A multi-dimensional evaluation and analysis method for user association data based on deep learning

Abstract

The present invention relates to the field of multidimensional analysis and processing of network user data, and in particular to a multidimensional evaluation and analysis method for user-related data based on deep learning, including: acquiring real-time user network behavior data to establish multidimensional features of user-related data; obtaining continuous basic evaluation and analysis results of user-related data based on deep learning according to the multidimensional features of user-related data; performing multidimensional cross-validation processing according to the continuous basic evaluation and analysis results to obtain multidimensional evaluation and analysis results of user-related data. In order to ensure the continuity and reliability of the evaluation and analysis results, an iterative mechanism within the model is designed. By continuously optimizing and adjusting model parameters, high-quality analysis results are continuously output to provide a scientific basis for network optimization and decision-making. This series of innovations and optimization measures not only improves the performance of the model, but also lays a solid foundation for the stable operation and efficient management of communication networks.

Description

Technical Field

[0001] The present invention relates to the field of multi-dimensional analysis and processing of network user data, and in particular to a multi-dimensional evaluation and analysis method for user association data based on deep learning. Background Art

[0002] When analyzing the traffic data of traditional network users, the focus is usually on the traffic output of the target user or the processing capacity of the server-side node. However, this analysis is often limited to the data itself, ignoring the consideration of multiple dimensions related to the data. It is impossible to have a more comprehensive understanding of user behavior and network performance, and lacks the ability to combine data analysis with multiple dimensions such as user behavior patterns, network topology, time series analysis, and security threat assessment. Summary of the invention

[0003] In view of the shortcomings of the prior art, the present invention provides a method for multi-dimensional evaluation and analysis of user-related data based on deep learning. Through the real-time communication data and communication line status of network users, a multi-dimensional data classification model is established based on deep learning, and rapid iteration within the solution is achieved, so as to stably and accurately output the multi-dimensional evaluation and analysis results of user-related data.

[0004] To achieve the above object, the present invention provides a multi-dimensional evaluation and analysis method of user association data based on deep learning, comprising:

[0005] S1. Obtain real-time user network behavior data to establish multi-dimensional features of user association data;

[0006] S2. Obtaining a continuous basic evaluation analysis result of the user association data based on deep learning according to the multi-dimensional features of the user association data;

[0007] S3. Perform multi-dimensional cross-validation processing according to the continuous basic evaluation and analysis results to obtain multi-dimensional evaluation and analysis results of user-related data.

[0008] Preferably, the step of acquiring real-time user network behavior data to establish multi-dimensional features of user association data includes:

[0009] S1-1, obtain real-time user network behavior data based on user IP address;

[0010] S1-2. Preprocess the real-time user network behavior data to obtain multi-dimensional features of user association data.

[0011] Furthermore, obtaining real-time user network behavior data according to the user IP address includes:

[0012] Obtain real-time user network communication lines based on user IP addresses;

[0013] Utilizing the real-time user network communication line, respectively acquiring a server port and a communication protocol according to the real-time user network communication line;

[0014] Acquire the switch IP address of the real-time user network communication line according to the user IP address and the server port;

[0015] Acquiring network communication data volume according to the real-time user network communication line;

[0016] Utilize the real-time user network communication line and network communication data volume as user network behavior master data;

[0017] Using the server port, communication protocol and switch IP address as user network behavior secondary data;

[0018] The user network behavior main data and the user network behavior subsidiary data are used as real-time user network behavior data.

[0019] Furthermore, the multi-dimensional features of user-related data obtained by preprocessing the real-time user network behavior data include:

[0020] S1-2-1, using the user network behavior master data of the real-time user network behavior data to perform preprocessing to establish a strong correlation feature of user correlation data of the real-time user network behavior data;

[0021] S1-2-2, using the user network behavior secondary data of the real-time user network behavior data to perform preprocessing to establish user association data weak association features of the real-time user network behavior data;

[0022] S1-2-3. Utilize the strong correlation features of the user correlation data and the weak correlation features of the user correlation data as multi-dimensional features of the user correlation data.

[0023] Further, using the user network behavior master data of the real-time user network behavior data to perform preprocessing to establish the user association data strong association features of the real-time user network behavior data includes:

[0024] Establishing a virtual distributed line node corresponding to the line node of the real-time user network communication line using the user network behavior master data of the real-time user network behavior data;

[0025] Using the network communication data volume corresponding to the user network behavior master data of the real-time user network behavior data, the network communication data volume corresponding to the virtual distributed line node is obtained according to the virtual distributed line node;

[0026] The virtual distributed line node corresponding to the network communication data volume is used to obtain the virtual distributed architecture data flow characteristics according to the data flow direction as the user-related data strong correlation characteristics of the real-time user network behavior data.

[0027] Further, using the user network behavior secondary data of the real-time user network behavior data to perform preprocessing to establish user-related data weak correlation features of the real-time user network behavior data includes:

[0028] S1-2-2-1, using the user network behavior secondary data of the real-time user network behavior data to correspond to the server port and the switch IP address to establish a network communication sub-line;

[0029] S1-2-2-2, establishing a basic line protocol mapping of the communication sub-line according to the communication sub-line of the real-time user network behavior data and the corresponding communication protocol of the user network behavior sub-data of the real-time user network behavior data;

[0030] S1-2-2-3, determine whether the server port at the current moment is consistent with the server port at the next adjacent moment, if so, use the basic line protocol mapping as the user association data weak association feature of the real-time user network behavior data, otherwise, obtain the server port at the next adjacent moment as the server port at the current moment, and execute S1-2-2-4;

[0031] S1-2-2-4, using the current server port and switch IP address to establish an updated network communication sub-line;

[0032] S1-2-2-5, establishing an update line protocol mapping of the communication sub-line according to the communication protocol corresponding to the updated network communication sub-line and the user network behavior sub-data of the real-time user network behavior data;

[0033] S1-2-2-6. Determine whether the server port at the current moment is consistent with the server port at the next adjacent moment. If so, use the updated line protocol mapping to update the basic line protocol mapping as a weak correlation feature of user-related data of real-time user network behavior data. Otherwise, obtain the server port at the next adjacent moment as the server port at the current moment, and return to S1-2-2-4.

[0034] Furthermore, the continuous basic evaluation analysis results of the user association data obtained based on deep learning according to the multi-dimensional features of the user association data include:

[0035] S2-1, using the multi-dimensional features of the user-related data to establish a comprehensive risk assessment and analysis model for the user-related data based on deep learning;

[0036] S2-2. Use the comprehensive risk assessment analysis model of the user-related data to perform cross-analysis processing to obtain a continuous basic assessment analysis result of the user-related data.

[0037] Furthermore, using the multi-dimensional features of the user-related data to establish a comprehensive risk assessment analysis model for the user-related data based on deep learning includes:

[0038] S2-1-1, establishing a first data set using the strong correlation features of the user correlation data of the multi-dimensional features of the user correlation data;

[0039] S2-1-2, establishing a second data set using the weak correlation characteristics of the user correlation data of the multi-dimensional characteristics of the user correlation data;

[0040] S2-1-3. Using the first data set as input and the second data set corresponding to the first data set as output, the number of hidden layers is established according to the number of virtual distributed line nodes corresponding to the first data set, and a traffic-port association classification model is established based on deep learning;

[0041] S2-1-4, using the traffic-port association classification output result of the traffic-port association classification model as input, the corresponding quantity of the second data set as output, and establishing a feature classification quantity model based on deep learning;

[0042] S2-1-5. Utilize the traffic-port association classification model and feature classification quantity model as a comprehensive risk assessment and analysis model for user association data.

[0043] Furthermore, the cross-analysis processing using the comprehensive risk assessment analysis model of the user-related data to obtain the continuous basic assessment analysis results of the user-related data includes:

[0044] S2-2-1, using the corresponding time of the real-time user network behavior data as the starting analysis time t;

[0045] S2-2-2, using the next moment adjacent to the starting analysis moment t as the auxiliary analysis moment t+1;

[0046] S2-2-3, using the comprehensive risk assessment analysis model of the user association data to obtain the flow-port association classification output results and the feature classification quantity output results of the comprehensive risk assessment analysis model according to the starting analysis time t;

[0047] S2-2-4, using the comprehensive risk assessment analysis model of the user association data to obtain the flow-port association classification output results and the feature classification quantity output results of the comprehensive risk assessment analysis model according to the auxiliary analysis time t+1;

[0048] S2-2-5, determine whether the flow-port association classification output result at the starting analysis time t is consistent with the flow-port association classification output result at the auxiliary analysis time t+1, if so, the output flow-port state is stable, otherwise, the output flow-port state is unstable;

[0049] S2-2-6. Determine whether the feature classification quantity output result at the starting analysis time t is the same as the feature classification quantity output result at the auxiliary analysis time t+1. If so, the output line protocol quantity state is stable, and the flow-port state and the line protocol quantity state are used as the continuity basic evaluation and analysis results of the user-related data. Otherwise, the output line protocol quantity state is unstable, and the flow-port state and the line protocol quantity state are used as the continuity basic evaluation and analysis results of the user-related data.

[0050] Furthermore, the multi-dimensional cross-validation processing is performed according to the continuous basic evaluation and analysis results to obtain the multi-dimensional evaluation and analysis results of the user-related data, including:

[0051] S3-1. Obtain the corresponding historical sustainable basic assessment analysis results according to the sustainable basic assessment analysis results;

[0052] S3-2. Obtain the risk historical sustainability basic assessment and analysis results based on the historical sustainability basic assessment and analysis results;

[0053] S3-3. According to the historical risk continuity basic assessment analysis result, the corresponding change rate of the number of line protocols between the historical starting analysis time t and the historical auxiliary analysis time t+1 is obtained as a risk period benchmark template;

[0054] S3-4, judging whether the number of line protocols in the continuity basic evaluation analysis result is stable, if so, executing S3-5, otherwise, directly executing S3-6;

[0055] S3-5, determine whether the change rate corresponding to the number of line protocols is the same as the risk period benchmark template. If so, output the weak correlation feature of the user-related data corresponding to the continuity basic evaluation analysis result as the multi-dimensional evaluation analysis result of the user-related data; otherwise, use the strong correlation feature of the user-related data corresponding to the risk period benchmark template and the weak correlation feature of the user-related data to update the first data set and the second data set respectively, and return to S2-1-1;

[0056] S3-6. Determine whether the traffic-port status of the continuity basic evaluation analysis result is stable. If so, update the current time as the starting analysis time t and return to S2-2-1. Otherwise, output the strong correlation characteristics of the user-related data corresponding to the continuity basic evaluation analysis result as the multi-dimensional evaluation analysis result of the user-related data.

[0057] Compared with the closest prior art, the present invention has the following beneficial effects:

[0058] This solution proposes an advanced dual network model based on deep learning technology, which aims to achieve multi-dimensional correlation classification of user data. In the process of building the model, we pay attention to the user traffic data itself and also deeply analyze the hardware node information of the communication line related to it. Through this comprehensive consideration, we can more accurately understand the operation status of the network and user behavior patterns.

[0059] In terms of innovation, a data port mapping mechanism is proposed, which ensures the transparency and traceability of data flow. When data flows out of a specific port, the mapping mechanism can clearly record its flow direction, thus providing strong support for network management and troubleshooting. In addition, considering that the transmission of communication lines depends on specific communication protocols, a correlation analysis of line protocols is established. The stability and accuracy of the entire network analysis process are improved. In order to ensure the continuity and reliability of the evaluation and analysis results, an iteration mechanism within the model is designed. By continuously optimizing and adjusting the model parameters, high-quality analysis results are continuously output, providing a scientific basis for network optimization and decision-making. This series of innovations and optimization measures not only improves the performance of the model, but also lays a solid foundation for the stable operation and efficient management of the communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flow chart of a multi-dimensional evaluation and analysis method of user association data based on deep learning provided by the present invention. DETAILED DESCRIPTION

[0061] The specific implementation modes of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0062] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Embodiment 1:

[0064] The present invention provides a multi-dimensional evaluation and analysis method for user association data based on deep learning, such as Figure 1 As shown, including:

[0065] S1. Obtain real-time user network behavior data to establish multi-dimensional features of user association data;

[0066] S2. Obtaining a continuous basic evaluation analysis result of the user association data based on deep learning according to the multi-dimensional features of the user association data;

[0067] S3. Perform multi-dimensional cross-validation processing according to the continuous basic evaluation and analysis results to obtain multi-dimensional evaluation and analysis results of user-related data.

[0068] S1 specifically includes:

[0069] S1-1, obtain real-time user network behavior data based on user IP address;

[0070] S1-2. Preprocess the real-time user network behavior data to obtain multi-dimensional features of user association data.

[0071] S1-1 specifically includes:

[0072] S1-1-1, obtain the real-time user network communication line according to the user IP address;

[0073] S1-1-2, using the real-time user network communication line to obtain the server port and the communication protocol according to the real-time user network communication line;

[0074] S1-1-3, obtaining the switch IP address of the real-time user network communication line according to the user IP address and the server port;

[0075] S1-1-4, obtaining the network communication data volume according to the real-time user network communication line;

[0076] S1-1-5, using the real-time user network communication line and network communication data volume as user network behavior master data;

[0077] S1-1-6, using the server port, communication protocol and switch IP address as user network behavior secondary data;

[0078] S1-1-7. Utilize the user network behavior main data and the user network behavior sub-data as real-time user network behavior data.

[0079] S1-2 specifically includes:

[0080] S1-2-1, using the user network behavior master data of the real-time user network behavior data to perform preprocessing to establish a strong correlation feature of user correlation data of the real-time user network behavior data;

[0081] S1-2-2, using the user network behavior secondary data of the real-time user network behavior data to perform preprocessing to establish user association data weak association features of the real-time user network behavior data;

[0082] S1-2-3. Utilize the strong correlation features of the user correlation data and the weak correlation features of the user correlation data as multi-dimensional features of the user correlation data.

[0083] S1-2-1 specifically includes:

[0084] S1-2-1-1, using the user network behavior master data of the real-time user network behavior data to correspond to the line nodes of the real-time user network communication line to establish a virtual distributed line node;

[0085] S1-2-1-2, using the network communication data volume corresponding to the user network behavior master data of the real-time user network behavior data, according to the virtual distributed line node, obtain the network communication data volume corresponding to the virtual distributed line node;

[0086] S1-2-1-3. Utilize the network communication data volume corresponding to the virtual distributed line node according to the data flow direction to obtain the data flow characteristics of the virtual distributed architecture as the strong correlation characteristics of the user correlation data of the real-time user network behavior data.

[0087] S1-2-2 specifically includes:

[0088] S1-2-2-1, using the user network behavior secondary data of the real-time user network behavior data to correspond to the server port and the switch IP address to establish a network communication sub-line;

[0089] S1-2-2-2, establishing a basic line protocol mapping of the communication sub-line according to the communication sub-line of the real-time user network behavior data and the corresponding communication protocol of the user network behavior sub-data of the real-time user network behavior data;

[0090] S1-2-2-3, determine whether the server port at the current moment is consistent with the server port at the next adjacent moment, if so, use the basic line protocol mapping as the user association data weak association feature of the real-time user network behavior data, otherwise, obtain the server port at the next adjacent moment as the server port at the current moment, and execute S1-2-2-4;

[0091] S1-2-2-4, using the current server port and switch IP address to establish an updated network communication sub-line;

[0092] S1-2-2-5, establishing an update line protocol mapping of the communication sub-line according to the communication protocol corresponding to the updated network communication sub-line and the user network behavior sub-data of the real-time user network behavior data;

[0093] S1-2-2-6. Determine whether the server port at the current moment is consistent with the server port at the next adjacent moment. If so, use the updated line protocol mapping to update the basic line protocol mapping as a weak correlation feature of user-related data of real-time user network behavior data. Otherwise, obtain the server port at the next adjacent moment as the server port at the current moment, and return to S1-2-2-4.

[0094] S2 specifically includes:

[0095] S2-1, using the multi-dimensional features of the user-related data to establish a comprehensive risk assessment and analysis model for the user-related data based on deep learning;

[0096] S2-2. Use the comprehensive risk assessment analysis model of the user-related data to perform cross-analysis processing to obtain a continuous basic assessment analysis result of the user-related data.

[0097] S2-1 specifically includes:

[0098] S2-1-1, establishing a first data set using the strong correlation features of the user correlation data of the multi-dimensional features of the user correlation data;

[0099] S2-1-2, establishing a second data set using the weak correlation characteristics of the user correlation data of the multi-dimensional characteristics of the user correlation data;

[0100] S2-1-3. Using the first data set as input and the second data set corresponding to the first data set as output, the number of hidden layers is established according to the number of virtual distributed line nodes corresponding to the first data set, and a traffic-port association classification model is established based on deep learning;

[0101] S2-1-4, using the traffic-port association classification output result of the traffic-port association classification model as input, the corresponding quantity of the second data set as output, and establishing a feature classification quantity model based on deep learning;

[0102] S2-1-5. Utilize the traffic-port association classification model and feature classification quantity model as a comprehensive risk assessment and analysis model for user association data.

[0103] S2-2 specifically includes:

[0104] S2-2-1, using the corresponding time of the real-time user network behavior data as the starting analysis time t;

[0105] S2-2-2, using the next moment adjacent to the starting analysis moment t as the auxiliary analysis moment t+1;

[0106] S2-2-3, using the comprehensive risk assessment analysis model of the user association data to obtain the flow-port association classification output results and the feature classification quantity output results of the comprehensive risk assessment analysis model according to the starting analysis time t;

[0107] S2-2-4, using the comprehensive risk assessment analysis model of the user association data to obtain the flow-port association classification output results and the feature classification quantity output results of the comprehensive risk assessment analysis model according to the auxiliary analysis time t+1;

[0108] S2-2-5, determine whether the flow-port association classification output result at the starting analysis time t is consistent with the flow-port association classification output result at the auxiliary analysis time t+1, if so, the output flow-port state is stable, otherwise, the output flow-port state is unstable;

[0109] S2-2-6. Determine whether the feature classification quantity output result at the starting analysis time t is the same as the feature classification quantity output result at the auxiliary analysis time t+1. If so, the output line protocol quantity state is stable, and the flow-port state and the line protocol quantity state are used as the continuity basic evaluation and analysis results of the user-related data. Otherwise, the output line protocol quantity state is unstable, and the flow-port state and the line protocol quantity state are used as the continuity basic evaluation and analysis results of the user-related data.

[0110] S3 specifically includes:

[0111] S3-1. Obtain the corresponding historical sustainable basic assessment analysis results according to the sustainable basic assessment analysis results;

[0112] S3-2. Obtain the risk historical sustainability basic assessment and analysis results based on the historical sustainability basic assessment and analysis results;

[0113] S3-3. According to the historical risk continuity basic assessment analysis result, the corresponding change rate of the number of line protocols between the historical starting analysis time t and the historical auxiliary analysis time t+1 is obtained as a risk period benchmark template;

[0114] S3-4, judging whether the number of line protocols in the continuity basic evaluation analysis result is stable, if so, executing S3-5, otherwise, directly executing S3-6;

[0115] S3-5, determine whether the change rate corresponding to the number of line protocols is the same as the risk period benchmark template. If so, output the weak correlation feature of the user-related data corresponding to the continuity basic evaluation analysis result as the multi-dimensional evaluation analysis result of the user-related data; otherwise, use the strong correlation feature of the user-related data corresponding to the risk period benchmark template and the weak correlation feature of the user-related data to update the first data set and the second data set respectively, and return to S2-1-1;

[0116] S3-6. Determine whether the traffic-port status of the continuity basic evaluation analysis result is stable. If so, update the current time as the starting analysis time t and return to S2-2-1. Otherwise, output the strong correlation characteristics of the user-related data corresponding to the continuity basic evaluation analysis result as the multi-dimensional evaluation analysis result of the user-related data.

[0117] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A multi-dimensional evaluation and analysis method for user association data based on deep learning, characterized in that: include: S1. Obtain real-time user network behavior data to establish multi-dimensional features of user association data; S1-1, obtain real-time user network behavior data based on user IP address; S1-1-1, obtain the real-time user network communication line according to the user IP address; S1-1-2, using the real-time user network communication line to obtain the server port and the communication protocol according to the real-time user network communication line; S1-1-3, obtaining the switch IP address of the real-time user network communication line according to the user IP address and the server port; S1-1-4, obtaining the network communication data volume according to the real-time user network communication line; S1-1-5, using the real-time user network communication line and network communication data volume as user network behavior master data; S1-1-6, using the server port, communication protocol and switch IP address as user network behavior secondary data; S1-1-7, using the user network behavior main data and the user network behavior subsidiary data as real-time user network behavior data; S1-2, preprocessing the real-time user network behavior data to obtain multi-dimensional features of user association data; S1-2-1, using the user network behavior master data of the real-time user network behavior data to perform preprocessing to establish a strong correlation feature of user correlation data of the real-time user network behavior data; S1-2-1-1, using the user network behavior master data of the real-time user network behavior data to correspond to the line nodes of the real-time user network communication line to establish a virtual distributed line node; S1-2-1-2, using the network communication data volume corresponding to the user network behavior master data of the real-time user network behavior data, according to the virtual distributed line node, obtain the network communication data volume corresponding to the virtual distributed line node; S1-2-1-3, using the network communication data volume corresponding to the virtual distributed line node according to the data flow direction to obtain the virtual distributed architecture data flow characteristics as the user-related data strong correlation characteristics of the real-time user network behavior data; S1-2-2, using the user network behavior secondary data of the real-time user network behavior data to perform preprocessing to establish user association data weak association features of the real-time user network behavior data; S1-2-2-1, using the user network behavior secondary data of the real-time user network behavior data to correspond to the server port and the switch IP address to establish a network communication sub-line; S1-2-2-2, establishing a basic line protocol mapping of the communication sub-line according to the communication sub-line of the real-time user network behavior data and the corresponding communication protocol of the user network behavior sub-data of the real-time user network behavior data; S1-2-2-3, determine whether the server port at the current moment is consistent with the server port at the next adjacent moment, if so, use the basic line protocol mapping as the user association data weak association feature of the real-time user network behavior data, otherwise, obtain the server port at the next adjacent moment as the server port at the current moment, and execute S1-2-2-4; S1-2-2-4, using the current server port and switch IP address to establish an updated network communication sub-line; S1-2-2-5, establishing an update line protocol mapping of the communication sub-line according to the communication protocol corresponding to the updated network communication sub-line and the user network behavior sub-data of the real-time user network behavior data; S1-2-2-6, determine whether the server port at the current moment is consistent with the server port at the next adjacent moment, if so, use the updated line protocol mapping to update the basic line protocol mapping as the user association data weak association feature of the real-time user network behavior data, otherwise, obtain the server port at the next adjacent moment as the server port at the current moment, and return to S1-2-2-4; S1-2-3, using the strong correlation feature of the user correlation data and the weak correlation feature of the user correlation data as the multi-dimensional feature of the user correlation data; S2. Obtaining a continuous basic evaluation analysis result of the user association data based on deep learning according to the multi-dimensional features of the user association data; S2-1, using the multi-dimensional features of the user-related data to establish a comprehensive risk assessment and analysis model for the user-related data based on deep learning; S2-1-1, establishing a first data set using the strong correlation features of the user correlation data of the multi-dimensional features of the user correlation data; S2-1-2, establishing a second data set using the weak correlation characteristics of the user correlation data of the multi-dimensional characteristics of the user correlation data; S2-1-3. Using the first data set as input and the second data set corresponding to the first data set as output, the number of hidden layers is established according to the number of virtual distributed line nodes corresponding to the first data set, and a traffic-port association classification model is established based on deep learning; S2-1-4, using the traffic-port association classification output result of the traffic-port association classification model as input, the corresponding quantity of the second data set as output, and establishing a feature classification quantity model based on deep learning; S2-1-5, using the traffic-port association classification model and the feature classification quantity model as a comprehensive risk assessment analysis model for user association data; S2-2, using the comprehensive risk assessment analysis model of the user-related data to perform cross-analysis processing to obtain a continuous basic assessment analysis result of the user-related data; S2-2-1, using the corresponding time of the real-time user network behavior data as the starting analysis time t; S2-2-2, using the next moment adjacent to the starting analysis moment t as the auxiliary analysis moment t+1; S2-2-3, using the comprehensive risk assessment analysis model of the user association data to obtain the flow-port association classification output results and the feature classification quantity output results of the comprehensive risk assessment analysis model according to the starting analysis time t; S2-2-4, using the comprehensive risk assessment analysis model of the user association data to obtain the flow-port association classification output results and the feature classification quantity output results of the comprehensive risk assessment analysis model according to the auxiliary analysis time t+1; S2-2-5, determine whether the flow-port association classification output result at the starting analysis time t is consistent with the flow-port association classification output result at the auxiliary analysis time t+1, if so, the output flow-port state is stable, otherwise, the output flow-port state is unstable; S2-2-6. Determine whether the feature classification quantity output result at the starting analysis time t is the same as the feature classification quantity output result at the auxiliary analysis time t+1. If so, output the line protocol quantity state as stable, and use the flow-port state and the line protocol quantity state as the continuity basic evaluation analysis result of the user association data. Otherwise, output the line protocol quantity state as unstable, and use the flow-port state and the line protocol quantity state as the continuity basic evaluation analysis result of the user association data. S3. Perform multi-dimensional cross-validation processing according to the continuous basic evaluation and analysis results to obtain multi-dimensional evaluation and analysis results of user-related data.

2. A user-related data multi-dimensional evaluation and analysis method based on deep learning as claimed in claim 1, characterized in that: The multi-dimensional cross-validation processing is performed according to the continuous basic evaluation and analysis results to obtain the multi-dimensional evaluation and analysis results of the user-related data, including: S3-1. Obtain the corresponding historical sustainable basic assessment analysis results according to the sustainable basic assessment analysis results; S3-2. Obtain the risk historical sustainability basic assessment and analysis results based on the historical sustainability basic assessment and analysis results; S3-3. According to the historical risk continuity basic assessment analysis result, the corresponding change rate of the number of line protocols between the historical starting analysis time t and the historical auxiliary analysis time t+1 is obtained as a risk period benchmark template; S3-4, judging whether the number of line protocols in the continuity basic evaluation analysis result is stable, if so, executing S3-5, otherwise, directly executing S3-6; S3-5, determine whether the change rate corresponding to the number of line protocols is the same as the risk period benchmark template. If so, output the weak correlation feature of the user-related data corresponding to the continuity basic evaluation analysis result as the multi-dimensional evaluation analysis result of the user-related data; otherwise, use the strong correlation feature of the user-related data corresponding to the risk period benchmark template and the weak correlation feature of the user-related data to update the first data set and the second data set respectively, and return to S2-1-1; S3-6. Determine whether the traffic-port status of the continuity basic evaluation analysis result is stable. If so, update the current time as the starting analysis time t and return to S2-2-1. Otherwise, output the strong correlation characteristics of the user-related data corresponding to the continuity basic evaluation analysis result as the multi-dimensional evaluation analysis result of the user-related data.

Images