Abnormal user behavior detection method for energy storage EMS based on sparse attention mechanism

Abstract

The present invention belongs to the field of data security technology, and discloses an energy storage EMS abnormal user behavior detection method based on a sparse attention mechanism, obtains a standard behavior pattern set for each role according to the normal behavior data of the user's history, splices the user's temporal behavior characteristics to be detected with the most similar standard behavior baseline in the standard behavior pattern set of the corresponding role, and inputs the spliced ​​samples into an autoencoder based on a sparse attention mechanism to obtain a reconstructed user temporal behavior feature, compares the reconstructed user temporal behavior feature with a threshold, and obtains a user behavior abnormality detection result. The present invention overcomes the problems that the existing user behavior analysis method cannot effectively extract features from sparse data, and the method has low detection efficiency and poor quality.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to an energy storage EMS (energy storage energy management system, Energy Management System) abnormal user behavior detection method based on a sparse attention mechanism. Background Art

[0002] With the rapid development of Internet technology, key infrastructure including cloud computing, data warehouse, Internet of Things (IoT) and artificial intelligence (AI) has been significantly improved and perfected. These technological advances have provided a solid foundation for the transformation of traditional power grids.

[0003] As an important component of the power grid, the energy storage system plays a vital role in the safe and stable operation of the entire power system by achieving functions such as peak shaving and valley filling, smoothing power output, and providing emergency backup power. However, with the increase in the scale and complexity of the energy storage system, the increase in the amount of information within its EMS system has brought new challenges. Informatization and intelligence have brought many conveniences to the energy storage system, but they also expose it to complex security threats and attacks. For example, criminals may disguise themselves as system insiders through deliberate fraud and other means to steal, intercept or even tamper with the key operating data of the system, which will seriously threaten the safe and stable operation of the energy storage system. Therefore, studying an accurate and effective abnormal user behavior detection method is crucial to identifying potential threats within the system, formulating solutions in a timely manner to reduce the risk of data security within the system, and improving the overall operating efficiency of the system, thereby ensuring the safety, stability and reliability of the energy storage system. Summary of the invention

[0004] The purpose of the present invention is to provide an energy storage EMS abnormal user behavior detection method based on a sparse attention mechanism, so as to overcome the problems that the existing user behavior analysis methods cannot effectively extract features from sparse data, and the methods have low detection efficiency and poor quality.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] A method for detecting abnormal user behavior of an energy storage EMS based on a sparse attention mechanism, the method for detecting abnormal user behavior of an energy storage EMS based on a sparse attention mechanism comprising:

[0007] Extract the user's historical normal behavior data from the energy storage EMS, divide the extracted normal behavior data into time windows, and count the frequencies of different behaviors in different time periods in each time window to obtain a sparse matrix that characterizes the user's temporal behavior characteristics;

[0008] For the temporal behavior characteristics of users belonging to the same role, clustering is performed using a clustering method based on weighted temporal cosine similarity. Each cluster center in the clustering result is used as a standard behavior baseline. All standard behavior baselines are combined to obtain a standard behavior pattern set belonging to each role.

[0009] For a user temporal behavior feature to be detected, the weighted temporal cosine similarity is used to calculate the distance between the user temporal behavior feature to be detected and each standard behavior baseline of the character to which it belongs, and the user temporal behavior feature to be detected and the standard behavior baseline with the smallest distance are spliced ​​along the dimension to obtain a joint data sample;

[0010] Constructing an autoencoder based on a sparse attention mechanism, wherein the encoder based on the autoencoder based on the sparse attention mechanism includes a normalization layer and a sparse attention layer, and the decoder based on the autoencoder based on the sparse attention mechanism includes a plurality of multi-layer perceptrons;

[0011] The joint data sample is input into the sparse attention mechanism-based autoencoder to obtain a reconstructed user temporal behavior feature, and the reconstructed user temporal behavior feature is compared with a threshold to obtain a user behavior anomaly detection result.

[0012] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0013] Preferably, the behavior of statistical frequency includes:

[0014] Number of logins, number of logouts, number of website visits, number of device connections, number of device disconnections, number of exe files opened, number of txt files opened, number of pdf files opened, number of doc files opened, number of zip files opened, number of jpg files opened, number of emails received, average size of emails received, average number of email attachments received, number of emails sent, average size of emails sent, and average number of email attachments sent.

[0015] Preferably, the calculation method based on weighted time series cosine similarity is as follows:

[0016] ;

[0017] in, Represents user temporal behavior characteristics and user temporal behavior characteristics The distance between The dimension is And the sequence length is The user's temporal behavior characteristics, Indicates The weight of each period, Represents user temporal behavior characteristics Middle The feature vector of each time period, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, Represents user temporal behavior characteristics Middle The feature vector of each time period, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, , express The module length, express The mold length.

[0018] Preferably, the sparse attention weight calculation process of the sparse attention layer is as follows:

[0019] ;

[0020] ;

[0021] ;

[0022] in, is the sparse attention weight, represents the query vector, is the key vector, is a value vector, represents the mask matrix, represents the softmax activation function, is the key vector The transpose of represents the scaling factor, Represents the mask matrix Middle Line Column element value, It also represents the position in the query vector. represents the position in the key vector, Represents the position in the query vector Note that the set of positions in the key vector, , is the delimiting parameter and , Represents the position in the query vector with the position in the key vector The key-value pairs do not participate in the calculation of sparse attention weights. Represents the position in the query vector with the position in the key vector The composed key-value pairs participate in the calculation of sparse attention weights.

[0023] Preferably, the decoder comprises The decoder is composed of a multi-layer perceptron, and the processing process of the decoder is as follows:

[0024] ;

[0025] ;

[0026] ;

[0027] in, The latent representation representing the encoder output No. dimensions, Representation and characteristics The corresponding A multi-layer perceptron, The first dimensions, Represents the reconstructed user temporal behavior characteristics, express The transpose of represents a linear layer, represents the activation function, , is the sequence length of the user's temporal behavior features and the reconstructed user's temporal behavior features, It is the user's temporal behavior characteristics and the dimensions of the reconstructed user's temporal behavior characteristics.

[0028] Preferably, during the training process of the sparse attention mechanism autoencoder, the loss function is calculated as follows:

[0029] ;

[0030] in, represents the loss function, is the sequence length of the user's temporal behavior features and the reconstructed user's temporal behavior features, The dimensions of user temporal behavior characteristics and reconstructed user temporal behavior characteristics, Indicates the user's temporal behavior characteristics. The next period The characteristics of the dimensions, Indicates the reconstructed user temporal behavior characteristics The next period Features of dimensions.

[0031] Preferably, the step of comparing the reconstructed user temporal behavior feature with a threshold to obtain a user behavior anomaly detection result includes:

[0032] Calculate the reconstruction error :

[0033] ;

[0034] in, Represents the reconstruction error No. dimensions, is the sequence length of the user's temporal behavior features and the reconstructed user's temporal behavior features, The dimensions of user temporal behavior characteristics and reconstructed user temporal behavior characteristics, Indicates the user's temporal behavior characteristics. The next period The characteristics of the dimensions, Indicates the reconstructed user temporal behavior characteristics The next period The characteristics of the dimensions, ;

[0035] Get user behavior anomaly detection results :

[0036] ;

[0037] ;

[0038] ;

[0039] in, Indicates The test results of the dimensions, Indicates The threshold corresponding to the dimension is Represents the set of detection results, To express or calculate, equal or , When , it means that the user behavior anomaly detection result is abnormal. , it indicates that the user behavior anomaly detection result is normal.

[0040] The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism provided by the present invention has the following beneficial effects compared with the prior art:

[0041] 1. Perform statistical analysis on user behavior through temporal behavior aggregation, construct a sparse matrix that can effectively characterize the user's temporal behavior characteristics, and improve the accuracy of user feature characterization.

[0042] 2. By analyzing the behaviors of different roles through a clustering method based on weighted temporal cosine similarity, a set of standard behavioral patterns for each role is established, which provides an additional reference for the model, so that when evaluating the user's temporal behavioral characteristics, it can not only consider the user's past behavior, but also make judgments based on a wider range of behavioral patterns.

[0043] 3. An autoencoder structure with unbalanced input and output is designed and used for abnormal user behavior detection. When there is a significant deviation between the user's temporal behavior characteristics and the role's standard behavior baseline, it helps to increase the reconstruction error, thereby improving the recognition rate of abnormalities.

[0044] 4. A sparse attention mechanism is used, and a sparse pattern is constructed based on prior knowledge to guide the model to capture the temporal correlation between temporal behavior characteristics and standard behavior baselines, thereby improving the model's sensitivity to anomalies.

[0045] 5. The method of the present invention has good generalization performance, strong portability, simple operation, convenient use and low cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart of a method for detecting abnormal user behavior of energy storage EMS based on sparse attention mechanism of the present invention;

[0047] Figure 2 It is a schematic diagram of the temporal behavior aggregation of the present invention;

[0048] Figure 3 This is a schematic diagram of the structure of the autoencoder based on the sparse attention mechanism of the present invention;

[0049] Figure 4 Schematic diagram of the position relationship of attention in the sparse attention mechanism of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0052] like Figure 1 As shown, this embodiment proposes a method for detecting abnormal user behavior of energy storage EMS based on a sparse attention mechanism, comprising the following steps:

[0053] Step S1: extract the user's historical normal behavior data from the energy storage EMS to perform time series behavior aggregation, count the frequencies of different behaviors in different time periods, and obtain a sparse matrix that characterizes the user's time series behavior characteristics.

[0054] In order to facilitate the aggregation of time series behavior, the collected normal behavior data is first divided according to the time window to obtain multiple time window data, and each time window data is divided into different time periods, and the frequency of each behavior is counted according to the time period. When extracting the user's historical normal behavior data, normal behavior data with a data length far greater than the time window is extracted for multiple different users to improve the accuracy of the subsequent standard behavior baseline establishment.

[0055] Take a time window data for illustration, such as Figure 2 As shown in the figure, the time window length is 24 hours, and the time periods are divided into 1-hour periods, that is, 0-1 hours is the first period, 1-2 hours is the second period, 2-3 hours is the third period, and so on, 23-24 hours is the twenty-fourth period. The frequency of different behaviors in each period is counted to construct the user behavior feature matrix. Among them, the data sources related to user behavior include: Lightweight Directory Access Protocol (LDAP), login data, Hypertext Transfer Protocol (HTTP), devices, files, and emails.

[0056] The features that require behavioral statistics in this embodiment include: number of logins, number of logouts, number of website visits, number of device connections, number of device disconnections, number of exe type files opened, number of txt type files opened, number of pdf type files opened, number of doc type files opened, number of zip type files opened, number of jpg type files opened, number of emails received, average size of emails received, average number of email attachments received, number of emails sent, average size of emails sent, and average number of email attachments sent.

[0057] It should be noted that the above-mentioned behavior characteristics are a specific embodiment. When applying to different scenarios, those skilled in the art may select different relevant data sources and extract different specific characteristics, which will not be described in detail here.

[0058] In this embodiment, after the above-mentioned time series behavior aggregation, a sparse matrix representing the user's time series behavior characteristics is obtained. , and Respectively represent the dimension and sequence length of the user's temporal behavior characteristics, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, , . Figure 2 middle , , whose symbol to Empathy.

[0059] Step S2: Cluster the temporal behavior characteristics of users belonging to the same role by a clustering method based on weighted temporal cosine similarity, so as to establish a set of standard behavior patterns belonging to the role. Each user temporal behavior characteristic in the set corresponds to a cluster center in the clustering result, i.e., a standard behavior baseline.

[0060] In the operation of the energy storage EMS, users who can log in are divided into different roles to facilitate management by granting different permissions. Since the operation permissions of multiple users with the same role are basically the same, this embodiment extracts the standard behavior baseline based on the role.

[0061] Aggregate multiple user temporal behavior features of all users belonging to the same role to construct role temporal behavior feature datasets for different roles , and normalize the different dimensions of each user's temporal behavior characteristics in the role temporal behavior characteristics dataset, and scale the data to , thereby eliminating the influence caused by different dimensions, the normalization method used in this embodiment is as follows:

[0062]

[0063] Among them, the left side of the equation Represents the normalized user temporal behavior characteristics. feature dimensions, the right side of the equation Represents the user's temporal behavior characteristics before normalization. feature dimensions, and Represents the minimum and maximum value in this dimension respectively.

[0064] For the normalized user time series behavior features, clustering is performed using a clustering method based on weighted time series cosine similarity. The calculation method based on weighted time series cosine similarity is expressed as:

[0065]

[0066] in, Represents user temporal behavior characteristics and user temporal behavior characteristics The distance between The dimension is And the sequence length is The user's temporal behavior characteristics, Indicates The weight of each period, Represents user temporal behavior characteristics Middle The feature vector of each time period, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, Represents user temporal behavior characteristics Middle The feature vector of each time period, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, , express The module length, express The mold length.

[0067] Then based on the distance Perform clustering to obtain clustering results, use each cluster center in the clustering results as a standard behavior baseline, and combine all standard behavior baselines to obtain a standard behavior pattern set belonging to each role. For ease of understanding, this embodiment takes the K-Means clustering method based on weighted time series cosine similarity as an example to calculate sample distances. The clustering process is:

[0068] 1) Determine the search interval for the number of clusters: Set the search interval for the number of clusters .

[0069] 2) Traverse the number of clusters and calculate the internal dispersion index: traverse the interval , for each , using the K-Means algorithm to analyze the role temporal behavior feature dataset Clustering was performed and the corresponding Davidson-Bouldin index (DBI) was calculated.

[0070] 3) Select the optimal number of clusters: Select the number of clusters with the minimum DBI value As a hyperparameter of the K-Means algorithm, based on this, the role temporal behavior feature dataset Perform the final clustering to obtain the optimal clustering result and record the cluster center set , which is the standard behavior pattern set of the role, where represents a cluster center, i.e. a standard behavior baseline, .

[0071] The calculation method of DBI is expressed as:

[0072]

[0073] in, is the DBI value, Indicates The elements in the cluster to The average weighted temporal cosine similarity distance of the centers of the clusters, Indicates The elements in the cluster to The average weighted temporal cosine similarity distance of the centers of the clusters, Indicates Clusters and The weighted temporal cosine similarity distance between the centers of the clusters.

[0074] Step S3: For a user temporal behavior feature to be detected, the weighted temporal cosine similarity is used to calculate the distance between the user temporal behavior feature to be detected and each standard behavior baseline of the character to which it belongs, that is, the most matching standard behavior baseline is searched in the standard behavior pattern set of the character to which it belongs, and the user temporal behavior feature to be detected is spliced ​​with the standard behavior baseline with the smallest distance along the dimension, so as to construct a complete joint data sample.

[0075] Specifically, the process of constructing a joint data sample is as follows:

[0076] 1) In the standard behavior pattern set For each standard behavior baseline , respectively, with the temporal behavior characteristics of the user to be detected Calculate the distance and record it.

[0077] 2) Select the standard behavior baseline with the minimum distance As the user's temporal behavior characteristics to be detected Corresponding standard behavior baseline.

[0078] 3) The user temporal behavior characteristics to be detected Standard behavior baseline that matches Splicing along the behavioral feature dimension, the formula is as follows:

[0079]

[0080] The distance between features is calculated by the weighted time series cosine similarity distance mentioned above. is the user temporal behavior feature to be detected and matching standard behavioral baseline The joint data sample.

[0081] Step S4, construct an autoencoder based on a sparse attention mechanism. The encoder of the autoencoder based on the sparse attention mechanism includes a normalization layer and a sparse attention layer. In the sparse attention layer of the encoder, a sparse pattern designed based on prior knowledge is used to capture the temporal correlation between the user's temporal behavior characteristics and the standard behavior baseline.

[0082] The decoder of the autoencoder based on the sparse attention mechanism includes several multi-layer perceptrons. The standard behavior baseline is used in the decoder to assist in the reconstruction of the user's temporal behavior features. The two types of data, user temporal behavior features and standard behavior baseline, are fused to output the reconstructed user temporal behavior features that are inconsistent with the shape of the input data.

[0083] Specifically, the autoencoder based on the sparse attention mechanism consists of an encoder and decoder The composition is expressed as:

[0084]

[0085]

[0086] in, represents the joint data sample, Encode the input and map it into a potential representation , represents the linear layer network parameters to be trained, represents the sparse attention weight, which comes from , Representative use Reconstructed user temporal behavior characteristics, and .

[0087] It consists of a normalization layer and a sparse attention layer, where the sparse attention layer is expressed as:

[0088]

[0089] in, The meaning and calculation method of are the same as the standard attention mechanism, representing the query vector, key vector and value vector respectively; represents element-wise multiplication; represents the mask matrix, which indicates which key-value pairs can participate in the attention weight calculation; Represents the scaling factor.

[0090] Depend on Multilayer Perceptron constitute, will potentially represent Decode and reconstruct for different feature dimensions, expressed as:

[0091]

[0092]

[0093] in, The first dimensions, Represents the reconstructed user temporal behavior characteristics, express The transpose of Representation potential No. dimensions. Representation and characteristics The corresponding A multi-layer perceptron, It consists of two linear layers and an activation function:

[0094]

[0095] in, represents a linear layer, Represents the activation function.

[0096] It is worth noting that the input and output of a conventional autoencoder have the same feature dimension and sequence length, while Figure 3 As shown, the autoencoder constructed in the present invention has output and input with inconsistent data shapes, and the standard behavior baseline is used when calculating the loss function. Does not participate in the calculation, the formula is expressed as:

[0097]

[0098] in, represents the loss function, Represents user temporal behavior characteristics No. In the dimension The value of the time period, It represents the reconstructed user temporal behavior characteristics No. In the dimension The value of a time period.

[0099] In order to improve the effectiveness of sparse attention weight calculation, the sparse pattern and the corresponding mask matrix in the sparse attention mechanism of this example are represented as follows:

[0100] In the sparse attention layer, for the query vector The positions, it can note the key vector The set of positions in is as follows:

[0101]

[0102] in, represents the position in the query vector, represents the position in the key vector, Represents the position in the query vector Note that the set of positions in the key vector, , is the delimiting parameter and .by Figure 4 For example, take the query vector The locations, get the location set .

[0103] According to the above position set, the mask matrix The Line Column element values ​​are represented as:

[0104]

[0105] in, Represents the position in the key vector. If the element Position in Exists in location set ,but ;otherwise . Then the mask matrix It is expressed as:

[0106]

[0107]

[0108] in, Indicates that the key-value pair can participate in the calculation of attention weight, that is, Represents the position in the query vector with the position in the key vector The key-value pairs composed of participate in the calculation of sparse attention weights. Indicates that the key-value pair cannot participate in the calculation of attention weight, that is, Represents the position in the query vector with the position in the key vector The composed key-value pairs do not participate in the calculation of sparse attention weights.

[0109] Step S5: Input the joint data sample into the autoencoder based on the sparse attention mechanism to obtain the reconstructed user temporal behavior features, compare the reconstructed user temporal behavior features with the threshold (the 95th percentile of all training samples in this embodiment) to obtain the user behavior anomaly detection result.

[0110] The reconstructed user temporal behavior characteristics obtained in step S4 , calculate the reconstruction error for each dimension separately , reconstruction error No. Dimensions The calculation method is as follows:

[0111]

[0112] Then, we compared Whether it exceeds the corresponding threshold. If one dimension exceeds the threshold, the user behavior characteristics are finally determined. is an exception, the above process is expressed as:

[0113]

[0114]

[0115]

[0116] in, Indicates The threshold corresponding to each dimension is obtained by training a dataset containing the past normal behaviors of the user to be detected, and calculating the reconstruction error generated by each dimension using formula (16), and taking the 95% quantile as the threshold of the dimension. Indicates The test results of the dimensions, express A collection of dimension detection results. The final test result is Representation or calculation ensures that as long as the set There is an element in but for , which means that the user behavior An exception occurs; otherwise for , which means that the user behavior normal.

[0117] In order to illustrate the effectiveness of the method of the present invention, the public data set CERT is used as a verification, and 5 users are randomly selected from it for testing.

[0118] In the verification, AUC (Area Under the Curve) is used as a metric for performance evaluation, and the test results are shown in Table 1. According to the test results, it can be concluded that the method of the present invention can accurately distinguish whether the user behavior is abnormal.

[0119] Table 1 User test results

[0120] User Number AUC DCH0843 0.9886 AAM0658 0.9265 MAR0955 0.9667 KLH0596 0.9773 AJR0932 0.9310

[0121] In order to further illustrate the superiority of the method of the present invention, the existing user behavior detection methods are introduced for comparative testing with the method of the present invention. The introduced existing user behavior detection methods include LSTM (Long Short-Term Memory), markov-s (hidden Markov model) and log-graph. AUC is also used as a metric for performance evaluation, and the comparative test results are shown in Table 2. According to Table 2, it can be seen that the method of the present invention exhibits the best classification performance compared with the existing methods, and effectively overcomes the problems of low detection efficiency and poor quality of the existing methods.

[0122] Table 2 Comparative test results

[0123] Method Name AUC LSTM 0.88 markov-s 0.79 log-graph 0.87 Method of the present invention 0.95

[0124] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A method for detecting abnormal user behavior of energy storage EMS based on sparse attention mechanism, characterized in that: The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism includes: Extract the user's historical normal behavior data from the energy storage EMS, divide the extracted normal behavior data into time windows, and count the frequencies of different behaviors in different time periods in each time window to obtain a sparse matrix that characterizes the user's temporal behavior characteristics; For the temporal behavior characteristics of users belonging to the same role, clustering is performed using a clustering method based on weighted temporal cosine similarity. Each cluster center in the clustering result is used as a standard behavior baseline. All standard behavior baselines are combined to obtain a standard behavior pattern set belonging to each role. For a user temporal behavior feature to be detected, the weighted temporal cosine similarity is used to calculate the distance between the user temporal behavior feature to be detected and each standard behavior baseline of the character to which it belongs, and the user temporal behavior feature to be detected and the standard behavior baseline with the smallest distance are spliced ​​along the dimension to obtain a joint data sample; Constructing an autoencoder based on a sparse attention mechanism, wherein the encoder based on the autoencoder based on the sparse attention mechanism includes a normalization layer and a sparse attention layer, and the decoder based on the autoencoder based on the sparse attention mechanism includes a plurality of multi-layer perceptrons; The joint data sample is input into the sparse attention mechanism-based autoencoder to obtain a reconstructed user temporal behavior feature, and the reconstructed user temporal behavior feature is compared with a threshold to obtain a user behavior anomaly detection result.

2. The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism according to claim 1 is characterized in that: Statistical frequency behaviors include: Number of logins, number of logouts, number of website visits, number of device connections, number of device disconnections, number of exe files opened, number of txt files opened, number of pdf files opened, number of doc files opened, number of zip files opened, number of jpg files opened, number of emails received, average size of emails received, average number of email attachments received, number of emails sent, average size of emails sent, and average number of email attachments sent.

3. The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism according to claim 1 is characterized in that: The calculation method based on weighted time series cosine similarity is as follows: ； in, Represents user temporal behavior characteristics and user temporal behavior characteristics The distance between The dimension is And the sequence length is The user's temporal behavior characteristics, Indicates The weight of each period, Represents user temporal behavior characteristics Middle The feature vector of each time period, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, Represents user temporal behavior characteristics Middle The feature vector of each time period, Represents user temporal behavior characteristics Middle The next period The characteristics of the dimensions, , express The module length, express The mold length.

4. The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism according to claim 1 is characterized in that: The sparse attention weight calculation process of the sparse attention layer is as follows: ； ； ； in, is the sparse attention weight, represents the query vector, is the key vector, is a value vector, represents the mask matrix, represents the softmax activation function, is the key vector The transpose of represents the scaling factor, Represents the mask matrix Middle Line Column element value, It also represents the position in the query vector. represents the position in the key vector, Represents the position in the query vector Note that the set of positions in the key vector, , is the delimiting parameter and , Represents the position in the query vector with the position in the key vector The key-value pairs do not participate in the calculation of sparse attention weights. Represents the position in the query vector with the position in the key vector The composed key-value pairs participate in the calculation of sparse attention weights.

5. The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism according to claim 1 is characterized in that: The decoder consists of The decoder is composed of a multi-layer perceptron, and the processing process of the decoder is as follows: ； ； ； in, The latent representation representing the encoder output No. dimensions, Representation and characteristics The corresponding A multi-layer perceptron, The first dimensions, Represents the reconstructed user temporal behavior characteristics, express The transpose of represents a linear layer, represents the activation function, , is the sequence length of the user's temporal behavior features and the reconstructed user's temporal behavior features, It is the user's temporal behavior characteristics and the dimensions of the reconstructed user's temporal behavior characteristics.

6. The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism according to claim 1 is characterized in that: During the training process of the sparse attention mechanism autoencoder, the loss function is calculated as follows: ； in, represents the loss function, is the sequence length of the user's temporal behavior features and the reconstructed user's temporal behavior features, The dimensions of user temporal behavior characteristics and reconstructed user temporal behavior characteristics, Indicates the user's temporal behavior characteristics. The next period The characteristics of the dimensions, Indicates the reconstructed user temporal behavior characteristics The next period Features of dimensions.

7. The energy storage EMS abnormal user behavior detection method based on sparse attention mechanism according to claim 1 is characterized in that: The step of comparing the reconstructed user temporal behavior feature with a threshold to obtain a user behavior anomaly detection result includes: Calculate the reconstruction error : ； in, Represents the reconstruction error No. dimensions, is the sequence length of the user's temporal behavior features and the reconstructed user's temporal behavior features, The dimensions of user temporal behavior characteristics and reconstructed user temporal behavior characteristics, Indicates the user's temporal behavior characteristics. The next period The characteristics of the dimensions, Represents the reconstructed user temporal behavior characteristics The next period The characteristics of the dimensions, ; Get user behavior anomaly detection results : ； ； ； in, Indicates The test results of the dimensions, Indicates The threshold corresponding to the dimension is Represents the set of detection results, To express or calculate, equal or , When , it means that the user behavior anomaly detection result is abnormal. , it indicates that the user behavior anomaly detection result is normal.

Images