Abnormal data access identification method

Abstract

The invention particularly relates to an abnormal data access identification method, and belongs to the technical field of anomaly detection through traffic logs. According to the method, an existing calculation method is improved to obtain log feature extraction models, and then the log feature extraction models are respectively trained through different training sets; and respectively carrying out feature extraction through the two trained final models, and then sequentially carrying out similarity calculation on the obtained feature vectors with a real-time login environment log feature vector q and a real-time access behavior log feature vector u of the current access user so as to realize abnormal data access identification. According to the method, deep features of user behaviors are captured through the language model based on the deep neural network. The method can adapt to unstructured log data in various formats, and tedious log data preprocessing is not needed. Good performance is kept in complex scenes with multiple users, multiple data and irregular logs, and adaptability and flexibility of the method are enhanced.

Description

Technical Field

[0001] The present invention specifically relates to a method for identifying abnormal data access, and belongs to the technical field of abnormality detection through traffic logs. Background Art

[0002] With the rapid development of information technology, data security has become a focus of attention for enterprises and organizations. Among many security threats, abnormal data access behavior may lead to the leakage of sensitive information and cause significant losses to enterprises. Therefore, it is particularly important to accurately identify and prevent abnormal data access behavior. In recent years, with the development of machine learning technology, especially the breakthrough in the field of natural language processing (NLP), anomaly detection methods based on language models have gradually attracted attention. Language models, such as BERT (Bidirectional Encoder Representations from Transformers) and its variants, can capture deep semantic information in text data and provide new ideas for feature extraction. In the field of abnormal data access pattern recognition, by organizing the key entries in the log into text form, language models can be used for feature extraction. However, these methods still have two main disadvantages: 1. It is still necessary to organize unstructured logs into structured logs and extract key entries from them, resulting in additional data processing costs. 2. All information in the log is evenly focused, and the corresponding sensitive information cannot be keenly identified. The above two disadvantages will lead to a decrease in the accuracy of abnormal data access identification. Summary of the invention

[0003] The technical problem to be solved by the present invention is: how to improve the accuracy of abnormal data access identification.

[0004] In order to solve the above technical problems, the technical solution proposed by the present invention is: a method for identifying abnormal data access, involving a database storing historical login environment logs and historical access behavior logs of n normal users, historical abnormal login environment logs and historical abnormal access behavior logs of m abnormal users, and performing the following steps:

[0005] Step 1: Establish a log feature extraction model based on the improved Bert-based log detection algorithm, as shown in the following formula (1):

[0006]

[0007] In formula (1), oT is the output feature vector, X is the input text embedding vector, which is obtained by calculating the vocabulary embedding, segment embedding and position embedding of the original text words and then adding them together; W K , W Q , W V , W O , W1 , b 1 , W 2 , b 2 These are all parameters that need to be learned through training in the original Attention module; Ws is the sensitive mutual information extraction layer, which can gradually learn to extract key information in the log during the training process, so that it can give higher weights to the text corresponding to the sensitive features, so that the calculated feature vector has stronger representation ability in the anomaly recognition scenario; LayerNorm() and softmax() represent layer normalization and soft maximization calculations respectively;

[0008] Step 2: Perform N replacement samplings from the historical login environment logs of n normal users in the database and collect the sampling results to form a historical login environment log set A. Divide all the logs in the historical login environment log set A into a first training set B according to the empirical ratio. 1 and the first test set C 1 ; Through the first training set B 1 and the first test set C 1 Performing model training on the log feature extraction model to obtain a final login environment log feature extraction model; the final login environment log feature extraction model takes the login environment log as input and takes the login environment log feature vector as output;

[0009] Step 3: Perform N replacement samplings from the historical access behavior logs of n normal users in the database and collect the sampling results to form a historical access behavior log set D. Divide all the logs in the historical access behavior log set D into a second training set B according to the empirical ratio. 2 and the second test set C 2 ; Through the second training set B 2 and the second test set C 2 Performing model training on the log feature extraction model to obtain a final access behavior log feature extraction model; the final access behavior log feature extraction model takes the access behavior log as input and takes the access behavior log feature vector as output;

[0010] Step 4: Substitute the historical login environment logs of n normal users in the database into the final login environment log feature extraction model in turn to extract features to obtain n historical login environment log feature vectors and collect them to form a historical login environment log feature vector set E, as shown in the following formula (2):

[0011] E={e 1 、e 2 ,...,e n} (2)

[0012] In formula (2), e1 is the first historical login environment log feature vector obtained by extracting features from the historical login environment log of the first user among the n normal users in the database through the final login environment log feature extraction model; e 2 is a second historical login environment log feature vector obtained by extracting features from the historical login environment log of the second user among the n normal users in the database through the final login environment log feature extraction model; e n The nth historical login environment log feature vector is obtained by extracting features from the historical login environment log of the last user among the n normal users in the database through the final login environment log feature extraction model;

[0013] Substitute the historical access behavior logs of n normal users in the database into the final access behavior log feature extraction model in turn to extract features to obtain n historical access behavior log feature vectors and collect them to form a historical access behavior log feature vector set F, as shown in the following formula (3):

[0014] F={f 1 、f 2 , ..., f n} (3)

[0015] In formula (3), f 1 is the first historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the first user among the n normal users in the database through the final access behavior log feature extraction model; f 2 is a second historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the second user among the n normal users in the database through the final access behavior log feature extraction model; f n The nth historical access behavior log feature vector is obtained by extracting features from the historical access behavior log of the last user among the n normal users in the database through the final access behavior log feature extraction model;

[0016] Substitute the historical abnormal login environment logs of m abnormal users in the database into the final login environment log feature extraction model in turn to extract features to obtain m historical abnormal login environment log feature vectors and collect them to form a historical abnormal login environment log feature vector set O, as shown in the following formula (4):

[0017] O={o 1 , o 2 ,...,o m} (4)

[0018] In formula (4), o1 is the first historical abnormal login environment log feature vector obtained by extracting features from the historical abnormal login environment log of the first user among the m abnormal users in the database through the final login environment log feature extraction model; 2 is a second historical abnormal login environment log feature vector obtained by extracting features from the historical abnormal login environment log of the second user among the m abnormal users in the database through the final login environment log feature extraction model; m The mth historical abnormal login environment log feature vector is obtained by extracting features from the historical abnormal login environment log of the last user among the m abnormal users in the database through the final login environment log feature extraction model;

[0019] Substitute the historical abnormal access behavior logs of m abnormal users in the database into the final access behavior log feature extraction model in turn to extract features to obtain m historical abnormal access behavior log feature vectors and collect them to form a historical abnormal access behavior log feature vector set K, as shown in the following formula (5):

[0020] K={k 1 , k 2 , ..., k m} (5)

[0021] In formula (5), k 1 is the first historical abnormal access behavior log feature vector obtained by extracting features from the historical abnormal access behavior log of the first user among the m abnormal users in the database through the final access behavior log feature extraction model; k 2 is a second historical abnormal access behavior log feature vector obtained by extracting features from the historical abnormal access behavior log of the second user among the m abnormal users in the database through the final access behavior log feature extraction model; k m The mth historical abnormal access behavior log feature vector is obtained by extracting features from the historical abnormal access behavior log of the last user among the m abnormal users in the database through the final access behavior log feature extraction model;

[0022] Step 5: Read the real-time login environment log Q and the real-time access behavior log U of the current access user in real time, substitute the real-time login environment log Q and the real-time access behavior log E into the final login environment log feature extraction model and the final access behavior log feature extraction model respectively to perform feature extraction, and obtain the real-time login environment log feature vector q and the real-time access behavior log feature vector u of the current access user;

[0023] The similarity S between the current access user's real-time login environment and the historical login environment is calculated according to the following formula (6): u ,

[0024]

[0025] In formula (6), q is the real-time login environment log feature vector of the current access user; e i is the i-th historical login environment log feature vector in the historical login environment log feature vector set E; ||q|| is the modulus value of q; ||e i || is the e i The modulus value of

[0026] The similarity S between the current access user's real-time access behavior and historical access behavior is calculated according to the following formula (7): a ,

[0027]

[0028] In formula (7), u is the real-time access behavior log feature vector of the current access user; f i is the i-th historical access behavior log feature vector in the historical access behavior log feature vector set F; ||u|| is the modulus value of u; ||f i || is the f i The modulus value of

[0029] The similarity Y between the current access user's real-time login environment and the historical abnormal login environment is calculated according to the following formula (8): u ,

[0030]

[0031] In formula (8), q is the real-time login environment log feature vector of the current access user; i is the i-th historical abnormal login environment log feature vector in the historical abnormal login environment log feature vector set O; q|| is the modulus value of q; ||o i || is the o i The modulus value of

[0032] The similarity Y between the current user's real-time access behavior and the historical abnormal access behavior is calculated according to the following formula (9): a ,

[0033]

[0034] In formula (9), u is the real-time access behavior log feature vector of the current access user; k iis the i-th historical abnormal access behavior log feature vector in the historical abnormal access behavior log feature vector set K; u|| is the modulus value of u; ||k i || is the k i The modulus of

[0035] Step 6: Obtain the login environment risk level RISK of the current access user according to the following formula (10): u ,

[0036]

[0037] In formula (10), and are the similarity thresholds of the first and second login environments, respectively, both of which are empirical values;

[0038] According to the following formula (11), the access behavior risk level RISK of the current access user is obtained: a ,

[0039]

[0040] In formula (11), and are the first and second access behavior similarity thresholds, both of which are empirical values;

[0041] If the login environment risk level of the current access user is RISK u RISK LEVELS AND RISK LEVELS a If the sum is greater than level 3, it means that the access data of the current access user is abnormal data; if the login environment risk level of the current access user is RISK u RISK LEVELS AND RISK LEVELS a If the sum is not greater than 3 levels, it means that the access data of the current access user is normal data.

[0042] Furthermore, the specific steps of the training process in step 2 are as follows:

[0043] Step 2.1: Add a special flag USER to the beginning of each login environment log text in the training data set, and use the output vector o corresponding to the USER flag as the feature vector of the entire log text;

[0044] Step 2.2: Construct the loss function of multi-task fine-tuning, which is composed of the loss functions of multiple subtasks; each subtask is divided into feature vector o to predict a sensitive feature of the login log through a linear layer of size h×1, where h is the dimension of o. The subtask uses the feature vector to predict the user's geographic location, IP address range, MAC address, permission level and other sensitive information, so as to extract the key features of the log; for the classification subtask, cross entropy is used As the loss function, and Represent the true value and predicted value of the nth sample in the i-th category respectively; for regression tasks, the mean square error is used As the loss function, y n and Represent the true value and predicted value of the nth sample respectively; the final error function is the average of all subtask error functions Where L t represents the tth subtask.

[0045] Furthermore, the specific steps of the training process in step 3 are as follows:

[0046] Step 3.1: Add a special flag USER to the beginning of each access behavior log text in the training data set, and use the output vector o corresponding to the USER flag as the feature vector of the entire log text;

[0047] Step 3.2: Construct the loss function of multi-task fine-tuning, which is composed of the loss functions of multiple subtasks; each subtask is divided into feature vector o to predict a sensitive feature of the login log through a linear layer of size h×1, where h is the dimension of o. The subtask uses the feature vector to predict data permission level, user permission level, user access frequency, data type, data source, and other sensitive information, so as to extract the key features of the log; for the classification subtask, cross entropy is also used as the loss function, and for the regression task, mean square error is also used as the loss function. The final error function is the average of all subtask error functions.

[0048] Beneficial effects of the present invention: The present invention improves the existing Bert-based log detection algorithm to obtain a log feature extraction model, and then trains the log feature extraction model to become a final login environment log feature extraction model and a final access behavior log feature extraction model through different training sets; the two trained final models perform feature extraction on all historical login environment logs, historical access behavior logs, historical abnormal login environment logs, and historical abnormal access behavior logs, and then perform similarity calculations on the obtained feature vectors with the real-time login environment log feature vector q and the real-time access behavior log feature vector u of the current access user in turn to realize abnormal data access identification. The present invention captures the deep-level features of user behavior through a language model based on a deep neural network. It can adapt to various formats and unstructured log data without tedious log data preprocessing. It maintains good performance in complex scenarios with multiple users, multiple data, and irregular logs, and enhances the adaptability and flexibility of the method. DETAILED DESCRIPTION

[0049] The following is a further description of a method for identifying abnormal data access according to the present invention in conjunction with a specific embodiment.

[0050] Example

[0051] The method for identifying abnormal data access in this implementation involves storing a database having historical login environment logs and historical access behavior logs of n normal users, and historical abnormal login environment logs and historical abnormal access behavior logs of m abnormal users, and performing the following steps:

[0052] Step 1: Establish a log feature extraction model based on the improved Bert-based log detection algorithm, as shown in the following formula (1):

[0053]

[0054] In formula (1), oT is the output feature vector, X is the input text embedding vector, which is obtained by calculating the vocabulary embedding, segment embedding and position embedding of the original text words and then adding them together; W K , W Q , W V , W O , W 1 , b 1 , W 2 , b 2These are all parameters that need to be learned through training in the original Attention module; Ws is the sensitive mutual information extraction layer, which can gradually learn to extract key information in the log during the training process, so that it can give higher weights to the text corresponding to the sensitive features, so that the calculated feature vector has stronger representation ability in the anomaly recognition scenario; LayerNorm() and softmax() represent layer normalization and soft maximization calculations respectively;

[0055] Step 2: Perform N replacement samplings from the historical login environment logs of n normal users in the database and collect the sampling results to form a historical login environment log set A. Divide all the logs in the historical login environment log set A into the first training set B according to the empirical ratio. 1 and the first test set C 1 , the empirical ratio in this embodiment is 7:3; through the first training set B 1 and the first test set C 1 The log feature extraction model is trained to obtain a final login environment log feature extraction model; the final login environment log feature extraction model takes the login environment log as input and takes the login environment log feature vector as output;

[0056] The specific steps of the training process are as follows:

[0057] Step 2.1: Add a special flag USER to the beginning of each login environment log text in the training data set, and use the output vector o corresponding to the USER flag as the feature vector of the entire log text;

[0058] Step 2.2: Construct the loss function of multi-task fine-tuning, which is composed of the loss functions of multiple subtasks; each subtask is divided into feature vector o to predict a sensitive feature of the login log through a linear layer of size h×1, where h is the dimension of o. The subtask uses the feature vector to predict the user's geographic location, IP address range, MAC address, permission level and other sensitive information, so as to extract the key features of the log; for the classification subtask, cross entropy is used As the loss function, and Represent the true value and predicted value of the nth sample in the i-th category respectively; for regression tasks, the mean square error is used As the loss function, y n and Represent the true value and predicted value of the nth sample respectively; the final error function is the average of all subtask error functions Where L t represents the tth subtask.

[0059] Step 3: Perform N replacement sampling from the historical access behavior logs of n normal users in the database and collect the sampling results to form a historical access behavior log set D. Divide all the logs in the historical access behavior log set D into the second training set B according to the empirical ratio. 2 and the second test set C 2 , the empirical ratio in this embodiment is 7:3; through the second training set B 2 and the second test set C 2 The log feature extraction model is trained to obtain a final access behavior log feature extraction model; the final access behavior log feature extraction model takes the access behavior log as input and takes the access behavior log feature vector as output;

[0060] The specific steps of the training process are as follows:

[0061] Step 3.1: Add a special flag USER to the beginning of each access behavior log text in the training data set, and use the output vector o corresponding to the USER flag as the feature vector of the entire log text;

[0062] Step 3.2: Construct the loss function of multi-task fine-tuning, which is composed of the loss functions of multiple subtasks; each subtask is divided into feature vector o to predict a sensitive feature of the login log through a linear layer of size h×1, where h is the dimension of o. The subtask uses the feature vector to predict data permission level, user permission level, user access frequency, data type, data source, and other sensitive information, so as to extract the key features of the log; for the classification subtask, cross entropy is also used as the loss function, and for the regression task, mean square error is also used as the loss function. The final error function is the average of all subtask error functions.

[0063] Step 4: Substitute the historical login environment logs of n normal users in the database into the final login environment log feature extraction model in turn to extract features to obtain n historical login environment log feature vectors and collect them to form a historical login environment log feature vector set E, as shown in the following formula (2):

[0064] E={e 1 、e 2 ,...,e n} (2)

[0065] In formula (2), e 1 is the first historical login environment log feature vector obtained by extracting features from the historical login environment log of the first user among n normal users in the database through the final login environment log feature extraction model; e 2is the second historical login environment log feature vector obtained by extracting features from the historical login environment log of the second user among the n normal users in the database through the final login environment log feature extraction model; e n It is the nth historical login environment log feature vector obtained by extracting the historical login environment log of the last user among the n normal users in the database through the final login environment log feature extraction model;

[0066] Substitute the historical access behavior logs of n normal users in the database into the final access behavior log feature extraction model in turn to extract features to obtain n historical access behavior log feature vectors and collect them to form a historical access behavior log feature vector set F, as shown in the following formula (3):

[0067] F={f 1 、f 2 , ..., f n} (3)

[0068] In formula (3), f 1 is the first historical access behavior log feature vector obtained by extracting the historical access behavior log of the first user among n normal users in the database through the final access behavior log feature extraction model; f 2 is the second historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the second user among the n normal users in the database through the final access behavior log feature extraction model; f n It is the nth historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the last user among n normal users in the database through the final access behavior log feature extraction model;

[0069] Substitute the historical abnormal login environment logs of m abnormal users in the database into the final login environment log feature extraction model in turn to extract features to obtain m historical abnormal login environment log feature vectors and collect them to form a historical abnormal login environment log feature vector set O, as shown in the following formula (4):

[0070] O={o 1 , o 2 ,...,o m} (4)

[0071] In formula (4), o 1 is the first historical abnormal login environment log feature vector obtained by extracting the historical abnormal login environment log of the first user among the m abnormal users in the database through the final login environment log feature extraction model; 2is the second historical abnormal login environment log feature vector obtained by extracting the historical abnormal login environment log of the second user among the m abnormal users in the database through the final login environment log feature extraction model; m It is the mth historical abnormal login environment log feature vector obtained by extracting the feature of the historical abnormal login environment log of the last user among the m abnormal users in the database through the final login environment log feature extraction model;

[0072] Substitute the historical abnormal access behavior logs of m abnormal users in the database into the final access behavior log feature extraction model in turn to extract features to obtain m historical abnormal access behavior log feature vectors and collect them to form a historical abnormal access behavior log feature vector set K, as shown in the following formula (5):

[0073] K={k 1 , k 2 , ..., k m} (5)

[0074] In formula (5), k 1 k is the first historical abnormal access behavior log feature vector obtained by extracting the historical abnormal access behavior log of the first user among the m abnormal users in the database through the final access behavior log feature extraction model; 2 k is the second historical abnormal access behavior log feature vector obtained by extracting features from the historical abnormal access behavior log of the second user among the m abnormal users in the database through the final access behavior log feature extraction model; m It is the mth historical abnormal access behavior log feature vector obtained by extracting the historical abnormal access behavior log of the last user among the m abnormal users in the database through the final access behavior log feature extraction model;

[0075] Step 5: Read the real-time login environment log Q and real-time access behavior log U of the current access user in real time, substitute the real-time login environment log Q and real-time access behavior log E into the final login environment log feature extraction model and the final access behavior log feature extraction model respectively for feature extraction, and obtain the real-time login environment log feature vector q and real-time access behavior log feature vector u of the current access user;

[0076] The similarity S between the current access user's real-time login environment and the historical login environment is calculated according to the following formula (6): u ,

[0077]

[0078] In formula (6), q is the real-time login environment log feature vector of the current access user; e iis the i-th historical login environment log feature vector in the historical login environment log feature vector set E; ||q|| is the modulus value of q; ||e i || is e i The modulus value of

[0079] The similarity S between the current access user's real-time access behavior and historical access behavior is calculated according to the following formula (7): a ,

[0080]

[0081] In formula (7), u is the real-time access behavior log feature vector of the current access user; f i is the i-th historical access behavior log feature vector in the historical access behavior log feature vector set F; ||u|| is the modulus value of u; ||f i || is f i The modulus value of

[0082] The similarity Y between the current access user's real-time login environment and the historical abnormal login environment is calculated according to the following formula (8): u ,

[0083]

[0084] In formula (8), q is the real-time login environment log feature vector of the current access user; i is the i-th historical abnormal login environment log feature vector in the historical abnormal login environment log feature vector set O; ||q|| is the modulus value of q; ||o i ||Yes i The modulus value of

[0085] The similarity Y between the current user's real-time access behavior and the historical abnormal access behavior is calculated according to the following formula (9): a ,

[0086]

[0087] In formula (9), u is the real-time access behavior log feature vector of the current access user; k i is the i-th historical abnormal access behavior log feature vector in the historical abnormal access behavior log feature vector set K; ||u|| is the modulus value of u; ||k i || is k i The modulus value of

[0088] Step 6: Obtain the login environment risk level RISK of the current access user according to the following formula (10): u ,

[0089]

[0090] In formula (10), and are the similarity thresholds of the first and second login environments, respectively, both of which are empirical values;

[0091] According to the following formula (11), the access behavior risk level RISK of the current access user is obtained: a ,

[0092]

[0093] In formula (11), and are the first and second access behavior similarity thresholds, both of which are empirical values;

[0094] If the current access user's login environment risk level is RISK u RISK a If the sum is greater than level 3, it means that the access data of the current access user is abnormal data; if the login environment risk level of the current access user is RISK u RISK a If the sum is not greater than 3 levels, it means that the access data of the current access user is normal data.

Claims

1. A method for identifying abnormal data access, involving a database storing historical login environment logs and historical access behavior logs of n normal users, and historical abnormal login environment logs and historical abnormal access behavior logs of m abnormal users, characterized in that: Perform the following steps: Step 1: Establish a log feature extraction model based on the improved Bert-based log detection algorithm, as shown in the following formula (1): In formula (1), oT is the output feature vector, X is the input text embedding vector, which is obtained by calculating the vocabulary embedding, segment embedding and position embedding of the original text words and then adding them together; W K , W Q , W V , W O , W1, b1, W2, b2 are all parameters in the original Attention module that need to be learned through training; Ws is the sensitive mutual information extraction layer, which can gradually learn to extract key information in the log during the training process, so that it can give higher weights to the text corresponding to the sensitive features, so that the calculated feature vector has stronger representation ability in the anomaly recognition scenario; LayerNorm() and softmax() represent layer normalization and soft maximization calculation respectively; Step 2: Perform N times of replacement sampling from the historical login environment logs of n normal users in the database and collect the sampling results to form a historical login environment log set A, and divide all the logs in the historical login environment log set A into a first training set B1 and a first test set C1 according to an empirical ratio; perform model training on the log feature extraction model through the first training set B1 and the first test set C1 to obtain a final login environment log feature extraction model; the final login environment log feature extraction model takes the login environment log as input and takes the login environment log feature vector as output; Step 3: Perform N replacement samplings from the historical access behavior logs of n normal users in the database and collect the sampling results to form a historical access behavior log set D, and divide all the logs in the historical access behavior log set D into a second training set B2 and a second test set C2 according to an empirical ratio; train the log feature extraction model using the second training set B2 and the second test set C2 to obtain a final access behavior log feature extraction model; The final access behavior log feature extraction model takes the access behavior log as input and takes the access behavior log feature vector as output; Step 4: Substitute the historical login environment logs of n normal users in the database into the final login environment log feature extraction model in turn to extract features to obtain n historical login environment log feature vectors and collect them to form a historical login environment log feature vector set E, as shown in the following formula (2): E={e1、e2、...、e n } (2) In formula (2), e1 is the first historical login environment log feature vector obtained by extracting features from the historical login environment log of the first user among the n normal users in the database through the final login environment log feature extraction model; e2 is the second historical login environment log feature vector obtained by extracting features from the historical login environment log of the second user among the n normal users in the database through the final login environment log feature extraction model; e n The nth historical login environment log feature vector is obtained by extracting features from the historical login environment log of the last user among the n normal users in the database through the final login environment log feature extraction model; Substitute the historical access behavior logs of n normal users in the database into the final access behavior log feature extraction model in turn to extract features to obtain n historical access behavior log feature vectors and collect them to form a historical access behavior log feature vector set F, as shown in the following formula (3): F={f1、f2、...、f n } (3) In formula (3), f1 is the first historical access behavior log feature vector obtained by extracting the historical access behavior log of the first user among the n normal users in the database through the final access behavior log feature extraction model; f2 is a second historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the second user among the n normal users in the database through the final access behavior log feature extraction model; f n The nth historical access behavior log feature vector is obtained by extracting features from the historical access behavior log of the last user among the n normal users in the database through the final access behavior log feature extraction model; Substitute the historical abnormal login environment logs of m abnormal users in the database into the final login environment log feature extraction model in turn to extract features to obtain m historical abnormal login environment log feature vectors and collect them to form a historical abnormal login environment log feature vector set O, as shown in the following formula (4): O={o1、o2、...、o m } (4) In formula (4), o1 is the first historical abnormal login environment log feature vector obtained by extracting the historical abnormal login environment log of the first user among the m abnormal users in the database through the final login environment log feature extraction model; o2 is the second historical abnormal login environment log feature vector obtained by extracting the historical abnormal login environment log of the second user among the m abnormal users in the database through the final login environment log feature extraction model; m The mth historical abnormal login environment log feature vector is obtained by extracting features from the historical abnormal login environment log of the last user among the m abnormal users in the database through the final login environment log feature extraction model; Substitute the historical abnormal access behavior logs of m abnormal users in the database into the final access behavior log feature extraction model in turn to extract features to obtain m historical abnormal access behavior log feature vectors and collect them to form a historical abnormal access behavior log feature vector set K, as shown in the following formula (5): K={k1、k2、...、k m } (5) In formula (5), k1 is the first historical abnormal access behavior log feature vector obtained by extracting the historical abnormal access behavior log of the first user among the m abnormal users in the database through the final access behavior log feature extraction model; k2 is the second historical abnormal access behavior log feature vector obtained by extracting the historical abnormal access behavior log of the second user among the m abnormal users in the database through the final access behavior log feature extraction model; k m The mth historical abnormal access behavior log feature vector is obtained by extracting features from the historical abnormal access behavior log of the last user among the m abnormal users in the database through the final access behavior log feature extraction model; Step 5: Read the real-time login environment log Q and the real-time access behavior log U of the current access user in real time, substitute the real-time login environment log Q and the real-time access behavior log E into the final login environment log feature extraction model and the final access behavior log feature extraction model respectively to perform feature extraction, and obtain the real-time login environment log feature vector q and the real-time access behavior log feature vector u of the current access user; The similarity S between the current access user's real-time login environment and the historical login environment is calculated according to the following formula (6): u , In formula (6), q is the real-time login environment log feature vector of the current access user; e i is the i-th historical login environment log feature vector in the historical login environment log feature vector set E; ||q|| is the modulus value of q; ||e i || is the e i The modulus of The similarity S between the current access user's real-time access behavior and historical access behavior is calculated according to the following formula (7): a , In formula (7), u is the real-time access behavior log feature vector of the current access user; f i is the i-th historical access behavior log feature vector in the historical access behavior log feature vector set F; | |u|| is the modulus value of u; ||f i || is the f i The modulus of The similarity Y between the current access user's real-time login environment and the historical abnormal login environment is calculated according to the following formula (8): u , In formula (8), q is the real-time login environment log feature vector of the current access user; i is the i-th historical abnormal login environment log feature vector in the historical abnormal login environment log feature vector set O; ||q|| is the modulus value of q; ||o i || is the o i The modulus of The similarity Y between the current user's real-time access behavior and the historical abnormal access behavior is calculated according to the following formula (9): a , In formula (9), u is the real-time access behavior log feature vector of the current access user; k i is the i-th historical abnormal access behavior log feature vector in the historical abnormal access behavior log feature vector set K; | |u|| is the modulus value of u; ||k i || is the k i The modulus of Step 6: Obtain the login environment risk level RISK of the current access user according to the following formula (10): u , In formula (10), and are the similarity thresholds of the first and second login environments, respectively, both of which are empirical values; According to the following formula (11), the access behavior risk level RISK of the current access user is obtained: a , In formula (11), and are the first and second access behavior similarity thresholds, both of which are empirical values; If the login environment risk level of the current access user is RISK u RISK LEVELS AND RISK LEVELS a If the sum is greater than level 3, it means that the access data of the current access user is abnormal data; If the login environment risk level of the current access user is RISK u RISK LEVELS AND RISK LEVELS a If the sum is not greater than 3 levels, it means that the access data of the current access user is normal data.

2. The method for identifying abnormal data access according to claim 1, characterized in that: The specific steps of the training process in step 2 are as follows: Step 2.1: Add a special flag USER to the beginning of each login environment log text in the training data set, and use the output vector o corresponding to the USER flag as the feature vector of the entire log text; Step 2.2: Construct the loss function of multi-task fine-tuning, which is composed of the loss functions of multiple subtasks; each subtask is divided into feature vector o to predict a sensitive feature of the login log through a linear layer of size h×1, where h is the dimension of o. The subtask uses the feature vector to predict the user's geographic location, IP address range, MAC address, permission level and other sensitive information, so as to extract the key features of the log; for the classification subtask, cross entropy is used As the loss function, and Represent the true value and predicted value of the nth sample in the i-th category respectively; for regression tasks, the mean square error is used As the loss function, y n and Represent the true value and predicted value of the nth sample respectively; the final error function is the average of all subtask error functions Where L t represents the tth subtask.

3. The method for identifying abnormal data access according to claim 1, characterized in that: The specific steps of the training process in step 3 are as follows: Step 3.1: Add a special flag USER to the beginning of each access behavior log text in the training data set, and use the output vector o corresponding to the USER flag as the feature vector of the entire log text; Step 3.2: Construct the loss function of multi-task fine-tuning, which is composed of the loss functions of multiple subtasks; each subtask is divided into feature vector o to predict a sensitive feature of the login log through a linear layer of size h×1, where h is the dimension of o. The subtask uses the feature vector to predict data permission level, user permission level, user access frequency, data type, data source, and other sensitive information, so as to extract the key features of the log; for the classification subtask, cross entropy is also used as the loss function, and for the regression task, mean square error is also used as the loss function. The final error function is the average of all subtask error functions.

Images