Method and device for carrying out user behavior portraying based on small sample data by AAA system

Abstract

The invention discloses a method and device for carrying out user behavior portraying based on small sample data by an AAA system, and the method comprises the steps: defining the dimensions of the small sample data in the AAA system, and obtaining a data collection template; acquiring and processing the small sample instant data in the AAA system to obtain user behavior small sample data; expanding the small sample data from different dimensions to form an expanded data set; slicing the extended data to form dimension analysis data; carrying out merging analysis on the dimension analysis data and carrying out user behavior portrait processing to obtain an individual user behavior portrait; and updating the page display effect based on the portrait data linkage alarm rule. The device comprises a definition module, a data processing module, an effect updating module and the like. According to the method and the device, the problem that an AAA system can still carry out accurate portraying on user behaviors and timely discover abnormal users under the conditions that authority control of an application system is not taken over and user authority control data and page access data are lacked can be solved.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a method and device for performing user behavior profiling based on small sample data in an AAA system. Background Art

[0002] The AAA system is a system that provides unified user account management, identity authentication services, and user behavior auditing. This system belongs to the category of unified identity authentication system 4A. However, compared with the traditional unified identity authentication system 4A, the AAA system has the following differences: First, the traditional 4A system needs to take over the permission control function of the connected system. The user's permissions and access process need to be processed by 4A before accessing the real application system. Therefore, the 4A system can perceive and obtain user behavior from many dimensions, making it easier to analyze user behavior data. The AAA system does not take over the permission control of the application system and is loosely coupled with the application system, with fewer dimensions and scope for perceiving user behavior information.

[0003] Second, the traditional 4A system serves as a unified login and access entrance for users, and other applications are displayed uniformly in the 4A system. When users access the system, they first see and enter the 4A system, and then access other application systems through single sign-on. Therefore, 4A can control all user access behaviors of the application system, including which page is visited, what operations are performed, etc., while AAA is hidden behind the application system. When users access the application system, they will not perceive the existence of the AAA system, which also means that the AAA system has weak control capabilities over user behavior data. Summary of the invention

[0004] In view of the above problems existing in the prior art, the present invention provides a method and device for user behavior profiling based on small sample data in the AAA system, so as to solve the problem of profiling user behavior in the AAA system and timely discover abnormal behavior. The present invention realizes how to achieve accurate user behavior profiling and timely discover abnormal behavior to trigger an alarm when the user behavior data has fewer dimensions, which can effectively improve the security protection capability of the AAA system.

[0005] In order to achieve the above object, the present invention adopts the following technical solution: The AAA system uses a user behavior profiling method based on small sample data, including: Step S1, defining the dimensions of small sample data in the AAA system to obtain a data collection template; Step S2, based on the data collection template, collect and process the small sample real-time data in the AAA system to obtain the small sample data of user behavior; Step S3, expanding the small sample data of user behavior from different dimensions to form an extended data set; Step S4, slicing the extended data set to form dimensional analysis data; Step S5, merging and analyzing the dimension analysis data and processing the user behavior profile to obtain a personal user behavior profile; Step S6, based on the data linkage alarm rules of the individual user behavior portrait, update the page display effect.

[0006] A further improvement of the present invention is that, in step S1, the dimensions of the small sample data in the AAA system are defined to obtain a data collection template, including: Step S11: Collecting user access data and logs of various application systems connected to the AAA system for the past six months; Step S12: normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; Step S13: Analyze the normalized data of each system respectively, identify the data related to the user behavior and can be sent to the AAA system, define the same behavior data as one type, and define different behavior data as different types, and obtain classified user behavior data; the data related to the user behavior includes: user access time, application access number, authentication frequency, login failure number, password input number, abnormal authentication behavior and roaming authentication number; Step S14: Sort the user behavior data according to the number of times it appears in the category to obtain T 1 , T 2 ……T n User behavior sorting sequence, each sequence represents a type of user behavior data; Step S15: define the minimum threshold of small sample data as D; Step S16: Compare each value in the user behavior ranking sequence with the minimum threshold D of the small sample data, remove the sequence less than the threshold D, and obtain a small sample data template reference sequence; Step S17: Remove duplicates from the small sample data template reference sequence, retain only one piece of data for each behavior, and obtain the data sequence C 1 , C 2 ……C n , define this sequence as a data acquisition template.

[0007] A further improvement of the present invention is that, in step S2, based on the data collection template, a small sample of real-time data in the AAA system is collected and processed to obtain a small sample of user behavior data, including: Step S21: Based on the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template; Step S22: The AAA system collects user data in the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior; Step S23: Classify the small sample data of user behavior according to the unique identifier of the user to form a classification sequence U of the small sample data of user behavior 1 , U 2 ...U n , each U n Including C 1 , C 2 ……C n Dimension, user unique identification refers to the coded information that can uniquely identify the user, including user ID, phone number, ID number and UUID.

[0008] A further improvement of the present invention is that, in step S3, the small sample data of user behavior is expanded from different dimensions to form an extended data set, including: Step S31: Select U from the classification sequence of user behavior small sample data one by one n data; Step S32: n Data C 1 , C 2 ……C n The dimensions are expanded separately to form a user single-dimensional extended data set C+ 1 、C+ 2 ...C+ n ; Expanding the dimensions separately means collecting the dimension data of the user in the system for the past year based on the dimension data; Step S33: Merge the user single dimension extended data set into each user behavior small sample data classification sequence to obtain U 1 C+ 1 , U 1 C+ 2 ...U 1 C+ n , U 2 C+ 1 , U 2 C+ 2 ...U m C+ n , U m C+ 1 , U m C+ 2 ...U m C+ n Expand the dataset by using multi-dimensional user behaviors.

[0009] A further improvement of the present invention is that, in step S4, the extended data set is sliced ​​to form dimensional analysis data, including: Step S41: Select U from the user multi-dimensional extended data set one by one n C+ n data; Step S42: n C+ n The data is normally distributed and a normal distribution diagram of the data is obtained; Step S43: Slice the data in the normal distribution map, and divide the part of the normal distribution map that accounts for more than 99% of the area into data set AU n C+ n , the rest is divided into data set BU n C+ n , forming dimensional analysis data, where data set AU n C+ n Defined as a user single-dimensional normal behavior dataset, dataset BU n C+ n Defined as a user single-dimensional abnormal data set; Step S51: AU 1 C+ 1 AU 2 C+ 2 ,……AU n C+ n Merge into a sequence to obtain the AUC+ of the user's multi-dimensional normal behavior dataset, and convert BU 1 C+ 1 , BU 2 C+ 2 ,...BU n C+ n Merged together, the user multi-dimensional abnormal behavior dataset BUC+, the user multi-dimensional normal behavior dataset AUC+ and the user multi-dimensional abnormal behavior dataset BUC+ are the dimensional analysis data.

[0010] A further improvement of the present invention is that, in step S5, the dimension analysis data is merged and analyzed and user behavior profile processing is performed to obtain a personal user behavior profile, including: Step S51: Perform frequency statistics on the user behavior data of each dimension in the user multi-dimensional normal behavior data set AUC+ to obtain the user single-dimensional normal behavior portrait data, and define the data as the alarm baseline threshold; Step S52: Perform frequency statistics on the user behavior data of each dimension in the user single-dimensional abnormal behavior data set BUC+ to obtain user multi-dimensional abnormal behavior portrait data; Step S53: setting an alarm rule in the AAA system according to the alarm baseline threshold and the user's multi-dimensional abnormal behavior portrait data, and the alarm rule is set to alarm when the user's multi-dimensional abnormal behavior portrait data is greater than, less than, or equal to the threshold; Step S54: Display each single-dimensional normal behavior portrait data of the user in the form of a spider web diagram on the page to obtain a multi-dimensional normal behavior portrait of the user, that is, a personal user behavior portrait.

[0011] A further improvement of the present invention is that, in step S6, based on the data linkage alarm rule of the individual user behavior portrait, the page display effect is updated, including: Step S61: The AAA system calculates the user's multi-dimensional normal behavior profile data every 24 hours, and updates the alarm baseline threshold according to the profile data; Step S62: The AAA system calculates the user's multi-dimensional abnormal behavior portrait data every 24 hours, and checks the alarm rules based on the portrait data. If the alarm rules are met, an alarm message is issued and the page spider map portrait display effect is updated.

[0012] The AAA system uses small sample data to create user behavior profiles, including: Definition module, which defines the dimensions of small sample data in the AAA system and obtains the data collection template; The data processing module collects and processes the small sample instant data in the AAA system based on the data collection template to obtain the small sample data of user behavior; The data expansion module expands the small sample data of user behavior from different dimensions to form an extended data set; The data slicing module slices the extended data set to form dimensional analysis data; The data processing module merges and analyzes the dimension analysis data and processes the user behavior profile to obtain the individual user behavior profile; The effect update module updates the page display effect based on the data linkage alarm rules of individual user behavior portraits.

[0013] A further improvement of the present invention is that, in the definition module, the small sample data dimension in the AAA system is defined to obtain a data collection template, including: Collect user access data and logs for the past six months in various application systems connected to the AAA system; Normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; Analyze the normalized data of each system separately, identify the data related to user behavior and can be sent to the AAA system, define the same behavior data as one type, and define different behavior data as different types, and obtain classified user behavior data; data related to user behavior include: user access time, application access number, authentication frequency, login failure number, password input number, abnormal authentication behavior and roaming authentication number; Sort the user behavior data according to the number of times it appears in the category and get T 1 , T 2 ……T n User behavior sorting sequence, each sequence represents a type of user behavior data; Define the minimum threshold of small sample data as D; Compare each value in the user behavior sorting sequence with the minimum threshold D of the small sample data, remove the sequence less than the threshold D, and obtain the small sample data template reference sequence; The small sample data template reference sequence is deduplicated, and only one data item is retained for each behavior to obtain the data sequence C 1 , C 2 ……C n , define this sequence as a data acquisition template.

[0014] A further improvement of the present invention is that, in the data processing module, based on the data collection template, small sample real-time data in the AAA system is collected and processed to obtain small sample data of user behavior, including: Based on the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template; The AAA system collects user data in the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior; According to the user's unique identifier, the small sample data of user behavior is classified to form a classification sequence U of the small sample data of user behavior 1 , U 2 ...U n , each U n Including C 1 , C 2 ……C n Dimension, user unique identification refers to the coded information that can uniquely identify the user, including user ID, phone number, ID number and UUID.

[0015] Compared with the prior art, the present invention has at least the following beneficial technical effects: The present invention provides a method and device for user behavior profiling based on small sample data in an AAA system. After application, the AAA system can obtain less dimensional behavior data information of application system users, such as login time, authentication time, IP address and other information, and expand the sample size by combining with timeline and asset features. The method creatively invents a small sample expansion technology that integrates dimensional data expansion, slicing and classification technologies, solves the problem of insufficient dimensions and quantity of user behavior data in the AAA system, and difficulty in effectively discovering abnormal user behavior, and achieves the purpose of profiling user behavior based on small sample data and timely discovering abnormal user behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of a method for performing user behavior profiling based on small sample data in an AAA system according to an embodiment of the present invention.

[0017] Figure 2 This is a user portrait effect diagram of the method for performing user behavior profiling based on small sample data by the AAA system in an embodiment of the present invention.

[0018] Figure 3 The structure diagram of the device for performing user behavior profiling based on small sample data in the AAA system of the present invention. DETAILED DESCRIPTION

[0019] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0020] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0021] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0022] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0023] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0024] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0025] Example 1 like Figure 1 and Figure 2 As shown, the embodiment of the present invention discloses a method for performing user behavior profiling based on small sample data in an AAA system, comprising the following steps: Step S1, defining the dimensions of small sample data in the AAA system to obtain a data collection template; Step S2, based on the data collection template, collect and process the small sample real-time data in the AAA system to obtain the small sample data of user behavior; Step S3, expanding the small sample data of user behavior from different dimensions to form an extended data set; Step S4, slicing the extended data set to form dimensional analysis data; Step S5, merging and analyzing the dimension analysis data and processing the user behavior profile to obtain a personal user behavior profile; Step S6, based on the data linkage alarm rules of the individual user behavior portrait, update the page display effect.

[0026] In this embodiment, step S1 includes the following steps: A: Collect the user access data and logs of various application systems connected to the AAA system for the past six months; B: Normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; C: Analyze the normalized data of each system respectively, identify the data related to user behavior and can be sent to the AAA system, define the same behavior data as one type, and define different behavior data as different types, and obtain classified user behavior data. The data related to user behavior includes: user access time, application access number, authentication frequency, login failure number, password input number, abnormal authentication behavior, roaming authentication number, etc.

[0027] D: Sort the user behavior data according to the number of times it appears in the category, and get T1 , T 2 ……T n User behavior sorting sequence, each sequence represents a type of user behavior data; E: Define the minimum threshold of small sample data as D; F: Compare each value in the user behavior sorting sequence with the minimum threshold D of the small sample data, remove the sequence less than the threshold D, and obtain the small sample data template reference sequence; G: Remove duplicates from the small sample data template reference sequence, retaining only one piece of data for each behavior, and obtain the data sequence C 1 , C 2 ……C n , define this sequence as a data acquisition template; This embodiment uses the statistical results of AAA system practice as a basis, selects 6 months as a cycle, collects user access data and log data of application systems connected to the AAA system, and adopts data normalization processing technology (such as nonlinear normalization method, Min-Max normalization method, etc.) to unify them into a standard format and interval; then, the normalized data is analyzed through expert knowledge, and data that can be collected by AAA is selected, and such data is counted and sorted by frequency (for example, from high to low); then, a minimum threshold is set based on expert knowledge, and statistical data above the threshold is retained to avoid statistical distortion caused by too low frequency data; then, the remaining statistical data is defined as a data collection template after deduplication.

[0028] In this embodiment, step S2 includes the following steps: A: Based on the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template; B: The AAA system collects user data in the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior.

[0029] C: Classify the small sample data of user behavior according to the user's unique identifier to form a classification sequence U of the small sample data of user behavior 1 , U 2 ...U n , each U n Including C 1 , C 2 ……C n Dimension, the user unique identifier refers to the coded information that can uniquely identify the user's identity, including user ID, telephone number, ID number, UUID, etc.

[0030] This embodiment sends the data collection template to the AAA system data collector. Based on historical experience and expert knowledge, the data collector is set to collect data once every 24 hours. The collection range includes data from the past 24 hours, thereby obtaining small sample data for analysis.

[0031] In this embodiment, step S3 includes the following steps: A: Select U from the classification sequence of small sample data of user behavior one by one n data; B: Yes n Data C 1 , C 2 ……C n The dimensions are expanded separately to form a user single-dimensional extended data set C+ 1 、C+ 2 ...C+ n The said dimensional expansion refers to collecting the dimensional data of the user in the system for the past year based on the dimensional data.

[0032] C: Merge the user's single dimension extended data set into each user's behavior small sample data classification sequence to obtain U 1 C+ 1 , U 1 C+ 2 ...U 1 C+ n , U 2 C+ 1 , U 2 C+ 2 ...U m C+ n , U m C+ 1 , U m C+ 2 ...U m C+ n Expand the dataset by using multi-dimensional user behaviors.

[0033] This embodiment combines the timeline and asset characteristics for each dimension in the small sample data, and uses a data enhancement algorithm to expand it (such as the SMOTE enhancement algorithm, Borderline SMOTE algorithm, etc.), so as to expand the 24-hour data into 1 year of data in a single dimension, thereby increasing the scale of small sample analysis.

[0034] In this embodiment, step S4 includes the following steps: A: Select U from the user multi-dimensional extended dataset one by one n C+ n data; B: Yes n C+n The data is normally distributed and a normal distribution diagram of the data is obtained; C: Slice the data in the normal distribution map and divide the part of the normal distribution map that accounts for more than 99% of the area into data set AU n C+ n , the rest is divided into data set BU n C+ n , forming dimensional analysis data, where data set AU n C+ n Defined as a user single-dimensional normal behavior dataset, dataset BU n C+ n Defined as a user single-dimensional abnormal dataset.

[0035] D: AU 1 C+ 1 AU 2 C+ 2 ,……AU n C+ n Merge into a sequence to obtain the AUC+ of the user's multi-dimensional normal behavior dataset, and convert BU 1 C+ 1 , BU 2 C+ 2 ,...BU n C+ n Combined together, they form the user multi-dimensional abnormal behavior dataset BUC+.

[0036] This embodiment forms a normal distribution graph by graphing a multi-dimensional user data set (such as using the Pandas library, etc.), and obtains data sets of normal and abnormal user behaviors by slicing the graph, thereby providing data support for the profiling of different behaviors.

[0037] In this embodiment, step S5 includes the following steps: A: Perform frequency statistics on the user behavior data of each dimension in the user multi-dimensional normal behavior dataset AUC+ to obtain the user's single-dimensional normal behavior portrait data, and define the data as the alarm baseline threshold.

[0038] B: Perform frequency statistics on the user behavior data of each dimension in the user single-dimensional abnormal behavior dataset BUC+ to obtain the user multi-dimensional abnormal behavior portrait data; C: In the AAA system, alarm rules are set based on the alarm baseline threshold and the user's multi-dimensional abnormal behavior profile data. The alarm rules can be set to alarm when the user's multi-dimensional abnormal behavior profile data is greater than, less than, or equal to the threshold. D: Display each single-dimensional normal behavior portrait data of the user in the form of a spider web graph on the page to obtain a multi-dimensional normal behavior portrait of the user; This embodiment forms an alarm baseline threshold for normal behavior by classifying and counting the frequency of the user's normal behavior data set according to each dimension, and forms abnormal behavior portrait data by classifying and counting the frequency of the user's abnormal behavior data set. Then, automation technologies such as data early warning are used to automatically update the alarm rules (such as AIOps technology). When the abnormal behavior portrait meets the alarm rules, an alarm is triggered.

[0039] In this embodiment, step S6 includes the following steps: A: The AAA system calculates the user's multi-dimensional normal behavior profile data every 24 hours and updates the alarm baseline threshold based on the profile data; B: The AAA system calculates the user's multi-dimensional abnormal behavior portrait data every 24 hours, and checks the alarm rules based on the portrait data. If the alarm rules are met, an alarm message is issued and the page spider web portrait display effect is updated.

[0040] Example 2 like Figure 3 As shown, the AAA system provided in this embodiment performs user behavior profiling based on small sample data, including: Definition module, which defines the dimensions of small sample data in the AAA system and obtains the data collection template; The data processing module collects and processes the small sample instant data in the AAA system based on the data collection template to obtain the small sample data of user behavior; The data expansion module expands the small sample data of user behavior from different dimensions to form an extended data set; The data slicing module slices the extended data set to form dimensional analysis data; The data processing module merges and analyzes the dimension analysis data and processes the user behavior profile to obtain the individual user behavior profile; The effect update module updates the page display effect based on the data linkage alarm rules of individual user behavior portraits.

[0041] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0042] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. The AAA system uses a user behavior profiling method based on small sample data, which is characterized by: include: Step S1, defining the dimensions of small sample data in the AAA system to obtain a data collection template; Step S2, based on the data collection template, collect and process the small sample real-time data in the AAA system to obtain the small sample data of user behavior; Step S3, expanding the small sample data of user behavior from different dimensions to form an extended data set; Step S4, slicing the extended data set to form dimensional analysis data; Step S5, merging and analyzing the dimension analysis data and processing the user behavior profile to obtain a personal user behavior profile; Step S6, based on the data linkage alarm rules of the individual user behavior portrait, update the page display effect.

2. The method for user behavior profiling based on small sample data in the AAA system according to claim 1 is characterized in that: In step S1, the small sample data dimension in the AAA system is defined to obtain a data collection template, including: Step S11: Collecting user access data and logs of various application systems connected to the AAA system for the past six months; Step S12: normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; Step S13: Analyze the normalized data of each system respectively, identify the data related to the user behavior and can be sent to the AAA system, define the same behavior data as one type, and define different behavior data as different types, and obtain classified user behavior data; the data related to the user behavior includes: user access time, application access number, authentication frequency, login failure number, password input number, abnormal authentication behavior and roaming authentication number; Step S14: Sort the user behavior data according to the number of times they appear in the category to obtain T1, T2, ..., T n User behavior sorting sequence, each sequence represents a type of user behavior data; Step S15: define the minimum threshold of small sample data as D; Step S16: Compare each value in the user behavior ranking sequence with the minimum threshold D of the small sample data, remove the sequence less than the threshold D, and obtain a small sample data template reference sequence; Step S17: Remove duplicates from the small sample data template reference sequence, retain only one piece of data for each behavior, and obtain data sequences C1, C2, ..., C n , define this sequence as a data acquisition template.

3. The method for user behavior profiling based on small sample data in the AAA system according to claim 1 is characterized in that: In step S2, based on the data collection template, the small sample real-time data in the AAA system is collected and processed to obtain the small sample data of user behavior, including: Step S21: Based on the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template; Step S22: The AAA system collects user data in the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior; Step S23: Classify the small sample data of user behavior according to the unique identifier of the user to form a classification sequence U1, U2, ..., U n , each U n Including C1, C2...C n Dimension, user unique identification refers to the coded information that can uniquely identify the user, including user ID, phone number, ID number and UUID.

4. The method for user behavior profiling based on small sample data in the AAA system according to claim 1 is characterized in that: In step S3, the small sample data of user behavior is expanded from different dimensions to form an extended data set, including: Step S31: Select U from the classification sequence of user behavior small sample data one by one n data; Step S32: n C1, C2, ... C n The dimensions are expanded separately to form user single-dimensional extended data sets C+1, C+2, ... C+ n ; Expanding the dimensions separately means collecting the dimension data of the user in the system for the past year based on the dimension data; Step S33: Merge the user single dimension extended data set into each user behavior small sample data classification sequence to obtain U1C+1, U1C+2...U1C+ n 、U2C+1、U2C+2……U m C+ n , U m C+1, U m C+2……U m C+ n Expand the dataset by using multi-dimensional user behaviors.

5. The method for user behavior profiling based on small sample data in the AAA system according to claim 1 is characterized in that: In step S4, the extended data set is sliced ​​to form dimensional analysis data, including: Step S41: Select U from the user multi-dimensional extended data set one by one n C+ n data; Step S42: n C+ n The data is normally distributed and a normal distribution diagram of the data is obtained; Step S43: Slice the data in the normal distribution map, and divide the part of the normal distribution map that accounts for more than 99% of the area into data set AU n C+ n , the rest is divided into data set BU n C+ n , forming dimensional analysis data, where data set AU n C+ n Defined as a user single-dimensional normal behavior dataset, dataset BU n C+ n Defined as a user single-dimensional abnormal data set; Step S51: AU1C+1, AU2C+2, ... AU n C+ n Merge into a sequence to obtain the user multi-dimensional normal behavior data set AUC+, and convert BU1C+1, BU2C+2, ... BU n C+ n Merged together, the user multi-dimensional abnormal behavior dataset BUC+, the user multi-dimensional normal behavior dataset AUC+ and the user multi-dimensional abnormal behavior dataset BUC+ are the dimensional analysis data.

6. The method for user behavior profiling based on small sample data in the AAA system according to claim 5 is characterized in that: In step S5, the dimension analysis data is merged and analyzed and user behavior profile processing is performed to obtain a personal user behavior profile, including: Step S51: Perform frequency statistics on the user behavior data of each dimension in the user multi-dimensional normal behavior data set AUC+ to obtain the user single-dimensional normal behavior portrait data, and define the data as the alarm baseline threshold; Step S52: Perform frequency statistics on the user behavior data of each dimension in the user single-dimensional abnormal behavior data set BUC+ to obtain user multi-dimensional abnormal behavior portrait data; Step S53: setting an alarm rule in the AAA system according to the alarm baseline threshold and the user's multi-dimensional abnormal behavior portrait data, and the alarm rule is set to alarm when the user's multi-dimensional abnormal behavior portrait data is greater than, less than, or equal to the threshold; Step S54: Display each single-dimensional normal behavior portrait data of the user in the form of a spider web diagram on the page to obtain a multi-dimensional normal behavior portrait of the user, that is, a personal user behavior portrait.

7. The method for user behavior profiling based on small sample data in the AAA system according to claim 6, characterized in that: In step S6, based on the data linkage alarm rules of the individual user behavior profile, the page display effect is updated, including: Step S61: The AAA system calculates the user's multi-dimensional normal behavior profile data every 24 hours, and updates the alarm baseline threshold according to the profile data; Step S62: The AAA system calculates the user's multi-dimensional abnormal behavior portrait data every 24 hours, and checks the alarm rules based on the portrait data. If the alarm rules are met, an alarm message is issued and the page spider map portrait display effect is updated.

8. The AAA system uses a user behavior profiling device based on small sample data, characterized in that: include: Definition module, which defines the dimensions of small sample data in the AAA system and obtains the data collection template; The data processing module collects and processes the small sample instant data in the AAA system based on the data collection template to obtain the small sample data of user behavior; The data expansion module expands the small sample data of user behavior from different dimensions to form an extended data set; The data slicing module slices the extended data set to form dimensional analysis data; The data processing module merges and analyzes the dimension analysis data and processes the user behavior profile to obtain the individual user behavior profile; The effect update module updates the page display effect based on the data linkage alarm rules of individual user behavior portraits.

9. The device for performing user behavior profiling based on small sample data in the AAA system according to claim 8, characterized in that: In the definition module, the small sample data dimensions in the AAA system are defined to obtain a data collection template, including: Collect user access data and logs for the past six months in various application systems connected to the AAA system; Normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; Analyze the normalized data of each system separately, identify the data related to user behavior and can be sent to the AAA system, define the same behavior data as one type, and define different behavior data as different types, and obtain classified user behavior data; data related to user behavior include: user access time, application access number, authentication frequency, login failure number, password input number, abnormal authentication behavior and roaming authentication number; Sort the user behavior data by the number of times it appears in the category, and get T1, T2, ..., T n User behavior sorting sequence, each sequence represents a type of user behavior data; Define the minimum threshold of small sample data as D; Compare each value in the user behavior sorting sequence with the minimum threshold D of the small sample data, remove the sequence less than the threshold D, and obtain the small sample data template reference sequence; The small sample data template reference sequence is deduplicated, and only one data item is retained for each behavior to obtain data sequences C1, C2, ..., C n , define this sequence as a data acquisition template.

10. The device for performing user behavior profiling based on small sample data in the AAA system according to claim 8, characterized in that: In the data processing module, based on the data collection template, the small sample real-time data in the AAA system is collected and processed to obtain the small sample data of user behavior, including: Based on the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template; The AAA system collects user data in the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior; According to the user's unique identifier, the user behavior small sample data is classified to form a classification sequence U1, U2...U n , each U n Including C1, C2...C n Dimension, user unique identification refers to the coded information that can uniquely identify the user, including user ID, phone number, ID number and UUID.

Images