the extracted key feature data.

[0024] In some embodiments of the present invention, the detection method comprises, in the knowledge graph construction step:

[0025] Business knowledge extraction step, extracting entity, attribute and event data from user behavior logs of each business system;

[0026] Structuring step: converting the extracted entities, events, and attributes into structured data that can be understood by machines;

[0027] Knowledge graph modeling steps: Map the structured entities, attributes, and event data of different business systems into a unified semantic network to build a global data background;

[0028] Event filling step: Map the structured event information to the existing entity and relationship models in the user behavior knowledge graph, and fill in the relevant event nodes and attributes.

[0029] In some embodiments of the present invention, the detection method introduces a gated attention mechanism network model in the user behavior feature learning step, and trains the gated attention mechanism network model using an unsupervised learning model by constructing a user behavior knowledge graph. The final features of each node are extracted from the trained gated attention mechanism network model as distributed features of the knowledge graph nodes.

[0030] In order to achieve the above object, the present invention provides a detection system for relatively abnormal user behavior in a business system, the detection system comprising:

[0031] A user behavior data real-time collection and processing unit, wherein the user behavior data real-time collection and processing unit is configured to obtain user behavior log data from multiple business systems, perform preprocessing, and extract key features corresponding to different business systems;

[0032] A knowledge graph unit, wherein the knowledge graph unit is configured to interact with the user behavior data real-time collection and processing unit data, and can extract corresponding business knowledge based on the extracted key features of different business systems, and construct a knowledge graph based on the extracted key features, and map the entities and relationships in the user behavior logs of different business systems into the knowledge graph;

[0033] A user behavior feature learning unit, wherein the user behavior feature learning unit is configured to interact with the knowledge graph unit data, and can learn features in the user behavior knowledge graph based on the constructed user behavior knowledge graph for different business systems by adopting a graph-based representation learning method;

[0034] A deep anomaly detection model training unit, wherein the deep anomaly detection model training unit is configured to interact with the user behavior feature learning unit data, and can complete the deep anomaly detection model training based on the feature values ​​extracted through the user behavior feature learning and without a supervised learning mode;

[0035] A deep anomaly detection unit, wherein the deep anomaly detection unit is configured to interact with the user behavior data real-time collection and processing unit and the deep anomaly detection model training unit, and can perform anomaly detection on the real-time collected user behavior logs based on the trained deep anomaly detection model to intelligently identify the user behavior corresponding to the corresponding log.

[0036] In some embodiments of the present invention, the user behavior data real-time collection and processing unit integrates the acquired original user behavior log data into a unified data representation form according to the extracted key features corresponding to different business systems.

[0037] In some embodiments of the present invention, the knowledge graph unit includes:

[0038] A business knowledge extraction module, wherein the business knowledge extraction module is configured to extract entity, attribute and event data from user behavior logs of each business system;

[0039] A structuring module, wherein the structuring module is configured to interact with the business knowledge extraction module data and is capable of converting the extracted entities, events and attributes into structured data that can be understood by a machine;

[0040] A knowledge graph modeling module, which is configured to interact with the structured module data and is capable of mapping the structured entity, attribute and event data of different business systems into a unified semantic network to build a global data context;

[0041] Event filling module: Map the structured event information to the existing entity and relationship models in the user behavior knowledge graph, and fill in the relevant event nodes and attributes.

[0042] In some embodiments of the present invention, the user behavior feature learning unit includes:

[0043] Gated attention mechanism network model,

[0044] A training model, wherein the training model is configured to train a gated attention mechanism network model using an unsupervised learning model by using a constructed user behavior knowledge graph;

[0045] A feature extraction module, wherein the feature extraction module is configured to extract the final features of each node as the distributed features of the knowledge graph node for the gated attention mechanism network model that has completed training.

[0046] In order to achieve the above-mentioned object, the present invention also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of the above-mentioned method for detecting relative abnormality of user behavior in a business system.

[0047] In order to achieve the above-mentioned object, the present invention further provides a processor, which is used to run a program, and when the program is running, the steps of the above-mentioned method for detecting relative abnormality of user behavior in a business system are executed.

[0048] In order to achieve the above-mentioned purpose, the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program code is loaded and executed by the processor to implement the steps of the above-mentioned method for detecting relative abnormalities in user behavior of the business system.

[0049] In order to achieve the above-mentioned object, the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the above-mentioned method for detecting relative abnormality of user behavior in a business system.

[0050] The invention provides a solution for detecting relative anomalies in user behavior of business systems, innovative graph data mining technology based on graph neural networks, and semantic understanding capabilities based on knowledge graph construction, which can effectively process complex user behavior data in multiple business systems and achieve efficient and accurate anomaly detection.

[0051] Furthermore, this solution improves the accuracy and explainability of anomaly detection through node-level feature learning and relationship modeling, providing enterprises with reliable security and operational support when facing volatile markets and user behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments.

[0053] Figure 1 A flowchart of detecting relative abnormal behavior of users in the business system of the present invention;

[0054] Figure 2 It is a flow chart of data collection and preprocessing in the present invention;

[0055] Figure 3 A flowchart of the map construction and dynamic update in the present invention;

[0056] Figure 4 A flowchart of user behavior feature learning in the present invention;

[0057] Figure 5 This is a schematic diagram of the deep anomaly detection model in the present invention;

[0058] Figure 6 It is a schematic diagram of the system for detecting relative abnormality of user behavior in the business system of the present invention;

[0059] Figure 7 This is a flowchart of user anomaly detection according to an example of the present invention. DETAILED DESCRIPTION

[0060] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below with reference to specific diagrams.

[0061] In response to the problems faced in identifying abnormal behavior under complex user behavior patterns in multi-business systems, the present invention abandons the conventional static rule or pattern matching analysis based on a small number of features, and innovatively introduces knowledge graphs, graph representations, and graph neural network models to build an intelligent business system user behavior relative anomaly detection solution, effectively achieving efficient identification of relative anomalies and real-time response capabilities.

[0062] Representation learning based on knowledge graphs can obtain distributed representations based on dense vectors from knowledge representations based on discrete symbols, so that hidden knowledge can be better captured. By connecting to the powerful capabilities of neural networks, the reasoning process can be transformed into calculations between vectors, thus getting rid of the traditional reasoning calculation method based on symbolic search and making reasoning more efficient.

[0063] See also Figure 1 The detection scheme for relative anomaly of user behavior in the business system provided by the present invention mainly includes the real-time collection and processing stage of user behavior data, the knowledge graph construction stage, the user behavior feature learning stage, the deep anomaly detection model training stage and the deep anomaly detection stage in its specific implementation.

[0064] This solution first enters the stage of real-time collection and processing of user behavior data. In this stage, user behavior log data is obtained from multiple business systems, and preprocessed to extract key features corresponding to different business systems, thereby forming detection data objects.

[0065] On this basis, this solution further carries out the stages of knowledge graph construction and user behavior feature learning.

[0066] In the knowledge graph construction stage, this solution extracts corresponding business knowledge based on the key features of different business systems extracted during the real-time collection and processing of user behavior data, and constructs a knowledge graph based on this. The entities and relationships in the user behavior logs of different business systems are mapped to the knowledge graph, thereby constructing a comprehensive, consistent, and explainable knowledge system to serve subsequent analysis.

[0067] After completing the construction of the knowledge graph, this solution enters the user behavior feature learning stage. In this stage, based on the user behavior knowledge graph constructed for different business systems, a graph-based representation learning method is used to learn the features in the user behavior knowledge graph, so as to realize the mining of implicit information between user behaviors in the constructed knowledge graph.

[0068] After completing the above-mentioned stages, the solution further enters the deep anomaly detection model training stage. In this stage, based on the feature values ​​extracted through user behavior feature learning, an unsupervised learning model is used to complete the deep anomaly detection model training in order to train the best deep anomaly detection model.

[0069] Finally, based on the trained deep anomaly detection model, this solution enters the deep anomaly detection stage. In this stage, anomaly detection is performed on the real-time collected user behavior logs based on the trained deep anomaly detection model to intelligently identify the user behavior corresponding to the corresponding log.

[0070] The specific implementation process and corresponding technical features of each stage in the detection scheme for relative abnormal behavior of business system users provided by the present invention are described in detail below.

[0071] The scheme of the present invention mainly includes data collection and cleaning steps, feature extraction steps and data integration steps when performing real-time collection and processing of user behavior data in the real-time collection and processing stage of user behavior data.

[0072] The data collection and cleaning steps here are specifically configured to obtain user behavior log data from multiple business systems, and perform cleaning and preprocessing to remove noise and inconsistent data to ensure the accuracy of subsequent data processing results.

[0073] Furthermore, based on the processing of the data collection and cleaning steps, the feature extraction step is specifically configured to extract key features from the data features of different business systems processed by the data collection and cleaning steps.

[0074] Further, based on the feature extraction step, the data integration step is specifically configured to integrate the original user behavior log data obtained in the data collection step into a unified data representation based on the extracted key feature data, in preparation for subsequent analysis.

[0075] As a further example, based on the above implementation scheme, the following specific steps can be used to obtain user behavior log data from multiple business systems and perform corresponding processing.

[0076] See also Figure 2 First, for the user behavior data of the business system that needs to be monitored in real time, configure the real-time data stream pipeline to ensure fast and low-latency data transmission. The data stream pipeline configured here can be Kafka, RabbitMQ, etc.

[0077] Based on the configured real-time data stream pipeline, the business system actively pushes the generated user behavior logs to the topic specified by Kafka in real time.

[0078] On this basis, we further configure the real-time user behavior collection component to monitor the Kafka topic in real time, and perform pre-processing such as data cleaning, denoising, data conversion and data integration on the acquired user behavior log data.

[0079] When performing data cleaning on the acquired user behavior log data, it is preferred to eliminate invalid data by clearing format errors, null values, abnormal characters and other techniques; when performing denoising on the user behavior log data that has completed data cleaning, it is preferred to process abnormal values ​​by data smoothing, filtering and other techniques, thereby improving the quality and availability of the data.

[0080] In order to solve the problem that the user behaviors of different business systems are not uniform, resulting in the non-uniform set of collected user behavior data elements, the original user behavior log data is converted into a unified format by extracting key features and data conversion methods, which is convenient for the subsequent comprehensive analysis and processing of multiple business systems.

[0081] As a further priority setting, to support analysis and association across business systems, this solution integrates user behavior logs of multiple business systems into a unified data warehouse after completing the above preprocessing for the user behavior data of the business systems.

[0082] In the specific implementation, the user behavior logs of multiple business systems are standardized, and the "time", "personnel", "business system", "functional module", "operation type", "operation description" and "terminal" are uniformly named to integrate the data of multiple systems.

[0083] When constructing the knowledge graph in the knowledge graph construction stage, the solution of the present invention is mainly composed of the steps of business knowledge extraction, data structuring, knowledge graph modeling, and event filling, thereby realizing the construction of a knowledge graph based on business knowledge, and mapping the entities and relationships in the user behavior logs of different business systems to the knowledge graph, providing a semantic basis and data integration capability for subsequent graph feature representation and anomaly detection.

[0084] See also Figure 3 , which shows the implementation flow chart of the knowledge graph construction of the present invention, based on Figure 3 The implementation process of the knowledge graph construction of the solution of the present invention is as follows:

[0085] Step one: extracting business knowledge.

[0086] This step is based on domain expert knowledge and the automated method D2R (Data to RDF) to extract entities (such as users, units, application systems, functional modules), attributes (such as "user unit", "system includes modules") and events (such as "login", "query", "update") from the aforementioned pre-processed user behavior logs of each business system.

[0087] Step 2: Data structuring.

[0088] This step converts the entities, events and attributes extracted in the first step into machine-understandable structured data. Preferably, the structured data is stored in the form of triples (entity 1-event-entity 2).

[0089] Step 3: Knowledge graph modeling.

[0090] This step is based on the data after data structuring processing in the second step. It maps the entities, relationships, and events extracted from different business systems into a unified semantic network (i.e., knowledge graph) to form a global data background.

[0091] As an example, the entity types in the graph include "user", "unit", "application system", "function module", "terminal information", etc.; the relationships include "user unit", "system contains modules", etc., and the events include "login", "query", "update", "delete" and other basic types. Based on this, in this step, the D2R (Data to RDF) method is used to extract various types of entities, relationships and events from the user audit log, and fill them into the knowledge graph to complete the construction of the user behavior log knowledge graph (i.e., user behavior knowledge graph).

[0092] Furthermore, in this step, a graph database or a triple storage system is used simultaneously to effectively store and manage the knowledge user behavior graph, and index optimization, caching mechanism, and distributed computing are combined to improve the retrieval efficiency of the knowledge graph and support efficient query and update operations.

[0093] Step 4: Event filling.

[0094] This step targets the knowledge graph model constructed in the third step, and maps the event information to the existing entity and relationship models in the user behavior knowledge graph, so that the user behavior knowledge graph can associate various types of entities through elements such as the event's "operation terminal", "operation system", and "operation functional module", thereby filling in relevant event nodes and attributes.

[0095] As a further preferred setting, after the knowledge graph is constructed, in order to be able to respond to new data and information changes in a timely manner and maintain the real-time and accuracy of the knowledge graph, this implementation scheme further introduces a dynamic update step based on the above-mentioned steps, thereby realizing the dynamic update of the knowledge graph by updating real-time data changes.

[0096] In the dynamic update step, automated information extraction technology and natural language processing tools are used to extract new entities, relationships, and events from the collected user behavior logs in real time and add them to the knowledge graph.

[0097] As a further preferred setting, in view of the large number of user audit logs, complex user behaviors, and the fact that the constructed knowledge graph has many entities, relationships, and events, and the relationships between nodes are intricate, this solution further combines index optimization, caching mechanism, distributed computing and other modes to improve the retrieval efficiency of the knowledge graph.

[0098] In the user behavior feature learning stage, the solution of the present invention realizes feature learning in the user behavior graph by adopting a graph representation learning-based method, and mines the implicit information between user behaviors in the constructed knowledge graph accordingly.

[0099] Specifically, this solution preferably introduces a gated attention mechanism network model to realize feature learning in the user behavior graph. The gated attention mechanism network model here is configured with a graph attention mechanism and a gating mechanism. Through the organic cooperation between the graph attention mechanism and the gating mechanism, the gated attention mechanism network model can capture the complex relationship and semantic information between nodes when processing graph structure data.

[0100] For further explanation, see Figure 4 ,The implementation process of this scheme based on the gated attention mechanism network model to learn features in the user behavior graph is as follows:

[0101] Step 1: Load user behavior graph data.

[0102] In this step, the constructed user behavior knowledge graph is loaded into the gated attention mechanism network model. At the same time, the gated attention mechanism network model is represented in the form of an adjacency matrix and a node feature matrix.

[0103] Step 2: Node feature initialization.

[0104] This step initializes the features (i.e., the value of the node) of each node in the gated attention network model loaded with knowledge graph data. As an example, in this step, the feature vector can be initialized randomly or according to the entity attributes of the node.

[0105] Step 3: Training and optimization.

[0106] Based on the first two steps, a gated attention mechanism network model is constructed, which is configured with attention mechanism, gating mechanism and node update rules. At the same time, the attention mechanism, gating mechanism and node update rules work together to capture the complex relationships and semantic information between nodes when processing graph structure data.

[0107] In this step, the constructed gated attention mechanism network model is further trained and optimized using an unsupervised learning method.

[0108] Specifically, in this step, the user behavior knowledge graph is divided into a training set, a validation set, and a test set, and it is ensured that the data in each set can represent the characteristics and relationships of the overall data; secondly, the unsupervised learning method is used to train and optimize the gated attention mechanism network model, using the mean square error as the loss function and Adam as the optimizer; then the training set user behavior graph data is loaded into the gated attention mechanism network model for batch training, and the model performance is evaluated on the validation set and the hyperparameters are adjusted according to the results on the validation set, such as the learning rate, batch size, number of hidden layers, etc.

[0109] Step 4: Feature extraction.

[0110] After the training in the third step is completed, the final feature representation h of each node is further extracted from the trained and optimized gated attention mechanism network model i , and represent these feature vectors as distributed features of knowledge graph nodes, which correspond to user behavior data.

[0111] The solution of the present invention adopts a single-class anomaly detection method - Deep SVDD model in the training stage of the deep anomaly detection model. When the model is trained, it does not require labels for each training sample, but only needs to ensure that most samples are normal samples, and describes the behavior of normal data by learning a "hypersphere". Deep SVDD does not need to rely on labeled data for training, and is suitable for the situation where normal samples are much larger than abnormal samples in anomaly detection scenarios. It can automatically learn discriminative feature representations from raw data, effectively reducing the manual feature engineering work in anomaly detection tasks, and using the powerful expression and generalization capabilities of deep learning, it can effectively detect anomalies on new samples that have not been seen, enhancing the practicality of the model in practical applications.

[0112] See also Figure 5 , which shows the composition principle diagram of the deep anomaly detection (Deep SVDD) model used in this solution. In this deep anomaly detection (Deep SVDD) model, a neural network is tried to learn to map the data points to another space. In this space, there is a hypersphere with c as the center and R as the radius. The neural network needs to ensure that most points (normal points) in the new space fall within the sphere, and a small number of points (abnormal points) fall outside the sphere, so as to detect abnormal points.

[0113] Furthermore, since the pattern of abnormal user behavior is constantly changing, and the behavior log of abnormal user behavior is normal business access log in terms of content, it is difficult to distinguish it from normal user behavior. Therefore, it is difficult to obtain the corpus required for training the anomaly detection model through manual annotation. Therefore, this solution uses an unsupervised approach to train the model for the single-class anomaly detection method - Deep SVDD model.

[0114] Based on this, in this stage, when training the single-class anomaly detection method - Deep SVDD model, the user behavior feature values ​​extracted by learning the gated attention mechanism network model are first input into the single-class anomaly detection method - Deep SVDD model, and then unsupervised learning is used to train the model, and parameters are adjusted and evaluated based on the performance of the model.

[0115] In the deep anomaly detection stage, the solution of the present invention performs anomaly detection on the user behavior logs collected in real time based on the single classification anomaly detection method - Deep SVDD model trained in the deep anomaly detection model training stage, so as to intelligently determine whether the user behavior corresponding to the log is abnormal. Based on the anomaly detection results, an anomaly report is generated or a preset anomaly handling process is triggered to help business operators respond to and handle abnormal situations in a timely manner.

[0116] The resulting detection solution for relatively abnormal user behavior in business systems, based on graph neural networks and further combined with the semantic understanding capabilities of knowledge graphs, can effectively process complex user behavior data in multiple business systems and achieve efficient and accurate anomaly detection.

[0117] Furthermore, this detection solution further improves the accuracy and explainability of anomaly detection through node-level feature learning and relationship modeling, providing enterprises with reliable security and operational support when facing volatile markets and user behaviors.

[0118] The detection scheme for relative abnormality of user behavior in a business system provided by the present invention can be used to form a corresponding software program in specific applications to form a corresponding detection system for relative abnormality of user behavior in a business system. When the software program is running, it will execute the above-mentioned detection method for relative abnormality of user behavior in a business system and store it in a corresponding storage medium for the processor to retrieve and execute.

[0119] See also Figure 6The business system user behavior relative anomaly detection system 100 formed in this way mainly includes five functional units: a user behavior data real-time collection and processing unit 110, a knowledge graph unit 120, a user behavior feature learning unit 130, a deep anomaly detection model training unit 140 and a deep anomaly detection unit 150.

[0120] The user behavior data real-time collection and processing unit 130 is specifically configured to obtain user behavior log data from multiple business systems, perform preprocessing, and extract key features corresponding to different business systems.

[0121] The knowledge graph unit 120 in this system is configured to interact with the user behavior data real-time collection and processing unit 110, and can extract corresponding business knowledge based on the extracted key features of different business systems, and construct a knowledge graph based on this, mapping the entities and relationships in the user behavior logs of different business systems into the knowledge graph.

[0122] The user behavior feature learning unit 130 in the system is specifically configured to interact with the knowledge graph unit 120 data, and can learn the features in the user behavior knowledge graph based on the constructed user behavior knowledge graph for different business systems by adopting a graph-based learning method;

[0123] The deep anomaly detection model training unit 140 in this system is specifically configured to interact with the user behavior feature learning unit 130 data, and can complete the deep anomaly detection model training based on the feature values ​​extracted through user behavior feature learning without a supervised learning mode.

[0124] The deep anomaly detection unit 150 in this system is configured to interact with the user behavior data real-time collection and processing unit 110 and the deep anomaly detection model training unit 140, and can perform anomaly detection on the real-time collected user behavior logs based on the trained deep anomaly detection model to intelligently identify the user behavior corresponding to the corresponding log.

[0125] As a further explanation, the user behavior data real-time collection and processing unit 110 in the present system can integrate the acquired original user behavior log data into a unified data representation form according to the extracted key features corresponding to different business systems.

[0126] Specifically, the user behavior data real-time collection and processing unit 110 is specifically composed of a data collection module 111, a data cleaning module 112, a feature extraction module 113 and a data integration module 114.

[0127] The data collection module 111 is specifically configured to obtain user behavior log data from multiple business systems. As an example, the data collection module 111 is configured to be able to monitor the user behavior data of the business system in real time, configure a real-time data stream pipeline to ensure fast and low-latency data transmission, and the data stream pipeline configured here can be Kafka, RabbitMQ, etc. At the same time, based on the configured real-time data stream pipeline, the business system actively pushes the generated user behavior log to the topic specified by Kafka in real time.

[0128] The data cleaning module 112 in this unit is configured to interact with the data acquisition module 111, and can be used to obtain user behavior log data from multiple business systems, and perform cleaning and preprocessing to remove noise and inconsistent data to ensure the accuracy of subsequent data processing results.

[0129] The feature extraction module 113 in this unit is configured to interact with the data cleaning module 112 and can extract key features based on the data features of different business systems that have undergone data collection and cleaning processing.

[0130] Specifically, the feature extraction module 113 can summarize the user behavior logs of various business systems into seven core features: "time", "personnel", "business system", "functional module", "operation type", "operation description", and "terminal", which facilitates unified processing of multi-system data.

[0131] The data integration module 114 in this unit is configured to interact with the feature extraction module 113 and can integrate the acquired original user behavior log data into a unified data representation based on the extracted key feature data, in preparation for subsequent analysis.

[0132] As a further explanation, the knowledge graph unit 120 in the present system is specifically composed of a business knowledge extraction module 121, a structuring module 122, a knowledge graph modeling module 123 and an event filling module 124.

[0133] The business knowledge extraction module 121 in this unit is configured to extract entity, attribute and event data from user behavior logs of various business systems.

[0134] The structuring module 122 in this unit is configured to interact with the business knowledge extraction module 121 data, and is capable of converting the extracted entities, events and attributes into structured data that can be understood by a machine.

[0135] The knowledge graph modeling module 123 in this unit is configured to interact with the data of the structuring module 122, and is able to map the structured entities, attributes and event data of different business systems into a unified semantic network (i.e., knowledge graph) to build a global data context.

[0136] Furthermore, the entity types in the knowledge graph here include "user", "unit", "application system", "functional module", "terminal information", etc., the relationships include "user's unit", "system includes modules", etc., and the events include basic types such as "login", "query", "update", and "delete". The knowledge graph modeling module 123 uses the D2R (Data to RDF) method to extract various types of entities, relationships, and events from the user audit log, fill them into the knowledge graph, and complete the behavior log knowledge graph.

[0137] The event filling module 124 in this unit maps the structured event information to the existing entity and relationship models in the user behavior knowledge graph, and fills in the relevant event nodes and attributes. The user behavior knowledge graph associates various types of entities through elements such as the "operation terminal", "operation system", and "operation module" of the event, and finally forms a unified and associated knowledge graph.

[0138] As a further explanation, the user behavior feature learning unit 130 in the present system is specifically composed of a gated attention mechanism network model, a training model, and a feature extraction module that cooperate with each other.

[0139] The training model in this unit is configured to train the gated attention mechanism network model using an unsupervised learning model by building a user behavior graph.

[0140] The feature extraction module in this unit is configured to extract the final features of each node as the distributed features of the knowledge graph nodes for the gated attention mechanism network model that has completed training.

[0141] As a further explanation, the deep anomaly detection model training unit in this system adopts a single classification anomaly detection method - Deep SVDD model and uses an unsupervised approach to perform model training.

[0142] In order to further illustrate the operation process and corresponding technical characteristics of the business system user behavior relative anomaly detection scheme constituted by this scheme, the following will illustrate the implementation process of the business system user behavior relative anomaly detection scheme to realize multiple business system user behavior relative anomaly detection through specific application examples.

[0143] When the detection scheme for relatively abnormal user behavior of this business system is applied in practice, the corresponding detection system or detection platform is first built based on the aforementioned scheme, and the user behavior logs collected in real time are then used for anomaly detection to intelligently determine whether the user behavior corresponding to the log is abnormal.

[0144] See also Figure 7 , which shows the implementation structure diagram of the user anomaly detection method in user anomaly detection.

[0145] As can be seen from the figure, this user anomaly detection method is divided into five stages when performing user anomaly detection: data collection and preprocessing, characterization of user behavior and relationship between behaviors, user behavior feature learning, anomaly detection model training and deep anomaly detection.

[0146] Phase 1: Data collection and preprocessing phase.

[0147] In this stage, real-time data is cleaned, features are extracted, and integrated. The specific process is as follows: Figure 2 shown.

[0148] Specifically, the business system actively pushes the generated user behavior logs to the topic (businesslog) specified by Kafka in real time. The log collection component monitors Kafka's businesslog topic in real time. When it monitors that a log is generated, it consumes new logs from it and hands them over to the log cleaning component for data cleaning and denoising. The log cleaning component verifies the integrity and compliance of the log content. The logs that pass the two checks are delivered to the feature extraction component, and the logs that fail the check are discarded as dirty data to ensure data quality. The feature extraction component summarizes the user behavior logs of various business systems into seven core features: "time", "personnel", "business system", "functional module", "operation type", "operation description", and "terminal", extracts these seven core features of the user behavior logs and standardizes them, and then hands the standardized logs to the integration component. The integration component persists the user behavior logs of each business system in a unified data warehouse, and at the same time, in order to improve the efficiency of subsequent data retrieval, they are stored in separate databases according to "time" and "operation type".

[0149] Phase 2: The phase of describing user behaviors and the relationships between behaviors.

[0150] like Figure 3 As shown, firstly, entities, relationships and events are extracted. The latest logs are obtained from the data warehouse to extract five types of entity element information - users, units, application systems, functional modules, and terminal information; three types of relationship information are extracted - the unit to which the user belongs, the functional modules included in the system, and the terminal used by the user; the user's behavior in using the business system can be summarized as login and add, delete, modify and query operations. Here, the event types of the business system are normalized, and five types of event information are extracted - login, query, update, delete, and add.

[0151] Then the user behavior graph is constructed. The entity types in the graph include "user", "unit", "business system", "functional module", "terminal information", etc. The relationships include "user's unit", "system contains functional modules", "user uses terminal", etc. Events include basic types such as "login", "query", "update", "delete", and "add". The graph mainly associates various types of entities through elements such as "operation terminal", "operation system", and "operation functional module" of the event, and finally forms a unified and associated knowledge graph.

[0152] Next, the knowledge graph is dynamically updated. Here, D2R (Data to RDF) technology is first used to extract various entity, relationship and event information in the user behavior log; then it is determined whether the entities and relationships are in the knowledge graph, and the entities and relationships that are not in the knowledge graph are filled into the knowledge graph; then the event information is mapped to the existing entity and relationship model in the user behavior knowledge graph, and the relevant event nodes and attributes are filled.

[0153] Phase 3: User behavior characteristics learning phase.

[0154] This stage is used to achieve the learning of dense vector-based distributed representation from discrete symbol-based knowledge representation, so as to better capture the hidden knowledge in the user behavior knowledge graph, and by connecting to the powerful capabilities of neural networks, the reasoning process is converted into calculations between vectors to make the reasoning efficient.

[0155] First, the user behavior graph is divided into training set, validation set and test set to ensure that the data in each set can represent the characteristics and relationships of the overall data; secondly, the gated attention mechanism network model is trained and optimized using the unsupervised learning method, using the mean square error as the loss function and Adam as the optimizer; then the training set user behavior graph data is loaded into the gated attention mechanism network model for batch training, the model performance is evaluated on the validation set and the hyperparameters are adjusted according to the results on the validation set, such as the learning rate, batch size, number of hidden layers, etc.; finally, the trained gated attention mechanism network model is used to extract features from the user behavior graph.

[0156] Phase 4: Anomaly detection model DeepSVDD training phase.

[0157] In this stage, the feature values ​​extracted by the gated attention mechanism network model are input into the deep detection model, and the model is trained using an unsupervised learning method. By training the network, the feature vectors of normal user behavior are concentrated in a small area, while the feature vectors of abnormal behavior are far away from this area.

[0158] Among them, the loss function of DeepSVDD consists of two parts: centralization loss: minimizing the distance from the feature vector to the center of the sphere; boundary loss: maximizing the radius of the sphere to ensure that normal data points are inside the sphere and abnormal data points are outside the sphere.

[0159] In this stage, the model training is completed by repeating the process of forward propagation, loss calculation, and back propagation until the model converges or reaches the preset training rounds.

[0160] Phase 5: Deep anomaly detection phase.

[0161] In this stage, we first use the gated attention mechanism network designed in the user behavior feature learning stage to extract user behavior data features, input the features into the deep anomaly detection model, and calculate the distance from the feature vector to the center of the sphere. If the distance is greater than the set threshold, the data point is considered abnormal.

[0162] It can be seen from the above examples that the detection scheme for relative anomalies of user behavior in the business system provided by the present invention improves the accuracy and intelligence level of anomaly detection through intelligent knowledge graph construction and dynamic update mechanism; based on graphical learning, it realizes deep feature learning and analysis of complex user behavior patterns; and combines the neural network anomaly detection algorithm with the knowledge graph to realize efficient recognition and real-time response capabilities for relative anomalies.

[0163] As further explanation, the present invention further provides the following implementation scheme.

[0164] An embodiment of the present invention further provides a processor, which is used to run a program, wherein the program executes the steps of the above-mentioned method for detecting relative abnormality of user behavior in a business system when running.

[0165] An embodiment of the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program code is loaded and executed by the processor to implement the steps of the above-mentioned method for detecting relative abnormality of user behavior in the business system.

[0166] The present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the above-mentioned method for detecting relative abnormality of user behavior in a business system.

[0167] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0168] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0169] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0170] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products of the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0171] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0172] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0173] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0174] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0175] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0176] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0177] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0178] The above-mentioned method of the present invention, or a specific system unit, or a part of the same, is a pure software architecture, which can be arranged on a physical medium, such as a hard disk, an optical disk, or any electronic device (such as a smart phone, a computer-readable storage medium) through program code. When the machine loads the program code and executes it (such as a smart phone loading and executing it), the machine becomes a device for implementing the present invention. The above-mentioned method and device of the present invention can also be transmitted in the form of program code through some transmission media, such as cables, optical fibers, or any transmission mode. When the program code is received, loaded and executed by a machine (such as a smart phone), the machine becomes a device for implementing the present invention.

[0179] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for detecting relative abnormal behavior of users in a business system, characterized in that: The detection method comprises: Real-time collection and processing of user behavior data: Obtain user behavior log data from multiple business systems, perform preprocessing, and extract key features corresponding to different business systems; Knowledge graph construction steps: Based on the extracted key features of different business systems, the corresponding business knowledge is extracted and a knowledge graph is constructed accordingly. The entities, relationships and events in the user behavior logs of different business systems are mapped to the knowledge graph. User behavior feature learning steps: Based on the user behavior knowledge graphs built for different business systems, the features in the user behavior knowledge graphs are learned using graph representation-based learning methods; Deep anomaly detection model training steps: Based on the feature values ​​extracted through user behavior feature learning, the deep anomaly detection model training is completed without supervised learning mode; Deep anomaly detection steps: Based on the trained deep anomaly detection model, anomaly detection is performed on the user behavior logs collected in real time to intelligently identify the user behavior corresponding to the corresponding log.

2. The method for detecting relative abnormality of user behavior in a business system according to claim 1, characterized in that: The detection method includes the following steps when collecting and processing user behavior data in real time: Data collection and cleaning steps: obtaining user behavior log data from multiple business systems, and performing cleaning and preprocessing to remove noise and inconsistent data; Feature extraction step, extracting key features based on the data features of different business systems; In the data integration step, the acquired raw user behavior log data is integrated into a unified data representation based on the extracted key feature data.

3. The method for detecting relative abnormality of user behavior in a business system according to claim 1, characterized in that: The detection method comprises the following steps in the knowledge graph construction step: Business knowledge extraction step, extracting entity, relationship and event data from user behavior logs of each business system; Structuring step: converting the extracted entities, relationships, and events into structured data that can be understood by machines; Knowledge graph modeling steps: Map the structured entities, relationships, and event data of different business systems into a unified semantic network to build a global data background and form a user behavior knowledge graph; Event filling step: Map the structured event information to the existing entity and relationship models in the user behavior knowledge graph, and fill in the relevant event nodes and attributes.

4. The method for detecting relative abnormality of user behavior in a business system according to claim 1, characterized in that: The detection method introduces a gated attention mechanism network model in the user behavior feature learning step, and trains the gated attention mechanism network model using an unsupervised learning model by constructing a user behavior knowledge graph. The final features of each node are extracted from the trained gated attention mechanism network model as distributed features of the knowledge graph nodes.

5. A system for detecting relative abnormal behavior of users in a business system, characterized in that: The detection system comprises: A user behavior data real-time collection and processing unit, wherein the user behavior data real-time collection and processing unit is configured to obtain user behavior log data from multiple business systems, perform preprocessing, and extract key features corresponding to different business systems; A knowledge graph unit, wherein the knowledge graph unit is configured to interact with the user behavior data real-time collection and processing unit data, and can extract corresponding business knowledge based on the extracted key features of different business systems, and construct a knowledge graph based on the extracted key features, and map the entities and relationships in the user behavior logs of different business systems into the knowledge graph; A user behavior feature learning unit, wherein the user behavior feature learning unit is configured to interact with the knowledge graph unit data, and can learn features in the user behavior knowledge graph based on the constructed user behavior knowledge graph for different business systems by adopting a graph-based representation learning method; A deep anomaly detection model training unit, wherein the deep anomaly detection model training unit is configured to interact with the user behavior feature learning unit data, and can complete the deep anomaly detection model training based on the feature values ​​extracted through the user behavior feature learning and without a supervised learning mode; A deep anomaly detection unit, wherein the deep anomaly detection unit is configured to interact with the user behavior data real-time collection and processing unit and the deep anomaly detection model training unit, and can perform anomaly detection on the real-time collected user behavior logs based on the trained deep anomaly detection model to intelligently identify the user behavior corresponding to the corresponding log.

6. The system for detecting relative abnormality of user behavior in a business system according to claim 5, characterized in that: The user behavior data real-time collection and processing unit integrates the acquired original user behavior log data into a unified data representation form according to the extracted key features corresponding to different business systems.

7. The system for detecting relative abnormality of user behavior in a business system according to claim 5, characterized in that: The knowledge graph unit includes: A business knowledge extraction module, wherein the business knowledge extraction module is configured to extract entity, attribute and event data from user behavior logs of each business system; A structuring module, wherein the structuring module is configured to interact with the business knowledge extraction module data and is capable of converting the extracted entities, events and attributes into structured data that can be understood by a machine; A knowledge graph modeling module, which is configured to interact with the structured module data and is capable of mapping the structured entity, relationship and event data of different business systems into a unified semantic network to build a global data context; Event filling module: Map the structured event information to the existing entity and relationship models in the user behavior knowledge graph, and fill in the relevant event nodes and attributes.

8. The system for detecting relative abnormality of user behavior in a business system according to claim 5, characterized in that: The user behavior feature learning unit includes: Gated attention mechanism network model, A training model, wherein the training model is configured to train a gated attention mechanism network model using an unsupervised learning model by using a constructed user behavior knowledge graph; A feature extraction module, wherein the feature extraction module is configured to extract the final features of each node as the distributed features of the knowledge graph node for the gated attention mechanism network model that has completed training.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for detecting relative abnormality of user behavior in a business system described in any one of claims 1 to 4 are implemented.

10. A computer program product, characterized in that When executed on a data processing device, it is suitable for executing the steps of the method for detecting relative abnormality of user behavior of a business system according to any one of claims 1 to 4.

Images