Method for identifying anomalous data access

Abstract

The application particularly relates to a method for identifying abnormal data access, and belongs to the technical field of abnormal detection through traffic logs. The application improves an existing measurement algorithm to obtain a log feature extraction model, and then trains the log feature extraction model through different training sets; the two final models trained are used for feature extraction respectively, and then the obtained feature vectors are sequentially subjected to similarity calculation with a real-time login environment log feature vector q and a real-time access behavior log feature vector u of a current access user, so that abnormal data access identification is realized. The application captures deep features of user behavior through a language model based on a deep neural network. The application can adapt to various formats and unstructured log data, and does not need complicated log data preprocessing. In a complex scene of multiple users, multiple data and irregular logs, the application maintains good performance, and enhances adaptability and flexibility of the method.

Description

TECHNICAL FIELD

[0001] The present application relates to a method for identifying abnormal data access, belonging to the technical field of anomaly detection through traffic logs. BACKGROUND

[0002] With the rapid development of information technology, data security has become the focus of enterprises and organizations. Among many security threats, abnormal data access behavior may lead to sensitive information leakage, causing significant losses to enterprises. Therefore, accurately identifying and preventing abnormal data access behavior becomes particularly important. In recent years, with the development of machine learning technology, especially the breakthroughs in natural language processing (NLP) field, language model-based anomaly detection methods have gradually attracted attention. Language models, such as BERT (Bidirectional Encoder Representations from Transformers) and its variants, can capture deep semantic information in text data, providing a new approach to feature extraction. In the field of abnormal data access pattern recognition, by organizing key entries in logs into text form, language models can be used for feature extraction. However, these methods still have two main drawbacks: 1. Still need to organize unstructured logs into structured logs and extract key entries from them, resulting in additional data processing costs. 2. All information in the log is equally focused, which cannot accurately identify the corresponding sensitive information. The above two shortcomings will lead to a decrease in the accuracy of abnormal data access identification. SUMMARY

[0003] The technical problem to be solved by the present application is how to improve the accuracy of abnormal data access identification.

[0004] To solve the above technical problems, the technical solution proposed by the present application is: a method for identifying abnormal data access, involving a database storing n normal user's historical login environment logs and historical access behavior logs, m abnormal user's historical abnormal login environment logs and historical abnormal access behavior logs, and performing the following steps:

[0005] Step 1: Establish a log feature extraction model based on the improved Bert-based log detection algorithm, as shown in the following formula (1),

[0006]

[0007] In formula (1), oT is the output feature vector, X is the input text embedding vector, which is obtained by adding the word embedding, segment embedding and position embedding calculated on the original text words; W K , W Q , W V , W O, W1, b1, W2, b2 are parameters that need to be learned through training in the original Attention module; Ws is a sensitive mutual information extraction layer, which can gradually learn to extract key information in the log during training, so as to give higher weight to the text corresponding to the sensitive feature, so that the calculated feature vector has stronger representation ability in the abnormal identification scene; LayerNorm() and softmax() represent layer normalization and soft-max computation respectively;

[0008] Step 2: N times of replacement sampling are performed on the historical login environment logs of n normal users in the database, and the sampling results are collected to form a historical login environment log set A. All logs in the historical login environment log set A are divided into a first training set B1 and a first test set C1 according to an empirical proportion. The log feature extraction model is trained through the first training set B1 and the first test set C1, and a final login environment log feature extraction model is obtained. The final login environment log feature extraction model takes a login environment log as input and outputs a login environment log feature vector.

[0009] Step 3: N times of replacement sampling are performed on the historical access behavior logs of n normal users in the database, and the sampling results are collected to form a historical access behavior log set D. All logs in the historical access behavior log set D are divided into a second training set B2 and a second test set C2 according to an empirical proportion. The log feature extraction model is trained through the second training set B2 and the second test set C2, and a final access behavior log feature extraction model is obtained. The final access behavior log feature extraction model takes an access behavior log as input and outputs an access behavior log feature vector.

[0010] Step 4: The historical login environment logs of n normal users in the database are sequentially substituted into the final login environment log feature extraction model for feature extraction to obtain n historical login environment log feature vectors and collect them to form a historical login environment log feature vector set E, as shown in the following formula (2),

[0011] E={e1、e2、...、e n} (2)

[0012] In formula (2), e1 is a first historical login environment log feature vector obtained by substituting the historical login environment log of a first user of n normal users in the database into the final login environment log feature extraction model for feature extraction; e2 is a second historical login environment log feature vector obtained by substituting the historical login environment log of a second user of n normal users in the database into the final login environment log feature extraction model for feature extraction; e nis an nth historical login environment log feature vector obtained by feature extraction of the historical login environment log of the last one of the n normal users in the database through the final login environment log feature extraction model;

[0013] The historical access behavior logs of the n normal users in the database are sequentially substituted into the final access behavior log feature extraction model for feature extraction to obtain n historical access behavior log feature vectors which are collected to form a historical access behavior log feature vector set F, as shown in the following formula (3),

[0014] F = {f1, f2,..., fn} (3) n

[0015] In formula (3), f1 is a first historical access behavior log feature vector obtained by feature extraction of the historical access behavior log of the first one of the n normal users in the database through the final access behavior log feature extraction model; f2 is a second historical access behavior log feature vector obtained by feature extraction of the historical access behavior log of the second one of the n normal users in the database through the final access behavior log feature extraction model; f n is an nth historical access behavior log feature vector obtained by feature extraction of the historical access behavior log of the last one of the n normal users in the database through the final access behavior log feature extraction model;

[0016] The historical abnormal login environment logs of the m abnormal users in the database are sequentially substituted into the final login environment log feature extraction model for feature extraction to obtain m historical abnormal login environment log feature vectors which are collected to form a historical abnormal login environment log feature vector set O, as shown in the following formula (4),

[0017] O = {o1, o2,..., om} (4) m

[0018] In formula (4), o1 is a first historical abnormal login environment log feature vector obtained by feature extraction of the historical abnormal login environment log of the first one of the m abnormal users in the database through the final login environment log feature extraction model; o2 is a second historical abnormal login environment log feature vector obtained by feature extraction of the historical abnormal login environment log of the second one of the m abnormal users in the database through the final login environment log feature extraction model; o m is an mth historical abnormal login environment log feature vector obtained by feature extraction of the historical abnormal login environment log of the last one of the m abnormal users in the database through the final login environment log feature extraction model; ​​

[0019] The history abnormal access behavior log of the m abnormal users in the database is sequentially substituted into the final access behavior log feature extraction model for feature extraction to obtain m history abnormal access behavior log feature vectors and collect them to form a history abnormal access behavior log feature vector set K, as shown in the following formula (5),

[0020] K={k1、k2、...、k m} (5)

[0021] In formula (5), k1 is the first history abnormal access behavior log feature vector obtained by substituting the history abnormal access behavior log of the first user of the m abnormal users in the database into the final access behavior log feature extraction model for feature extraction; k2 is the second history abnormal access behavior log feature vector obtained by substituting the history abnormal access behavior log of the second user of the m abnormal users in the database into the final access behavior log feature extraction model for feature extraction; k m is the mth history abnormal access behavior log feature vector obtained by substituting the history abnormal access behavior log of the last user of the m abnormal users in the database into the final access behavior log feature extraction model for feature extraction;

[0022] Step 5: Real-time reading of the real-time login environment log Q and the real-time access behavior log U of the current access user, substituting the real-time login environment log Q and the real-time access behavior log E into the final login environment log feature extraction model and the final access behavior log feature extraction model respectively for feature extraction to obtain the real-time login environment log feature vector q and the real-time access behavior log feature vector u of the current access user;

[0023] The similarity S u between the real-time login environment and the history login environment of the current access user is calculated according to the following formula (6)

[0024]

[0025] In formula (6), q is the real-time login environment log feature vector of the current access user; e i is the ith history login environment log feature vector in the history login environment log feature vector set E; ||q|| is the modulus of q; ||e i || is the modulus of e i ;

[0026] The similarity S a between the real-time access behavior and the history access behavior of the current access user is calculated according to the following formula (7)

[0027]

[0028] In formula (7), u is the real-time access behavior log feature vector of the current access user; f i is the i-th historical access behavior log feature vector in the historical access behavior log feature vector set F; ||u|| is the modulus of u; ||f i || is the modulus of f i ;

[0029] The similarity Y between the real-time login environment of the current access user and the historical abnormal login environment is calculated according to the following formula (8) u ,

[0030]

[0031] In formula (8), q is the real-time login environment log feature vector of the current access user; o i is the i-th historical abnormal login environment log feature vector in the historical abnormal login environment log feature vector set O; ||q|| is the modulus of q; ||o i || is the modulus of o i ;

[0032] The similarity Y between the real-time access behavior of the current access user and the historical abnormal access behavior is calculated according to the following formula (9) a ,

[0033]

[0034] In formula (9), u is the real-time access behavior log feature vector of the current access user; k i is the i-th historical abnormal access behavior log feature vector in the historical abnormal access behavior log feature vector set K; ||u|| is the modulus of u; ||k i || is the modulus of k i ;

[0035] Step 6: The login environment risk level RISK of the current access user is obtained according to the following formula (10) u ,

[0036]

[0037] In formula (10), and are the first and second login environment similarity thresholds respectively, which are empirical values;

[0038] The access behavior risk level RISK of the current access user is obtained according to the following formula (11) a ,

[0039]

[0040] in formula (11), and are respectively the first and second access behavior similarity thresholds, both of which are empirical values;

[0041] If the login environment risk level RISK u of the current access user is greater than 3 when added to the access behavior risk level RISK a , it indicates that the access data of the current access user is abnormal data; if the login environment risk level RISK u of the current access user is not greater than 3 when added to the access behavior risk level RISK a , it indicates that the access data of the current access user is normal data.

[0042] Further, the specific steps of the training process in step 2 are as follows:

[0043] Step 2.1: A special mark USER is added to the beginning of each login environment log text in the training data set, and the output vector o corresponding to the USER mark is used as the feature vector of the entire log text.

[0044] Step 2.2: A multi-task fine-tuning loss function is constructed, which is composed of multiple sub-task loss functions; each sub-task is used to predict a sensitive feature of the login log through a linear layer with a size of h x 1, where h is the dimension of o. The sub-task uses the feature vector to predict sensitive information such as the user's geographic location, IP address range, MAC address, and permission level, so as to extract the key features of the log; for the classification sub-task, the cross-entropy is used as the loss function, where and respectively represent the true value and the predicted value of the nth sample in the ith class; for the regression task, the mean square error is used as the loss function, where y n and respectively represent the true value and the predicted value of the nth sample; the final error function is the average value of all sub-task error functions , where L t represents the tth sub-task.

[0045] Further, the specific steps of the training process in step 3 are as follows:

[0046] Step 3.1: Add a special mark USER at the beginning of each access behavior log text in the training data set, and use the output vector o corresponding to the USER mark as the feature vector of the entire log text;

[0047] Step 3.2: Construct a multi-task fine-tuning loss function composed of multiple sub-task loss functions; each sub-task is used to predict a sensitive feature of the login log by passing the feature vector o through a linear layer with a size of h x 1, where h is the dimension of o. The sub-task can extract the key features of the log by predicting sensitive information such as data authority level, user authority level, user access frequency, data type, data source, etc. using the feature vector; for the classification sub-task, cross-entropy is also used as the loss function, and for the regression task, mean square error is also used as the loss function. The final error function is the average of all sub-task error functions.

[0048] The beneficial effects of the present application: the present application improves the existing Bert-based log detection algorithm to obtain a log feature extraction model, and then trains the log feature extraction model into a final login environment log feature extraction model and a final access behavior log feature extraction model through different training sets; the two final models trained are used to extract features from all historical login environment logs, historical access behavior logs, historical abnormal login environment logs and historical abnormal access behavior logs, and then the obtained feature vectors are sequentially compared with the real-time login environment log feature vector q and the real-time access behavior log feature vector u of the current access user to calculate the similarity and realize abnormal data access identification. The present application captures deep features of user behavior based on a deep neural network language model. It can adapt to various formats and unstructured log data without tedious log data preprocessing. It maintains good performance in complex scenarios of multiple users, multiple data and irregular logs, and enhances the adaptability and flexibility of the method. DETAILED DESCRIPTION

[0049] The present application will be further described below in conjunction with a specific embodiment of an abnormal data access identification method

[0050] EMBODIMENT

[0051] The abnormal data access identification method in the present embodiment involves a database storing historical login environment logs and historical access behavior logs of n normal users, and historical abnormal login environment logs and historical abnormal access behavior logs of m abnormal users, and the following steps are performed:

[0052] Step 1: Establish a log feature extraction model according to the improved Bert-based log detection algorithm, as shown in the following formula (1),

[0053]

[0054] In formula (1), oT is an output feature vector, X is an input text embedding vector, which is obtained by adding the word embedding, segment embedding and position embedding calculated on the original text words; W K , W Q , W V , W O , W1, b1, W2, b2 are parameters in the original Attention module that need to be learned through training; Ws is a sensitive mutual information extraction layer, which can gradually learn to extract key information in the log during training, so as to give higher weights to the text corresponding to the sensitive features, so that the calculated feature vector has stronger representation ability in the abnormal identification scene; LayerNorm() and softmax() represent layer normalization and soft-max computation, respectively;

[0055] Step 2: N times of replacement sampling is performed on the historical login environment logs of n normal users in the database, and the sampling results are collected to form a historical login environment log set A. All logs in the historical login environment log set A are divided into a first training set B1 and a first test set C1 according to an empirical ratio, and the empirical ratio in this embodiment is 7:3. The log feature extraction model is trained through the first training set B1 and the first test set C1, and the final login environment log feature extraction model is obtained. The final login environment log feature extraction model takes the login environment log as input and outputs the login environment log feature vector.

[0056] The specific steps of the training process are as follows:

[0057] Step 2.1: A special mark USER is added to the beginning of each login environment log text in the training data set, and the output vector o corresponding to the USER mark is used as the feature vector of the entire log text.

[0058] Step 2.2: A multi-task fine-tuning loss function is constructed, which is composed of multiple sub-task loss functions. Each sub-task is used to predict a sensitive feature of the login log through a linear layer with a size of h x 1, where h is the dimension of o. The sub-task uses the feature vector to predict sensitive information such as the user's geographic location, IP address range, MAC address, and permission level, so as to extract the key features of the log. For the classification sub-task, the cross-entropy is used as the loss function, where and represent the true value and the predicted value of the nth sample in the ith class, respectively; for the regression task, the mean square error is used as the loss function, where y n and respectively, denote the true value and the predicted value of the nth sample; the final error function is the average of all sub-task error functions where L t denotes the tth sub-task.

[0059] Step 3: N times replacement sampling is performed on the historical access behavior logs of n normal users in the database, and the sampling results are collected to form a historical access behavior log set D. All logs in the historical access behavior log set D are divided into a second training set B2 and a second test set C2 according to an empirical ratio, which is 7:3 in this embodiment. A log feature extraction model is trained through the second training set B2 and the second test set C2, and a final access behavior log feature extraction model is obtained. The final access behavior log feature extraction model takes an access behavior log as input and outputs an access behavior log feature vector.

[0060] The specific steps of the training process are as follows:

[0061] Step 3.1: A special mark USER is added to the beginning of each access behavior log text in the training data set. The output vector o corresponding to the USER mark is used as the feature vector of the entire log text.

[0062] Step 3.2: A multi-task fine-tuning loss function is constructed, which is composed of multiple sub-task loss functions. Each sub-task is used to predict a sensitive feature of the login log through a linear layer with a size of h x 1, where h is the dimension of o. The sub-task uses the feature vector to predict sensitive information such as data authority level, user permission level, user access frequency, data type, data source, etc., so as to extract the key features of the log. For classification sub-tasks, cross-entropy is also used as the loss function, and for regression tasks, mean square error is also used as the loss function. The final error function is the average of all sub-task error functions.

[0063] Step 4: The historical login environment logs of n normal users in the database are sequentially substituted into the final login environment log feature extraction model for feature extraction to obtain n historical login environment log feature vectors and collect them to form a historical login environment log feature vector set E, as shown in the following formula (2),

[0064] E = {e1, e2,..., en} (2) n

[0065] ​In formula (2), e1 is a first historical login environment log feature vector of a first user in n normal users in the database, which is obtained by performing feature extraction on the historical login environment log of the first user by using the final login environment log feature extraction model; e2 is a second historical login environment log feature vector of a second user in the n normal users in the database, which is obtained by performing feature extraction on the historical login environment log of the second user by using the final login environment log feature extraction model; e n is an n-th historical login environment log feature vector of a last user in the n normal users in the database, which is obtained by performing feature extraction on the historical login environment log of the last user by using the final login environment log feature extraction model;

[0066] The historical access behavior log of the n normal users in the database is sequentially substituted into the final access behavior log feature extraction model to obtain n historical access behavior log feature vectors, which are collected to form a historical access behavior log feature vector set F, as shown in the following formula (3):

[0067] F = {f1, f2,..., fn} (3) n

[0068] In formula (3), f1 is a first historical access behavior log feature vector of a first user in n normal users in the database, which is obtained by performing feature extraction on the historical access behavior log of the first user by using the final access behavior log feature extraction model; f2 is a second historical access behavior log feature vector of a second user in the n normal users in the database, which is obtained by performing feature extraction on the historical access behavior log of the second user by using the final access behavior log feature extraction model; f n is an n-th historical access behavior log feature vector of a last user in the n normal users in the database, which is obtained by performing feature extraction on the historical access behavior log of the last user by using the final access behavior log feature extraction model;

[0069] The historical abnormal login environment log of the m abnormal users in the database is sequentially substituted into the final login environment log feature extraction model to obtain m historical abnormal login environment log feature vectors, which are collected to form a historical abnormal login environment log feature vector set O, as shown in the following formula (4):

[0070] O = {o1, o2,..., on} (4) m

[0071] ​​In formula (4), o1 is a first historical abnormal login environment log feature vector of a first user of the m abnormal users in the database, which is obtained by performing feature extraction on the historical abnormal login environment log of the first user by using the final login environment log feature extraction model; o2 is a second historical abnormal login environment log feature vector of a second user of the m abnormal users in the database, which is obtained by performing feature extraction on the historical abnormal login environment log of the second user by using the final login environment log feature extraction model; o m is an mth historical abnormal login environment log feature vector of a last user of the m abnormal users in the database, which is obtained by performing feature extraction on the historical abnormal login environment log of the last user by using the final login environment log feature extraction model;

[0072] The historical abnormal access behavior logs of the m abnormal users in the database are sequentially substituted into the final access behavior log feature extraction model to obtain m historical abnormal access behavior log feature vectors, which are collected to form a historical abnormal access behavior log feature vector set K, as shown in the following formula (5):

[0073] K = {k1, k2,..., km} (5) m

[0074] In formula (5), k1 is a first historical abnormal access behavior log feature vector of a first user of the m abnormal users in the database, which is obtained by performing feature extraction on the historical abnormal access behavior log of the first user by using the final access behavior log feature extraction model; k2 is a second historical abnormal access behavior log feature vector of a second user of the m abnormal users in the database, which is obtained by performing feature extraction on the historical abnormal access behavior log of the second user by using the final access behavior log feature extraction model; k m is an mth historical abnormal access behavior log feature vector of a last user of the m abnormal users in the database, which is obtained by performing feature extraction on the historical abnormal access behavior log of the last user by using the final access behavior log feature extraction model;

[0075] Step 5: Real-time login environment log Q and real-time access behavior log U of a current access user are read in real time, and the real-time login environment log Q and the real-time access behavior log E are substituted into the final login environment log feature extraction model and the final access behavior log feature extraction model respectively to perform feature extraction, to obtain real-time login environment log feature vector q and real-time access behavior log feature vector u of the current access user;

[0076] The similarity S between the real-time login environment of the current access user and the historical login environment is calculated according to the following formula (6): u

[0077]

[0078] ​​In formula (6), q is the real-time login environment log feature vector of the current access user; e i is the i-th historical login environment log feature vector in the historical login environment log feature vector set E; ||q|| is the modulus of q; ||e i || is the modulus of e i ;

[0079] The similarity S between the real-time access behavior of the current access user and the historical access behavior is calculated according to the following formula (7) a ,

[0080]

[0081] In formula (7), u is the real-time access behavior log feature vector of the current access user; f i is the i-th historical access behavior log feature vector in the historical access behavior log feature vector set F; ||u|| is the modulus of u; ||f i || is the modulus of f i ;

[0082] The similarity Y between the real-time login environment of the current access user and the historical abnormal login environment is calculated according to the following formula (8) u ,

[0083]

[0084] In formula (8), q is the real-time login environment log feature vector of the current access user; o i is the i-th historical abnormal login environment log feature vector in the historical abnormal login environment log feature vector set O; ||q|| is the modulus of q; ||o i || is the modulus of o i ;

[0085] The similarity Y between the real-time access behavior of the current access user and the historical abnormal access behavior is calculated according to the following formula (9) a ,

[0086]

[0087] In formula (9), u is the real-time access behavior log feature vector of the current access user; k i is the i-th historical abnormal access behavior log feature vector in the historical abnormal access behavior log feature vector set K; ||u|| is the modulus of u; ||k i || is the modulus of k i ;

[0088] Step 6: The login environment risk level RISK of the current access user is obtained according to the following formula (10)u ,

[0089]

[0090] in formula (10), and are respectively a first and a second login environment similarity threshold value, both of which are empirical values;

[0091] The access behavior risk level RISK of the current access user is obtained according to the following formula (11) a ,

[0092]

[0093] in formula (11), and are respectively a first and a second access behavior similarity threshold value, both of which are empirical values;

[0094] If the login environment risk level RISK of the current access user u and the access behavior risk level RISK a are added together to be greater than 3 levels, it is indicated that the access data of the current access user is abnormal data; if the login environment risk level RISK of the current access user u and the access behavior risk level RISK a are added together to be not greater than 3 levels, it is indicated that the access data of the current access user is normal data.

Claims

1. A method for identifying abnormal data access, involving a database storing historical login environment logs and historical access behavior logs of n normal users, and historical abnormal login environment logs and historical abnormal access behavior logs of m abnormal users, characterized in that: Perform the following steps: Step 1: Establish a log feature extraction model based on the improved BERT-based log detection algorithm, as shown in equation (1) below. （1） In equation (1), It is the output feature vector. It is the input text embedding vector, which is obtained by calculating the lexical embedding, segment embedding and position embedding of the original text words and then adding them together; , , , , , , , These are all parameters that need to be learned through training in the original Attention module; It is a sensitive mutual information extraction layer, which can gradually learn to extract key information from logs during the training process, thereby giving higher weights to the text corresponding to sensitive features, so that the calculated feature vector has a stronger representation ability in anomaly recognition scenarios. and These represent layer normalization and soft maximization computation, respectively. Step 2: Sampling with replacement N times is performed on the historical login environment logs of n normal users in the database, and the sampling results are collected to form a historical login environment log set A. All logs in the historical login environment log set A are divided into a first training set B1 and a first test set C1 according to an empirical ratio. The log feature extraction model is trained using the first training set B1 and the first test set C1 to obtain the final login environment log feature extraction model. The final login environment log feature extraction model takes the login environment logs as input and outputs the login environment log feature vectors. The specific steps of the training process are as follows: Step 2.1: Add a special identifier, USER, to the beginning of each login environment log text in the training dataset, and use USER to label the corresponding output vector. As the feature vector of the entire log text; Step 2.2: Construct a multi-task fine-tuning loss function, which consists of loss functions for multiple sub-tasks; each sub-task is assigned to a feature vector. Through a size of A linear layer is used to predict a sensitive feature of the login logs, where yes The subtask uses feature vectors to predict sensitive information about a user's login environment, including geographical location, IP address range, MAC address, and permission level, thereby enabling the extraction of key features from the logs. For the classification subtask, use cross-entropy. As the loss function, where and They represent the first The sample at the th The true and predicted values ​​for the class; for regression tasks, the mean squared error is used. As the loss function, where and They represent the first The true and predicted values ​​of each sample; the final error function is the average of the error functions of all subtasks. ,in Indicates the first Sub-tasks; Step 3: Perform N rounds of sampling with replacement from the historical access behavior logs of n normal users in the database and collect the sampling results to form a historical access behavior log set D. Divide all logs in the historical access behavior log set D into a second training set B2 and a second test set C2 according to an empirical ratio. Train the log feature extraction model using the second training set B2 and the second test set C2 to obtain the final access behavior log feature extraction model. The final access behavior log feature extraction model takes access behavior logs as input and outputs access behavior log feature vectors. The specific steps of the training process are as follows: Step 3.1: Add a special identifier, USER, to the beginning of each access behavior log text in the training dataset, and use USER to label the corresponding output vector. As the feature vector of the entire log text; Step 3.2: Construct a multi-task fine-tuning loss function, which consists of loss functions for multiple sub-tasks; each sub-task is assigned to a feature vector. Through a size of A linear layer is used to predict a sensitive feature of access behavior logs, where yes The subtask uses feature vectors to predict sensitive information about user access behavior, including data permission level, user permission level, user access frequency, data type, and data source, thereby enabling the extraction of key features from logs. For the classification subtask, cross-entropy is used as the loss function, and for the regression task, mean squared error is used as the loss function; the final error function is the average of the error functions of all subtasks. Step 4: Substitute the historical login environment logs of n normal users in the database into the final login environment log feature extraction model to extract features and obtain n historical login environment log feature vectors. Collect them to form a set E of historical login environment log feature vectors, as shown in the following formula (2). （2） In equation (2), It is the first historical login environment log feature vector obtained by extracting features from the historical login environment log of the first user among n normal users in the database through the final login environment log feature extraction model; It is the second historical login environment log feature vector obtained by extracting features from the historical login environment log of the second user among n normal users in the database through the final login environment log feature extraction model; It is the nth historical login environment log feature vector obtained by extracting features from the historical login environment log of the last user among the n normal users in the database through the final login environment log feature extraction model; The historical access behavior logs of n normal users in the database are sequentially substituted into the final access behavior log feature extraction model to extract features, resulting in n historical access behavior log feature vectors. These feature vectors are then collected to form a historical access behavior log feature vector set F, as shown in equation (3) below. （3） In equation (3), It is the first historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the first user among n normal users in the database through the final access behavior log feature extraction model; It is the second historical access behavior log feature vector obtained by extracting features from the historical access behavior log of the second user among n normal users in the database through the final access behavior log feature extraction model; It is the nth historical access behavior log feature vector obtained by feature extraction of the historical access behavior log of the last user among the n normal users in the database through the final access behavior log feature extraction model; The historical abnormal login environment logs of m abnormal users in the database are sequentially substituted into the final login environment log feature extraction model to extract features, resulting in m historical abnormal login environment log feature vectors. These vectors are then collected to form a set O of historical abnormal login environment log feature vectors, as shown in equation (4) below. （4） In equation (4), It is the first historical abnormal login environment log feature vector obtained by feature extraction of the historical abnormal login environment log of the first user among the m abnormal users in the database through the final login environment log feature extraction model; It is the second historical abnormal login environment log feature vector obtained by feature extraction of the historical abnormal login environment log of the second user among the m abnormal users in the database through the final login environment log feature extraction model; It is the m-th historical abnormal login environment log feature vector obtained by feature extraction of the historical abnormal login environment log of the last user among the m abnormal users in the database through the final login environment log feature extraction model; The historical abnormal access behavior logs of m abnormal users in the database are sequentially substituted into the final access behavior log feature extraction model to extract features, resulting in m historical abnormal access behavior log feature vectors. These vectors are then collected to form a set K of historical abnormal access behavior log feature vectors, as shown in equation (5) below. （5） In equation (5), It is the first historical abnormal access behavior log feature vector obtained by feature extraction of the historical abnormal access behavior log of the first user among the m abnormal users in the database through the final access behavior log feature extraction model. It is the second historical abnormal access behavior log feature vector obtained by feature extraction of the historical abnormal access behavior log of the second user among the m abnormal users in the database through the final access behavior log feature extraction model. It is the m-th historical abnormal access behavior log feature vector obtained by feature extraction of the historical abnormal access behavior log of the last user among the m abnormal users in the database through the final access behavior log feature extraction model. Step 5: Read the real-time login environment log Q and real-time access behavior log U of the current user in real time. Substitute the real-time login environment log Q and real-time access behavior log U into the final login environment log feature extraction model and the final access behavior log feature extraction model respectively to extract features, and obtain the real-time login environment log feature vector q and the real-time access behavior log feature vector u of the current user. The similarity between the current user's real-time login environment and historical login environment is calculated according to the following formula (6). , （6） In equation (6), It is the feature vector of the real-time login environment log of the currently accessing user; It is the i-th historical login environment log feature vector in the set E of historical login environment log feature vectors; It is the modulus of q; It is the aforementioned The modulus; The similarity between the current user's real-time access behavior and historical access behavior is calculated according to the following formula (7). , （7） In equation (7), It is the feature vector of the real-time access behavior log of the current user; It is the i-th historical access behavior log feature vector in the set F of historical access behavior log feature vectors; It is the aforementioned The modulus; It is the aforementioned The modulus; The similarity between the current user's real-time login environment and historical abnormal login environments is calculated according to the following formula (8). , （8） In equation (8), It is the feature vector of the real-time login environment log of the currently accessing user; It is the i-th historical abnormal login environment log feature vector in the set O of historical abnormal login environment log feature vectors; It is the modulus of q; It is the aforementioned The modulus; The similarity between the current user's real-time access behavior and historical abnormal access behavior is calculated according to the following formula (9). , （9） In equation (9), It is the feature vector of the real-time access behavior log of the current user; It is the i-th historical abnormal access behavior log feature vector in the set K of historical abnormal access behavior log feature vectors; It is the aforementioned The modulus; It is the aforementioned The modulus; Step 6: Obtain the login environment risk level of the current user according to the following formula (10). , （10） In equation (10), and These are the similarity thresholds for the first and second login environments, respectively, both of which are empirical values. The access risk level of the current user is obtained according to the following formula (11). , （11） In equation (11), and These are the first and second similarity thresholds for access behaviors, both of which are empirical values. If the current user's login environment risk level is... Risk level of the access behavior If the sum is greater than 3, it indicates that the access data of the current user is abnormal; if the risk level of the current user's login environment is... Risk level of the access behavior If the sum of the levels is no greater than 3, it indicates that the access data of the current user is normal.

Images