User behavior identification method, system, electronic device and storage medium

Abstract

The present invention provides a user behavior identification method, system, electronic device and storage medium, which relates to the field of data processing technology. The method includes: obtaining target behavior data corresponding to the user to be analyzed; inputting the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with sample feature vectors corresponding to the sample behavior data and behavior categories corresponding to the sample feature vectors as nodes. The present invention improves the accuracy and stability of user behavior identification.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a user behavior recognition method, system, electronic device and storage medium. Background Art

[0002] In an enterprise network, users' network and file access behaviors need to be monitored and analyzed to identify potential security risks or abnormal behavior patterns.

[0003] Current user behavior analysis solutions are mainly divided into the following categories: rule-based user behavior analysis solutions, machine learning-based analysis solutions, deep learning model-based user behavior analysis solutions, graph analysis-based analysis solutions, and real-time streaming analysis-based user behavior analysis solutions.

[0004] However, existing user behavior analysis solutions still have shortcomings. For example, rule-based user behavior analysis solutions require frequent adjustments and have limited detection capabilities; machine learning solutions rely on high-quality big data and require continuous maintenance; deep learning solutions are prone to privacy, difficult to explain, and have poor real-time performance; graph analysis solutions have high computational costs and require frequent updates; and real-time streaming analysis faces the challenges of large resource requirements and reduced detection effects. Therefore, there is an urgent need for a user behavior recognition method, system, electronic device, and storage medium to solve the above problems. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides a user behavior identification method, system, electronic device and storage medium.

[0006] The present invention provides a user behavior identification method, comprising:

[0007] Obtain target behavior data corresponding to the user to be analyzed;

[0008] Inputting the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels;

[0009] The target high-dimensional feature vector is input into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with the sample feature vector corresponding to the sample behavior data and the behavior category corresponding to the sample feature vector as nodes.

[0010] According to a user behavior recognition method provided by the present invention, the deep feature extraction model is trained by the following steps:

[0011] Obtain sample behavior data;

[0012] Constructing a training sample set according to the sample behavior data and the behavior labels corresponding to the sample behavior data, wherein the behavior labels include normal behavior labels and abnormal behavior labels;

[0013] The deep learning model is trained according to the training sample set and the preset loss function until the number of training times reaches the preset number of training times, or until the loss function value in the training process converges, to obtain the deep feature extraction model, wherein the preset loss function is constructed based on the focal loss.

[0014] According to a user behavior identification method provided by the present invention, the uncertainty measurement model is constructed by the following steps:

[0015] Determining a basic node in the Bayesian network according to a sample feature vector corresponding to the sample behavior data;

[0016] Determining a behavior category node in the Bayesian network according to the behavior category corresponding to the sample feature vector;

[0017] Constructing directed edges in the Bayesian network according to the dependency relationship between the basic nodes and the correlation between the basic nodes and the behavior category nodes;

[0018] A Bayesian network is constructed based on the basic nodes, the behavior category nodes, the directed edges and the conditional probability table to obtain the uncertainty measurement model, wherein the conditional probability table is constructed based on the probability distribution of each node in the Bayesian network under the corresponding parent node state.

[0019] According to a user behavior recognition method provided by the present invention, the deep learning model includes a gated recurrent unit stacking layer formed by stacking a plurality of gated recurrent units;

[0020] After the deep learning model is trained according to the training sample set and the preset loss function until the number of training times reaches a preset number of training times, or until the loss function value in the training process converges, and the deep feature extraction model is obtained, the method further includes:

[0021] Obtaining a sample high-dimensional feature vector output by the gated recurrent unit stacking layer in the deep feature extraction model;

[0022] Performing dimensionality reduction processing on the sample high-dimensional feature vector to obtain the sample high-dimensional feature vector after dimensionality reduction processing;

[0023] The sample high-dimensional feature vector after the dimensionality reduction process is discretized to obtain the sample feature vector corresponding to the sample behavior data.

[0024] According to a user behavior identification method provided by the present invention, the formula of the preset loss function is:

[0025]

[0026]

[0027] in, Indicates the total number of sample behavior data, Indicates The model prediction probability corresponding to the sample behavior data, represents the category balance factor, represents the tuning parameter of the focus loss, Indicates The true label corresponding to the sample behavior data, represents the weight of uncertainty regularization, represents the uncertainty regularization term.

[0028] According to a user behavior identification method provided by the present invention, after inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, the method further includes:

[0029] According to the target behavior data and the behavior label corresponding to the target behavior data, updating the parameters of the fully connected layer in the deep feature extraction model to obtain an updated deep feature extraction model;

[0030] Based on variational inference, the uncertainty measurement model is updated according to the target behavior data to obtain an updated uncertainty measurement model.

[0031] According to a user behavior identification method provided by the present invention, the target high-dimensional feature vector is input into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, including:

[0032] Based on the uncertainty measurement model, the behavior category confidence is judged, wherein the behavior category confidence includes the abnormal behavior category posterior probability and the abnormal category posterior probability distribution;

[0033] If the abnormal behavior category posterior probability is greater than a preset posterior probability threshold, and the abnormal category posterior probability distribution is less than a preset posterior probability distribution, then determining that the behavior category corresponding to the behavior category confidence is an abnormal behavior;

[0034] If the abnormal behavior category posterior probability is greater than the preset posterior probability threshold, and the abnormal category posterior probability distribution is greater than the preset posterior probability distribution, or the abnormal behavior category posterior probability is less than the preset posterior probability threshold, and the abnormal category posterior probability distribution is greater than the preset posterior probability distribution, then determine that the behavior category corresponding to the behavior category confidence is an unrecognized behavior;

[0035] If the abnormal behavior category posterior probability is less than the preset posterior probability threshold, and the abnormal category posterior probability distribution is less than the preset posterior probability distribution, then the behavior category corresponding to the behavior category confidence is determined to be normal behavior.

[0036] The present invention also provides a user behavior identification system, comprising:

[0037] A data collection module is used to obtain target behavior data corresponding to the user to be analyzed;

[0038] A feature extraction module, used to input the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels;

[0039] A behavior recognition module is used to input the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with the sample feature vector corresponding to the sample behavior data and the behavior category corresponding to the sample feature vector as nodes.

[0040] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the user behavior recognition methods described above is implemented.

[0041] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the user behavior identification method as described in any one of the above is implemented.

[0042] The user behavior identification method, system, electronic device and storage medium provided by the present invention analyze user behavior and identify potential internal threats by introducing a combination of Bayesian network and deep learning model, thereby outputting a user behavior risk score with confidence, thereby improving the accuracy and stability of user behavior identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A schematic diagram of the flow of the user behavior identification method provided by the present invention;

[0045] Figure 2 A schematic diagram of the overall process of the user behavior recognition method based on uncertainty learning provided by the present invention;

[0046] Figure 3 A schematic diagram of the structure of the user behavior identification system provided by the present invention;

[0047] Figure 4 This is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Currently, user behavior analysis solutions are mainly divided into the following categories: Rule-based analysis solutions, which rely on pre-set rules to monitor specific behavior patterns or activity frequencies to analyze users' network behaviors. Machine learning-based analysis solutions use unsupervised or semi-supervised learning techniques, such as K-means clustering and isolation forest, to identify abnormal user behaviors. Deep learning model-based analysis solutions use deep learning technology to capture and analyze abnormal features in user behaviors, which helps to discover potential internal threats or abnormal operations. Graph analysis-based solutions depict the complex relationships between users, resources, and behaviors by building a graph structure, and use graph analysis technology to detect abnormal behaviors and potential threats. User behavior analysis solutions based on real-time streaming analysis focus on real-time processing and analysis of continuously inflowing user behavior data streams, aiming to promptly identify and respond to abnormal behaviors and potential threats.

[0050] However, current user behavior analysis solutions each have different characteristics and limitations, as shown below:

[0051] Rule-based analysis solutions rely on a set of predefined rules to detect and identify abnormal behaviors. These rules cover multiple aspects of user behavior, such as access frequency, operation type, time, and resource permissions. However, this solution requires regular maintenance and updating of the rule base to adapt to changes in user behavior patterns or business needs. At the same time, this method has weak detection capabilities for complex or hidden attack behaviors, and setting rules that are too strict may lead to false positives, while setting rules that are too loose may miss real threats.

[0052] Machine learning-based analysis solutions rely on the quality and quantity of data. A large amount of data is required to achieve ideal results, but noise, errors, and outliers in the data may cause model deviations. In addition, user behavior patterns change over time, so the model needs to be updated and retrained regularly. Maintaining and updating machine learning models is an ongoing task, which increases long-term costs.

[0053] Analysis solutions based on deep learning models also require a large amount of data for training. However, when the data is insufficient or of low quality, the model performance will drop significantly. In addition, deep learning models may involve user privacy issues, and there is a risk of leakage when data is transmitted or stored in centralized systems. At the same time, deep learning models are often regarded as "black box" models, and their internal operating mechanisms are difficult to explain, which is not conducive to network security analysis. In the case of real-time detection of large amounts of data, the computational delay of deep learning models may become a bottleneck.

[0054] Graph-based analysis solutions can capture the complex relationships between users, resources, and behaviors, and are particularly suitable for large-scale network environments. However, the construction and analysis of large-scale graph structures require high computational costs, which may become a bottleneck, especially in real-time detection. In addition, user behavior changes over time, which will cause the graph structure to change, so the graph structure and model need to be updated frequently. Strict privacy protection measures are also required when processing and storing graph structures.

[0055] Solutions based on real-time streaming analysis use stream processing technology to process massive, rapidly changing data with low latency, and combine it with machine learning or rule engines to detect and respond to abnormal behavior. However, real-time processing requires powerful computing resource support, especially when the data flow is large, the system's computing load and storage requirements are high. At the same time, the real-time detection model needs to find a balance between fast processing and accurate identification of anomalies, and the model complexity cannot be too high. When user behavior patterns change rapidly, the detection effect may be reduced, so the solution needs to frequently adjust thresholds and model parameters to adapt to changes.

[0056] In view of the problems existing in the above-mentioned prior art, the present invention provides a user behavior analysis solution based on uncertainty learning, which combines the advantages of uncertainty prediction (specifically using Bayesian network) and deep learning model. The present invention can learn the time series characteristics of user behavior through deep neural network, and extract high-dimensional behavior feature patterns from it to accurately capture the correlation and sequence between complex behaviors.

[0057] Furthermore, the present invention constructs an uncertainty prediction model, which uses the features output by the deep learning model as input, and based on the distribution of historical data, deeply analyzes the intrinsic connection between specific behaviors and potential risks. In this way, the uncertainty prediction model can dynamically update its judgment of abnormal events and output a risk score with confidence. When the user's behavior risk score exceeds the preset risk threshold, the behavior will be considered risky. In addition, the present invention is also highly adaptable and flexible. As user behavior and network environment continue to change, it can be updated periodically, thereby effectively responding to the dynamic changes in network behavior and ensuring long-term analysis accuracy and stability.

[0058] Figure 1 A flow chart of the user behavior identification method provided by the present invention is shown in FIG. Figure 1 As shown, the present invention provides a user behavior identification method, comprising:

[0059] Step 101, obtaining target behavior data corresponding to the user to be analyzed.

[0060] In the present invention, when obtaining the target behavior data corresponding to the user to be analyzed, we mainly rely on a series of data sources related to user activities and extract key behavior information from them. These data sources usually include but are not limited to network access logs, file access records, and login logs.

[0061] First, from the network access log, we can obtain key behavioral data such as the user's login time, IP address, and device type. The login time reflects the user's active period, the IP address can reveal the user's geographical location or network environment, and the device type helps us understand what device the user uses to access (such as mobile phone, tablet or computer).

[0062] Secondly, file access records provide us with detailed information such as the path users use to access files, access frequency, and access data transfer volume. The access path reveals which files or resources users are interested in, the access frequency reflects the degree of user dependence on specific resources, and the access data transfer volume helps us evaluate the data consumption of user activities.

[0063] Finally, login logs, as another important data source, record the user's login behavior, including login time, login device, login success or failure, etc. This information is of great significance for analyzing user login habits, identifying abnormal login behavior, and preventing potential security risks.

[0064] In summary, by integrating and analyzing these user behavior data from different data sources, we can obtain the target behavior data corresponding to the users to be analyzed, thereby providing strong data support for subsequent user behavior analysis.

[0065] Step 102: input the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels.

[0066] In the present invention, after the deep feature extraction model processes the input data, it will output one or more high-dimensional feature vectors. These high-dimensional feature vectors are the features extracted from the input data by the deep feature extraction model. They contain sufficient information to characterize the essential characteristics of the input data and can be used for subsequent analysis or recognition tasks.

[0067] Step 103: input the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with the sample feature vector corresponding to the sample behavior data and the behavior category corresponding to the sample feature vector as nodes.

[0068] In the present invention, the uncertainty measurement model receives the target high-dimensional feature vector as input and outputs confidence scores of one or more behavior categories, which reflect the probability that the target behavior data belongs to each behavior category. In the present invention, the uncertainty measurement model is constructed based on the Bayesian network, which is a graphical model used to represent the probabilistic relationship between variables. The Bayesian network describes the relationship between the feature vector and the behavior category through the connection between nodes (i.e., edges) and the conditional probability table, and then calculates the probability (i.e., confidence) of belonging to each behavior category.

[0069] The user behavior identification method provided by the present invention analyzes user behavior and identifies potential internal threats by introducing a combination of Bayesian networks and deep learning models, thereby outputting a user behavior risk score with confidence, thereby improving the accuracy and stability of user behavior identification.

[0070] Based on the above embodiment, the deep feature extraction model is trained by the following steps:

[0071] Obtain sample behavior data;

[0072] Constructing a training sample set according to the sample behavior data and the behavior labels corresponding to the sample behavior data, wherein the behavior labels include normal behavior labels and abnormal behavior labels;

[0073] The deep learning model is trained according to the training sample set and the preset loss function until the number of training times reaches the preset number of training times, or until the loss function value in the training process converges, to obtain the deep feature extraction model, wherein the preset loss function is constructed based on the focal loss.

[0074] In the present invention, historical behavior data of users are collected, and the data sources include network access logs, file access records, login logs, etc., to ensure sufficient sample size, and then remove irrelevant or noisy data from these historical behavior data to facilitate subsequent modeling.

[0075] Furthermore, preliminary feature extraction is performed based on the user behavior type, including login time, IP address, device type, access file path, access frequency, and access data transmission volume, etc., which are mapped into digital vector form as the initial vector feature of the user behavior data. At the same time, a standardization method is used to subtract the mean of each feature value and divide it by its standard deviation, so as to convert the data into a standard normal distribution and obtain sample behavior data. The present invention eliminates the dimensional differences between different features to prevent the influence of some feature values ​​that are too large on model training.

[0076] In the present invention, sample behavior data includes but is not limited to the user's login time, operation sequence, pages or resources visited, and interaction methods with the system. These data are collected through logging, monitoring tools, or user behavior tracking systems. Behavior labels are the classification or annotation of these behavior data, that is, whether each behavior of the guidance model is normal or abnormal. Normal behavior labels represent behaviors that meet system expectations and do not cause security or compliance issues, such as users using company computers for normal file editing and email sending during working hours. Abnormal behavior labels are used to mark behaviors that may indicate potential security risks or violations, such as frequent login attempts during non-working hours, abnormal patterns of access to sensitive data, or unauthorized remote access.

[0077] When constructing a training sample set, the present invention pairs each sample behavior data with its corresponding behavior label to form a complete training sample. These training samples are organized into a data set for training a machine learning model to enable it to learn and identify the difference between normal behavior and abnormal behavior.

[0078] Based on the above embodiment, the deep learning model includes a gated recurrent unit stacking layer formed by stacking a plurality of gated recurrent units;

[0079] In the present invention, the deep learning model is composed of a gated recurrent unit (GRU). As a variant of the recurrent neural network (RNN), GRU can effectively alleviate the gradient vanishing problem and can well capture the dependencies in the time series. In the present invention, the initial vector features of the standardized user behavior data are used as input, and multiple GRUs are stacked in the deep learning model, and then further processed by the fully connected layer to be converted into the output format required for the classification task, wherein the output layer uses the Softmax function to perform model training on the binary classification task (normal and abnormal).

[0080] Specifically, in the present invention, the preset loss function is constructed based on focal loss, which is a loss function that can be used to deal with category imbalance problems, especially in tasks such as target detection, which can help the model pay more attention to samples that are difficult to classify. When training a deep learning model, the goal is to adjust the parameters of the model to minimize this loss function, which can be achieved through a back-propagation algorithm, which calculates the gradient of the loss function with respect to the model parameters and uses these gradients to update the parameters. The training process is continued until the loss function value converges (the loss value no longer decreases) or the model training times reaches a preset number of training times to ensure that the model will neither stop training too early (causing underfitting) nor overtrain (causing overfitting). After determining that the model has been trained well enough, the training can be stopped to obtain a deep feature extraction model.

[0081] Based on the above embodiment, the uncertainty measurement model is constructed by the following steps:

[0082] Determining a basic node in the Bayesian network according to a sample feature vector corresponding to the sample behavior data;

[0083] Determining a behavior category node in the Bayesian network according to the behavior category corresponding to the sample feature vector;

[0084] Constructing directed edges in the Bayesian network according to the dependency relationship between the basic nodes and the correlation between the basic nodes and the behavior category nodes;

[0085] A Bayesian network is constructed based on the basic nodes, the behavior category nodes, the directed edges and the conditional probability table to obtain the uncertainty measurement model, wherein the conditional probability table is constructed based on the probability distribution of each node in the Bayesian network under the corresponding parent node state.

[0086] The nodes of a Bayesian network usually process discrete or finite continuous states, while the high-dimensional feature vectors of samples output by the stacked layers of gated recurrent units in a deep feature extraction model may be continuous values ​​with high dimensions. Therefore, these high-dimensional feature vectors of samples need to be reduced in dimension and discretized to fit the Bayesian network.

[0087] Preferably, after the deep learning model is trained according to the training sample set and the preset loss function until the number of training times reaches a preset number of training times, or until the loss function value in the training process converges to obtain the deep feature extraction model, the method further includes:

[0088] Obtaining a sample high-dimensional feature vector output by the gated recurrent unit stacking layer in the deep feature extraction model;

[0089] Performing dimensionality reduction processing on the sample high-dimensional feature vector to obtain the sample high-dimensional feature vector after dimensionality reduction processing;

[0090] Discretization is performed on the sample high-dimensional feature vector after the dimensionality reduction process to obtain the sample feature vector corresponding to the sample behavior data.

[0091] In the present invention, the high-dimensional feature vector (i.e., the sample feature vector) corresponding to the sample behavior data is reduced in dimensionality by using an autoencoder. The autoencoder model includes two parts, namely, an encoder and a decoder, wherein the encoder part gradually compresses the input data into a low-dimensional representation through multiple hidden layers to extract the main features of the data; the decoder part gradually reconstructs the input data through another hidden layer and outputs a reconstructed result that is as similar as possible to the original input. The present invention uses the encoder part in the trained autoencoder to compress and reduce the dimensionality of the high-dimensional feature vector of the user behavior data.

[0092] Furthermore, in order to adapt the Bayesian network, the sample feature vector after dimensionality reduction can be discretized by dividing the continuous feature into several intervals, each of which represents a discrete value. Then the feature vector is reduced in dimension and discretized into a set of discrete features. , where each is a discrete random variable.

[0093] After the high-dimensional feature vector of the sample is reduced in dimension and discretized, the discretized feature vector components are used as the basic nodes of the Bayesian network in the Bayesian network; at the same time, a behavior category node (normal or abnormal) is added to the Bayesian network to store the prediction results of the model.

[0094] Furthermore, the conditional dependency of each node is determined in the Bayesian network. The present invention constructs a dependency graph based on the interrelationships of features and the influence of behavior category nodes. Pointing from the behavior category node to each feature node represents the direct influence of the behavior category on each feature; at the same time, further edges are added according to the relationship between features. For example, if a feature and There is a strong conditional dependency between them, then and A directed edge is established between the behavior category nodes. If the behavior category "abnormal" is highly correlated with certain features (such as access time frequency), an edge can be directly established between the behavior category node and these feature nodes.

[0095] Furthermore, a conditional probability table (CPT) is constructed. In the present invention, the conditional probability table defines the probability distribution of each node given the state of its parent node, and these conditional probabilities are used to describe the distribution characteristics of behavior categories under different feature combinations. The present invention uses existing user behavior data to count the frequency distribution of each feature, that is, to count the occurrence frequency of each feature state when the behavior category is normal or abnormal.

[0096] In the present invention, the behavior category node is the output node of the entire network, and its conditional probability table determines the probability that the behavior category is abnormal under different feature combinations. The conditional probability table of the behavior category node is used by counting the proportion of the behavior category under different feature conditions.

[0097] Furthermore, after the Bayesian network is constructed, it is possible to infer the given user behavior data, determine whether it is abnormal, and quantify the uncertainty of the prediction. The present invention takes the reduced dimensionality feature vector as input, discretizes it and inputs it into the Bayesian network to calculate the posterior probability that the behavior category is abnormal. In order to judge the uncertainty of the prediction results, the present invention quantifies it through indicators such as entropy, so that the uncertainty is represented by the entropy of the posterior probability distribution of the behavior category node (i.e., the posterior probability distribution of the abnormal category), and the formula is as follows:

[0098]

[0099] The posterior probability that the behavior category is abnormal :

[0100]

[0101] in, represents the conditional probability of the feature vector when the behavior category is abnormal; Represents the prior probability of the abnormal category, which can be a fixed value obtained by statistics of training data; is the observed eigenvector The marginal probability of .

[0102] The present invention uses the structure of Bayesian network and conditional probability table (CPT) to calculate , the joint probability of the feature vector is obtained by multiplying the conditional probabilities of each feature. The formula is:

[0103]

[0104] in, is the conditional probability of each feature given its parent node (including the behavior category abnormality).

[0105] By using the total probability formula, the eigenvector is calculated. The marginal probability , the formula is:

[0106]

[0107] in, and They are the conditional probability and prior probability of the feature when the behavior category is normal.

[0108] Based on the above embodiment, the formula of the preset loss function is:

[0109]

[0110]

[0111] in, Indicates the total number of sample behavior data, Indicates The model prediction probability corresponding to the sample behavior data; represents the class balance factor, which is used to control the weights of normal and abnormal classes in the loss; represents the adjustment parameter of the focal loss, which is used to adjust the model's attention to the confused samples; Indicates The true label corresponding to the sample behavior data (1 indicates abnormality, 0 indicates normality), Represents the weight of uncertainty regularization, which is used to adjust the strength of the regularization term; represents the uncertainty regularization term, which calculates the uncertainty based on the predicted entropy value.

[0112] In real scenarios, the amount of normal user behavior data is much larger than abnormal user behavior data. In order to better adapt to anomaly detection in user behavior analysis, the present invention adopts an innovative loss function, takes uncertainty and category imbalance in anomaly detection into account, and combines the concepts of focal loss and uncertainty regularization to adapt to the high uncertainty and category imbalance problems that may occur in anomaly detection.

[0113] Specifically, focal loss can play a role when the categories are unbalanced, by giving higher weights to samples that are difficult to classify, thereby increasing the model's attention to abnormal categories with fewer samples. The present invention adds a penalty term based on the uncertainty of model predictions, which can help the model distinguish between abnormal and normal behaviors more robustly. By measuring the model's confidence (i.e., uncertainty) in each prediction, more attention can be paid to samples that the model is uncertain about, thereby reducing false positives and false negatives.

[0114] The present invention calculates the loss value according to the above preset loss function, performs back propagation and updates the parameters to train the recognition model. After the model training is completed, the output of the gated recurrent unit stacking layer in the deep learning model is used as the high-dimensional feature vector of the user behavior data, which is used as the input of the subsequent analysis model (i.e., the uncertainty measurement model).

[0115] On the basis of the above embodiment, after inputting the target high-dimensional feature vector into the uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, the method further includes:

[0116] According to the target behavior data and the behavior label corresponding to the target behavior data, updating the parameters of the fully connected layer in the deep feature extraction model to obtain an updated deep feature extraction model;

[0117] Based on variational inference, the uncertainty measurement model is updated according to the target behavior data to obtain an updated uncertainty measurement model.

[0118] In the present invention, the deep learning model is responsible for extracting time series features from user behavior data. In order to adapt to emerging user behavior patterns, the present invention regularly samples the latest user behavior data set and fine-tunes some parameters in the deep learning model through the collected new data, which can not only adapt to changes in data distribution, but also avoid the computational cost caused by full retraining.

[0119] During the fine-tuning process, the present invention freezes the parameters of some layers (gated recurrent unit stacking layers), only fine-tunes the high layers (fully connected layers), and uses the same loss function as that for training the GRU neural network (i.e., the preset loss function in the above embodiment) for training. This can retain the existing generalization ability of the model while reducing the amount of calculation required for fine-tuning.

[0120] Furthermore, the present invention uses variational inference to dynamically update the Bayesian network based on new user behavior data, so that the uncertainty independence model can better adapt to the changing user behavior patterns.

[0121] Specifically, when new user behavior data is obtained Finally, we use this data to update the parameters of the Bayesian network to better reflect the latest user behavior patterns. First, we choose Gaussian distribution as the approximate distribution. ,Will It is set as the product of multiple independent factors, that is:

[0122] ;

[0123] In order to maximize the approximate distribution of variational inference and the true posterior distribution Similarly, maximize the evidence lower bound (ELBO):

[0124]

[0125] in, Represents new user behavior data Log-likelihood expectation. express and the prior distribution The KL divergence between is used to constrain Approximate the true posterior distribution.

[0126] Furthermore, using the current distribution, log-likelihood of the data Perform sampling estimation and obtain its The expectations below.

[0127] calculate and The KL divergence of is updated by back-propagation or stochastic gradient descent The parameters are set to maximize the ELBO, and the process is iterated until the ELBO converges.

[0128] Before the Bayesian network performs dynamic updates, the original parameters of the Bayesian network are As the initial value. When new data arrives, set it as the current . Every time a new batch of user behavior data When it arrives, re-execute the above variational inference steps to set the network parameters Updated to adapt to the latest data distribution status.

[0129] In the present invention, in order to ensure that the network maintains accuracy in a constantly changing data environment, the Bayesian network is updated at fixed time intervals or data batches. as a prior distribution and retrain using the latest data.

[0130] After completing the dynamic update, use the latest Parameters can perform prediction and reasoning of user behavior. The Bayesian network under the new parameters can more accurately reflect the current user behavior characteristics, thereby improving the accuracy of abnormal behavior detection.

[0131] On the basis of the above embodiment, the step of inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model includes:

[0132] Based on the uncertainty measurement model, the behavior category confidence is judged, wherein the behavior category confidence includes the abnormal behavior category posterior probability and the abnormal category posterior probability distribution;

[0133] If the abnormal behavior category posterior probability is greater than a preset posterior probability threshold, and the abnormal category posterior probability distribution is less than a preset posterior probability distribution, then determining that the behavior category corresponding to the behavior category confidence is an abnormal behavior;

[0134] If the abnormal behavior category posterior probability is greater than the preset posterior probability threshold, and the abnormal category posterior probability distribution is greater than the preset posterior probability distribution, or the abnormal behavior category posterior probability is less than the preset posterior probability threshold, and the abnormal category posterior probability distribution is greater than the preset posterior probability distribution, then determine that the behavior category corresponding to the behavior category confidence is an unrecognized behavior;

[0135] If the abnormal behavior category posterior probability is less than the preset posterior probability threshold, and the abnormal category posterior probability distribution is less than the preset posterior probability distribution, then the behavior category corresponding to the behavior category confidence is determined to be normal behavior.

[0136] In the present invention, based on the confidence of behavior category, user behavior categories are divided into three categories: abnormal behavior, unrecognized behavior and normal behavior. The basis for judgment is two key factors: one is the posterior probability of abnormal behavior category ; The second is the entropy of the posterior probability distribution of the behavior category node (i.e., the posterior probability distribution of the abnormal category), wherein the preset posterior probability threshold and the preset posterior probability distribution in the present invention can be determined by historical data.

[0137] Specifically, if the behavior category is abnormal, the posterior probability If the entropy of the posterior probability distribution of the behavior category node is lower than the preset posterior probability distribution, the behavior category is marked as abnormal behavior.

[0138] If the behavior category is abnormal, the posterior probability The posterior probability of the behavior category node is higher than the preset posterior probability threshold, the entropy of the posterior probability distribution of the behavior category node is higher than the preset posterior probability distribution, or the posterior probability of the behavior category is abnormal. If the entropy of the posterior probability distribution of the behavior category node is lower than the preset posterior probability threshold, and higher than the preset posterior probability distribution, it is marked as an unrecognized behavior. In the present invention, the unrecognized behavior can be further identified manually, or re-identified after the subsequent parameter update of the deep feature extraction model and the uncertainty measurement model, so as to determine the category of the user behavior.

[0139] If the behavior category is abnormal, the posterior probability If the entropy of the posterior probability distribution of the behavior category node is lower than the preset posterior probability threshold, the behavior category is marked as normal behavior.

[0140] Figure 2 The overall flow chart of the user behavior recognition method based on uncertainty learning provided by the present invention can be referred to Figure 2 As shown, in the present invention, the user's login time, IP address and other basic information are first collected. This information is a preliminary record of the user's behavior and is used for subsequent feature extraction and analysis. Then, the login time and IP address and other information are subjected to original feature mapping and standardization to ensure the consistency and comparability of the feature data.

[0141] Furthermore, the GRU (Gated Recurrent Unit) neural network is used to extract high-dimensional features, and then the AutoEncoder is used to encode and decode the feature vectors, thereby reducing the dimensionality of the extracted high-dimensional features to reduce the data dimension and computational complexity. The features after dimensionality reduction are discretized and converted into discrete values ​​to facilitate subsequent classification and recognition.

[0142] In the present invention, GRU is used to build a deep learning model to model complex behavioral associations, so as to better analyze long-term behavioral trends. In addition, during the training process, labeled data (normal and abnormal behaviors) are used to guide model learning, and weights are updated through back propagation. After the GRU model learns the sequence data, the high-dimensional feature vector generated contains the deep-level features of the user behavior, which is used for subsequent uncertainty analysis.

[0143] Furthermore, the high-level feature vectors extracted by the deep learning module will be used as the input of the Bayesian network, and further modeled by the Bayesian network to calculate the probability distribution of various behaviors. The present invention constructs a Bayesian network structure that reflects the feature dependency relationship based on the characteristics of user behavior data. According to the reasoning results of the Bayesian network, the risk score of each behavior is calculated, wherein the risk score is obtained based on the joint distribution of the features, reflecting the uncertainty and abnormality of the behavior.

[0144] Moreover, in the present invention, dynamic updating and adaptive learning of the model can be realized to ensure that the system can adapt to new behavior pattern changes in long-term operation. The present invention regularly fine-tunes the high-level of the deep learning model to adapt to changes in data distribution. At the same time, the prior and conditional probabilities of the Bayesian network are regularly adjusted through the variational inference method to ensure that the network can effectively reflect the distribution of new data.

[0145] The user behavior identification system provided by the present invention is described below. The user behavior identification system described below and the user behavior identification method described above can be referenced to each other.

[0146] Figure 3 A schematic diagram of the structure of the user behavior recognition system provided by the present invention is shown in FIG. Figure 3 As shown, the present invention provides a user behavior identification system, including a data acquisition module 301, a feature extraction module 302 and a behavior identification module 303, wherein the data acquisition module 301 is used to obtain target behavior data corresponding to the user to be analyzed; the feature extraction module 302 is used to input the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; the behavior identification module 303 is used to input the target high-dimensional feature vector into an uncertainty measurement model to obtain a behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with sample feature vectors corresponding to the sample behavior data and behavior categories corresponding to the sample feature vectors as nodes.

[0147] The user behavior identification system provided by the present invention analyzes user behavior and identifies potential internal threats by introducing a combination of Bayesian networks and deep learning models, thereby outputting a user behavior risk score with confidence, thereby improving the accuracy and stability of user behavior identification.

[0148] The system provided in the embodiment of the present invention is used to execute the above-mentioned method embodiments. Please refer to the above-mentioned embodiments for the specific process and detailed contents, which will not be repeated here.

[0149] Figure 4 A schematic diagram of the structure of an electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor (Processor) 401, a communication interface (Communications Interface) 402, a memory (Memory) 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 complete mutual communication through the communication bus 404. The processor 401 may call the logic instructions in the memory 403 to execute the user behavior recognition method, which includes: obtaining the target behavior data corresponding to the user to be analyzed; inputting the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with the sample feature vector corresponding to the sample behavior data and the behavior category corresponding to the sample feature vector as nodes.

[0150] In addition, the logic instructions in the above-mentioned memory 403 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0151] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the user behavior identification method provided by the above methods, and the method includes: obtaining target behavior data corresponding to the user to be analyzed; inputting the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with sample feature vectors corresponding to the sample behavior data and behavior categories corresponding to the sample feature vectors as nodes.

[0152] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the user behavior identification method provided by the above-mentioned embodiments, the method comprising: obtaining target behavior data corresponding to the user to be analyzed; inputting the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed from a Bayesian network with sample feature vectors corresponding to the sample behavior data and behavior categories corresponding to the sample feature vectors as nodes.

[0153] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A user behavior identification method, characterized in that: include: Obtain target behavior data corresponding to the user to be analyzed; Inputting the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; Inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the confidence of the behavior category corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with the sample feature vector corresponding to the sample behavior data and the behavior category corresponding to the sample feature vector as nodes; The deep feature extraction model is trained by the following steps: Obtain sample behavior data; Constructing a training sample set according to the sample behavior data and the behavior labels corresponding to the sample behavior data, wherein the behavior labels include normal behavior labels and abnormal behavior labels; According to the training sample set and the preset loss function, the deep learning model is trained until the number of training times reaches the preset number of training times, or until the loss function value in the training process converges, to obtain the deep feature extraction model, wherein the preset loss function is constructed based on the focal loss; The uncertainty measurement model is constructed by the following steps: Determining a basic node in the Bayesian network according to a sample feature vector corresponding to the sample behavior data; Determining a behavior category node in the Bayesian network according to the behavior category corresponding to the sample feature vector; Constructing directed edges in the Bayesian network according to the dependency relationship between the basic nodes and the correlation between the basic nodes and the behavior category nodes; A Bayesian network is constructed based on the basic nodes, the behavior category nodes, the directed edges and the conditional probability table to obtain the uncertainty measurement model, wherein the conditional probability table is constructed based on the probability distribution of each node in the Bayesian network under the corresponding parent node state.

2. The user behavior identification method according to claim 1, characterized in that: The deep learning model includes a gated recurrent unit stacking layer formed by stacking a plurality of gated recurrent units; After the deep learning model is trained according to the training sample set and the preset loss function until the number of training times reaches a preset number of training times, or until the loss function value in the training process converges, and the deep feature extraction model is obtained, the method further includes: Obtaining a sample high-dimensional feature vector output by the gated recurrent unit stacking layer in the deep feature extraction model; Performing dimensionality reduction processing on the sample high-dimensional feature vector to obtain the sample high-dimensional feature vector after dimensionality reduction processing; The sample high-dimensional feature vector after the dimensionality reduction process is discretized to obtain the sample feature vector corresponding to the sample behavior data.

3. The user behavior identification method according to claim 1, characterized in that: The formula of the preset loss function is: ； ； in, Indicates the total number of sample behavior data, Indicates The model prediction probability corresponding to the sample behavior data, represents the category balance factor, represents the tuning parameter of the focus loss, Indicates The true label corresponding to the sample behavior data, represents the weight of uncertainty regularization, represents the uncertainty regularization term.

4. The user behavior identification method according to claim 1, characterized in that: After inputting the target high-dimensional feature vector into the uncertainty measurement model to obtain the behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model, the method further includes: According to the target behavior data and the behavior label corresponding to the target behavior data, updating the parameters of the fully connected layer in the deep feature extraction model to obtain an updated deep feature extraction model; Based on variational inference, the uncertainty measurement model is updated according to the target behavior data to obtain an updated uncertainty measurement model.

5. The user behavior identification method according to claim 1, characterized in that: The step of inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain a behavior category confidence corresponding to the target behavior data output by the uncertainty measurement model includes: Based on the uncertainty measurement model, the behavior category confidence is judged, wherein the behavior category confidence includes the abnormal behavior category posterior probability and the abnormal category posterior probability distribution; If the abnormal behavior category posterior probability is greater than a preset posterior probability threshold, and the abnormal category posterior probability distribution is less than a preset posterior probability distribution, then determining that the behavior category corresponding to the behavior category confidence is an abnormal behavior; If the abnormal behavior category posterior probability is greater than the preset posterior probability threshold, and the abnormal category posterior probability distribution is greater than the preset posterior probability distribution, or the abnormal behavior category posterior probability is less than the preset posterior probability threshold, and the abnormal category posterior probability distribution is greater than the preset posterior probability distribution, then determine that the behavior category corresponding to the behavior category confidence is an unrecognized behavior; If the abnormal behavior category posterior probability is less than the preset posterior probability threshold, and the abnormal category posterior probability distribution is less than the preset posterior probability distribution, then the behavior category corresponding to the behavior category confidence is determined to be normal behavior.

6. A user behavior recognition system, characterized in that: include: A data collection module is used to obtain target behavior data corresponding to the user to be analyzed; A feature extraction module, used to input the target behavior data into a deep feature extraction model to obtain a target high-dimensional feature vector corresponding to the target behavior data, wherein the deep feature extraction model is trained based on sample behavior data marked with behavior labels; A behavior recognition module, used for inputting the target high-dimensional feature vector into an uncertainty measurement model to obtain the confidence of the behavior category corresponding to the target behavior data output by the uncertainty measurement model, wherein the uncertainty measurement model is constructed by a Bayesian network with the sample feature vector corresponding to the sample behavior data and the behavior category corresponding to the sample feature vector as nodes; The deep feature extraction model is trained by the following steps: Obtain sample behavior data; Constructing a training sample set according to the sample behavior data and the behavior labels corresponding to the sample behavior data, wherein the behavior labels include normal behavior labels and abnormal behavior labels; According to the training sample set and the preset loss function, the deep learning model is trained until the number of training times reaches the preset number of training times, or until the loss function value in the training process converges, to obtain the deep feature extraction model, wherein the preset loss function is constructed based on the focal loss; The uncertainty measurement model is constructed by the following steps: Determining a basic node in the Bayesian network according to a sample feature vector corresponding to the sample behavior data; Determining a behavior category node in the Bayesian network according to the behavior category corresponding to the sample feature vector; Constructing directed edges in the Bayesian network according to the dependency relationship between the basic nodes and the correlation between the basic nodes and the behavior category nodes; A Bayesian network is constructed based on the basic nodes, the behavior category nodes, the directed edges and the conditional probability table to obtain the uncertainty measurement model, wherein the conditional probability table is constructed based on the probability distribution of each node in the Bayesian network under the corresponding parent node state.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the user behavior identification method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the user behavior identification method according to any one of claims 1 to 5 is implemented.

Images