Employee abnormal behavior early warning method and system based on GBM model
Through the early warning method of employee abnormal behavior based on GBM model, the problem of insufficient accuracy and adaptability in handling employee abnormal behavior in the existing technology is solved, and more efficient detection and update is achieved, maintenance costs are reduced, and new abnormalities are improved. Behavior recognition ability.
Patent Information
- Application Number
- CN202411276673.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-12
- Publication Date
- 2024-12-27
AI Technical Summary
The prior art has limited accuracy when dealing with employee abnormal behavior, insufficient generalization ability, low detection accuracy, difficult model updates and high maintenance costs, especially in the face of high-dimensional and nonlinear complex data.
Adopt employee abnormal behavior warning method based on GBM model, improve detection accuracy and adaptability by collecting and preprocessing employee behavior data, using GBM models for training and real-time monitoring, and regularly update the model to adapt to new behavior patterns and business needs. , reduce update and maintenance costs.
It improves the accuracy of abnormal behavior detection and system adaptability, reduces the cost of model update and maintenance, and enhances the ability to identify new abnormal behaviors.
Smart Images
Figure CN119202986A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of risk warning of abnormal behavior of employees, and in particular to a method and system for warning abnormal behavior of employees based on a GBM model. Background Art
[0002] With the rapid development of information technology, the internal risks faced by enterprises are increasing. Risk warning of abnormal employee behavior has become particularly important, including but not limited to data leakage, internal fraud, misconduct, etc. Traditional monitoring methods rely on rule-based systems and manual review, which show their limitations when faced with huge data and complex and changeable abnormal behaviors. In recent years, with the development of machine learning technology, especially the application of classification and prediction models, more effective solutions have been provided.
[0003] Currently, the closest technical solution is to use machine learning models, such as support vector machines (SVM), decision trees, random forests (RF), etc., to analyze employee behavior data and identify abnormal behaviors. These methods can automatically learn behavior patterns from data and reduce the need for human intervention. However, the accuracy of these models in processing nonlinear and complex data still needs to be improved. At the same time, there are still certain limitations, such as high cost of model training and updating, and insufficient adaptability to new abnormal behaviors.
[0004] The disadvantages of existing technologies are: Limited accuracy: Although traditional machine learning methods perform well in some scenarios, their accuracy is still limited when dealing with high-dimensional and nonlinear complex data.
[0005] Insufficient generalization ability: When faced with new or rare abnormal behaviors, existing models rely too much on known data patterns and are often difficult to accurately predict, thus affecting the effectiveness of early warning.
[0006] Limited detection accuracy: Existing methods often have difficulty achieving high detection accuracy when dealing with complex abnormal behaviors, especially when the data features are not obvious.
[0007] Difficulty in updating models: As corporate businesses and hacker attack methods continue to evolve, models need to be updated frequently to maintain the effectiveness of monitoring, but existing technical solutions are slow to update and iterate.
[0008] High update and maintenance costs: As the enterprise environment changes and new abnormal behaviors emerge, existing models require frequent manual updates and maintenance, which increases costs. Summary of the invention
[0009] In view of the above problems, the present invention is proposed to provide a method and system for early warning of abnormal behavior of employees based on the GBM model, which overcomes the above problems or at least partially solves the above problems.
[0010] According to one aspect of the present invention, a method for early warning of abnormal behavior of employees based on a GBM model is provided, the method comprising:
[0011] Collecting initial employee behavior data, and preprocessing the initial employee behavior data to obtain preprocessed data;
[0012] Use the GBM model to train the preprocessed data;
[0013] Use the trained GBM model to monitor and analyze employees’ real-time behaviors in real time;
[0014] Update the GBM model to adapt to new behavior patterns and business requirements.
[0015] Optionally, the collecting of initial employee behavior data specifically includes:
[0016] Collect employee login logs, email usage, file access records, and internet usage behavior data.
[0017] Optionally, the preprocessing of the initial employee behavior data specifically includes: cleaning, normalizing and feature extracting the internal employee behavior data of the enterprise.
[0018] Optionally, the using the GBM model to train the preprocessed data specifically includes: using the GBM model to train the preprocessed data to learn the difference between normal behavior and abnormal behavior of employees.
[0019] Optionally, the real-time monitoring and analysis of the real-time behavior of employees using the trained GBM model further includes: immediately issuing a warning when abnormal behavior is detected.
[0020] Optionally, updating the GBM model specifically includes: updating the GBM model regularly or as needed to adapt to new behavior patterns and business needs.
[0021] Optionally, the GBM model establishes a next new learner based on the gradient descent direction of the loss function of the established base learner.
[0022] The present invention also provides an employee abnormal behavior early warning system based on the GBM model, applying the employee abnormal behavior early warning method based on the GBM model described above, the early warning system comprises:
[0023] A data preprocessing module, used to collect initial employee behavior data, and preprocess the initial employee behavior data to obtain preprocessed data;
[0024] GBM model training module, used to train the preprocessed data using the GBM model;
[0025] Abnormal behavior detection module, which is used to monitor and analyze employees' real-time behavior in real time using the trained GBM model;
[0026] The model update module is used to update the GBM model to adapt to new behavior patterns and business requirements.
[0027] The present invention provides an employee abnormal behavior early warning method and system based on the GBM model, the early warning method comprising: collecting initial employee behavior data, preprocessing the initial employee behavior data, and obtaining preprocessed data; using the GBM model to train the preprocessed data; using the trained GBM model to monitor and analyze the real-time behavior of employees in real time; updating the GBM model to adapt to new behavior patterns and business needs. The accuracy of abnormal behavior detection and the adaptability of the system are improved, and the cost of model update and maintenance is reduced.
[0028] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.
[0030] Figure 1 A flowchart of a method for early warning of abnormal employee behavior based on a GBM model provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0031] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0032] The terms "comprises" and "having" and any variations thereof in the description embodiments, claims and drawings of the present invention are intended to cover non-exclusive inclusions, for example, including a series of steps or units.
[0033] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.
[0034] like Figure 1 As shown, a method and system for early warning of abnormal employee behavior based on the GBM model, the early warning method includes:
[0035] Collecting initial employee behavior data, and preprocessing the initial employee behavior data to obtain preprocessed data;
[0036] Use the GBM model to train the preprocessed data;
[0037] Use the trained GBM model to monitor and analyze employees’ real-time behaviors in real time;
[0038] Update the GBM model to adapt to new behavior patterns and business requirements.
[0039] An employee abnormal behavior early warning system based on a GBM model includes: a data preprocessing module, a GBM model training module, an abnormal behavior detection module, and a model updating module.
[0040] Data preprocessing module: collects employee login logs, mailbox usage, file access records, Internet usage behavior data, including but not limited to, etc., cleans, normalizes and extracts features of internal employee behavior data to ensure data quality and model training efficiency.
[0041] GBM model training module: Use the GBM model to train the preprocessed data and learn the difference between normal and abnormal employee behaviors. Improve the prediction accuracy by combining multiple weak prediction models (such as decision trees), effectively handle nonlinear relationships and interactions, and use the features that the GBM model can automatically identify to improve classification accuracy.
[0042] Abnormal behavior detection module: monitors and analyzes employees' real-time behaviors in real time based on the trained GBM model, and issues an immediate warning once abnormal behavior is detected.
[0043] Model update module: Update the GBM model regularly or as needed to adapt to new behavior patterns and business needs and maintain the efficiency and accuracy of the system.
[0044] Introduction to GBM Algorithm
[0045] GBM Gradient Boosting Machine, as an ensemble learning method, is based on combining multiple learners to learn and synthesizing the results of each learner according to specific rules, so as to achieve better learning performance than a single learner. This method integrates a series of "weak learners" to form a more powerful "strong learner", just as the old saying goes: "When three people walk together, there must be one who can teach me." By brainstorming, the learning effect is significantly improved.
[0046] GBM algorithm concept:
[0047] The GBM algorithm first calculates the pseudo residual based on the initial model, and then establishes a base learner to explain the pseudo residual. The base learner reduces the residual in the gradient direction. The base learner is then multiplied by the weight coefficient (learning rate) and the original model is linearly combined to form a new model. In this way, repeated iterations can find a model that minimizes the expectation of the loss function.
[0048] GBM algorithm idea:
[0049] The main idea of GBM is to establish the next new base learner based on the gradient descent direction of the loss function of the previously established base learner. The purpose is to continuously reduce the overall loss function of the model and continuously improve the model by integrating these base learners.
[0050] GBM important parameter settings:
[0051] The base learner is a decision tree, and its parameters are roughly divided into three categories:
[0052] 1) Decision tree related parameters: adjust the properties of each decision tree in the model, such as the depth of the tree, the minimum number of leaf node samples, the maximum number of leaf nodes, etc.;
[0053] 2) Boosting related parameters: adjust the boosting operation in the model, such as learning rate (step size), number of base learners, proportion of modeling samples, etc.
[0054] 3) Other model-related parameters: adjust the overall operation of the model, such as the loss function form, random seed, etc.
[0055] Suggestions for setting important GBM parameters:
[0056] Loss function form (distribution): The form of the loss function is set as follows: a) For classification problems, Bernoulli distribution is generally selected; b) For regression problems, Gaussian distribution can be selected.
[0057] Iteration number (n): According to experience, the iteration number n can be set between 3000-10000.
[0058] Learning rate (shrinkage): As the number of iterations increases, the training time and computing resources increase. Therefore, too large or too small a step is not appropriate. According to experience, the learning rate shrinkage setting is more appropriate between 0.01-0.001.
[0059] Resampling ratio (fraction): Resampling can be used when training the base learner, which is called stochastic gradient boosting.
[0060] During the execution of the GBM algorithm, the pseudo residuals are first calculated through the initial model, and then a base learner is constructed to explain and reduce these pseudo residuals. The base learner optimizes the residuals in the gradient direction. Then, the base learner is multiplied by a specific weight coefficient (i.e., the learning rate) and linearly combined with the original model to form a new model. This process is repeated through iterations to find an optimization model that minimizes the expected value of the loss function.
[0061] The following are some suggestions for setting important parameters of the GBM algorithm:
[0062] * Loss function form (distribution): The form of the loss function should be selected according to the type of problem. For classification problems, Bernoulli distribution is usually selected; for regression problems, Gaussian distribution can be selected.
[0063] * Iteration number (n): According to experience, the iteration number n can be set in the range of 3000 to 10000.
[0064] *Learning rate (shrinkage): The learning rate is similar to the step size. Too large or too small is not conducive to model optimization. According to experience, the learning rate shrinkage setting is more appropriate between 0.01 and 0.001.
[0065] *Resampling fraction: When training the base learner, a resampling method can be used, which is called stochastic gradient boosting.
[0066] Depth of decision tree: defines the maximum depth of decision tree, which can control overfitting, because the deeper the decision tree, the more likely it is to overfit. Of course, CV value (dispersion coefficient) should also be used for testing.
[0067] By properly setting and adjusting GBM parameters, the GBM algorithm will achieve unexpected computational results.
[0068] GBM algorithm model:
[0069] 1) Data fitting model: f1(x)=y
[0070] 2) Residual fitting model: h1(x) = y-f1(x)
[0071] 3) Build a new model: f2(x) = f1(x) + h1(x)
[0072] 4) Extend this model by introducing more models to correct the errors of the previous model:
[0073] f(x)=f1(x)
[0074] f2(x)=f1(x)+h1(x)
[0075] f3(x)=f2(x)+h2(x)
[0076] …
[0077] fm(x)=fm-1(x)+hm-1(x)
[0078] Where f1(x) represents the initial model fitted to y. The model is initialized by fitting f1(x), and then more models are introduced at each step, with the goal of finding hm(x) = y-fm(x).
[0079] Note: hm(x) is just a model. It is not required that hm(x) is a tree-based model. This is the broader concept and one of the advantages of gradient boosting. It is just a computational framework for iteratively improving the performance of weak learners. In theory, a well-coded gradient boosting module can "plug in" a variety of weak classifiers as needed. But in practice, hm(x) is usually always a tree-based learner.
[0080] Beneficial effects: A staff abnormal behavior monitoring system based on gradient boosting machine (GBM) is provided, which aims to improve the accuracy of abnormal behavior detection and the adaptability of the system and reduce the cost of model updating and maintenance through the powerful nonlinear data processing capability and excellent generalization performance of the GBM model.
[0081] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for early warning of abnormal employee behavior based on the GBM model, characterized in that: The early warning method comprises: Collecting initial employee behavior data, and preprocessing the initial employee behavior data to obtain preprocessed data; Use the GBM model to train the preprocessed data; Use the trained GBM model to monitor and analyze employees’ real-time behaviors in real time; Update the GBM model to adapt to new behavior patterns and business requirements.
2. The method for early warning of abnormal employee behavior based on the GBM model according to claim 1 is characterized in that: The collection of initial employee behavior data specifically includes: Collect employee login logs, email usage, file access records, and internet usage behavior data.
3. The method for early warning of abnormal employee behavior based on the GBM model according to claim 1 is characterized in that: The preprocessing of the initial employee behavior data specifically includes: cleaning, normalizing and feature extracting the internal employee behavior data of the enterprise.
4. The method for early warning of abnormal employee behavior based on the GBM model according to claim 1 is characterized in that: The using the GBM model to train the preprocessed data specifically includes: using the GBM model to train the preprocessed data to learn the difference between normal behavior and abnormal behavior of employees.
5. The method for early warning of abnormal employee behavior based on the GBM model according to claim 1 is characterized in that: The real-time monitoring and analysis of the real-time behavior of employees using the trained GBM model also includes: immediately issuing an early warning when abnormal behavior is detected.
6. The method for early warning of abnormal employee behavior based on the GBM model according to claim 1 is characterized in that: The updating of the GBM model specifically includes: updating the GBM model regularly or as needed to adapt to new behavior patterns and business needs.
7. The method for early warning of abnormal employee behavior based on the GBM model according to claim 1 is characterized in that: The GBM model establishes a new learner based on the gradient descent direction of the loss function of the established base learner.
8. An employee abnormal behavior warning system based on a GBM model, using an employee abnormal behavior warning method based on a GBM model as described in any one of claims 1 to 7, characterized in that: The early warning system includes: A data preprocessing module, used to collect initial employee behavior data, and preprocess the initial employee behavior data to obtain preprocessed data; GBM model training module, used to train the preprocessed data using the GBM model; Abnormal behavior detection module, which is used to monitor and analyze employees' real-time behavior in real time using the trained GBM model; The model update module is used to update the GBM model to adapt to new behavior patterns and business requirements.