User behavior profiling method and device based on small sample data for aaa system

Abstract

The application discloses a user behavior portrait method and device based on small sample data for an AAA system, and the method comprises the following steps: defining the small sample data dimension in the AAA system to obtain a data collection template; collecting and processing the small sample real-time data in the AAA system to obtain user behavior small sample data; expanding the small sample data from different dimensions to form an extended data set; performing slice processing on the extended data to form dimension analysis data; performing merging analysis on the dimension analysis data and performing user behavior portrait processing to obtain a personal user behavior portrait; and updating a page display effect based on the portrait data linkage alarm rule. The device comprises a definition module, a data processing module, an effect updating module and the like. The application can solve the problem that the AAA system can still accurately portrait the user behavior and timely find the problem of abnormal users in the case that the AAA system does not control the permission of an application system, and lacks user permission control data and page access data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a user behavior portrait method and device based on small sample data for an AAA system. BACKGROUND

[0002] The AAA system is a system for providing unified user account management, identity authentication service and user behavior audit. The system belongs to the category of unified identity authentication system 4A, but compared with the traditional unified identity authentication system 4A, the AAA system has the following differences.

[0003] Firstly, the traditional 4A system needs to take over the permission control function of the accessed system. The user's permission and access process need to be processed by the 4A system before accessing the real application system. Therefore, the 4A system can perceive and obtain user behavior from many dimensions, making it easier to analyze user behavior data. The AAA system is loosely coupled with the application system and has less perception dimension and range of user behavior information.

[0004] Secondly, the traditional 4A system is the entrance for unified login and access of users, and other applications are displayed in the 4A system. When the user accesses the system, the user first sees and enters the 4A system, and then accesses other application systems through single sign-on. Therefore, the 4A system can control all behaviors of the user accessing the application system, including which page is accessed and what operation is performed. The AAA system is hidden behind the application system, and the user does not perceive the existence of the AAA system when accessing the application system, which means that the AAA system has weak control ability over user behavior data. SUMMARY

[0005] The AAA system based on small sample data for user behavior portrait method and device are provided to solve the problem of user behavior portrait in the AAA system and timely detection of abnormal behavior. The application realizes how to realize accurate user behavior portrait and timely detection of abnormal behavior to trigger an alarm in the case of less user behavior data dimension, which can effectively improve the security protection ability of the AAA system.

[0006] In order to achieve the above purpose, the application adopts the following technical scheme:

[0007] The AAA system based on small sample data for user behavior portrait method comprises the following steps:

[0008] Step S1, defining the small sample data dimension in the AAA system to obtain a data collection template;

[0009] Step S2, based on the data collection template, the small sample real-time data in the AAA system is collected and processed to obtain the small sample data of user behavior;

[0010] Step S3, the small sample data of user behavior is expanded from different dimensions to form an extended data set;

[0011] Step S4, the extended data set is sliced to form dimension analysis data;

[0012] Step S5, the dimension analysis data is merged and analyzed, and user behavior portrait processing is performed to obtain a personal user behavior portrait;

[0013] Step S6, based on the data linkage alarm rule of the personal user behavior portrait, the page display effect is updated.

[0014] The further improvement of the application is that in step S1, the small sample data dimension in the AAA system is defined to obtain the data collection template, including:

[0015] Step S11: collecting the user access data and log of various application systems in the AAA system in the past 6 months;

[0016] Step S12: normalizing the log of various systems, unifying the data type and format, removing invalid data, and obtaining normalized data;

[0017] Step S13: analyzing the normalized data of each system respectively, identifying the data related to user behavior and capable of being sent to the AAA system, defining the same behavior data as a type and the different behavior data as different types, and obtaining user behavior data with classification; the data related to user behavior includes: user access time, application access quantity, authentication frequency, login failure times, password input times, abnormal authentication behavior and roaming authentication times;

[0018] Step S14: sorting the user behavior data according to the number of occurrences in the classification to obtain T1, T2……T n User behavior sorting sequence, each sequence represents a type of user behavior data;

[0019] Step S15: defining the minimum threshold of small sample data as D;

[0020] Step S16: comparing each item value in the user behavior sorting sequence with the minimum threshold D of the small sample data, removing the sequence less than the threshold D, and obtaining the small sample data template reference sequence;

[0021] Step S17: removing the small sample data template reference sequence, retaining only one data for each behavior, and obtaining data sequences C1, C2……Cn The sequence is defined as a data collection template.

[0022] The further improvement of the present application is that in step S2, the small sample real-time data in the AAA system is collected and processed based on the data collection template to obtain the small sample data of user behavior, including:

[0023] Step S21: Based on the data collection template, the user behavior data in the AAA system is collected from the dimensions defined in the data collection template.

[0024] Step S22: The user data in the past 24 hours is collected in real time by the AAA system according to the data collection template to obtain the small sample data of user behavior.

[0025] Step S23: The small sample data of user behavior is classified according to the unique user identifier to form a classification sequence U1, U2, …, U n Each U n includes C1, C2, …, C n dimensions, and the unique user identifier refers to coded information that can uniquely identify the user's identity, including user ID, phone number, ID number, and UUID.

[0026] The further improvement of the present application is that in step S3, the small sample data of user behavior is expanded from different dimensions to form an expanded data set, including:

[0027] Step S31: Select U n data in the classification sequence of small sample data of user behavior one by one.

[0028] Step S32: Expand C1, C2, …, C n dimensions in U n data respectively to form single-dimension expanded data sets C+1, C+2, …, C+ n ; expanding dimensions respectively means taking the dimension data as the standard to collect the dimension data of the user in the system in the past year.

[0029] Step S33: Merge the single-dimension expanded data sets into each classification sequence of small sample data of user behavior to obtain U1C+1, U1C+2, …, U1C+ n , U2C+1, U2C+2, …, U m C+ n , U m C+1, U m C+2, …, U m C+ n multi-dimension behavior expanded data set.

[0030] The further improvement of the present application is that in step S4, the extended data set is sliced to form the dimension analysis data, including:

[0031] Step S41: selecting U n C+ n data in the user multi-dimensional extended data set one by one;

[0032] Step S42: performing normal distribution calculation on the U n C+ n data to obtain a normal distribution graph of the data;

[0033] Step S43: slicing the data in the normal distribution graph, and dividing the part with an area ratio of more than 99% in the normal distribution graph into a data set AU n C+ n , and dividing the other part into a data set BU n C+ n to form the dimension analysis data, wherein the data set AU n C+ n is defined as a user single-dimensional normal behavior data set, and the data set BU n C+ n is defined as a user single-dimensional abnormal data set.

[0034] Step S51: merging AU1C+1, AU2C+2, …, AU n C+ n into a sequence to obtain a user multi-dimensional normal behavior data set AUC+, and merging BU1C+1, BU2C+2, …, BU n C+ n together to form a user multi-dimensional abnormal behavior data set BUC+, and the user multi-dimensional normal behavior data set AUC+ and the user multi-dimensional abnormal behavior data set BUC+ are the dimension analysis data.

[0035] The further improvement of the present application is that in step S5, the dimension analysis data is merged and analyzed, and user behavior portrait processing is performed to obtain a personal user behavior portrait, including:

[0036] Step S51: performing frequency statistics on the user behavior data of each dimension in the user multi-dimensional normal behavior data set AUC+ to obtain user single-dimensional normal behavior portrait data, and defining the data as an alarm baseline threshold;

[0037] Step S52: performing frequency statistics on the user behavior data of each dimension in the user multi-dimensional abnormal behavior data set BUC+ to obtain user multi-dimensional abnormal behavior portrait data;

[0038] Step S53: setting an alarm rule in the AAA system according to the alarm baseline threshold and the user multi-dimensional abnormal behavior portrait data, and setting the alarm rule to alarm when the user multi-dimensional abnormal behavior portrait data is greater than, less than or equal to the threshold value;

[0039] Step S54: displaying each item of single-dimensional normal behavior portrait data of the user in the form of a spider chart on a page respectively, and obtaining the multi-dimensional normal behavior portrait of the user, i.e., the personal user behavior portrait.

[0040] Further improvement of the present application is that, in step S6, the data linkage alarm rule based on the personal user behavior portrait is used to update the page display effect, including:

[0041] Step S61: the AAA system calculates the multi-dimensional normal behavior portrait data of the user every 24 hours, and updates the alarm baseline threshold according to the portrait data;

[0042] Step S62: the AAA system calculates the multi-dimensional abnormal behavior portrait data of the user every 24 hours, and links to check the alarm rule according to the portrait data, and if the alarm rule is met, an alarm information is sent, and the spider chart portrait display effect of the page is updated.

[0043] The AAA system based on small sample data for user behavior portrait device includes:

[0044] The definition module defines the dimensions of the small sample data in the AAA system to obtain a data collection template;

[0045] The data processing module collects and processes the small sample real-time data in the AAA system based on the data collection template to obtain user behavior small sample data;

[0046] The data expansion module expands the user behavior small sample data from different dimensions to form an expanded data set;

[0047] The data slicing module performs slicing processing on the expanded data set to form dimension analysis data;

[0048] The data processing module performs merging analysis on the dimension analysis data and performs user behavior portrait processing to obtain a personal user behavior portrait;

[0049] The effect updating module updates the page display effect based on the data linkage alarm rule of the personal user behavior portrait.

[0050] Further improvement of the present application is that, in the definition module, the dimensions of the small sample data in the AAA system are defined to obtain a data collection template, including:

[0051] Collecting the user access data and logs of various application systems connected to the AAA system in the past 6 months;

[0052] Normalizing the logs of various systems, unifying data types, formats, removing invalid data, and obtaining normalized data;

[0053] Analyzing the normalized data of each system, identifying data related to user behavior and capable of being fed into the AAA system, defining the same behavior data as a type and different behavior data as different types, and obtaining user behavior data with classification; the data related to user behavior includes: user access time, application access quantity, authentication frequency, login failure times, password input times, abnormal authentication behavior, and roaming authentication times;

[0054] Sorting the user behavior data according to the number of occurrences in the classification to obtain T1, T2……T n User behavior sorting sequence, each sequence representing a type of user behavior data;

[0055] Defining the minimum threshold of small sample data as D;

[0056] Comparing each value in the user behavior sorting sequence with the minimum threshold D of small sample data, removing sequences less than the threshold D, and obtaining a small sample data template reference sequence;

[0057] Removing duplicates from the small sample data template reference sequence, retaining only one data for each behavior, and obtaining data sequences C1, C2……C n , and defining this sequence as a data collection template.

[0058] The further improvement of the present application is that in the data processing module, based on the data collection template, the small sample real-time data in the AAA system is collected and processed to obtain user behavior small sample data, including:

[0059] Based on the data collection template, the user behavior data in the AAA system is collected from the dimensions defined in the data collection template;

[0060] The AAA system collects user data within the last 24 hours according to the data collection template to obtain user behavior small sample data;

[0061] Classifying user behavior small sample data according to user unique identification to form user behavior small sample data classification sequences U1, U2……U n , each U n includes C1, C2……C n dimensions, and user unique identification refers to coded information capable of uniquely identifying user identity, including user ID, phone number, ID number, and UUID.

[0062] Compared with the prior art, the application has at least the following beneficial technical effects:

[0063] The AAA system based on small sample data for user behavior portrait provided by the application has the dimension data expansion, slicing and classification technology fusion small sample expansion technology, solves the problems of insufficient user behavior data dimension and quantity in the AAA system, and effectively discovers user abnormal behavior, so that the user behavior portrait on small sample data is achieved, and user abnormal behavior is discovered in time. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 is a method for user behavior portrait based on small sample data of the AAA system of the embodiment of the application.

[0065] Figure 2 is a user portrait effect diagram of the method for user behavior portrait based on small sample data of the AAA system of the embodiment of the application.

[0066] Figure 3 is a structure block diagram of the device for user behavior portrait based on small sample data of the AAA system of the application. DETAILED DESCRIPTION

[0067] In the following, only some exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the application. Therefore, the drawings and the description are considered to be essentially exemplary rather than limiting.

[0068] It should be understood that when used in the specification and the appended claims, the terms "comprise" and "include" indicate the presence of described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0069] It should also be understood that the terms used in the specification of the application are only for the purpose of describing specific embodiments and do not intend to limit the application. As used in the specification and the appended claims of the application, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0070] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0071] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0072] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0073] Example 1

[0074] like Figure 1 and Figure 2 As shown in the figure, this invention discloses a method for user behavior profiling based on small sample data in an AAA system, including the following steps:

[0075] Step S1: Define the dimensions of small sample data in the AAA system to obtain the data collection template;

[0076] Step S2: Based on the data collection template, collect and process small sample real-time data from the AAA system to obtain small sample user behavior data.

[0077] Step S3: Expand the small sample data of user behavior from different dimensions to form an extended dataset;

[0078] Step S4: Slice the extended dataset to form dimensional analysis data;

[0079] Step S5: Perform merge analysis on the dimensional analysis data and process user behavior profiles to obtain individual user behavior profiles.

[0080] Step S6: Based on the data-driven alarm rules linked to individual user behavior profiles, update the page display effect.

[0081] In this embodiment, step S1 includes the following steps:

[0082] A: Collect user access data and logs from various application systems connected to the AAA system for the past 6 months;

[0083] B: Normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data;

[0084] C: Analyze the normalized data of each system respectively, identify the data related to user behavior and capable of being sent into the AAA system, define the same behavior data as a type and the different behavior data as different types, and obtain user behavior data with classification. The data related to user behavior include user access time, application access quantity, authentication frequency, login failure times, password input times, abnormal authentication behavior, roaming authentication times, and the like.

[0085] D: Sort the user behavior data according to the number of occurrences in the classification, and obtain T1, T2,..., T n user behavior sorting sequence, each sequence representing a type of user behavior data;

[0086] E: Define the minimum threshold of small sample data as D;

[0087] F: Compare each value in the user behavior sorting sequence with the minimum threshold D of small sample data, remove the sequence less than the threshold D, and obtain a small sample data template reference sequence;

[0088] G: Remove the small sample data template reference sequence, and retain only one data for each behavior, and obtain data sequences C1, C2,..., C n , and define this sequence as a data collection template;

[0089] In this embodiment, the AAA system practice statistical results are used as the basis, 6 months are selected as a period, user access data and log data of application systems accessed to the AAA system are collected, and data normalization processing technologies (such as nonlinear normalization method, Min-Max normalization method, etc.) are used to unify to a standard format and interval; then the normalized data are analyzed by expert knowledge, the data capable of being collected by the AAA are selected, and the statistical data are counted, sorted by number (such as from high to low), and then a minimum threshold is set according to expert knowledge, the statistical data higher than the threshold are retained, and the statistical distortion problem caused by low frequency data is avoided; and then the remaining statistical data are defined as a data collection template after removing the redundancy.

[0090] In this embodiment, step S2 includes the following steps:

[0091] A: According to the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template;

[0092] B: The AAA system collects the user data in the last 24 hours according to the data collection template in real time, and obtains user behavior small sample data.

[0093] C: According to the user unique identifier, the user behavior small sample data is classified to form a user behavior small sample data classification sequence U1, U2, …, U n Each U n includes C1, C2, …, C n dimensions, and the user unique identifier refers to coded information capable of uniquely identifying the user identity, including a user ID, a phone number, an ID number, a UUID, etc.

[0094] In the embodiment, the data collection template is sent into the AAA system data collector, the period of the data collector is set to 24 hours according to historical experience and expert knowledge, the collection range includes data in the past 24 hours, and thus small sample data for analysis is obtained.

[0095] In the embodiment, step S3 includes the following steps.

[0096] A: The U n data in the user behavior small sample data classification sequence is selected one by one.

[0097] B: The C1, C2, …, C n dimensions in the U n data are respectively expanded to form a user single-dimension expansion data set C+1, C+2, …, C+ n . The dimensions are respectively expanded, that is, the dimension data is taken as a standard, and the dimension data of the user in the collection system in the past one year is collected.

[0098] C: The user single-dimension expansion data set is merged into each user behavior small sample data classification sequence to obtain U1C+1, U1C+2, …, U1C+ n , U2C+1, U2C+2, …, U m C+ n , U m C+1, U m C+2, …, U m C+ n user multi-dimension behavior expansion data set.

[0099] In the embodiment, the idea of combining a timeline and asset characteristics is adopted for each dimension in the small sample data, a data enhancement algorithm (such as an SMOTE enhancement algorithm, a Borderline SMOTE algorithm, etc.) is used for expansion, 24 hours of data is expanded into one year of data in a single dimension, and thus the scale of small sample analysis is increased.

[0100] In the embodiment, step S4 includes the following steps.

[0101] A: The U n C+ nData;

[0102] B: to U n C+ n Data is calculated for normal distribution, and a normal distribution graph of the data is obtained;

[0103] C: slice the data in the normal distribution graph, and divide the part with an area ratio of more than 99% in the normal distribution graph into a data set AU n C+ n , and the other part is divided into a data set BU n C+ n , forming a dimension analysis data, wherein the data set AU n C+ n is defined as a user single-dimension normal behavior data set, and the data set BU n C+ n is defined as a user single-dimension abnormal data set.

[0104] D: AU1C+1, AU2C+2, …, AU n C+ n are merged into a sequence to obtain a user multi-dimension normal behavior data set AUC+, and BU1C+1, BU2C+2, …, BU n C+ n are merged together to form a user multi-dimension abnormal behavior data set BUC+.

[0105] The embodiment forms a normal distribution graph by image drawing (such as using Pandas library, etc.) of the multi-dimension user data set, and obtains the user normal behavior and abnormal behavior data sets by cross-section slicing of the graph, thereby providing data support for the portrait of different behaviors.

[0106] In the embodiment, step S5 includes the following steps:

[0107] A: frequency statistics is performed on the user behavior data of each dimension in the user multi-dimension normal behavior data set AUC+ to obtain user single-dimension normal behavior portrait data, and the data is defined as an alarm baseline threshold.

[0108] B: frequency statistics is performed on the user behavior data of each dimension in the user multi-dimension abnormal behavior data set BUC+ to obtain user multi-dimension abnormal behavior portrait data;

[0109] C: an alarm rule is set in the AAA system according to the alarm baseline threshold and the user multi-dimension abnormal behavior portrait data, and the alarm rule can be set to alarm when the user multi-dimension abnormal behavior portrait data is greater than, less than, or equal to the threshold.

[0110] D: The user's single-dimension normal behavior portrait data is displayed in the form of a spider chart on a page, and the user's multi-dimension normal behavior portrait is obtained;

[0111] In this embodiment, the normal behavior data set of the user is classified according to each dimension, and the frequency is counted to form an alarm baseline threshold of the normal behavior. The abnormal behavior data set of the user is classified and counted in frequency to form an abnormal behavior portrait data. Then, the data early warning and other automatic technologies (such as AIOps technology) are used to automatically update the alarm rules. When the abnormal behavior portrait meets the alarm rules, an alarm is triggered.

[0112] In this embodiment, step S6 includes the following steps:

[0113] A: The AAA system calculates the multi-dimension normal behavior portrait data of the user every 24 hours, and updates the alarm baseline threshold according to the portrait data.

[0114] B: The AAA system calculates the multi-dimension abnormal behavior portrait data of the user every 24 hours, and according to the portrait data, the alarm rules are checked in linkage. If the alarm rules are met, an alarm information is sent, and the page spider chart portrait display effect is updated.

[0115] Embodiment 2

[0116] As shown in Figure 3 The AAA system based on small sample data for user behavior portrait device provided by this embodiment includes:

[0117] The definition module defines the small sample data dimension in the AAA system to obtain a data collection template.

[0118] The data processing module collects and processes the small sample real-time data in the AAA system based on the data collection template to obtain the user behavior small sample data.

[0119] The data expansion module expands the user behavior small sample data from different dimensions to form an expanded data set.

[0120] The data slicing module performs slicing processing on the expanded data set to form dimension analysis data.

[0121] The data processing module performs merging analysis and user behavior portrait processing on the dimension analysis data to obtain a personal user behavior portrait.

[0122] The effect updating module updates the page display effect based on the data linkage alarm rules of the personal user behavior portrait.

[0123] The foregoing merely illustrates the principles of the application and application of its leading features. This application is not limited to the exact details shown above and described herein, and obvious modifications will occur to those skilled in the art upon reading the foregoing description. Therefore, the scope of the application is not to be determined by the specific examples shown above, but only by the claims below. Any reference signs in the claims should not be construed as limiting the scope of the claims.

[0124] Furthermore, it should be understood that although the description above relates to only one embodiment of the application, the application can be practiced with other embodiments that are apparent to, or readily ascertained by, those having ordinary skill in the art, which, although perhaps not explicitly described or shown herein, are in no way intended to exclude from the scope of the application. It is therefore evident that there is a close relation between the various items covered by the application and that any feature or combination of features covered by the application can be replaced by any other technical features or combinations of features covered by the application. The scope of the application is thus not to be determined by the specific examples disclosed above, but only by the claims below. Any reference signs in the claims should not be construed as limiting the scope of the claims.

Claims

1. A method for user behavior profiling in an AAA system based on small sample data, characterized in that: include: Step S1: Define the dimensions of small sample data in the AAA system to obtain a data collection template, including: Step S11: Collect user access data and logs from various application systems connected to the AAA system for the past 6 months; Step S12: Normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; Step S13: Analyze the normalized data of each system separately, identify the data that is related to user behavior and can be sent to the AAA system. The same behavior data is defined as one type, and the data of different behaviors are defined as different types, so as to obtain user behavior data with classification. The data related to user behavior includes: user access time, application access quantity, authentication frequency, login failure time, password input time, abnormal authentication behavior and roaming authentication time. Step S14: Sort the user behavior data according to the frequency of occurrence in the category to obtain T1, T2...T n User behavior sorting sequences, each sequence representing a type of user behavior data; Step S15: Define the minimum threshold for small sample data as D; Step S16: Compare each value in the user behavior sorting sequence with the lowest threshold D of the small sample data, remove sequences that are less than the threshold D, and obtain the small sample data template reference sequence. Step S17: Remove duplicates from the small sample data template reference sequence, keeping only one data point for each action, to obtain the data sequence C1, C2...C n Define this sequence as a data acquisition template; Step S2: Based on the data collection template, collect and process small sample real-time data from the AAA system to obtain small sample user behavior data. Step S3: Expand the small sample data of user behavior from different dimensions to form an extended dataset; Step S4: Slice the extended dataset to form dimensional analysis data, including: Step S41: Select U from the user multi-dimensional extended dataset one by one. n C+ n data; Step S42: For U n C+ n The data is subjected to a normal distribution calculation to obtain a normal distribution plot of the data; Step S43: Slice the data in the normal distribution plot, dividing the portion of the normal distribution plot with an area exceeding 99% into datasets AU. n C+ n The other parts are divided into dataset BU. n C+ n This generates dimensional analysis data, including dataset AU. n C+ n Defined as a single-dimensional normal user behavior dataset, dataset BU n C+ n Defined as a single-dimensional abnormal dataset of users; Step S51: Set AU1C+1, AU2C+2, ..., AU n C+ n Merging them into a single sequence yields the AUC+ dataset of user multidimensional normal behavior. BU1C+1, BU2C+2, ..., BU n C+ n The data are merged together to form the user multi-dimensional abnormal behavior dataset BUC+, the user multi-dimensional normal behavior dataset AUC+, and the user multi-dimensional abnormal behavior dataset BUC+, which are the dimensional analysis data. Step S5: Perform merge analysis on the dimensional analysis data and process user behavior profiles to obtain individual user behavior profiles, including: Step S51: Perform frequency statistics on the user behavior data of each dimension in the user multi-dimensional normal behavior dataset AUC+ to obtain the user single-dimensional normal behavior profile data, and define this data as the alarm baseline threshold. Step S52: Perform frequency statistics on the user behavior data of each dimension in the user single-dimensional abnormal behavior dataset BUC+ to obtain user multi-dimensional abnormal behavior profile data. Step S53: In the AAA system, set alarm rules based on the alarm baseline threshold and the user's multi-dimensional abnormal behavior profile data. The alarm rules are set to alarm when the user's multi-dimensional abnormal behavior profile data is greater than, less than or equal to the threshold. Step S54: Display the user's single-dimensional normal behavior profile data in the form of a spider diagram on the page to obtain a multi-dimensional normal behavior profile of the user, which is the personal user behavior profile. Step S6: Based on the data-driven alarm rules linked to individual user behavior profiles, update the page display effect.

2. The method for user behavior profiling based on small sample data in the AAA system according to claim 1, characterized in that, In step S2, based on the data collection template, small sample real-time data from the AAA system are collected and processed to obtain small sample user behavior data, including: Step S21: Based on the data collection template, set the user behavior data in the AAA system to be collected from the dimensions defined in the data collection template; Step S22: The AAA system collects user data from the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior; Step S23: Classify the small sample data of user behavior according to the user's unique identifier, forming a classification sequence U1, U2...U... n Each U n Including C1, C2...C n In terms of dimensions, a user's unique identifier refers to coded information that can uniquely identify a user, including user ID, phone number, national ID number, and UUID.

3. The method for user behavior profiling based on small sample data in the AAA system according to claim 1, characterized in that, In step S3, the small sample data of user behavior is expanded from different dimensions to form an extended dataset, including: Step S31: Select U from the classification sequence of small sample data of user behavior one by one. n data; Step S32: For U n In the data, C1, C2...C n Expanding each dimension individually creates user-specific extended datasets C+1, C+2...C+ n Expanding each dimension separately means using the dimension data as the standard to collect the user's data for that dimension over the past year from the system. Step S33: Merge the single-dimensional extended dataset of users into the classification sequence of small sample data of each user behavior, to obtain U1C+1, U1C+2...U1C+ n U2C+1, U2C+2...U m C+ n U m C+1, U m C+2……U m C+ n Expanding the user multi-dimensional behavior dataset.

4. The method for user behavior profiling based on small sample data in the AAA system according to claim 1, characterized in that, In step S6, based on the data-driven alarm rules linked to individual user behavior profiles, the page display effect is updated, including: Step S61: The AAA system calculates multi-dimensional normal behavior profile data of users every 24 hours and updates the alarm baseline threshold based on the profile data; Step S62: The AAA system calculates multi-dimensional abnormal behavior profile data of users every 24 hours, and checks alarm rules based on the profile data. If the alarm rules are met, an alarm message is issued and the spider web profile display effect on the page is updated.

5. An AAA system device for user behavior profiling based on small sample data, characterized in that: include: The definition module defines the dimensions of small sample data in the AAA system, resulting in a data collection template, including: Collect user access data and logs from various application systems connected to the AAA system for the past 6 months; Normalize the logs of various systems, unify the data types and formats, remove invalid data, and obtain normalized data; The normalized data of each system were analyzed to identify data related to user behavior that could be sent to the AAA system. Data with the same behavior was defined as one type, and data with different behaviors were defined as different types, resulting in categorized user behavior data. Data related to user behavior included: user access time, number of application accesses, authentication frequency, number of failed login attempts, number of password attempts, abnormal authentication behavior, and number of roaming authentication attempts. Sort the user behavior data according to the frequency of occurrence in the category to obtain T1, T2...T n User behavior sorting sequences, each sequence representing a type of user behavior data; Define the minimum threshold for small sample data as D; Each value in the user behavior ranking sequence is compared with the lowest threshold D of the small sample data. Sequences with values ​​less than the threshold D are removed to obtain the small sample data template reference sequence. The small sample data template reference sequence is deduplicated, retaining only one data point for each behavior, resulting in data sequences C1, C2...C1. n Define this sequence as a data acquisition template; The data processing module, based on the data acquisition template, collects and processes small samples of real-time data from the AAA system to obtain small sample data of user behavior. The data expansion module expands small sample data of user behavior from different dimensions to form an extended dataset; The data slicing module slices the extended dataset to create dimensional analysis data, including: Step S41: Select U from the user multi-dimensional extended dataset one by one. n C+ n data; Step S42: For U n C+ n The data is subjected to a normal distribution calculation to obtain a normal distribution plot of the data; Step S43: Slice the data in the normal distribution plot, dividing the portion of the normal distribution plot with an area exceeding 99% into datasets AU. n C+ n The other parts are divided into dataset BU. n C+ n This generates dimensional analysis data, including dataset AU. n C+ n Defined as a single-dimensional normal user behavior dataset, dataset BU n C+ n Defined as a single-dimensional abnormal dataset of users; Step S51: Set AU1C+1, AU2C+2, ..., AU n C+ n Merging them into a single sequence yields the AUC+ dataset of user multidimensional normal behavior. BU1C+1, BU2C+2, ..., BU n C+ n The data are merged together to form the user multi-dimensional abnormal behavior dataset BUC+, the user multi-dimensional normal behavior dataset AUC+, and the user multi-dimensional abnormal behavior dataset BUC+, which are the dimensional analysis data. The data processing module performs merge analysis on the dimensional analysis data and processes it into user behavior profiles, resulting in individual user behavior profiles, including: Step S51: Perform frequency statistics on the user behavior data of each dimension in the user multi-dimensional normal behavior dataset AUC+ to obtain the user single-dimensional normal behavior profile data, and define this data as the alarm baseline threshold. Step S52: Perform frequency statistics on the user behavior data of each dimension in the user single-dimensional abnormal behavior dataset BUC+ to obtain user multi-dimensional abnormal behavior profile data. Step S53: In the AAA system, set alarm rules based on the alarm baseline threshold and the user's multi-dimensional abnormal behavior profile data. The alarm rules are set to alarm when the user's multi-dimensional abnormal behavior profile data is greater than, less than or equal to the threshold. Step S54: Display the user's single-dimensional normal behavior profile data in the form of a spider diagram on the page to obtain a multi-dimensional normal behavior profile of the user, which is the personal user behavior profile. The effect update module updates the page display effect based on the data linkage alarm rules of individual user behavior profiles.

6. The AAA system user behavior profiling device based on small sample data according to claim 5, characterized in that, In the data processing module, based on the data acquisition template, small samples of real-time data from the AAA system are collected and processed to obtain small sample data of user behavior, including: Based on the data collection template, set up the AAA system to collect user behavior data from the dimensions defined in the data collection template; The AAA system collects user data from the past 24 hours in real time according to the data collection template to obtain small sample data of user behavior. Based on the user's unique identifier, the small sample data of user behavior is classified to form a classification sequence U1, U2...U... n Each U n Including C1, C2...C n In terms of dimensions, a user's unique identifier refers to coded information that can uniquely identify a user, including user ID, phone number, national ID number, and UUID.

Images