Abnormal user detection method and device for data security, equipment, storage medium and product

Abstract

The invention belongs to the technical field of data security, and discloses an abnormal user detection method and device for data security, equipment, a storage medium and a product. The method comprises the steps of determining operation behaviors corresponding to to-be-detected users and feature vectors corresponding to the operation behaviors, then determining operation similarities among the to-be-detected users, taking the operation behaviors as nodes, constructing a graph structure according to the feature vectors and the operation similarities, and then determining feature representation vectors corresponding to the nodes according to the graph structure. And abnormal user detection is carried out according to the feature representation vector. According to the method, the operation behaviors and the feature vectors corresponding to the to-be-detected users are determined firstly, the operation behaviors serve as the nodes, the graph structures are constructed according to the feature vectors and the operation similarities, and the graph structures related to the operation behaviors corresponding to the to-be-detected users can be constructed; and abnormal user detection is carried out according to the feature representation vector corresponding to each node, so that abnormal users can be detected more quickly and more accurately, and most of normal users are eliminated.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an abnormal user detection method, device, equipment, storage medium and product for data security. Background Art

[0002] At present, as the internal data of enterprises grows exponentially, it also brings huge data security risks. However, it is difficult to detect abnormal users within enterprises, mainly because the operations of abnormal users within enterprises are similar to the business behaviors of normal users, which are difficult to distinguish and identify. In addition, the huge amount and variety of internal data in enterprises also pose a huge challenge to the timeliness of abnormal user detection. Therefore, how to detect abnormal users faster and more accurately and exclude most normal users has become a problem that needs to be solved urgently. Summary of the invention

[0003] The main purpose of this application is to provide a method, device, equipment, storage medium and product for abnormal user detection for data security, aiming to solve the technical problem of how to detect abnormal users faster and more accurately and exclude most normal users.

[0004] To achieve the above object, the present application provides a method for detecting abnormal users for data security, the method for detecting abnormal users for data security comprising the following steps:

[0005] Determine an operation behavior corresponding to the user to be detected and a feature vector corresponding to the operation behavior;

[0006] Determine the operation similarity between the users to be detected, and use the operation behavior as a node, and construct a graph structure according to the feature vector and the operation similarity;

[0007] A feature representation vector corresponding to the node is determined according to the graph structure, and abnormal user detection is performed according to the feature representation vector.

[0008] Optionally, the step of determining an operation behavior corresponding to the user to be detected and a feature vector corresponding to the operation behavior specifically includes:

[0009] Determine the operation behavior of the user to be detected within a preset period;

[0010] Preprocessing the behavior log data corresponding to the operation behavior to obtain processed log data;

[0011] Performing data division on the processed log data to obtain a log data set of the user to be detected within the preset period;

[0012] Behavior features are extracted from the log data set, and feature vectors are determined according to the extracted behavior features.

[0013] Optionally, the step of determining the operation similarity between the to-be-detected users, taking the operation behaviors as nodes, and constructing a graph structure according to the feature vectors and the operation similarities specifically includes:

[0014] Extracting an operation object set from the log data set within the preset period;

[0015] Performing Jaccard similarity calculation on each of the operation object sets to obtain the operation similarity between each of the to-be-detected users;

[0016] Taking the operation behavior as a node, taking the feature vector as a node feature corresponding to the node, and taking the operation similarity as an edge weight between the nodes;

[0017] A graph structure is constructed according to the nodes, the node features, and the edge weights.

[0018] Optionally, the step of determining the feature representation vector corresponding to the node according to the graph structure, and performing abnormal user detection according to the feature representation vector specifically includes:

[0019] Determine a feature representation vector corresponding to the node according to the graph structure;

[0020] The nodes are divided into data sets by a random forest model to obtain abnormal nodes;

[0021] An abnormal user is determined according to the abnormal node.

[0022] Optionally, after the step of determining the feature representation vector corresponding to the node according to the graph structure and performing abnormal user detection according to the feature representation vector, the method further includes:

[0023] Encode the current operation behavior corresponding to the abnormal user to obtain the original feature vector;

[0024] Input the original feature vector into a preset autoencoder model, and output the reconstructed feature vector;

[0025] Whether the current operation is an abnormal operation is determined according to a reconstruction error between the original feature vector and the reconstructed feature vector.

[0026] Optionally, before the step of inputting the original feature vector into a preset autoencoder model and outputting the reconstructed feature vector, the step further includes:

[0027] Encode the normal operation behavior corresponding to the normal user to obtain a normal feature vector;

[0028] The initial autoencoder model is trained based on the normal feature vector to obtain a preset autoencoder model.

[0029] In addition, to achieve the above-mentioned purpose, the present application also provides an abnormal user detection device for data security, the abnormal user detection device for data security comprising:

[0030] A vector determination module, used to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior;

[0031] A graph structure building module, used to determine the operation similarity between the users to be detected, and use the operation behavior as a node to build a graph structure according to the feature vector and the operation similarity;

[0032] The abnormal user detection module is used to determine the feature representation vector corresponding to the node according to the graph structure, and perform abnormal user detection according to the feature representation vector.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes an abnormal user detection device for data security, the abnormal user detection device for data security comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the abnormal user detection method for data security as described above.

[0034] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the abnormal user detection method for data security as described above are implemented.

[0035] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the abnormal user detection method for data security as described above.

[0036] The present application determines the operation behavior and feature vector corresponding to the user to be detected and the operation behavior, then determines the operation similarity between the users to be detected, and uses the operation behavior as a node, constructs a graph structure according to the feature vector and the operation similarity, and then determines the feature representation vector corresponding to the node according to the graph structure, and performs abnormal user detection based on the feature representation vector. The present application first determines the operation behavior and feature vector corresponding to the user to be detected and uses the operation behavior as a node, and constructs a graph structure according to the feature vector and the operation similarity, and can construct a graph structure related to the operation behavior corresponding to the user to be detected, and then determines the feature representation vector corresponding to each node, and performs abnormal user detection based on the feature representation vector, which can detect abnormal users faster and more accurately and exclude most normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 This is a flow chart of the first embodiment of the abnormal user detection method for data security of the present application;

[0040] Figure 2 This is a flow chart of the second embodiment of the abnormal user detection method for data security of the present application;

[0041] Figure 3 This is a schematic diagram of the structure of the abnormal user detection system for data security used in this application;

[0042] Figure 4 This is a structural block diagram of the first embodiment of the abnormal user detection device for data security of the present application;

[0043] Figure 5 It is a structural diagram of an abnormal user detection device for data security in the hardware operating environment involved in the embodiment of the present application.

[0044] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The main solution of the embodiment of the present application is: determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior; determine the operation similarity between each of the users to be detected, and use the operation behavior as a node, and build a graph structure according to the feature vector and the operation similarity; determine the feature representation vector corresponding to the node according to the graph structure, and perform abnormal user detection based on the feature representation vector.

[0048] At present, as the internal data of enterprises grows exponentially, it also brings huge data security risks. However, it is difficult to detect abnormal users within enterprises, mainly because the operations of abnormal users within enterprises are similar to the business behaviors of normal users, which are difficult to distinguish and identify. In addition, the huge amount and variety of internal data in enterprises also pose a huge challenge to the timeliness of abnormal user detection.

[0049] The present application determines the operation behavior and feature vector corresponding to the user to be detected and the operation behavior, then determines the operation similarity between the users to be detected, and uses the operation behavior as a node, constructs a graph structure according to the feature vector and the operation similarity, and then determines the feature representation vector corresponding to the node according to the graph structure, and performs abnormal user detection based on the feature representation vector. The present application first determines the operation behavior and feature vector corresponding to the user to be detected and uses the operation behavior as a node, and constructs a graph structure according to the feature vector and the operation similarity, and can construct a graph structure related to the operation behavior corresponding to the user to be detected, and then determines the feature representation vector corresponding to each node, and performs abnormal user detection based on the feature representation vector, which can detect abnormal users faster and more accurately and exclude most normal users.

[0050] It should be noted that the execution subject of the present application may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, etc., or an electronic device capable of realizing the above functions, an abnormal user detection device, etc. The following takes the abnormal user detection device as an example to illustrate this embodiment and the following embodiments.

[0051] Based on this, the embodiment of the present application provides a method for detecting abnormal users for data security, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the abnormal user detection method for data security of the present application.

[0052] In this embodiment, the abnormal user detection method for data security includes the following steps:

[0053] Step S10: Determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior.

[0054] It is understandable that the user to be detected refers to the user who needs to be detected for abnormality, and the abnormal user refers to the user who generates abnormal behavior. The operation behavior refers to the behavior generated by each user to be detected during operation, and the operation behavior can be represented by data. The feature vector refers to a vector composed of several features corresponding to the operation behavior.

[0055] Furthermore, in order to accurately obtain the feature vector, in this embodiment, the step S10 includes: determining the operation behavior of the user to be detected within a preset period; preprocessing the behavior log data corresponding to the operation behavior to obtain processed log data; performing data division on the processed log data to obtain a log data set of the user to be detected within the preset period; extracting behavioral features from the log data set, and determining the feature vector based on the extracted behavioral features.

[0056] It should be understood that the preset period can be a preset period, such as one day, one week, one month, etc. This embodiment is described by taking one week as an example. This embodiment can obtain the weekly operation behavior of the user to be detected, and obtain the behavior log data corresponding to the operation behavior.

[0057] It is understandable that when the user to be tested uses the internal business system, six typical logs may be generated, including internal business system and platform login / logout logs, file operation logs, database operation logs, web page access logs, email logs, and mobile device connection logs. The above six types of logs cover all business data-related operation scenarios of internal users. Data security incidents such as data leakage and illegal operation of business data will be reflected in these six types of logs. The following is a specific description of these six types of logs: Internal business system and platform login / logout log: records the login and logout of internal users in various business systems, including time, user number, device number, system name, login / logout operations; File operation log: records the file operation behavior of internal users, including time, user number, device number, file name, file content, and file operation type; Database operation log: records the database operation behavior of internal users, including time, user number, device number, operation database / table / field, and operation command; Web page access log: records the Internet access behavior of internal users, including time, user number, device number, web page URL, and web page content; Email log: records the email communication behavior of internal users, including time, user number, device number, recipient, recipient domain name, sender, email size, number of attachments, and email content; Mobile device connection log: records the mobile device connection behavior of internal users, including time, user number, device number, mobile device type, and connection / disconnection operations.

[0058] In the specific implementation, the above six types of behavior log data can be preprocessed. Specifically, the timestamps of all behavior log data can be formatted uniformly first, and the time can be converted into the form of year, month, day, hour, minute, and second. Then, the six types of behavior log data can be integrated according to the user number and timestamp to build a complete internal user activity log, that is, the processed log data. The processed log data is then divided. Specifically, in the processed log data of each week, it is grouped according to the user number to obtain the weekly log data set of each user to be detected.

[0059] In addition, behavioral features can be extracted from the weekly log data set of each user to be tested, that is, multiple behavioral features are extracted from the weekly log data set of each user to be tested. These features can accurately reflect the periodicity and regularity of user behavior, and may include the following 19 features: Behavior period: the period during which the user's operation behavior occurs, which is divided into working hours, off-get off work hours, and weekends; Device type: the type of host device on which the user's operation behavior occurs, which is divided into personal host, other people's host, and shared host; Total number of business system logins: the total number of times the user logs into the business system within a week; Total number of business system logins during non-working hours: the total number of times the user logs into the business system during non-working hours within a week; Average business system login time: the average time the user logs into the business system each time within a week; Total business system login time: the average time the user logs into the business system each time within a week; Type of database / table called: the type of database called by the user within a week Total number, total number of data table types; Number of database command calls: the total number of database commands called by the user within a week; Database data volume called: the total amount of data called by the user through the database within a week; Number of mobile device uses: the total number of mobile device uses by the user within a week; Average mobile device usage time: the length of time the user uses the mobile device each time within a week; Average email size: the average size of all emails; Total email recipients: the total number of recipients in emails sent by the user within a week; Total email attachments: the total number of attachments in emails sent by the user; Number of non-working hours emails: the total number of emails sent by the user during non-working hours; Number of files: the total number of files operated by the user within a week; Average file size: the average size of files operated by the user within a week; Total file types: the total number of file types operated by the user; File operation type: the type of operation the user performs on the file, including upload, download, modify, and delete. The above 19-dimensional behavior features are represented as a feature vector in It represents the kth behavior feature of the i-th user to be detected in the j-th week.

[0060] Step S20: determining the operation similarity between the users to be detected, taking the operation behaviors as nodes, and constructing a graph structure according to the feature vectors and the operation similarities.

[0061] It can be understood that the operation similarity refers to the similarity between the operation behaviors of each user to be detected, and the operation behavior is used as a node, the feature vector is used as the node feature corresponding to the node, and the operation similarity is used as the edge weight between the nodes to construct a graph structure.

[0062] Furthermore, in order to effectively construct a graph structure, in this embodiment, step S20 includes: extracting a set of operation objects from the log data set within the preset period; performing Jaccard similarity calculation on each of the operation object sets to obtain the operation similarity between each of the users to be detected; taking the operation behavior as a node, and taking the feature vector as the node feature corresponding to the node, and taking the operation similarity as the edge weight between the nodes; and constructing a graph structure based on the nodes, the node features and the edge weights.

[0063] It should be understood that the operation object set can be extracted from the log data set within a preset period, that is, the operation object set can be extracted from the weekly log data set of the user to be detected. Business systems, files, databases, mobile devices, etc. are all operation objects. The operation object set is represented as Represents the set of operation objects of the i-th user in the j-th week.

[0064] It is understandable that the KVM (K-Minimum hash Values) algorithm can be used to calculate the Jaccard similarity of each set of operation objects. The KVM algorithm has low computational efficiency and computational storage, and can efficiently calculate the Jaccard similarity, that is, the operation similarity. Specifically, a set of hash functions h can be first selected. i , where i∈{1,…,n}. Then, for set A and set B, set A refers to the weekly operation object set corresponding to the user A to be detected, and set B refers to the weekly operation object set corresponding to the user B to be detected. The hash values ​​under this set of hash functions are calculated respectively, and the smallest k hash values ​​of each are retained to obtain two hash value sets K of size k. A and K B , the calculation formula is k = h i (s), where s is an object in the operation object set. Here, the operation type object is encoded with a unique value, and the specific encoding value is determined by the type of the operation object. Then calculate the two hash value sets K A and K B The intersection size c, that is, c = |K A ∩K B |, and calculate the Jaccard similarity of the two sets according to the formula, that is,

[0065] In the specific implementation, the operation behavior can be used as a node, and each feature vector can be used as the node feature corresponding to each node, and the operation similarity between each user to be detected can be used as the edge weight between each node, so that a graph structure can be constructed based on nodes, node features and edge weights.

[0066] Step S30: determining a feature representation vector corresponding to the node according to the graph structure, and performing abnormal user detection according to the feature representation vector.

[0067] Furthermore, in order to effectively perform abnormal user detection, in this embodiment, the step S30 includes: determining the feature representation vector corresponding to the node according to the graph structure; dividing the data set of the node through a random forest model to obtain abnormal nodes; and determining abnormal users according to the abnormal nodes.

[0068] It is understandable that, combined with the edge weights between nodes in the graph structure, the GNN graph convolutional neural network is used for node embedding learning, which can capture the similarities and differences between all user behaviors. Weekly operation behaviors with high similarity should have stronger correlation. Finally, the features of neighbor nodes are transferred to each node through the weights on the edges, and the feature representation vector of each node is finally obtained.

[0069] It should be understood that the present embodiment may use a random forest model to perform data set partitioning on several nodes in the graph structure. The random forest model is an unsupervised learning model that constructs an isolation forest composed of multiple isolated trees and partitions the data set on randomly selected features. Abnormal nodes will be isolated at a lower tree depth.

[0070] In the specific implementation, the isolated anomaly point is the set of user weekly behaviors that deviate from the normal baseline, and the relevant users involved will be considered as people with abnormal behaviors, that is, abnormal users.

[0071] This embodiment determines the operation behavior and feature vector corresponding to the user to be detected and the operation behavior, then determines the operation similarity between the users to be detected, and uses the operation behavior as a node, constructs a graph structure according to the feature vector and the operation similarity, and then determines the feature representation vector corresponding to the node according to the graph structure, and performs abnormal user detection according to the feature representation vector. This embodiment first determines the operation behavior and feature vector corresponding to the user to be detected, and uses the operation behavior as a node, and constructs a graph structure according to the feature vector and the operation similarity, and can construct a graph structure related to the operation behavior corresponding to the user to be detected, and then determines the feature representation vector corresponding to each node, and performs abnormal user detection according to the feature representation vector, which can detect abnormal users faster and more accurately, and exclude most normal users.

[0072] refer to Figure 2 , Figure 2 This is a flow chart of the second embodiment of the abnormal user detection method for data security of the present application.

[0073] Based on the first embodiment above, in this embodiment, after step S30, the following is further included:

[0074] Step S40: Encode the current operation behavior corresponding to the abnormal user to obtain an original feature vector.

[0075] It is understandable that after detecting an abnormal user, the specific operation behavior of the abnormal person needs to be analyzed and judged, and since most normal people have been filtered out, the scale of log data to be processed is greatly reduced. This embodiment can detect the single-day behavior of abnormal users and locate specific abnormal events by building a baseline behavior of normal users.

[0076] It should be understood that this embodiment can encode the current operation behavior corresponding to the abnormal user, and the encoding features include time, device, and activity type. Specifically, time: working hours on weekdays is 1; off-duty time on weekdays is 2; non-working time is 3; device: personal host device is 1; shared host device is 2; other host devices are 3; activity type: according to the activity types involved in the 6 types of logs, it is encoded, which will not be detailed here. After encoding the current operation behavior corresponding to the abnormal user in the above manner, the original feature vector can be obtained.

[0077] Step S50: input the original feature vector into a preset autoencoder model, and output a reconstructed feature vector.

[0078] In the specific implementation, the original feature vector is input into the preset autoencoder model to obtain the reconstructed feature vector

[0079] Furthermore, in order to accurately construct the preset autoencoder model, in this embodiment, before step S50, it also includes: encoding the normal operation behavior corresponding to the normal user to obtain a normal feature vector; training the initial autoencoder model based on the normal feature vector to obtain the preset autoencoder model.

[0080] It is understandable that some normal users can be randomly selected from all users to be detected except abnormal users, and the normal operation behaviors corresponding to the normal users can be encoded in the above manner to obtain normal feature vectors. The initial autoencoder model is then trained based on the normal feature vector. The initial autoencoder model can be an AE autoencoder model. The autoencoder is an unsupervised neural network model. By inputting the normal feature vector as supervision, the neural network is guided to learn the mapping relationship. The reconstruction error of the trained preset autoencoder model will tend to be stable and eventually be lower than a certain threshold.

[0081] Step S60: judging whether the current operation is an abnormal operation according to a reconstruction error between the original feature vector and the reconstructed feature vector.

[0082] It should be understood that since the neural network of the autoencoder model has learned the normal operation behavior of normal users, the reconstruction error between the original feature vectors of all normal operation behaviors and their reconstructed feature vectors will be less than the threshold, while the difference between the features of abnormal behaviors will be relatively large after reconstruction, that is, the reconstruction error between the original feature vectors of abnormal operations and the reconstructed feature vectors will be greater than the threshold.

[0083] It is understandable that all operation behaviors with reconstruction errors greater than or equal to the threshold will be determined as abnormal operation behaviors, and ultimately abnormal event detection results will be obtained.

[0084] In the specific implementation, refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of the abnormal user detection system for data security in this application. Figure 3 As shown, the abnormal user detection system for data security may include a data processing and analysis module, an internal abnormal personnel detection module, an internal abnormal event detection module, and a data security event analysis module. First, through the coarse-grained internal abnormal personnel detection module, all internal abnormal personnel that deviate from the normal behavior baseline are marked. Then, the fine-grained internal abnormal event detection module is used to detect the specific behaviors of these abnormal personnel that deviate from normal operations. The specific functions of the data processing and analysis module, the internal abnormal personnel detection module, and the internal abnormal event detection module have been described in the above content. The data processing and analysis module is responsible for associating the abnormal personnel and the abnormal event detection results, combining the user role of the personnel, the data involved, and the abnormal operation time, analyzing and confirming the data security incident caused by the personnel, and displaying the final detection results. The specific steps of this module are as follows: Step 1: Combine the user role, the sensitivity level of the data involved, and the abnormal operation event to enrich the abnormal event record. First, associate the abnormal personnel list with the corresponding user role, and then associate the sensitivity level of the data according to the data involved in the abnormal event, and finally obtain a detailed record of the data security incident. Step 2: Combined with the detailed records of data security events, determine the category of the event, including the following: Active leakage by internal personnel: data leakage caused by subjective reasons of internal personnel; Passive leakage by internal personnel: due to weak security awareness and other reasons, internal personnel accounts are maliciously controlled by external parties, resulting in data leakage; Illegal operation by internal personnel: internal personnel perform illegal operations on business data. Step 3: Combined with the data security event category and data security event records, the complete data security event can be output in the end.

[0085] This embodiment encodes the current operation behavior corresponding to the abnormal user to obtain the original feature vector, then inputs the original feature vector into a preset autoencoder model, outputs a reconstructed feature vector, and then determines whether the current operation is an abnormal operation based on the reconstruction error between the original feature vector and the reconstructed feature vector. This embodiment inputs the original feature vector into a preset autoencoder model, and then determines whether the current operation is an abnormal operation based on the reconstruction error between the original feature vector and the reconstructed feature vector, and can analyze the current operation behavior corresponding to the abnormal user and accurately determine whether the current operation is an abnormal operation.

[0086] Reference Figure 4 , Figure 4 This is a structural block diagram of the first embodiment of the abnormal user detection device for data security of the present application.

[0087] like Figure 4 As shown, the abnormal user detection device for data security proposed in the embodiment of the present application includes:

[0088] A vector determination module 10, used to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior;

[0089] A graph structure building module 20, used to determine the operation similarity between the users to be detected, and use the operation behavior as a node to build a graph structure according to the feature vector and the operation similarity;

[0090] The abnormal user detection module 30 is used to determine the feature representation vector corresponding to the node according to the graph structure, and perform abnormal user detection according to the feature representation vector.

[0091] This embodiment determines the operation behavior and feature vector corresponding to the user to be detected and the operation behavior, then determines the operation similarity between the users to be detected, and uses the operation behavior as a node, constructs a graph structure according to the feature vector and the operation similarity, and then determines the feature representation vector corresponding to the node according to the graph structure, and performs abnormal user detection according to the feature representation vector. This embodiment first determines the operation behavior and feature vector corresponding to the user to be detected, and uses the operation behavior as a node, and constructs a graph structure according to the feature vector and the operation similarity, and can construct a graph structure related to the operation behavior corresponding to the user to be detected, and then determines the feature representation vector corresponding to each node, and performs abnormal user detection according to the feature representation vector, which can detect abnormal users faster and more accurately, and exclude most normal users.

[0092] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present application. In practical applications, technicians in this field can select part or all of it according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0093] In addition, for technical details not described in detail in this embodiment, please refer to the abnormal user detection method for data security provided in any embodiment of the present application, and will not be repeated here.

[0094] Based on the above-mentioned first embodiment of the abnormal user detection device for data security of the present application, a second embodiment of the abnormal user detection device for data security of the present application is proposed.

[0095] In this embodiment, the vector determination module 10 is also used to determine the operation behavior of the user to be detected within a preset period; pre-process the behavior log data corresponding to the operation behavior to obtain processed log data; perform data division on the processed log data to obtain a log data set of the user to be detected within the preset period; extract behavior features from the log data set, and determine a feature vector based on the extracted behavior features.

[0096] Furthermore, the graph structure construction module 20 is also used to extract a set of operation objects from the log data set within the preset period; perform Jaccard similarity calculation on each of the operation object sets to obtain the operation similarity between each of the users to be detected; use the operation behavior as a node, and the feature vector as a node feature corresponding to the node, and use the operation similarity as an edge weight between the nodes; and construct a graph structure based on the nodes, the node features and the edge weights.

[0097] Furthermore, the abnormal user detection module 30 is also used to determine the feature representation vector corresponding to the node according to the graph structure; divide the data set of the node through a random forest model to obtain abnormal nodes; and determine the abnormal user according to the abnormal node.

[0098] Furthermore, the abnormal user detection device for data security also includes an operation judgment module, which is used to encode the current operation behavior corresponding to the abnormal user to obtain an original feature vector; input the original feature vector into a preset autoencoder model and output a reconstructed feature vector; and judge whether the current operation is an abnormal operation based on the reconstruction error between the original feature vector and the reconstructed feature vector.

[0099] Furthermore, the operation judgment module is also used to encode normal operation behaviors corresponding to normal users to obtain normal feature vectors; and train the initial autoencoder model based on the normal feature vectors to obtain a preset autoencoder model.

[0100] Other embodiments or specific implementation methods of the abnormal user detection device for data security of the present application can refer to the above-mentioned method embodiments and will not be repeated here.

[0101] The present application provides an abnormal user detection device for data security, and the abnormal user detection device for data security includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the abnormal user detection method for data security in the above-mentioned embodiment 1.

[0102] Reference below Figure 5 , which shows a schematic diagram of the structure of an abnormal user detection device for data security suitable for implementing the embodiment of the present application. The abnormal user detection device for data security in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The abnormal user detection device for data security shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0103] like Figure 5As shown, the abnormal user detection device for data security may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the abnormal user detection device for data security are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the abnormal user detection device for data security to communicate wirelessly or wired with other devices to exchange data. Although the abnormal user detection device for data security with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0104] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0105] The abnormal user detection device for data security provided by the present application adopts the abnormal user detection method for data security in the above embodiment, which can solve the technical problem of how to detect abnormal users faster and more accurately and exclude most normal users. Compared with the prior art, the beneficial effects of the abnormal user detection device for data security provided by the present application are the same as the beneficial effects of the abnormal user detection method for data security provided by the above embodiment, and other technical features in the abnormal user detection device for data security are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0106] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0108] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the abnormal user detection method for data security in the above-mentioned embodiment.

[0109] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0110] The computer-readable storage medium may be included in the abnormal user detection device for data security; or may exist independently without being assembled into the abnormal user detection device for data security.

[0111] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an abnormal user detection device for data security, the abnormal user detection device for data security: determines the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior; determines the operation similarity between each of the users to be detected, and uses the operation behavior as a node, and constructs a graph structure according to the feature vector and the operation similarity; determines the feature representation vector corresponding to the node according to the graph structure, and performs abnormal user detection according to the feature representation vector.

[0112] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0113] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0114] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0115] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned abnormal user detection method for data security, and can solve the technical problem of how to detect abnormal users faster and more accurately and exclude most normal users. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the abnormal user detection method for data security provided by the above-mentioned embodiment, and will not be repeated here.

[0116] The present application also provides a computer program product, including a computer program, which implements the steps of the abnormal user detection method for data security as described above when executed by a processor.

[0117] The computer program product provided by the present application can solve the technical problem of how to detect abnormal users faster and more accurately and exclude the vast majority of normal users. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the abnormal user detection method for data security provided by the above embodiment, and will not be repeated here.

[0118] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for detecting abnormal users for data security, characterized in that: The abnormal user detection method for data security comprises the following steps: Determine an operation behavior corresponding to the user to be detected and a feature vector corresponding to the operation behavior; Determine the operation similarity between the users to be detected, and use the operation behavior as a node, and construct a graph structure according to the feature vector and the operation similarity; A feature representation vector corresponding to the node is determined according to the graph structure, and abnormal user detection is performed according to the feature representation vector.

2. The abnormal user detection method for data security according to claim 1, characterized in that: The step of determining the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior specifically includes: Determine the operation behavior of the user to be detected within a preset period; Preprocessing the behavior log data corresponding to the operation behavior to obtain processed log data; Performing data division on the processed log data to obtain a log data set of the user to be detected within the preset period; Behavior features are extracted from the log data set, and feature vectors are determined according to the extracted behavior features.

3. The abnormal user detection method for data security according to claim 2, characterized in that: The step of determining the operation similarity between the users to be detected, taking the operation behavior as a node, and constructing a graph structure according to the feature vector and the operation similarity specifically includes: Extracting an operation object set from the log data set within the preset period; Performing Jaccard similarity calculation on each of the operation object sets to obtain the operation similarity between each of the to-be-detected users; Taking the operation behavior as a node, taking the feature vector as a node feature corresponding to the node, and taking the operation similarity as an edge weight between the nodes; A graph structure is constructed according to the nodes, the node features, and the edge weights.

4. The abnormal user detection method for data security according to claim 1, characterized in that: The step of determining the feature representation vector corresponding to the node according to the graph structure, and performing abnormal user detection according to the feature representation vector specifically includes: Determine a feature representation vector corresponding to the node according to the graph structure; The nodes are divided into data sets by a random forest model to obtain abnormal nodes; An abnormal user is determined according to the abnormal node.

5. The abnormal user detection method for data security according to any one of claims 1 to 4, characterized in that: After the step of determining the feature representation vector corresponding to the node according to the graph structure and performing abnormal user detection according to the feature representation vector, the method further includes: Encode the current operation behavior corresponding to the abnormal user to obtain the original feature vector; Input the original feature vector into a preset autoencoder model, and output the reconstructed feature vector; Whether the current operation is an abnormal operation is determined according to a reconstruction error between the original feature vector and the reconstructed feature vector.

6. The abnormal user detection method for data security according to claim 5, characterized in that: Before the step of inputting the original feature vector into a preset autoencoder model and outputting the reconstructed feature vector, the method further includes: Encode the normal operation behavior corresponding to the normal user to obtain a normal feature vector; The initial autoencoder model is trained based on the normal feature vector to obtain a preset autoencoder model.

7. An abnormal user detection device for data security, characterized in that: The abnormal user detection device for data security comprises: A vector determination module, used to determine the operation behavior corresponding to the user to be detected and the feature vector corresponding to the operation behavior; A graph structure building module, used to determine the operation similarity between the users to be detected, and use the operation behavior as a node to build a graph structure according to the feature vector and the operation similarity; The abnormal user detection module is used to determine the feature representation vector corresponding to the node according to the graph structure, and perform abnormal user detection according to the feature representation vector.

8. An abnormal user detection device for data security, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the abnormal user detection method for data security according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the abnormal user detection method for data security according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the abnormal user detection method for data security according to any one of claims 1 to 6 are implemented.

Images