Scientific and technological product abnormal login behavior identification method and device, equipment and medium

Abstract

The invention provides a scientific and technological product abnormal login behavior identification method and device, equipment and a medium, and solves the problems of limited identification capability, low efficiency and high error rate of an existing abnormal login behavior identification method or model. The method comprises the following steps: acquiring real-time login behavior data generated when a science and technology product is logged in by a user, and preprocessing the real-time login behavior data to obtain preprocessed real-time login behavior data; performing classification based on the preprocessed real-time login behavior data to obtain various classification data, and performing feature extraction on the classification data to obtain a feature set; performing feature fusion based on various feature data in the feature set to obtain a feature vector, and outputting the feature vector to the large language model; and reasoning based on the feature vector to obtain a reasoning result, so that the large language model identifies the abnormal login behavior of the science and technology product through the reasoning result.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to a method, device, equipment and medium for identifying abnormal login behavior of technological products. Background Art

[0002] At present, there are more and more technology products on the market, and in more and more forms, such as mobile applications, web applications, applets, etc. Since most of the above technology products store a variety of users' private information, including their own information and usage information, how to protect the privacy information security of users in technology products is the work direction of a large number of scientific researchers, and abnormal login behavior will damage the information security of users in technology products, so identifying abnormal login behavior of technology products is a key content.

[0003] At present, the identification of abnormal login behavior mainly relies on traditional rule-based methods and machine learning models. These methods and models usually rely on preset rule sets or feature engineering, which have good recognition effects on known attack patterns, but have limited recognition capabilities for new attacks or variant attacks. In addition, these methods often require a lot of manual tuning and feature selection when dealing with complex login behaviors and patterns, resulting in inefficiency and error-prone phenomena. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a method, device, equipment and medium for identifying abnormal login behavior of scientific and technological products. This method, device, equipment and medium for identifying abnormal login behavior of scientific and technological products solves the problems of limited recognition ability, low efficiency and high error rate of current abnormal login behavior identification methods or models.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal login behavior of a technology product, which is applicable to a login behavior identification system, wherein the login behavior identification system includes a large language model, and the method includes:

[0006] Acquire real-time login behavior data generated when a technology product is logged in by a user, and pre-process the real-time login behavior data to obtain pre-processed real-time login behavior data; there are multiple ways to pre-process;

[0007] Based on the pre-processed real-time login behavior data, a plurality of classification data are obtained by classification, and the classification data are subjected to feature extraction to obtain a feature set; the feature set includes a plurality of feature data;

[0008] Performing feature fusion based on multiple feature data in the feature set to obtain a feature vector, and outputting the feature vector to the large language model; the large language model is obtained after fine-tuning the initial large language model;

[0009] Reasoning is performed based on the feature vector to obtain a reasoning result, so that the large language model can identify abnormal login behavior of the technology product through the reasoning result.

[0010] In combination with the first aspect, the embodiment of the present application provides a first possible implementation of the first aspect, wherein the large language model is a specific step obtained after fine-tuning the language model, including:

[0011] Pre-acquire a data set including normal login behavior data and abnormal login behavior data, and output the data set to an initial large language model;

[0012] The initial large language model is trained multiple times based on the data set until a fine-tuning target is reached to obtain a large language model.

[0013] In combination with the first aspect, the embodiment of the present application provides a second possible implementation of the first aspect, wherein the initial large language model is trained multiple times based on the data set until a fine-tuning target is reached to obtain a large language model, including:

[0014] The initial large language model is trained multiple times based on the data set according to the fine-tuning strategy until the fine-tuning target is reached, thereby obtaining an intermediate large language model;

[0015] The intermediate large language model is verified and adjusted multiple times based on the preset verification set to obtain a large language model.

[0016] In combination with the first aspect, the embodiment of the present application provides a third possible implementation of the first aspect, wherein the acquiring of real-time login behavior data generated when the technological product is logged in by a user, and preprocessing the real-time login behavior data to obtain preprocessed real-time login behavior data, includes:

[0017] Cleaning the real-time login behavior data to obtain cleaned real-time login behavior data;

[0018] The partially cleaned real-time login behavior data is processed based on a preset processing method to obtain pre-processed real-time login behavior data.

[0019] In combination with the first aspect, the embodiment of the present application provides a fourth possible implementation of the first aspect, wherein the classification based on the preprocessed real-time login behavior data is performed to obtain a plurality of classification data, and feature extraction is performed on the classification data to obtain a feature set, including:

[0020] Pre-calling a feature extraction method corresponding to the classified data to extract features from the classified data based on the corresponding feature extraction method to obtain corresponding feature data;

[0021] Collect and organize multiple feature data obtained by feature extraction to obtain a feature set.

[0022] In combination with the first aspect, the embodiment of the present application provides a fifth possible implementation of the first aspect, wherein the reasoning based on the feature vector to obtain the reasoning result so that the large language model identifies the abnormal login behavior of the technology product through the reasoning result includes:

[0023] The large language model infers the feature vector from multiple dimensions to obtain multiple dimensional inference results;

[0024] The large language model integrates multiple dimensional reasoning results to obtain a reasoning result.

[0025] In combination with the first aspect, the embodiment of the present application provides a sixth possible implementation of the first aspect, wherein, after the reasoning based on the feature vector is performed to obtain a reasoning result so that the large language model identifies the abnormal login behavior of the technology product through the reasoning result, it also includes:

[0026] The large language model generates warning information for technological products based on the inference result;

[0027] The large language model implements protection measures for technological products based on the alarm information.

[0028] In a second aspect, an embodiment of the present application provides a device for identifying abnormal login behavior of a technology product, the device comprising:

[0029] An acquisition module is used to acquire real-time login behavior data generated when a technology product is logged in by a user, so as to pre-process the real-time login behavior data to obtain pre-processed real-time login behavior data; there are multiple ways of pre-processing;

[0030] A classification module, used for classifying the pre-processed real-time login behavior data to obtain a plurality of classification data, and extracting features from the classification data to obtain a feature set; the feature set includes a plurality of feature data;

[0031] A fusion module, used for performing feature fusion based on multiple feature data in the feature set to obtain a feature vector, and outputting the feature vector to the large language model; the large language model is obtained after fine-tuning the initial large language model;

[0032] The recognition module is used to perform reasoning based on the feature vector to obtain a reasoning result, so that the large language model can identify abnormal login behavior of the technology product through the reasoning result.

[0033] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, any step of the method for identifying abnormal login behavior of a technological product is performed.

[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the computer program executes any one of the steps of the method for identifying abnormal login behavior of a technology product.

[0035] A method for identifying abnormal login behavior of a technology product provided in an embodiment of the present application is applicable to a login behavior identification system, wherein the login behavior identification system includes a large language model. The method first obtains real-time login behavior data generated by a technology product when a user logs in to the product, and preprocesses the real-time login behavior data to obtain preprocessed real-time login behavior data; there are multiple ways of preprocessing; secondly, classification is performed based on the preprocessed real-time login behavior data to obtain multiple classification data, and feature extraction is performed on the classification data to obtain a feature set; the feature set includes multiple feature data; then, feature fusion is performed based on the multiple feature data in the feature set to obtain a feature vector, and the feature vector is output to the large language model; the large language model is an initial large language model. The method is obtained by fine-tuning the model; finally, reasoning is performed based on the feature vector to obtain the reasoning result, so that the large language model can identify the abnormal login behavior of the technology product through the reasoning result, thereby solving the problems of limited recognition ability, low efficiency and high error rate in the current abnormal login behavior recognition method or model, and improving the accuracy and generalization ability of the large language model through the feature set. Through the powerful language understanding and reasoning ability of the large language model, the recognition ability of new and variant attacks is improved, the accuracy and effectiveness of the identified abnormal login behavior are guaranteed, and the recognition ability of the abnormal login behavior is guaranteed, thereby ensuring the privacy information security of the user. Compared with the traditional method and machine learning model, a lot of manual tuning and feature selection work is reduced, the efficiency is improved and the error rate is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A schematic diagram of a process of identifying abnormal login behavior of a first technology product provided in an embodiment of the present application is shown;

[0038] Figure 2 A schematic diagram of a process for obtaining a feature set provided in an embodiment of the present application is shown;

[0039] Figure 3 A schematic diagram of a process for obtaining an inference result provided in an embodiment of the present application is shown;

[0040] Figure 4 A schematic diagram showing the structure of a first device for identifying abnormal login behavior of a technology product provided in an embodiment of the present application is shown;

[0041] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0042] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0043] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0044] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0045] At present, the identification of abnormal login behavior mainly relies on traditional rule-based methods and machine learning models. These methods and models usually rely on preset rule sets or feature engineering, which have good recognition effects on known attack patterns, but have limited recognition capabilities for new attacks or variant attacks. In addition, these methods often require a lot of manual tuning and feature selection when dealing with complex login behaviors and patterns, resulting in inefficiency and error-prone phenomena.

[0046] Based on this, the embodiments of the present application provide a method, device, equipment and medium for identifying abnormal login behavior of technology products, which is described below through embodiments.

[0047] Example 1

[0048] To facilitate understanding of this embodiment, a method for identifying abnormal login behavior of a technology product disclosed in an embodiment of this application is first described in detail. Figure 1 The flowchart of an abnormal login behavior identification of a technology product is shown. The present application provides an abnormal login behavior identification method for a technology product, which is applicable to a login behavior identification system. The login behavior identification system includes a large language model. The method includes:

[0049] S101, obtaining real-time login behavior data generated when a technology product is logged in by a user, and preprocessing the real-time login behavior data to obtain preprocessed real-time login behavior data; the preprocessing method has multiple ways;

[0050] S102, classifying the pre-processed real-time login behavior data to obtain a plurality of classification data, and extracting features from the classification data to obtain a feature set; the feature set includes a plurality of feature data;

[0051] S103, performing feature fusion based on multiple feature data in the feature set to obtain a feature vector, and outputting the feature vector to the large language model; the large language model is obtained after fine-tuning the initial large language model;

[0052] S104: Perform reasoning based on the feature vector to obtain a reasoning result, so that the large language model can identify abnormal login behavior of the technology product through the reasoning result.

[0053] The login behavior recognition system described in this application is placed on the terminal where the technology product is located, and the terminal includes a computer, a server, etc. The large language model has good language understanding and reasoning capabilities and can handle mixed input of natural language and structured data.

[0054] In step S101, the real-time login behavior data generated by the technology product when the user logs in is obtained. The real-time login behavior data can be obtained from a data source. The data source stores relevant data of the technology product when it is logged in. The data source can be the server side of the technology product, or it can be the client side, or it can be a third-party service platform. The real-time login behavior data includes multiple types, such as data fields and device information. The data fields include user ID, login time, and login location. The user ID is a character string that uniquely identifies the user. The login time is a timestamp, accurate to seconds. The login location is an IP address, expressed in dotted decimal format, and the device information includes brand, model, operating system, and login result. The brand, model, and operating system are all expressed in character strings, and the login results include success and failure.

[0055] In order to avoid the large amount of calculation in the real-time login behavior data and the problems in the data, the real-time login behavior data is preprocessed. There are multiple ways of preprocessing. The real-time login behavior data includes user ID, login time, login location, brand, model, operating system, and login result. The corresponding preprocessing method is adopted to preprocess the real-time login behavior data to obtain the preprocessed real-time login behavior data, so as to achieve a better preprocessing effect.

[0056] In the specific implementation process of step S101, there is an embodiment in which the real-time login behavior data generated when the technology product is logged in by the user is obtained, and the real-time login behavior data is pre-processed to obtain the pre-processed real-time login behavior data, including:

[0057] S1011, cleaning the real-time login behavior data to obtain cleaned real-time login behavior data;

[0058] S1012: Processing a portion of the cleaned real-time login behavior data based on a preset processing method to obtain pre-processed real-time login behavior data.

[0059] In steps S1011-S1012, the real-time login behavior data is cleaned to obtain cleaned real-time login behavior data, and the cleaning includes deduplication, that is, firstly judging the repetitiveness in the real-time login behavior data, if there is repetitiveness, then deduplication is performed on the combination of user ID, login time, login location, and device information in the real-time login behavior data, and the deduplication method is not limited here, and the cleaned real-time login behavior data is judged for missing key fields and obvious errors. If the cleaned real-time login behavior data has missing key fields and obvious errors, the cleaned real-time login behavior data with missing key fields and obvious errors is processed using a preset processing method, and the preset processing method can be discarding, that is, discarding the real-time login behavior data with missing key fields or obvious errors, such as user ID, login time, etc., so as to ensure the validity and accuracy of the real-time login behavior data.

[0060] In step S102, after preprocessing the real-time login behavior data to obtain preprocessed real-time login behavior data, the preprocessed real-time login behavior data is classified based on the type of the preprocessed real-time login behavior data to obtain multiple classification data, that is, if there are several types in the real-time login behavior data, several classification data are obtained. For the above existing real-time login behavior data, the real-time login behavior data includes structured data and natural language data, and the obtained classification data includes two types of structured data and natural language data, and feature extraction is performed on the classification data to obtain a feature set, and the feature set includes multiple feature data; before feature extraction, in order to facilitate feature extraction of the features contained in the real-time login behavior data, the structured data is formatted to ensure a unified timestamp format and standardized device information fields, and the natural language data is processed using word segmentation and stop word removal, the word segmentation uses a word segmentation tool suitable for the target language, and the stop word removal uses a predefined stop word list for processing.

[0061] In the specific implementation process of step S102, if Figure 2 As shown, there is an embodiment in which the pre-processed real-time login behavior data is classified to obtain a plurality of classification data, and feature extraction is performed on the classification data to obtain a feature set, including:

[0062] S1021, pre-calling a feature extraction method corresponding to the classification data, so as to extract features from the classification data based on the corresponding feature extraction method to obtain corresponding feature data;

[0063] S1022. Collect and organize multiple feature data obtained by feature extraction to obtain a feature set.

[0064] In steps S1021-S1022, when the classified data is obtained, the feature extraction method corresponding to the classified data is called in advance to perform feature extraction on the classified data based on the corresponding feature extraction method to obtain the corresponding feature data, and the numerical features existing in the structured data are extracted, such as segmenting the IP address in the login location and converting it into an integer, converting the login time into a numerical representation of a timestamp, and converting the operating system in the natural language data into a category label, such as Windows, iOS, Android, etc., and extracting text features from the device information in the natural language data, such as using a word embedding model to vectorize the device brand, model, and operating system. The word embedding model can be a Word2Vec model, and the multiple feature data extracted are collected and organized to obtain a feature set for easy storage and use.

[0065] In step S103, feature fusion is performed based on multiple feature data corresponding to the structural data and natural language data existing in the feature set to obtain a feature vector. The feature fusion may be implemented in multiple ways, such as concatenation, weighted summation or attention mechanism, or in other forms of feature fusion, and the feature vector is output to the large language model; the large language model is obtained after fine-tuning the initial large language model; the initial large language model is usually constructed through deep learning technology, such as Transformer architecture, combined with a large amount of training data and computing resources. Because the initial large language model has good language understanding and reasoning capabilities, it can handle mixed inputs of natural language and structured data, but it cannot obtain accurate reasoning results without fine-tuning. Therefore, the large language model can obtain accurate reasoning results according to the feature vector to ensure the accuracy of the identified abnormal login behavior.

[0066] In the specific implementation process of step S103, there is an embodiment in which the large language model is obtained after the language model is fine-tuned. The specific steps include:

[0067] S1031, pre-acquire a data set including normal login behavior data and abnormal login behavior data, and output the data set to an initial large language model;

[0068] S1032: The initial large language model is trained multiple times based on the data set until a fine-tuning target is achieved to obtain a large language model.

[0069] In steps S1031-S1032, a data set including normal login behavior data and abnormal login behavior data is obtained in advance, and the data set is a historical login behavior data set. The data set is output to an initial large language model. The initial large language model can select Qwen-110B. The initial large language model is trained multiple times with the data set. The large language model will repeatedly learn the text data in the data set and optimize its performance by adjusting the parameters inside the model. The training usually includes multiple iterations. In each iteration, the initial large language model will traverse the entire data set. According to the evaluation results, the parameters of the initial large language model will be updated to improve its performance in the next iteration. After multiple iterations, until the initial large language model can achieve the fine-tuning goal of accurately distinguishing normal login behavior from abnormal login behavior, the iteration is stopped, and the initial large language model that achieves the fine-tuning goal is used as the large language model to infer the feature vector.

[0070] In the specific implementation process of step S1032, there is an embodiment in which the initial large language model is trained multiple times based on the data set until a fine-tuning target is reached to obtain a large language model, including:

[0071] S10321, the initial large language model is trained multiple times according to the fine-tuning strategy based on the data set until the fine-tuning target is reached, thereby obtaining an intermediate large language model;

[0072] S10322. Verify and adjust the intermediate large language model multiple times based on a preset verification set to obtain a large language model.

[0073] In steps S10321-S10322, the initial large language model is trained multiple times based on the data set fine-tuning strategy. The fine-tuning strategy evaluates its performance according to a loss function such as a cross entropy loss function, and stops training when the value of the cross entropy loss function is the minimum. In this process, an optimizer is set. The optimizer can be Adam, and the learning rate is set to 1e-5 to achieve the fine-tuning target faster. The initial large language model that achieves the fine-tuning target is set as an intermediate large language model, and the validation set is called to verify the intermediate large language model. In each verification, the model is fine-tuned according to the verification result, and its performance on the validation set is re-evaluated to obtain the validation result. The verification process usually includes calculating evaluation indicators such as the accuracy of the intermediate large language model on the verification set, and analyzing the prediction results and error types of the intermediate large language model until the large language model is obtained. If the intermediate large language model performs poorly on the verification set, it may be due to insufficient training data, too complex model structure or improper training strategy. At this time, you can try to increase training data, simplify model structure or adjust training parameters to improve performance. If the model shows signs of overfitting on the verification set, that is, it performs well on the training set but poorly on the verification set, you can reduce overfitting by adding regularization terms, using dropout technology or stopping training early.

[0074] In step S104, the large language model uses its own good language understanding and reasoning capabilities to infer the feature vector to obtain an inference result, which includes a judgment on whether there is abnormal login behavior. The reasoning process may involve analysis, comparison and pattern matching of the feature vector to determine whether the login behavior conforms to normal login behavior. The large language model can identify abnormal login behavior of the technology product through the inference result, if there is abnormal login behavior.

[0075] In the specific implementation process of step S104, if Figure 3 As shown, there is an embodiment in which the inference result is obtained based on the feature vector, so that the large language model can identify the abnormal login behavior of the technology product through the inference result, including:

[0076] S10411, the large language model infers the feature vector from multiple dimensions to obtain multiple dimensional inference results;

[0077] S10412. The large language model integrates the reasoning results of multiple dimensions to obtain a reasoning result.

[0078] In steps S10411-S10412, the large language model infers the feature vector from multiple dimensions, and the dimensions include anomaly scores and category labels. The anomaly score is a continuous value output by the large language model that identifies the possibility of abnormal login behavior, and the corresponding dimension reasoning result is the anomaly score. When the continuous value reaches the threshold score, it is an abnormal login behavior, and when it is lower than the threshold, it is a normal login behavior. The category label is a binary classification label output by the large language model, that is, normal / abnormal, and the corresponding dimension reasoning result is normal / abnormal. The threshold score can be adjusted according to the performance of the validation set. If both the anomaly score and the category label are abnormal login behaviors, it means that the reasoning result is abnormal login behavior. If both the anomaly score and the category label are normal login behaviors, it means that the reasoning result is normal login behavior. If only one of the anomaly score and the category label is an abnormal login behavior, manual judgment is adopted to determine whether it is an abnormal login behavior, and the large language model is readjusted to ensure the accuracy of identifying abnormal login behavior next time.

[0079] In the specific implementation process of step S104, there is another embodiment: after the reasoning based on the feature vector is performed to obtain the reasoning result so that the large language model can identify the abnormal login behavior of the technology product through the reasoning result, it also includes:

[0080] S10421, the large language model generates alarm information for technological products based on the inference result;

[0081] S10422. The large language model implements protection measures for the technological products based on the alarm information.

[0082] In steps S10421-S10422, when the inference result is an abnormal login behavior, the large language model generates an alarm message for the technology product to remind the user to handle the user's privacy information security. The alarm message includes user ID, login time, login location, device information, abnormality score and category label, and sets the medium abnormality threshold score and high abnormality threshold score again based on the abnormality score. When the abnormality score reaches the high abnormality threshold score, the protection measure for the technology product is to directly block the abnormal login behavior and record it. When the abnormality score hits the high abnormality threshold score, the protection measure for the technology product is to send a verification code or make a voice call and other verification methods for secondary verification to ensure the user's privacy information security.

[0083] Example 2

[0084] The present application also provides a device for identifying abnormal login behavior of a technology product, such as Figure 4The block diagram of a device for identifying abnormal login behavior of a technology product is shown. The function implemented by the device for identifying abnormal login behavior of a technology product corresponds to the steps of executing a method for identifying abnormal login behavior of a technology product on a terminal device. The device can be understood as a component of a server including a processor, and the device includes:

[0085] The acquisition module 401 is used to acquire the real-time login behavior data generated when the technology product is logged in by the user, and pre-process the real-time login behavior data to obtain pre-processed real-time login behavior data; there are multiple ways of pre-processing;

[0086] A classification module 402, configured to classify the pre-processed real-time login behavior data to obtain a plurality of classification data, and extract features from the classification data to obtain a feature set; the feature set includes a plurality of feature data;

[0087] A fusion module 403 is used to perform feature fusion based on multiple feature data in the feature set to obtain a feature vector, and output the feature vector to the large language model; the large language model is obtained after fine-tuning the initial large language model;

[0088] The identification module 404 is used to perform reasoning based on the feature vector to obtain a reasoning result, so that the large language model can identify abnormal login behavior of the technology product through the reasoning result.

[0089] In a feasible implementation, the fusion module includes:

[0090] An output module, used to pre-acquire a data set including normal login behavior data and abnormal login behavior data, and output the data set to an initial large language model;

[0091] A training module is used to train the initial large language model multiple times based on the data set until a fine-tuning target is achieved to obtain a large language model.

[0092] In a feasible implementation manner, the fusion module further includes:

[0093] An obtaining module is used for performing multiple trainings on the initial large language model based on the data set according to a fine-tuning strategy until a fine-tuning target is reached, thereby obtaining an intermediate large language model;

[0094] The verification module is used to verify and adjust the intermediate large language model multiple times based on a preset verification set to obtain a large language model.

[0095] In a feasible implementation, the acquisition module includes:

[0096] A cleaning module, used for cleaning the real-time login behavior data to obtain cleaned real-time login behavior data;

[0097] The processing module is used to process part of the cleaned real-time login behavior data based on a preset processing method to obtain pre-processed real-time login behavior data.

[0098] In a feasible implementation, the classification module includes:

[0099] A calling module is used to pre-call the feature extraction method corresponding to the classification data, so as to extract features from the classification data based on the corresponding feature extraction method to obtain corresponding feature data;

[0100] The collection module is used to collect and organize multiple feature data obtained by feature extraction to obtain a feature set.

[0101] In a feasible implementation manner, the identification module includes:

[0102] An inference module, used for the large language model to infer the feature vector from multiple dimensions to obtain multiple dimensional inference results;

[0103] The integration module is used for integrating the reasoning results of multiple dimensions with the large language model to obtain the reasoning result.

[0104] In a feasible implementation manner, the identification module further includes:

[0105] A generation module, used for the large language model to generate alarm information for scientific and technological products based on the inference result;

[0106] An implementation module is used for the large language model to implement protection measures for scientific and technological products based on the alarm information.

[0107] Example 3

[0108] The present application also provides an electronic device, such as Figure 5 As shown, it includes: a processor 501, a memory 502 and a bus 503, the memory 502 stores machine-readable instructions executable by the processor 501, when the electronic device is running, the processor 501 and the memory 502 communicate through the bus 503, and when the machine-readable instructions are executed by the processor 501, any one of the steps of the method for identifying abnormal login behavior of a technology product is executed.

[0109] Example 4

[0110] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods for identifying abnormal login behavior of a technology product are executed.

[0111] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0112] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0113] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0114] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0115] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for identifying abnormal login behavior of a technology product, characterized in that: Applicable to a login behavior recognition system, the login behavior recognition system includes a large language model, and the method includes: Acquire real-time login behavior data generated when a technology product is logged in by a user, and pre-process the real-time login behavior data to obtain pre-processed real-time login behavior data; there are multiple ways to pre-process; Based on the pre-processed real-time login behavior data, a plurality of classification data are obtained by classification, and the classification data are subjected to feature extraction to obtain a feature set; the feature set includes a plurality of feature data; Performing feature fusion based on multiple feature data in the feature set to obtain a feature vector, and outputting the feature vector to the large language model; the large language model is obtained after fine-tuning the initial large language model; Reasoning is performed based on the feature vector to obtain a reasoning result, so that the large language model can identify abnormal login behavior of the technology product through the reasoning result.

2. The method according to claim 1, characterized in that The large language model is obtained after fine-tuning the language model, and the specific steps include: Pre-acquire a data set including normal login behavior data and abnormal login behavior data, and output the data set to an initial large language model; The initial large language model is trained multiple times based on the data set until a fine-tuning target is reached to obtain a large language model.

3. The method according to claim 2, characterized in that The initial large language model is trained multiple times based on the data set until a fine-tuning target is achieved to obtain a large language model, including: The initial large language model is trained multiple times based on the data set according to the fine-tuning strategy until the fine-tuning target is reached, thereby obtaining an intermediate large language model; The intermediate large language model is verified and adjusted multiple times based on the preset verification set to obtain a large language model.

4. The method according to claim 1, characterized in that: The acquiring of the real-time login behavior data generated by the technological product when the user logs in, and preprocessing the real-time login behavior data to obtain preprocessed real-time login behavior data, includes: Cleaning the real-time login behavior data to obtain cleaned real-time login behavior data; The partially cleaned real-time login behavior data is processed based on a preset processing method to obtain pre-processed real-time login behavior data.

5. The method according to claim 1, characterized in that The preprocessed real-time login behavior data is classified to obtain a plurality of classified data, and the classified data is subjected to feature extraction to obtain a feature set, including: Pre-calling a feature extraction method corresponding to the classified data to extract features from the classified data based on the corresponding feature extraction method to obtain corresponding feature data; Collect and organize multiple feature data obtained by feature extraction to obtain a feature set.

6. The method according to claim 1, characterized in that The inference based on the feature vector to obtain an inference result, so that the large language model can identify abnormal login behavior of the technology product through the inference result, includes: The large language model infers the feature vector from multiple dimensions to obtain multiple dimensional inference results; The large language model integrates multiple dimensional reasoning results to obtain a reasoning result.

7. The method according to claim 1, characterized in that After the reasoning is performed based on the feature vector to obtain the reasoning result so that the large language model can identify the abnormal login behavior of the technology product through the reasoning result, the method further includes: The large language model generates warning information for technological products based on the inference result; The large language model implements protection measures for technological products based on the alarm information.

8. A device for identifying abnormal login behavior of a technology product, characterized in that: The device comprises: An acquisition module is used to acquire real-time login behavior data generated when a technology product is logged in by a user, so as to pre-process the real-time login behavior data to obtain pre-processed real-time login behavior data; there are multiple ways of pre-processing; A classification module, used for classifying the pre-processed real-time login behavior data to obtain a plurality of classification data, and extracting features from the classification data to obtain a feature set; the feature set includes a plurality of feature data; A fusion module, used for performing feature fusion based on multiple feature data in the feature set to obtain a feature vector, and outputting the feature vector to the large language model; the large language model is obtained after fine-tuning the initial large language model; The recognition module is used to perform reasoning based on the feature vector to obtain a reasoning result, so that the large language model can identify abnormal login behavior of the technology product through the reasoning result.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate via the bus. When the machine-readable instructions are executed by the processor, the steps of the method for identifying abnormal login behavior of a technology product as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of a method for identifying abnormal login behavior of a technological product as described in any one of claims 1 to 7.

Images