User abnormal behavior recognition method and device, equipment and storage medium

Abstract

The invention discloses a user abnormal behavior recognition method and device, equipment and a storage medium. According to the method, the user attribute feature matrix and the user behavior feature matrix are obtained by encoding the user attribute heterogeneous graph and the user behavior heterogeneous graph, weights are generated for features in the user attribute feature matrix and the user behavior feature matrix through the attention mechanism network model, and weighted attribute features and weighted behavior features are obtained. And then carrying out feature interaction on the weighted attribute features and the weighted behavior features, determining an association relationship between different features, further screening the weighted attribute features and the weighted behavior features of which the association relationship meets a preset threshold condition, and inputting the screened weighted attribute features and weighted behavior features into an abnormal behavior recognition model. And judging whether the user is an abnormal behavior or not. According to the invention, the fine-grained feature data can be obtained, and abnormal behavior recognition is carried out based on the fine-grained feature data, so that the accuracy of abnormal behavior recognition is improved.

Description

Technical Field

[0001] The present application belongs to the field of big data technology, and in particular, relates to a method, device, equipment, storage medium and computer program product for identifying abnormal user behavior. Background Art

[0002] Abnormal behavior mainly refers to the operations that harm the interests of enterprises or organizations brought by people who have direct access to business systems. If they are not discovered in time, they will cause significant losses to enterprises or organizations.

[0003] Existing abnormal behavior recognition technology directly inputs user behavior feature vectors into the recognition model for recognition. The feature data used for analysis and recognition of user abnormal behavior is relatively coarse-grained. In actual scenarios, users' abnormal behaviors are mostly slightly different from benign behaviors. Using coarse-grained feature data for analysis and recognition often has poor results and low recognition accuracy. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device, storage medium and computer program product for identifying abnormal behavior of a user, which can obtain fine-grained feature data and perform abnormal behavior identification based on the fine-grained feature data, thereby improving the accuracy of abnormal behavior identification.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal user behavior, the method comprising:

[0006] Obtaining a user attribute heterogeneous graph and a user behavior heterogeneous graph of the user;

[0007] Encode the user attribute heterogeneous graph and the user behavior heterogeneous graph respectively to obtain the user attribute feature matrix and the user behavior feature matrix;

[0008] The user attribute feature matrix and the user behavior feature matrix are respectively input into the attention mechanism network model, and weights are generated for the features in the user attribute feature matrix and the user behavior feature matrix through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features;

[0009] Based on the first weighted attribute feature and the first weighted behavior feature, feature interaction is performed to determine the association relationship between the first weighted attribute feature and the first weighted behavior feature;

[0010] Filtering the weighted attribute features and weighted behavior features whose association relationships meet a preset threshold condition to obtain a second weighted attribute feature and a second weighted behavior feature;

[0011] The second weighted attribute feature and the second weighted behavior feature are input into a pre-trained abnormal behavior recognition model to obtain a user behavior recognition result.

[0012] In a second aspect, an embodiment of the present application provides a user abnormal behavior identification device, the device comprising:

[0013] An acquisition module, used to acquire a user attribute heterogeneous graph and a user behavior heterogeneous graph of a user;

[0014] An encoding module, used to encode the user attribute heterogeneous graph and the user behavior heterogeneous graph respectively to obtain a user attribute feature matrix and a user behavior feature matrix;

[0015] A generation module is used to input the user attribute feature matrix and the user behavior feature matrix into the attention mechanism network model respectively, and generate weights for the features in the user attribute feature matrix and the user behavior feature matrix respectively through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features;

[0016] An interaction module, configured to perform feature interaction based on the first weighted attribute feature and the first weighted behavior feature, and determine an association relationship between the first weighted attribute feature and the first weighted behavior feature;

[0017] A screening module, used for screening weighted attribute features and weighted behavior features whose association relations meet a preset threshold condition, to obtain a second weighted attribute feature and a second weighted behavior feature;

[0018] The recognition module is used to input the second weighted attribute feature and the second weighted behavior feature into a pre-trained abnormal behavior recognition model to obtain a user behavior recognition result.

[0019] In a third aspect, an embodiment of the present application provides a user abnormal behavior identification device, the device comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the user abnormal behavior identification method as in the first aspect is implemented.

[0020] In a fourth aspect, an embodiment of the present application provides a computer storage medium having computer program instructions stored thereon, and when the computer program instructions are executed by a processor, the method for identifying abnormal user behavior as in the first aspect is implemented.

[0021] In a fifth aspect, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the user abnormal behavior identification method as in the first aspect.

[0022] The user abnormal behavior identification method, device, equipment, storage medium and computer program product of the embodiments of the present application can use the attention mechanism network model to assign weights to the features in the user attribute feature matrix and the user behavior feature matrix. The high or low weight assignment represents the importance of different features for identifying abnormal behavior, thereby enhancing the contribution of important features to abnormal behavior mining and identification. At the same time, based on the weighted user attribute features and the weighted user behavior features, the weighted attribute features and the weighted behavior features are interacted with each other to mine the correlation between the weighted attribute features and the weighted behavior features. The strength of the correlation can represent the accuracy of different features in distinguishing abnormal behavior from normal behavior, and then the weighted attribute features and weighted behavior features whose correlation meets the preset threshold conditions are screened to obtain more fine-grained features. By inputting the above-mentioned fine-grained features into the abnormal behavior recognition model, a more accurate recognition result can be obtained, thereby improving the recognition accuracy of user abnormal behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 It is a flowchart of a method for identifying abnormal user behavior provided by an embodiment of the present application;

[0025] Figure 2 This is a schematic diagram of the principle of a method for identifying abnormal user behavior provided by an embodiment of the present application;

[0026] Figure 3 It is a structural diagram of a user abnormal behavior identification device provided by an embodiment of the present application;

[0027] Figure 4 It is a structural diagram of a user abnormal behavior identification device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0029] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0030] In real-life scenarios, sometimes people inside a company or organization may engage in operations that harm the interests of the company or organization. Such operations appear as abnormal behaviors in the terminal or system. If they are not discovered in time, they will cause significant losses to the company or organization.

[0031] In the prior art, the identification of abnormal behavior usually uses the log files generated by the terminals used by internal personnel as the original data, extracts the information that can reflect the operating characteristics of the personnel, and uses various identification methods to analyze it to obtain information including the time when the malicious behavior occurred, the threats generated, and the people and equipment related to the operation.

[0032] Existing technical solutions process the above-mentioned multi-dimensional heterogeneous data into data streams, and determine whether it is abnormal behavior based on the characteristics therein; or build a preset behavior whitelist, match the current behavior with the preset whitelist to determine whether it is abnormal behavior; or only analyze the user behavior trajectory to determine whether it is malicious behavior.

[0033] However, the above solutions are either based on data flow, preset whitelists, or only analyze user behavior trajectories. The granularity of the feature data used for abnormal behavior analysis and identification is relatively coarse. In actual scenarios, users' abnormal behaviors are highly concealed, and most of them are slightly different from normal behaviors. Using coarse-grained feature data for analysis and identification often has poor results and low recognition accuracy.

[0034] In order to solve the problems of the prior art, the embodiments of the present application provide a method, apparatus, device, storage medium and computer program product for identifying abnormal behavior of users, which can use the attention mechanism network model to assign weights to the features in the user attribute feature matrix and the user behavior feature matrix. The weight assignment represents the importance of different features for identifying abnormal behavior, thereby enhancing the contribution of important features to abnormal behavior mining and identification. At the same time, based on the weighted user attribute features and the weighted user behavior features, the weighted attribute features and the weighted behavior features are interacted with each other, thereby mining the correlation between the weighted attribute features and the weighted behavior features. The strength of the correlation can represent the accuracy of different features in distinguishing abnormal behavior from normal behavior, and then screen the weighted attribute features and weighted behavior features whose correlation meets the preset threshold conditions to obtain more fine-grained features. By inputting the above-mentioned fine-grained features into the abnormal behavior recognition model, a more accurate recognition result can be obtained, thereby improving the recognition accuracy of user abnormal behavior.

[0035] The following first introduces the user abnormal behavior identification method provided in the embodiment of the present application.

[0036] Figure 1 A schematic diagram of a process for identifying abnormal user behavior provided by an embodiment of the present application is shown. Figure 2 The schematic diagram of the principle of the method for identifying abnormal user behavior provided by this embodiment is shown as follows: Figure 1 Combination Figure 2 As shown, the method may include the following steps: S101 to S106.

[0037] S101: Obtain a user attribute heterogeneous graph and a user behavior heterogeneous graph of the user.

[0038] In order to fully explore the impact of different feature data of users on the identification of abnormal user behavior, and obtain feature data with finer granularity to better help identify abnormal behavior, in an embodiment of the present application, it is first necessary to obtain the user attribute heterogeneous graph and user behavior heterogeneous graph of the user.

[0039] Among them, the user attribute heterogeneous graph is used to describe the user's own attribute information, and the user behavior heterogeneous graph is used to describe the behavior information in the user behavior text content.

[0040] The user attribute heterogeneous graph and user behavior heterogeneous graph clearly and completely display the user's own attribute information and user's behavior information. Based on the user's own attribute information and behavior information, it can help to explore the potential correlation between user feature data and abnormal behavior identification, thus providing a basis for accurately identifying user abnormal behavior.

[0041] In some embodiments, each node in the user attribute heterogeneous graph can describe attribute information such as the relationship between the user and other users, the user's own permissions, etc., and each node in the user behavior heterogeneous graph can describe various behavior information such as the user's access behavior, ordering behavior, etc.

[0042] S102: Encode the user attribute heterogeneous graph and the user behavior heterogeneous graph respectively to obtain a user attribute feature matrix and a user behavior feature matrix.

[0043] In order to more conveniently process the acquired user attribute information and behavior information and to mine the information that is more beneficial to the identification of abnormal user behavior, in this step, the user attribute heterogeneous graph and the user behavior heterogeneous graph are converted into user attribute feature matrix and user behavior feature matrix through encoding, so that they can be used as input data of the attention mechanism network model, and the attention mechanism network model can be used to preliminarily and quickly mark the information that is beneficial to the identification of abnormal behavior.

[0044] In some embodiments, the encoding process may be performed by using a graph neural network model, such as a Graph Convolutional Network (GCN) model as an encoder, by inputting the user attribute heterogeneous graph and the user behavior heterogeneous graph into the GCN model respectively to obtain a user attribute feature matrix and a user behavior feature matrix.

[0045] In some embodiments, the above GCN model may be composed of m graph convolutional layers, a concatenation layer and n fully connected layers.

[0046] Among them, each graph convolution layer consists of a GraphConv function, a Dropout function and an activation function; each fully connected layer consists of a density layer, a Dropout function and an activation function.

[0047] Taking the user behavior heterogeneous graph as an example, the data processing process in the GCN model is introduced as follows:

[0048] The user behavior heterogeneous graph is input into the first graph convolution layer, and m graph convolution layer output vectors are generated after passing through m graph convolution layers, where each output vector corresponds to the information of each node in the user behavior heterogeneous graph combined with its node with a distance of m. These m graph convolution layer output vectors are horizontally spliced ​​in the splicing layer and input into the fully connected layer. After passing through n fully connected layers, the feature vector of each node in the user behavior heterogeneous graph is obtained.

[0049] S103: Input the user attribute feature matrix and the user behavior feature matrix into the attention mechanism network model respectively, and generate weights for the features in the user attribute feature matrix and the user behavior feature matrix respectively through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features.

[0050] Due to the initial acquisition of user attribute features and user behavior features, not all features can bring good effects to abnormal behavior mining. In order to achieve more accurate identification of abnormal behavior, it is necessary to enhance the contribution of useful features to abnormal behavior mining, while reducing the interference of useless features to abnormal behavior mining.

[0051] This step uses the attention mechanism network model to learn the importance of different user features. The fully connected layer in the attention mechanism network model generates weights for the features in the user attribute feature matrix and the user behavior feature matrix respectively. Features with relatively high weights are regarded as useful features, and features with relatively low weights are regarded as useless features. This can achieve the importance distinction of different user features, thereby enhancing the contribution of useful features to abnormal behavior mining, while reducing the interference of useless features to abnormal behavior mining, overcoming the problems in the prior art of weak distinction between different user features and low contribution of useless features to abnormal behavior mining.

[0052] In some embodiments, the fully connected layer may include a first fully connected layer and a second fully connected layer.

[0053] In some embodiments, the first fully connected layer may include an activation function, and the activation function may be used to generate a first attribute attention weight matrix of the user attribute feature matrix and a first behavior attention weight matrix of the user behavior feature matrix based on the user attribute feature matrix and the user behavior feature matrix, respectively;

[0054] The second fully connected layer may include an activation function, which may be used to generate a second attribute attention weight matrix and a second behavior attention weight matrix, respectively, based on the first attribute attention weight matrix and the first behavior attention weight matrix output by the first fully connected layer.

[0055] Among them, the second attribute attention weight matrix contains the corresponding weight values ​​of all attribute features in the user attribute feature matrix; the second behavior attention weight matrix contains the corresponding weight values ​​of all behavior features in the user behavior feature matrix.

[0056] S104: Based on the first weighted attribute feature and the first weighted behavior feature, feature interaction is performed to determine an association relationship between the first weighted attribute feature and the first weighted behavior feature.

[0057] After the above step S103, although useful features and useless features that can distinguish the importance of abnormal behavior identification have been obtained, since the impact of exploring the potential correlation between different feature data on abnormal behavior identification has not been considered, the feature data obtained is still coarse-grained. Directly using the feature data obtained in step S103 to perform abnormal behavior analysis and identification, the obtained identification result is difficult to achieve the best effect.

[0058] Therefore, based on the weighted attribute features and weighted behavior features obtained in step S103, this step further performs a joint analysis of the user weighted attribute features and the user weighted behavior features by adopting a feature interaction method, so as to fully explore the potential correlation between the feature data of different dimensions of the user, thereby obtaining feature data with finer granularity, so that the user feature data can better help identify abnormal user behavior and improve the accuracy of identifying abnormal user behavior.

[0059] Among them, feature interaction refers to the interactive combination of different features in some way, so as to learn the rules hidden behind the feature data.

[0060] Among them, the strength of the above-mentioned correlation relationship determined by feature interaction can represent the accuracy of distinguishing abnormal behavior from normal behavior using different features. In this implementation, the stronger the correlation relationship, the higher the accuracy of the feature used to distinguish abnormal behavior from normal behavior.

[0061] In some embodiments, the above-mentioned correlation relationship can be expressed as a percentage, and the larger the percentage is, the stronger the correlation relationship between the features is.

[0062] S105: Filter the weighted attribute features and weighted behavior features whose association relations meet the preset threshold condition to obtain a second weighted attribute feature and a second weighted behavior feature.

[0063] Through the feature interaction of step S104, the correlation between different weighted attribute features and different weighted behavior features can be fully explored, so as to filter out features that are conducive to abnormal behavior identification through the correlation between features. In order to specifically realize the screening of fine-grained feature data that can improve the accuracy of abnormal behavior identification, this step filters the features by presetting a threshold condition, compares the multiple correlations obtained in step S104 with the threshold condition, and retains the features that meet the threshold condition as the final feature data for abnormal behavior identification.

[0064] Among them, the preset threshold condition can be expressed as a percentage value, and the percentage value can be set manually according to the specific scenario and is not limited in the embodiments of the present application.

[0065] As an example, the preset threshold condition may be eighty percent.

[0066] S106: Input the second weighted attribute feature and the second weighted behavior feature into a pre-trained abnormal behavior recognition model to obtain a user behavior recognition result.

[0067] In order to quickly and accurately determine whether the user behavior is abnormal behavior, this step improves the efficiency and accuracy of user abnormal behavior identification by inputting the fine-grained features obtained by screening in step S105 into a pre-trained abnormal behavior identification model, and outputting the user's behavior identification results through the abnormal behavior identification model.

[0068] In the embodiment of the present application, the attention mechanism network model can be used to assign weights to the features in the user attribute feature matrix and the user behavior feature matrix. The weight assignment represents the importance of different features for identifying abnormal behaviors, thereby enhancing the contribution of important features to abnormal behavior mining and identification. At the same time, based on the weighted user attribute features and the weighted user behavior features, the weighted attribute features and the weighted behavior features are interacted with each other to mine the correlation between the weighted attribute features and the weighted behavior features. The strength of the correlation can represent the accuracy of different features in distinguishing abnormal behaviors from normal behaviors, and then the weighted attribute features and weighted behavior features whose correlations meet the preset threshold conditions are screened to obtain more fine-grained features. By inputting the above-mentioned fine-grained features into the abnormal behavior recognition model, a more accurate recognition result can be obtained, thereby improving the recognition accuracy of user abnormal behavior.

[0069] In some embodiments, in step S103, weights are generated for features in the user attribute feature matrix and the behavior feature matrix respectively through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features, which may include:

[0070] Input the user attribute feature matrix and the user behavior feature matrix into the activation function of the first fully connected layer respectively to obtain the first attribute attention weight matrix and the first behavior attention weight matrix;

[0071] The first attribute attention weight matrix and the first behavior attention weight matrix are respectively input into the activation function of the second fully connected layer to obtain the second attribute attention weight matrix and the second behavior attention weight matrix;

[0072] Normalize the second attribute attention weight matrix and the second behavior attention weight matrix respectively to obtain the third attribute attention weight matrix and the third behavior attention weight matrix;

[0073] The third attribute attention weight matrix and the user attribute feature matrix are dot-multiplied to obtain the weighted attribute features of the user attribute feature matrix; the third behavior attention weight matrix and the behavior feature matrix are dot-multiplied to obtain the weighted behavior features of the user behavior feature matrix.

[0074] Among them, the second attribute attention weight matrix and the second behavior attention weight matrix are normalized respectively in order to unify the range of weight values ​​into (0, 1), so as to clearly show the weight values ​​of different features.

[0075] In one embodiment, the activation function of the first fully connected layer may include:

[0076]

[0077] Among them, E 1 represents the first attribute attention weight matrix, W 1 represents the weight matrix on the first fully connected layer, b 1 represents the bias vector on the first fully connected layer, ReLU represents the activation function of the first fully connected layer, Represents the user attribute feature matrix.

[0078] In one embodiment, the activation function of the second fully connected layer may include:

[0079] E 2 =ReLU(W 2 E 1 +b 2 ) (2)

[0080] Among them, E 2 represents the second attribute attention weight matrix, W 2 represents the weight matrix on the second fully connected layer, b 2 ReLU represents the activation function of the second fully connected layer.

[0081] In one embodiment, the second attribute attention weight matrix and the second behavior attention weight matrix are normalized respectively, which can be accomplished using a softmax function.

[0082] In one embodiment, the third attribute attention weight matrix and the user attribute feature matrix are dot-multiplied to obtain the weighted attribute features of the user attribute feature matrix, which can be expressed by the following formula:

[0083]

[0084] Among them, ⊙ is the dot product operator between two matrices, E is the third attribute attention weight matrix, is the user attribute feature matrix, is the user's weighted attribute feature matrix.

[0085] In one embodiment, the third behavior attention weight matrix and the behavior feature matrix are dot-multiplied to obtain the weighted behavior features of the user behavior feature matrix. The same calculation formula as the dot-multiplication of the third attribute attention weight matrix and the user attribute feature matrix can be used, which will not be repeated here.

[0086] In some embodiments, in order to fully explore the potential correlation between the user's feature data of different dimensions and obtain feature data with finer granularity, so that the user feature data can better help identify abnormal user behavior, in step S104, based on the first weighted attribute feature and the first weighted behavior feature, feature interaction is performed to determine the correlation between the first weighted attribute feature and the first weighted behavior feature, which may include:

[0087] The first weighted attribute feature and the first weighted behavior feature are horizontally spliced ​​to determine the spliced ​​feature, and based on the correspondence between the spliced ​​feature and the association relationship, the association relationship between the first weighted attribute feature and the first weighted behavior feature is obtained.

[0088] In one embodiment, the first weighted attribute feature and the first weighted behavior feature are horizontally spliced ​​to determine the corresponding relationship between the spliced ​​features and the association relationship, which can be expressed by the following formula:

[0089]

[0090] in, is the i-th weighted attribute feature of the weighted attribute feature matrix, Z j ′ is the jth weighted behavior feature of the weighted behavior feature matrix, d represents the dimension of the feature, ⊕ represents the horizontal feature concatenation operation, and N represents the dimension of the concatenated feature.

[0091] In some embodiments, before step S104: performing feature interaction based on the first weighted attribute feature and the first weighted behavior feature, the user abnormal behavior identification method may further include the following steps:

[0092] S1041: Based on the weighted attribute features, feature interaction is performed to determine the association relationship between the weighted attribute features, and the weighted attribute feature whose association relationship meets the first threshold condition is used as the first weighted attribute feature;

[0093] S1042: Based on the weighted behavior features, feature interaction is performed to determine the association relationship between the weighted behavior features, and the weighted behavior feature whose association relationship meets the second threshold condition is used as the first weighted behavior feature.

[0094] In order to fully explore the potential correlation between different features, a multi-level feature interaction method can be adopted. In this embodiment, two levels of feature interaction are mainly performed.

[0095] The first level is to perform feature interactions between weighted attribute features and weighted behavior features, so as to fully explore the potential correlation between each two different weighted attribute features and the potential correlation between each two different weighted behavior features, and then screen out the first weighted attribute features and the first weighted behavior features that meet the corresponding threshold conditions based on the potential correlation obtained by interacting the first level features. The feature data obtained by the first level feature interaction is used as the basic data for the second level feature interaction, thereby realizing multi-level feature interaction.

[0096] Multi-level feature interaction truly achieves multi-dimensional joint analysis between different features, which can more comprehensively and fully explore the potential correlations between different features, thereby more effectively helping to identify abnormal user behaviors and thereby improving the accuracy of identifying abnormal user behaviors.

[0097] In some embodiments, in step S1041, based on the weighted attribute features, feature interaction is performed to determine the association relationship between the weighted attribute features, which may include:

[0098] Each two different weighted attribute features are horizontally spliced ​​to determine the spliced ​​features, and based on the corresponding relationship between the spliced ​​features and the association relationship, the association relationship between the weighted attribute features is obtained.

[0099] In one embodiment, each two different weighted attribute features are horizontally spliced ​​to determine the spliced ​​features. Based on the correspondence between the spliced ​​features and the association relationship, the following formula can be used to express:

[0100]

[0101] in, is the i-th weighted attribute feature of the weighted attribute feature matrix, is the jth weighted attribute feature of the weighted attribute feature matrix, d represents the dimension of the feature, ⊕ represents the horizontal feature concatenation operation, and N represents the dimension of the concatenated feature.

[0102] In some embodiments, in step S1042, based on the weighted behavior features, feature interaction is performed to determine the association relationship between the weighted behavior features, which may include:

[0103] Each two different weighted behavior features are horizontally spliced ​​together to determine the dimension of the spliced ​​features, and based on the correspondence between the dimension and the association relationship, the association relationship between the weighted behavior features is obtained.

[0104] In one embodiment, the above-mentioned two different weighted behavior features are horizontally spliced ​​to determine the dimension of the spliced ​​feature. Based on the corresponding relationship between the dimension and the association relationship, it can be expressed by the following formula:

[0105]

[0106] Among them, Z i ′ is the ith weighted behavior feature of the weighted behavior feature matrix, Z j ′ is the jth weighted behavior feature of the weighted behavior feature matrix, Z i ′ , Z j ′ ∈R 1×d , d represents the dimension of the feature, ⊕ represents the horizontal feature concatenation operation, and N represents the dimension of the concatenated feature.

[0107] In some embodiments, before step S106: inputting the second weighted attribute feature and the second weighted behavior feature into a pre-trained abnormal behavior recognition model, the user abnormal behavior recognition method may further include:

[0108] a. Obtain a training sample set, the training sample set includes multiple training samples, each training sample includes a second weighted attribute feature of the sample, a second weighted behavior feature of the sample, a user behavior category and a behavior label;

[0109] b. Taking the second weighted attribute feature of the sample and the second weighted behavior feature of the sample as independent variables and the user behavior category and behavior label in the training sample as dependent variables, train the preset classifier model, and when the training stop condition is met, determine that the trained model is an abnormal behavior recognition model.

[0110] In some embodiments, the above step b. takes the second weighted attribute feature of the sample and the second weighted behavior feature of the sample as independent variables, takes the user behavior category and behavior label in the training sample as dependent variables, trains a preset classifier model, and when the training stop condition is met, determines that the trained model is an abnormal behavior recognition model, which may include:

[0111] Inputting the second weighted attribute feature of the sample and the second weighted behavior feature of the sample into a preset classifier model to obtain the identified user behavior category;

[0112] Determine the loss function value of the classifier model based on the user behavior category and behavior label;

[0113] When the loss function value meets the training stop condition, the abnormal behavior recognition model is obtained.

[0114] In order to make the recognition effect of the abnormal behavior recognition model better and improve the recognition accuracy, after obtaining fine-grained user features, these fine-grained features are used to further train the behavior classifier model.

[0115] The existing second weighted attribute features, second weighted behavior features, user behavior categories and behavior labels are used as training samples, and the behavior classifier model is trained using the training samples, wherein the sample second weighted attribute features and the sample second weighted behavior features are used as input, and the user behavior categories and behavior labels in the training samples are used as output. The loss function value is continuously adjusted during the training process, and when the loss function value meets the training stop condition, the final behavior classifier model is obtained as the final abnormal behavior recognition model.

[0116] Compared with directly training the classifier based on the user's original attribute feature vector or behavior feature vector, the classifier model is trained using the above-mentioned fine-grained feature training samples of the embodiment of the present application, so that the abnormal behavior recognition model can quickly and accurately determine whether the user behavior is abnormal behavior based on the user's fine-grained feature data.

[0117] Figure 3 is a schematic diagram of the structure of a user abnormal behavior identification device 300 provided in an embodiment of the present application. Figure 3 As shown, the apparatus may include a data acquisition module 310 , a generation module 320 , an interaction module 330 , and an identification module 340 .

[0118] An acquisition module 310 is used to acquire a user attribute heterogeneous graph and a user behavior heterogeneous graph of the user;

[0119] A generating module 320, for encoding the user attribute heterogeneous graph and the user behavior heterogeneous graph respectively to obtain a user attribute feature matrix and a user behavior feature matrix;

[0120] The generating module 320 is further used to input the user attribute feature matrix and the user behavior feature matrix into the attention mechanism network model respectively, and generate weights for the features in the user attribute feature matrix and the user behavior feature matrix respectively through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features;

[0121] An interaction module 330, configured to perform feature interaction based on the first weighted attribute feature and the first weighted behavior feature, and determine an association relationship between the first weighted attribute feature and the first weighted behavior feature;

[0122] The generating module 320 is further used to screen the weighted attribute features and weighted behavior features whose association relations meet the preset threshold conditions to obtain the second weighted attribute features and the second weighted behavior features;

[0123] The recognition module 340 is used to input the second weighted attribute feature and the second weighted behavior feature into a pre-trained abnormal behavior recognition model to obtain a user behavior recognition result.

[0124] In the embodiment of the present application, the attention mechanism network model can be used to assign weights to the features in the user attribute feature matrix and the user behavior feature matrix. The weight assignment represents the importance of different features for identifying abnormal behaviors, thereby enhancing the contribution of important features to abnormal behavior mining and identification. At the same time, based on the weighted user attribute features and the weighted user behavior features, the weighted attribute features and the weighted behavior features are interacted with each other to mine the correlation between the weighted attribute features and the weighted behavior features. The strength of the correlation can represent the accuracy of different features in distinguishing abnormal behaviors from normal behaviors, and then the weighted attribute features and weighted behavior features whose correlations meet the preset threshold conditions are screened to obtain more fine-grained features. By inputting the above-mentioned fine-grained features into the abnormal behavior recognition model, a more accurate recognition result can be obtained, thereby improving the recognition accuracy of user abnormal behavior.

[0125] In some embodiments, the generating module 320 is further used to input the user attribute feature matrix and the user behavior feature matrix into the activation function of the first fully connected layer respectively to obtain the first attribute attention weight matrix and the first behavior attention weight matrix;

[0126] The first attribute attention weight matrix and the first behavior attention weight matrix are respectively input into the activation function of the second fully connected layer to obtain the second attribute attention weight matrix and the second behavior attention weight matrix;

[0127] Normalize the second attribute attention weight matrix and the second behavior attention weight matrix respectively to obtain the third attribute attention weight matrix and the third behavior attention weight matrix;

[0128] The third attribute attention weight matrix and the user attribute feature matrix are dot-multiplied to obtain the weighted attribute features of the user attribute feature matrix; the third behavior attention weight matrix and the behavior feature matrix are dot-multiplied to obtain the weighted behavior features of the user behavior feature matrix.

[0129] In some embodiments, the interaction module 330 is further used to horizontally splice the first weighted attribute feature with the first weighted behavior feature, determine the spliced ​​features, and obtain the association relationship between the first weighted attribute feature and the first weighted behavior feature based on the correspondence between the spliced ​​features and the association relationship.

[0130] In some embodiments, the interaction module 330 is further used to perform feature interaction based on the weighted attribute features, determine the association relationship between the weighted attribute features, and use the weighted attribute feature whose association relationship meets the first threshold condition as the first weighted attribute feature;

[0131] Based on the weighted behavior features, feature interaction is performed to determine the association relationship between the weighted behavior features, and the weighted behavior feature whose association relationship meets the second threshold condition is used as the first weighted behavior feature.

[0132] In some embodiments, the interaction module 330 is further used to horizontally splice every two different weighted attribute features, determine the spliced ​​features, and obtain the association relationship between the weighted attribute features based on the correspondence between the spliced ​​features and the association relationship.

[0133] In some embodiments, the interaction module 330 is further used to horizontally splice every two different weighted behavior features, determine the dimension of the spliced ​​features, and obtain the association relationship between the weighted behavior features based on the correspondence between the dimension and the association relationship.

[0134] In some embodiments, the user abnormal behavior identification device 300 further includes a training module;

[0135] A training module, used to obtain a training sample set, the training sample set includes a plurality of training samples, each training sample includes a second weighted attribute feature of the sample, a second weighted behavior feature of the sample, a user behavior category and a behavior label;

[0136] The preset classifier model is trained with the second weighted attribute feature of the sample and the second weighted behavior feature of the sample as independent variables, and the user behavior category and behavior label in the training sample as dependent variables. When the training stop condition is met, the trained model is determined to be an abnormal behavior recognition model.

[0137] The training module is further used to input the second weighted attribute feature of the sample and the second weighted behavior feature of the sample into a preset classifier model to obtain the recognized user behavior category;

[0138] Determine the loss function value of the classifier model based on the user behavior category and behavior label;

[0139] When the loss function value meets the training stop condition, the abnormal behavior recognition model is obtained.

[0140] Figure 3 The various modules in the device shown can be implemented Figure 1 Each step in the above steps can achieve the corresponding technical effect, which will not be repeated here for the sake of brevity.

[0141] Figure 4 A schematic diagram of the hardware structure of a user abnormal behavior identification device provided in an embodiment of the present application is shown.

[0142] The user abnormal behavior identification device may include a processor 401 and a memory 402 storing computer program instructions.

[0143] Specifically, the processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0144] Memory 402 may include a large capacity memory for data or instructions. By way of example and not limitation, memory 402 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, memory 402 may include a removable or non-removable (or fixed) medium. In appropriate cases, memory 402 may be inside or outside of an integrated gateway disaster recovery device. In a specific embodiment, memory 402 is a non-volatile solid-state memory.

[0145] In certain embodiments, the memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present application.

[0146] The processor 401 implements any one of the user abnormal behavior identification methods in the above embodiments by reading and executing computer program instructions stored in the memory 402 .

[0147] In one example, the user abnormal behavior identification device may further include a communication interface 403 and a bus 410. Figure 4As shown, the processor 401, the memory 402, and the communication interface 403 are connected via a bus 410 and communicate with each other.

[0148] The communication interface 403 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0149] Bus 410 includes hardware, software or both, and the parts of user abnormal behavior identification equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransmission (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 410 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0150] In addition, in combination with the user abnormal behavior identification method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the user abnormal behavior identification methods in the above embodiment is implemented.

[0151] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed, implements any one of the user abnormal behavior identification methods in the above embodiments.

[0152] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0153] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0154] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0155] The above reference is to the flowchart and / or block diagram of the method, device, equipment, storage medium and computer program product according to the embodiment of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0156] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for identifying abnormal user behavior, characterized in that: include: Obtaining a user attribute heterogeneous graph and a user behavior heterogeneous graph of the user; Encoding the user attribute heterogeneous graph and the user behavior heterogeneous graph respectively to obtain a user attribute feature matrix and a user behavior feature matrix; The user attribute feature matrix and the user behavior feature matrix are respectively input into the attention mechanism network model, and weights are generated for the features in the user attribute feature matrix and the user behavior feature matrix respectively through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features; Based on the first weighted attribute feature and the first weighted behavior feature, feature interaction is performed to determine the association relationship between the first weighted attribute feature and the first weighted behavior feature; Screening the weighted attribute features and weighted behavior features whose association relationships meet a preset threshold condition to obtain a second weighted attribute feature and a second weighted behavior feature; The second weighted attribute feature and the second weighted behavior feature are input into a pre-trained abnormal behavior recognition model to obtain a user behavior recognition result.

2. The method for identifying abnormal user behavior according to claim 1, characterized in that: The fully connected layer includes a first fully connected layer and a second fully connected layer; the fully connected layer in the attention mechanism network model generates weights for the features in the user attribute feature matrix and the behavior feature matrix respectively, and obtains weighted attribute features and weighted behavior features, including: Input the user attribute feature matrix and the user behavior feature matrix into the activation function of the first fully connected layer respectively to obtain the first attribute attention weight matrix and the first behavior attention weight matrix; The first attribute attention weight matrix and the first behavior attention weight matrix are respectively input into the activation function of the second fully connected layer to obtain the second attribute attention weight matrix and the second behavior attention weight matrix; Normalize the second attribute attention weight matrix and the second behavior attention weight matrix respectively to obtain the third attribute attention weight matrix and the third behavior attention weight matrix; The third attribute attention weight matrix and the user attribute feature matrix are dot-multiplied to obtain the weighted attribute features of the user attribute feature matrix; the third behavior attention weight matrix and the behavior feature matrix are dot-multiplied to obtain the weighted behavior features of the user behavior feature matrix.

3. The method for identifying abnormal user behavior according to claim 1, characterized in that: The performing feature interaction based on the first weighted attribute feature and the first weighted behavior feature to determine the association relationship between the first weighted attribute feature and the first weighted behavior feature includes: The first weighted attribute feature and the first weighted behavior feature are horizontally spliced ​​to determine the spliced ​​feature, and based on the correspondence between the spliced ​​feature and the association relationship, the association relationship between the first weighted attribute feature and the first weighted behavior feature is obtained.

4. The method for identifying abnormal user behavior according to claim 1, characterized in that: Before performing feature interaction based on the first weighted attribute feature and the first weighted behavior feature, the method further includes: Based on the weighted attribute features, feature interaction is performed to determine the association relationship between the weighted attribute features, and the weighted attribute feature whose association relationship satisfies a first threshold condition is used as the first weighted attribute feature; Based on the weighted behavior features, feature interaction is performed to determine the association relationship between the weighted behavior features, and the weighted behavior feature whose association relationship meets the second threshold condition is used as the first weighted behavior feature.

5. The method for identifying abnormal user behavior according to claim 4, characterized in that: The performing feature interaction based on the weighted attribute features to determine the association relationship between the weighted attribute features includes: Each two different weighted attribute features are horizontally spliced ​​to determine the spliced ​​features, and based on the corresponding relationship between the spliced ​​features and the association relationship, the association relationship between the weighted attribute features is obtained.

6. The method for identifying abnormal user behavior according to claim 4, characterized in that: The performing feature interaction based on the weighted behavior features to determine the association relationship between the weighted behavior features includes: Each two different weighted behavior features are horizontally spliced ​​to determine the dimension of the spliced ​​features, and based on the corresponding relationship between the dimension and the association relationship, the association relationship between the weighted behavior features is obtained.

7. The method for identifying abnormal user behavior according to claim 1, characterized in that: Before inputting the second weighted attribute feature and the second weighted behavior feature into the pre-trained abnormal behavior recognition model, the method further includes: Acquire a training sample set, the training sample set comprising a plurality of training samples, each of the training samples comprising a second weighted attribute feature of the sample, a second weighted behavior feature of the sample, a user behavior category and a behavior label; The second weighted attribute feature of the sample and the second weighted behavior feature of the sample are used as independent variables, and the user behavior category and behavior label in the training sample are used as dependent variables to train a preset classifier model. When the training stop condition is met, the trained model is determined to be an abnormal behavior recognition model.

8. The method for identifying abnormal user behavior according to claim 7, characterized in that: The method of training a preset classifier model with the second weighted attribute feature of the sample and the second weighted behavior feature of the sample as independent variables and the user behavior category and behavior label in the training sample as dependent variables, and determining that the trained model is an abnormal behavior recognition model when a training stop condition is met, includes: Inputting the second weighted attribute feature of the sample and the second weighted behavior feature of the sample into a preset classifier model to obtain an identified user behavior category; Determining a loss function value of the classifier model according to the user behavior category and the behavior label; When the loss function value satisfies the training stop condition, an abnormal behavior recognition model is obtained.

9. A user abnormal behavior identification device, characterized in that: The device comprises: An acquisition module, used to acquire a user attribute heterogeneous graph and a user behavior heterogeneous graph of a user; An encoding module, used to encode the user attribute heterogeneous graph and the user behavior heterogeneous graph respectively to obtain a user attribute feature matrix and a user behavior feature matrix; A generation module, used to input the user attribute feature matrix and the user behavior feature matrix into the attention mechanism network model respectively, and generate weights for the features in the user attribute feature matrix and the user behavior feature matrix respectively through the fully connected layer in the attention mechanism network model to obtain weighted attribute features and weighted behavior features; An interaction module, configured to perform feature interaction based on the first weighted attribute feature and the first weighted behavior feature, and determine an association relationship between the first weighted attribute feature and the first weighted behavior feature; A screening module, used for screening the weighted attribute characteristics and weighted behavior characteristics whose association relations meet a preset threshold condition, to obtain a second weighted attribute characteristic and a second weighted behavior characteristic; The recognition module is used to input the second weighted attribute feature and the second weighted behavior feature into a pre-trained abnormal behavior recognition model to obtain a user behavior recognition result.

10. A user abnormal behavior identification device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for identifying abnormal user behavior as described in any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by the processor, the method for identifying abnormal user behavior according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the user abnormal behavior identification method as described in any one of claims 1-8.

Images