Abnormal behavior analysis method and device, computer equipment and storage medium

Abstract

The invention relates to an abnormal behavior analysis method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring historical behavior data in a historical time period, wherein the historical behavior data comprises respective data information of each operation behavior; an abnormal behavior path is created through the historical behavior data, information features of all historical abnormal behaviors are extracted based on the historical behavior data, and the abnormal behavior path comprises abnormal behavior nodes corresponding to all the historical abnormal behaviors; determining common features from the information sub-features of the respective information features of the historical abnormal behaviors, wherein the common features are the same information sub-features in the information features of the at least two historical abnormal behaviors; and creating a mapping relationship between each common feature and each abnormal behavior node, and performing abnormal analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report. By adopting the method, the abnormal behavior analysis efficiency and the data reusability can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device and storage medium for abnormal behavior analysis. Background Art

[0002] With the rapid development of computing technology and Internet technology, people can obtain network information through the Internet, so Internet social platforms have huge user traffic. However, this also leads to a large number of sensitive industries performing abnormal operations on normal users on Internet social platforms, such as transmitting sensitive information, performing sensitive behaviors, or posing a threat to the network environment and the privacy and property security of normal users in the network environment. Therefore, analyzing and detecting abnormal behaviors can effectively avoid the occurrence of subsequent abnormal behaviors.

[0003] At present, it is possible to identify whether an operation behavior is abnormal based on rules. However, in actual situations, abnormal behavior is usually repeated in multiple operations. Therefore, policy algorithm personnel usually need to rely on their own experience to judge multiple operations. The analysis conclusion obtained at this time depends on personal experience and judgment, and it is necessary to repeat the judgment of multiple operations multiple times to obtain a relatively complete conclusion. At this time, the efficiency and data reusability of the abnormal behavior analysis results are also low. Therefore, how to improve the efficiency of abnormal behavior analysis and data reusability is an urgent problem to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment and storage medium for abnormal behavior analysis that can improve the efficiency of abnormal behavior analysis and data reusability in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for abnormal behavior analysis. The method comprises:

[0006] Obtain historical behavior data within a historical time period, the historical behavior data includes data information of each operation behavior;

[0007] An abnormal behavior path is created through historical behavior data, and information features of each historical abnormal behavior are extracted based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0008] Determine a common feature from the information sub-features of the information features of each of the historical abnormal behaviors, where the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors;

[0009] A mapping relationship between each common feature and each abnormal behavior node is created, and an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0010] In a second aspect, the present application also provides an abnormal behavior analysis device. The device comprises:

[0011] A behavior data acquisition module is used to acquire historical behavior data within a historical time period, and the historical behavior data includes data information of each operation behavior;

[0012] A feature extraction module is used to create an abnormal behavior path through historical behavior data, and extract information features of each historical abnormal behavior based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0013] A common feature determination module, used to determine a common feature from the information sub-features of the information features of each historical abnormal behavior, wherein the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors;

[0014] The behavior analysis module is used to create a mapping relationship between each common feature and each abnormal behavior node, and perform anomaly analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0015] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0016] Obtain historical behavior data within a historical time period, the historical behavior data includes data information of each operation behavior;

[0017] An abnormal behavior path is created through historical behavior data, and information features of each historical abnormal behavior are extracted based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0018] Determine a common feature from the information sub-features of the information features of each of the historical abnormal behaviors, where the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors;

[0019] A mapping relationship between each common feature and each abnormal behavior node is created, and an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0021] Obtain historical behavior data within a historical time period, the historical behavior data includes data information of each operation behavior;

[0022] An abnormal behavior path is created through historical behavior data, and information features of each historical abnormal behavior are extracted based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0023] Determine a common feature from the information sub-features of the information features of each of the historical abnormal behaviors, where the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors;

[0024] A mapping relationship between each common feature and each abnormal behavior node is created, and an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0025] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0026] Obtain historical behavior data within a historical time period, the historical behavior data includes data information of each operation behavior;

[0027] An abnormal behavior path is created through historical behavior data, and information features of each historical abnormal behavior are extracted based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0028] Determine a common feature from the information sub-features of the information features of each of the historical abnormal behaviors, where the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors;

[0029] A mapping relationship between each common feature and each abnormal behavior node is created, and an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0030] The above-mentioned abnormal behavior analysis method, device, computer equipment, storage medium and computer program product first obtain historical behavior data within a historical time period, the historical behavior data includes data information of each operation behavior, and then create an abnormal behavior path through the historical behavior data, and extract the information features of each historical abnormal behavior based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior. Based on this, common features are determined from the information sub-features of the information features of each historical abnormal behavior. The common features are: the same information sub-features in the information features of at least two historical abnormal behaviors. Finally, a mapping relationship between each common feature and each abnormal behavior node is created, and abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report. Through the aforementioned abnormal behavior analysis method, abnormal behavior paths are created respectively through historical behavior data, and information features of historical abnormal behaviors are extracted, so that the process of creating abnormal behavior paths and determining common features based on information features can be decoupled, and then each abnormal behavior node in the abnormal behavior path is analyzed through the mapping relationship created between the path and the common features. The process of decoupling path creation and common feature determination can reuse the data of any process to avoid the impact between data, thereby improving the efficiency of data analysis and data reusability. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A diagram of an application environment of a method for abnormal behavior analysis in one embodiment;

[0032] Figure 2 A schematic diagram of a process framework of a method for abnormal behavior analysis in one embodiment;

[0033] Figure 3 A flowchart of a method for abnormal behavior analysis in one embodiment;

[0034] Figure 4 A schematic diagram of a process for creating a mapping relationship in an embodiment;

[0035] Figure 5 A schematic diagram of a process for generating an abnormal behavior analysis report in one embodiment;

[0036] Figure 6 A schematic diagram of a process for analyzing and generating an abnormal behavior analysis report in one embodiment;

[0037] Figure 7 A schematic diagram of a process for creating an abnormal behavior path through historical behavior data in one embodiment;

[0038] Figure 8 A schematic diagram of a process for generating an abnormal behavior path in one embodiment;

[0039] Fig. 9A schematic diagram of a process of extracting information features in one embodiment;

[0040] Fig.10 A schematic diagram of a process for determining multiple pieces of data to be analyzed in one embodiment;

[0041] Fig.11 A complete flowchart of a method for abnormal behavior analysis in one embodiment;

[0042] Fig.12 is a structural block diagram of an abnormal behavior analysis device in one embodiment;

[0043] Fig.13 is a structural block diagram of an abnormal behavior analysis device in another embodiment;

[0044] Fig.14 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] With the rapid development of computing technology and Internet technology, people can obtain network information through the Internet, so Internet social platforms have huge user traffic. However, this also leads to a large number of sensitive industries performing abnormal operations on normal users on Internet social platforms, such as transmitting sensitive information, implementing sensitive behaviors, or posing a danger to the network environment and the privacy and property safety of normal users in the network environment. Therefore, analyzing and detecting abnormal behaviors can effectively avoid the occurrence of subsequent abnormal behaviors. At present, it is possible to identify whether there is abnormal behavior in the operation behavior based on rules, such as manually constructing monitoring indicators, then manually analyzing key abnormal links, and then selecting the required cases from a large amount of data, and finally manually analyzing them based on key abnormal links, selected cases and their own experience. In actual situations, abnormal behaviors are usually repeated in multiple operation behaviors, so it is usually necessary for strategy algorithm personnel to rely on their own experience to judge multiple operation behaviors. At this time, the analysis conclusions obtained depend on personal experience judgment, and it is also necessary to repeat multiple judgments on multiple operation behaviors to obtain relatively complete conclusions. At this time, the efficiency and data reusability of the abnormal behavior analysis results are also low. Therefore, how to improve the efficiency and data reusability of abnormal behavior analysis is an urgent problem to be solved.

[0047] Therefore, the embodiment of the present application provides a method for abnormal behavior analysis that can improve the efficiency of abnormal behavior analysis and data reusability. The method for abnormal behavior analysis provided by the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other servers.

[0048] Specifically, the server 104 can obtain historical behavior data within a historical time period, and the historical behavior data includes data information of each operation behavior, and then create an abnormal behavior path through the historical behavior data, and extract the information features of each historical abnormal behavior based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior, and determines the common features from the information sub-features of the information features of each historical abnormal behavior. The common features are: the same information sub-features in the information features of at least two historical abnormal behaviors. Finally, the server 104 creates a mapping relationship between each common feature and each abnormal behavior node, and performs an abnormal analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report. The process of decoupling path creation and common feature determination can reuse the data of any process to avoid the impact between data, thereby improving the efficiency of data analysis and data reusability.

[0049] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0050] In actual applications, the scenarios for abnormal behavior analysis may include but are not limited to: shopping transaction scenarios, social information transmission scenarios, or other analysis scenarios with behavioral periodicity. The scenarios with behavioral periodicity are specifically divided into the pre-abnormal behavior stage, the abnormal behavior stage, and the post-abnormal behavior stage. Among them, the pre-abnormal behavior stage: mainly prevents the occurrence of abnormal behavior through abnormal behavior detection and abnormal behavior prevention. Secondly, the abnormal behavior stage is usually when abnormal behavior is detected, further evaluation and analysis are required to determine whether abnormal behavior really exists. The post-abnormal behavior stage is usually when abnormal behavior has occurred, measures are taken to manage and handle it.

[0051] The method for abnormal behavior analysis provided in this embodiment can be applied to any of the aforementioned stages. When applied to the stage before abnormal behavior is carried out, the abnormal behavior analysis report obtained from the historical abnormal behavior can be used to establish an abnormal behavior detection model, strengthen identity authentication, set up risk control strategies and other means to prevent the occurrence of abnormal behavior. Alternatively, when applied to the stage when abnormal behavior is in progress, corresponding processing measures can be provided after obtaining the abnormal behavior analysis report to avoid the continued occurrence of abnormal behavior. For example, when applied to a shopping transaction scenario, the processing measure at this time may be to suspend the shopping transaction. If applied to a social information transmission scenario, the processing measure at this time may be to ban accounts that transmit sensitive information, etc. Alternatively, when applied to the stage after abnormal behavior is carried out, it can be determined that abnormal behavior has occurred, and then through the abnormal behavior analysis report, it can be determined from which behavior node to reduce losses. The specific scenario and the stage of application are not limited here.

[0052] To facilitate understanding of the process framework in the embodiments of the present application, Figure 2 As shown, when the user triggers each operation behavior, the business system 202 can obtain the data information generated by each operation behavior in real time, and then the data information generated by each operation behavior is landed in the database 204 through the business system 202, that is, the data information generated by each operation behavior in the database 204 is statistically obtained to obtain the data information of each operation behavior. From the above introduction, it can be seen that the stage with behavioral periodicity can be specifically divided into the stage before the abnormal behavior, the stage during the abnormal behavior, and the stage after the abnormal behavior. Then, the steps of the repetitive cycle will be performed in the above different stages, that is, the scheduling system 206 obtains the data information of each operation behavior in different stages in the historical time period from the database 204, and then performs data desensitization processing on the data information of each operation behavior through the desensitization model, so as to obtain the historical behavior data at this stage.

[0053] Further, the abnormal behavior analysis model 210 creates an abnormal behavior path through historical behavior data, that is, the normal behavior analysis model 210 determines the probability that each operation behavior is an abnormal operation behavior through historical behavior data, and then determines the historical abnormal behavior through the aforementioned probability, and thus generates an abnormal behavior path. Based on this, since the historical abnormal behavior will be determined in the process of creating the abnormal behavior path through the abnormal behavior analysis model 210, then at this time, the historical behavior data of the historical abnormal behavior can also be sampled in multiple batches to determine multiple data information to be analyzed, and then the feature system 212 extracts information features of the multiple data information to be analyzed, and then the feature system 212 transmits the extracted information features of each historical abnormal behavior to the scheduling system 206, so that the scheduling system 206 can determine the common features through the information features of each historical abnormal behavior to create a mapping relationship between each common feature and each abnormal behavior node, and then the abnormal behavior analysis model 210 performs abnormal analysis based on the mapping relationship and the abnormal behavior path to obtain the abnormal behavior analysis report at this stage. Therefore, for each of the aforementioned stages, the abnormal behavior analysis report at each stage can be obtained through the aforementioned process framework.

[0054] Furthermore, since the method of abnormal behavior analysis provided in the embodiment of the present application also involves artificial intelligence (AI) technology, such as: the information characteristics of each historical abnormal behavior can be extracted through the abnormal behavior analysis model, or the probability of each operation behavior being an abnormal operation behavior can be determined through the abnormal behavior analysis model, or the common characteristics can be determined through the abnormal behavior analysis model. The following is a brief description of AI technology: AI is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making.

[0055] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, and mechatronics. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning. Among them, machine learning (ML) is a multi-field cross-disciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and learning by teaching.

[0056] The following examples are used to illustrate: In one embodiment, Figure 3 As shown, a method for abnormal behavior analysis is provided, and the method is applied to Figure 1 The server 104 in the example is used for explanation. It is understandable that the method can also be applied to the terminal 102, and can also be applied to a system including the terminal 102 and the server 104, and is implemented through the interaction between the terminal 102 and the server 104. In this embodiment, the method includes the following steps:

[0057] Step 302: Acquire historical behavior data within a historical time period, where the historical behavior data includes data information of each operation behavior.

[0058] Among them, the historical time period is the time interval between the historical timestamps before the timestamp of abnormal behavior analysis. The time interval of the historical time period can be 1 day, 3 days, 15 days, 30 days, etc. The specific time interval needs to be flexibly determined based on actual application requirements and is not limited here.

[0059] Secondly, the historical behavior data includes the data information of each operation behavior, which at least includes the behavior description information used to describe the operation behavior and the operator information that triggers the operation behavior. The aforementioned behavior description information can be: the number of operation behaviors performed in the historical time period, the interactive object targeted by the operation behavior, and the specific process description information of the operation behavior. For example, taking the application of social information transmission scenario as an example, the process description information can be: after arriving at the social information exchange area, repeatedly sending information to a single social object, and the information carries sensitive data (such as sensitive text, sensitive images, etc.). And the operator information can be the operator identification information that triggers the operation behavior, the location information of the operator, the Internet Protocol (IP) address of the operator account, and other information related to the operator.

[0060] Specifically, when abnormal behavior analysis is required, the server obtains historical behavior data within a historical time period, that is, the server can obtain data information generated by each user when performing operations based on the terminal through a communication connection with the terminal used by each user. Alternatively, the data information generated by the user when performing operations based on the terminal can be reported to the server in real time, and then the server stores each data information in a data storage system. When abnormal behavior analysis is required, the server can obtain the data information of each operation behavior within the historical time period from the data storage system to obtain historical behavior data. The method of obtaining historical behavior data is not specifically limited here.

[0061] Optionally, obtaining the historical behavior data within the historical time period specifically includes: collecting statistics on the data information of each operation behavior within the historical time period; performing data desensitization processing on the data information of each operation behavior to obtain the historical behavior data. That is, the server first uses the data information of each operation behavior within the historical time period, and at this time, the data information of each operation behavior is the original data that has not been processed by the operation. Then, the data information of each operation behavior is desensitized to obtain the historical behavior data. At this time, the historical behavior data specifically includes: the data information of each operation behavior after the data desensitization processing, so as to ensure that the historical behavior data does not include data involving user sensitive information.

[0062] Step 304: Create an abnormal behavior path through the historical behavior data, and extract information features of each historical abnormal behavior based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0063] Among them, the abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior, and the abnormal behavior nodes are connected by the operational association relationship between the corresponding historical abnormal behaviors. For example, there are historical abnormal behaviors A1, historical abnormal behaviors A2, historical abnormal behaviors A3 and historical abnormal behaviors A4, and in actual applications, the operational association relationship between historical abnormal behaviors A1 to historical abnormal behaviors A4 is: first perform historical abnormal behavior A1, then perform historical abnormal behavior A3, then perform historical abnormal behavior A2, and finally perform historical abnormal behavior A4. Based on this, if historical abnormal behavior A1 corresponds to abnormal behavior node B1, historical abnormal behavior A2 corresponds to abnormal behavior node B2, historical abnormal behavior A3 corresponds to abnormal behavior node B3, and historical abnormal behavior A4 corresponds to abnormal behavior node B4, then the abnormal behavior path formed by the corresponding abnormal behavior node B1 to the corresponding abnormal behavior node B4 is specifically: abnormal behavior node B1-abnormal behavior node B3-abnormal behavior node B2-abnormal behavior node B4. Secondly, information features are used to characterize data information of historical abnormal behaviors. That is, information features can characterize the behavior description information and operator information of historical abnormal behaviors.

[0064] Specifically, the server first determines the historical abnormal behavior through the historical behavior data, and then creates the abnormal behavior path based on the historical abnormal behavior. Secondly, after determining the historical abnormal behavior, the server also extracts the information characteristics of each determined historical abnormal behavior through the historical behavior data, that is, the data information of each historical abnormal behavior from the historical behavior data, and then performs specialized processing on the data information of each historical abnormal behavior to obtain the information characteristics of each historical abnormal behavior.

[0065] Step 306: determine a common feature from the information sub-features of the information features of each historical abnormal behavior, where the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors.

[0066] Among them, since the behavior description information includes a variety of information describing the operation behavior, and the operator information also includes a variety of related information about the operator who triggered the operation behavior, the information feature may include a plurality of information sub-features, which are the corresponding information in the behavior description information and the related information of the various operators in the operator information. Based on this, the common feature is the same information sub-feature in the information features of at least two historical abnormal behaviors, and the common feature may include a single or multiple information sub-features.

[0067] For example, the behavior description information includes: the number of operation behaviors performed in the historical time period, the interactive objects targeted by the operation behaviors, and the specific process description information of the operation behaviors. And the operator information includes: the identification information of the operator who triggered the operation behavior, the location information of the operator, and the IP address of the operator account. Then the information feature can include information sub-feature C1, information sub-feature C2, information sub-feature C3, information sub-feature C4, information sub-feature C5 and information sub-feature C6, and information sub-feature C1 is used to characterize the number of operation behaviors performed in the historical time period, information sub-feature C2 is used to characterize the interactive objects targeted by the operation behaviors, and so on, and information sub-feature C6 is used to characterize the IP address of the operator account.

[0068] Specifically, after extracting the information features of each historical abnormal behavior, the server further determines the information sub-features in each information feature, and then compares the information sub-features of each historical abnormal behavior, and determines the information sub-features that exist in the information features of at least two historical abnormal behaviors as common features. For example, the information features of historical abnormal behavior A1 include information sub-feature C1, information sub-feature C2, and information sub-feature C3. The information features of historical abnormal behavior A2 include information sub-feature C1, information sub-feature C2, and information sub-feature C4. The information features of historical abnormal behavior A3 include information sub-feature C1 and information sub-feature C5. And the information features of historical abnormal behavior A4 include information sub-feature C1, information sub-feature C4, and information sub-feature C6.

[0069] It can be seen that the information sub-feature C1 exists in the information features of historical abnormal behaviors A1 to A4, the information sub-feature C2 exists in the information features of historical abnormal behaviors A1 and A2, and the information sub-feature C4 exists in the information features of historical abnormal behaviors A2 and A4. Therefore, it can be determined that the information sub-feature C1, the information sub-feature C2, and the information sub-feature C4 can be determined as common features, that is, the common features specifically include: information sub-feature C1, information sub-feature C2, and information sub-feature C4.

[0070] Step 308: Create a mapping relationship between each common feature and each abnormal behavior node, and perform an abnormal analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0071] Among them, the mapping relationship is specifically used to describe the one-to-one correspondence between abnormal behavior nodes and common features, that is, the common features must belong to the information features of the historical abnormal behaviors of the abnormal behavior nodes with the mapping relationship. Secondly, the abnormal behavior analysis report at least includes: the node analysis results of each abnormal behavior node, and the node analysis results are specifically obtained by the data information represented by the common features that have a mapping relationship with the abnormal behavior nodes. And in practical applications, the abnormal behavior analysis report can be used to describe the abnormal behavior process composed of each abnormal operation behavior. Taking the application in the shopping transaction scenario as an example, the abnormal behavior analysis report can be used to describe: newly registering a malicious account, then adding the friends of the user to be interacted through the terminal identification, and then pulling the user to be interacted into the social area, and guiding the user to be interacted to make a transaction payment through pictures, links, etc., wherein the abnormal operation behavior includes: newly registering a malicious account, adding the friends of the user to be interacted through the terminal identification, pulling the user to be interacted into the social area, and guiding the user to be interacted to make a transaction payment through pictures, links, etc.

[0072] Specifically, the server first creates a mapping relationship between each common feature and each abnormal behavior node, that is, the server considers which information features of historical abnormal behaviors the information sub-features in each common feature belong to, and then creates a mapping relationship between the common feature and each abnormal behavior node through the subordinate relationship between the information sub-features and the information features, and the corresponding relationship between the information features and the historical abnormal behaviors.

[0073] For ease of understanding, the above example is used for illustration, such as the information sub-feature C1 included in the common feature. Since the information sub-feature C1 exists in the information features of historical abnormal behaviors A1 to historical abnormal behaviors A4, a mapping relationship can be created between the information sub-feature C1 and the abnormal behavior node B1 corresponding to the historical abnormal behavior A1. Similarly, a mapping relationship can also be created between the information sub-feature C1 and the abnormal behavior node B2 corresponding to the historical abnormal behavior A2, a mapping relationship between the information sub-feature C1 and the abnormal behavior node B3 corresponding to the historical abnormal behavior A3, and a mapping relationship between the information sub-feature C1 and the abnormal behavior node B4 corresponding to the historical abnormal behavior A4.

[0074] Furthermore, the server determines the common features in the abnormal behavior path that have a mapping relationship with each abnormal behavior node through the one-to-one correspondence between the abnormal behavior nodes and the common features described by the mapping relationship, and then extracts the data information represented by the common features of each abnormal behavior node that have a mapping relationship, and analyzes the data information represented by the common features to obtain the node analysis results of each abnormal behavior node, thereby generating an abnormal behavior analysis report through the node analysis results of each abnormal behavior node.

[0075] It is understandable that, since actual abnormal behavior scenarios are usually carried out through the interaction of multiple operational behaviors, the server can also consider the operational association relationship between the abnormal behavior nodes in the abnormal behavior path during the abnormal analysis process, so that in the analysis process, it can further consider: the operational association relationship between the common features of the abnormal behavior nodes with a mapping relationship, that is, on the basis of separately analyzing the common features of each abnormal behavior node, the operational association relationship between the common features is also considered to obtain the operational relationship analysis results, so that the abnormal behavior analysis report can include the aforementioned operational relationship analysis results on the basis of the node analysis results of each abnormal behavior node.

[0076] It can be understood that all the examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0077] In the above-mentioned method of abnormal behavior analysis, abnormal behavior paths are created respectively through historical behavior data, and information features of historical abnormal behaviors are extracted, so as to decouple the process of creating abnormal behavior paths and determining common features based on information features, and then analyze each abnormal behavior node in the abnormal behavior path through the mapping relationship created between the path and the common features. The process of decoupling path creation and common feature determination can reuse the data of any process to avoid the influence between data, thereby improving the efficiency of data analysis and data reusability.

[0078] In one embodiment, Figure 4 As shown, a mapping relationship between each common feature and each abnormal behavior node is created, including:

[0079] Step 402: determine the historical abnormal behaviors corresponding to the information features to which each common feature belongs as associated historical abnormal behaviors associated with the common feature.

[0080] The associated historical abnormal behavior specifically refers to the historical abnormal behavior corresponding to the information feature to which the common feature belongs. Specifically, the server determines the historical abnormal behavior corresponding to the information feature to which each common feature belongs as the associated historical abnormal behavior associated with the common feature.

[0081] For ease of understanding, the above example is used for introduction. The common features specifically include: information sub-feature C1, information sub-feature C2, and information sub-feature C4. Information sub-feature C1 belongs to the information feature of historical abnormal behavior A1, the information feature of historical abnormal behavior A2, the information feature of historical abnormal behavior A3, and the information feature of historical abnormal behavior A4. Therefore, it can be determined that the associated historical abnormal behaviors associated with information sub-feature C1 in the common features include: historical abnormal behavior A1, historical abnormal behavior A2, historical abnormal behavior A3, and historical abnormal behavior A4.

[0082] Similarly, it can be known that information sub-feature C2 belongs to the information feature of historical abnormal behavior A1 and the information feature of historical abnormal behavior A2. Therefore, it can be determined that the associated historical abnormal behaviors associated with information sub-feature C2 in the common feature include: historical abnormal behavior A1 and historical abnormal behavior A2. Information sub-feature C4 belongs to the information feature of historical abnormal behavior A2 and the information feature of historical abnormal behavior A4. Therefore, it can be determined that the associated historical abnormal behaviors associated with information sub-feature C4 in the common feature include: historical abnormal behavior A2 and historical abnormal behavior A4.

[0083] Step 404: Create a mapping relationship between the abnormal behavior node associated with the historical abnormal behavior and the associated common features.

[0084] Specifically, the server creates a mapping relationship between the abnormal behavior node associated with the historical abnormal behavior and the associated common feature, that is, the server specifically establishes a one-to-one association relationship between the abnormal behavior node corresponding to the associated historical abnormal behavior and the common feature associated with the associated historical abnormal behavior. Exemplarily, the above example is used for further introduction. It can be seen from the above example that since the associated historical abnormal behaviors associated with the information sub-feature C1 in the common feature include: historical abnormal behavior A1, historical abnormal behavior A2, historical abnormal behavior A3 and historical abnormal behavior A4. Therefore, a mapping relationship between the abnormal behavior node B1 corresponding to the historical abnormal behavior A1 and the information sub-feature C1, a mapping relationship between the abnormal behavior node B2 corresponding to the historical abnormal behavior A2 and the information sub-feature C1, a mapping relationship between the abnormal behavior node B3 corresponding to the historical abnormal behavior A3 and the information sub-feature C1, and a mapping relationship between the abnormal behavior node B4 corresponding to the historical abnormal behavior A4 and the information sub-feature C1 can be created.

[0085] Similarly, it can be seen from the above examples that the associated historical abnormal behaviors associated with the information sub-feature C2 in the common features include: historical abnormal behaviors A1 and historical abnormal behaviors A2. Therefore, a mapping relationship between the abnormal behavior node B1 corresponding to the historical abnormal behavior A1 and the information sub-feature C2, and a mapping relationship between the abnormal behavior node B2 corresponding to the historical abnormal behavior A2 and the information sub-feature C2 can be created. Secondly, it can be seen from the above examples that the associated historical abnormal behaviors associated with the information sub-feature C4 in the common features include: historical abnormal behaviors A2 and historical abnormal behaviors A4. Therefore, a mapping relationship between the abnormal behavior node B2 corresponding to the historical abnormal behavior A2 and the information sub-feature C4, and a mapping relationship between the abnormal behavior node B4 corresponding to the historical abnormal behavior A4 and the information sub-feature C4 can be created.

[0086] It can be understood that all the examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0087] In this embodiment, the reliability of the determined associated historical abnormal behaviors is ensured by accurately establishing the subordinate relationship between common features and information features, and accurately establishing the corresponding relationship between information features and historical abnormal behaviors, thereby further improving the reliability and accuracy of data analysis on the basis of ensuring data decoupling and improving data reusability by mapping the abnormal behavior nodes and common features of the associated historical abnormal behaviors and accurately and reliably describing the correlation between the abnormal behavior nodes and the common features.

[0088] In one embodiment, Figure 5 As shown, an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report, including:

[0089] Step 502: determine the common features having a mapping relationship with each abnormal behavior node through the mapping relationship and the abnormal behavior nodes included in the abnormal behavior path.

[0090] Specifically, the server first determines the abnormal behavior nodes included in the abnormal behavior path, and for each abnormal behavior node, determines the association relationship between the abnormal behavior node and the common feature described by the mapping relationship to determine the common feature of each abnormal behavior node having the mapping relationship.

[0091] Exemplarily, the above example is used for further introduction. It can be seen from the above example that the obtained mapping relationship specifically includes: the mapping relationship between abnormal behavior node B1 and information sub-feature C1, the mapping relationship between abnormal behavior node B2 and information sub-feature C1, the mapping relationship between abnormal behavior node B3 and information sub-feature C1, the mapping relationship between abnormal behavior node B4 and information sub-feature C1, the mapping relationship between abnormal behavior node B1 and information sub-feature C2, the mapping relationship between abnormal behavior node B2 and information sub-feature C2, the mapping relationship between abnormal behavior node B2 and information sub-feature C4, and the mapping relationship between abnormal behavior node B4 and information sub-feature C4.

[0092] Based on this, for abnormal behavior node B1, it can be seen from the above examples that the common features that have a mapping relationship with abnormal behavior node B1 include: information sub-feature C1 and information sub-feature C2. Similarly, it can be seen that the common features that have a mapping relationship with abnormal behavior node B2 include: information sub-feature C1, information sub-feature C2 and information sub-feature C4. The common features that have a mapping relationship with abnormal behavior node B3 include: information sub-feature C1. And the common features that have a mapping relationship with abnormal behavior node B4 include: information sub-feature C1 and information sub-feature C4.

[0093] Step 504: Analyze and generate an abnormal behavior analysis report based on the common features that have a mapping relationship with each abnormal behavior node.

[0094] Specifically, the server analyzes and generates an abnormal behavior analysis report based on the common features that have a mapping relationship with each abnormal behavior node. That is, the server specifically performs an abnormal analysis based on the data information represented by the common features that have a mapping relationship with each abnormal behavior node, so as to generate an abnormal behavior analysis report. This process can be performed through an abnormal behavior analysis model, such as: the abnormal behavior analysis model can be a generative unsupervised pre-training (Generative Pre-Training, GPT) model, or an autoregressive model (Autoregressive Model), etc., which is not limited here, and the aforementioned abnormal behavior analysis model can be tuned based on the prompt word (Prompt).

[0095] It can be understood that all the examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0096] In this embodiment, due to the association between the abnormal behavior nodes and the common features described by the mapping relationship, all common features with the mapping relationship can be found for each abnormal behavior node included in the abnormal behavior path based on the mapping relationship, and the common features can reflect the existence of the same data information between multiple abnormal behavior nodes. The results obtained from the abnormal data analysis can more accurately describe the data information that may cause the anomaly, thereby improving the accuracy of the data analysis.

[0097] The following describes in detail how, in one embodiment, Figure 6 As shown, based on the data information represented by the common features having a mapping relationship with each abnormal behavior node, an abnormal behavior analysis report is analyzed and generated, including:

[0098] Step 602 : Perform feature text processing on the common features that have a mapping relationship with each abnormal behavior node to extract data information represented by the common features of each abnormal behavior node.

[0099] Specifically, it can be seen from the aforementioned embodiments that common features can represent data information. Therefore, in order to extract the specific text information of the data information represented by the common features, the server needs to perform feature text processing on the common features that have a mapping relationship with each abnormal behavior node to extract the data information represented by the common features of each abnormal behavior node.

[0100] For example, the above example is used for further introduction. The common features that are mapped to the abnormal behavior node B2 include: information sub-feature C1, information sub-feature C2, and information sub-feature C4. If the information sub-feature C1 is processed as a feature text, it can be obtained that: interaction is carried out in the social area within 7 days of creation. And the information sub-feature C2 is processed as a feature text, it can be obtained that: virtual data is distributed in the social area. And the information sub-feature C3 is processed as a feature text, it can be obtained that: there is a friend relationship between the interacting objects.

[0101] Step 604: Analyze the data information represented by the common characteristics of each abnormal behavior node to obtain the node analysis result of each abnormal behavior node.

[0102] Specifically, the server performs feature textualization for the common features of each abnormal behavior node to obtain data information represented by the common features of each abnormal behavior node, and then analyzes and derives each data information to obtain the node analysis results of each abnormal behavior node. It can be understood that this process can be carried out through an abnormal behavior analysis model, such as: the abnormal behavior analysis model can be a GPT model, and the GPT model can be tuned based on Prompt. That is, through the historical behavior data of historical abnormal behaviors, the predicted node analysis results of each abnormal behavior node are obtained through the initial abnormal behavior analysis model, and then the predicted node analysis results of each abnormal behavior node and the historical behavior analysis report of each abnormal behavior node are used, and the initial abnormal behavior analysis model is tuned based on Prompt until the model training end condition is met, and the abnormal behavior analysis model used in this embodiment can be obtained.

[0103] Exemplarily, further introducing the above example, the information sub-feature C1 is processed into a feature text to obtain: the creation time of the social area is within 7 days. And the information sub-feature C2 is processed into a feature text to obtain: triggering the release of virtual data. And the information sub-feature C3 is processed into a feature text to obtain: there is a friend relationship between the interactive objects. It can be seen that the node analysis result for the abnormal behavior node B2 can be: interaction in the social area within 7 days of creation, and the interactive object will pull other interactive objects with friend relationships into the social area, and virtual data has been released in the social area.

[0104] Step 606: Generate an abnormal behavior analysis report based on the node analysis results of each abnormal behavior node.

[0105] Specifically, the server generates an abnormal behavior analysis report through the node analysis results of each abnormal behavior node. Since the actual abnormal behavior scenario is usually carried out through the interaction of multiple operation behaviors, the server can also consider the operation association relationship between each abnormal behavior node in the abnormal behavior path during the abnormal analysis process. Therefore, the server can also analyze the data information represented by the common characteristics of each abnormal behavior node based on the operation association relationship between each abnormal behavior node in the abnormal behavior path to obtain the operation relationship analysis results between each abnormal behavior node in the abnormal behavior path, thereby generating an abnormal behavior analysis report through the node analysis results and the operation relationship analysis results of each abnormal behavior node.

[0106] For example, if the actual description scenario and the aforementioned strengths are combined, taking the application to the shopping transaction scenario as an example, the abnormal behavior analysis report can describe the node analysis results of each abnormal behavior node pair from the perspective of the global process. If the node analysis result of the abnormal behavior node B2 is taken as an example, the analysis report for the abnormal behavior node B2 in the abnormal behavior analysis report can be:

[0107] 1. Interact in a social area created within 7 days, because social areas created within 7 days may not have been monitored for abnormalities.

[0108] 2. The existence of friendships between interacting objects can make the interacting objects in the social area more trusting of each other, and more people can be attracted to the social area through friendships.

[0109] 3. Virtual data is distributed in the social area to attract more interactive objects to enter the social area to obtain virtual data, and then abnormal shopping transactions are guided in the social area.

[0110] It is understandable that how to generate an abnormal behavior analysis report can also be done through an abnormal behavior analysis model, such as: the abnormal behavior analysis model can be a GPT model, and the GPT model can be tuned based on Prompt. That is, through the historical behavior data of historical abnormal behaviors, the predicted behavior analysis report is obtained through the initial abnormal behavior analysis model, and then the initial abnormal behavior analysis model is tuned based on the predicted behavior analysis report and the historical behavior analysis report and Prompt until the model training end condition is met, and the abnormal behavior analysis model used in this embodiment can be obtained.

[0111] It should be understood that all examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0112] In this embodiment, the common features that have a mapping relationship with each abnormal behavior node are processed into feature texts to ensure that the data text information describing the common features that may cause the anomaly can be obtained, that is, the deduction and analysis can be performed more accurately and feasible through the data text information, thereby ensuring the feasibility and accuracy of the data analysis.

[0113] In one embodiment, Figure 7 As shown in the figure, abnormal behavior paths are created through historical behavior data, including:

[0114] Step 702: Determine the probability that each operation behavior is an abnormal operation behavior based on the historical behavior data.

[0115] Specifically, the server determines the probability that each operation behavior is an abnormal operation behavior based on the historical behavior data. Since the historical behavior data includes the data information of each operation behavior, the server can determine the probability that each operation behavior is an abnormal operation behavior based on the data information of each operation behavior through the abnormal behavior analysis model.

[0116] For example, historical behavior data includes data information of operation behavior D1, data information of operation behavior D2, data information of operation behavior D3, data information of operation behavior D4, and data information of operation behavior D5. The server can input the historical behavior data into the abnormal behavior analysis model, and use the abnormal behavior analysis model to output the probabilities of operation behaviors D1 to D5 being abnormal operation behaviors, such as, the probability that operation behavior D1 is an abnormal operation behavior is 70%, the probability that operation behavior D2 is an abnormal operation behavior is 20%, the probability that operation behavior D3 is an abnormal operation behavior is 40%, the probability that operation behavior D4 is an abnormal operation behavior is 90%, and the probability that operation behavior D5 is an abnormal operation behavior is 80%.

[0117] Step 704: determine historical abnormal behaviors based on the probability that each operation behavior is an abnormal operation behavior.

[0118] The historical abnormal behavior may be a single operation or multiple operation behaviors. Specifically, the operation behavior of the server whose probability of abnormal operation behavior is within the abnormal probability range is determined as the historical abnormal behavior, and the aforementioned abnormal probability range may be 60% to 100%, or 80% to 100%, or 50% to 100%, etc.

[0119] For example, the abnormal probability range is 60% to 100%. As can be seen from the above example, the probability that operation behavior D1 is an abnormal operation behavior is 70%, the probability that operation behavior D2 is an abnormal operation behavior is 20%, the probability that operation behavior D3 is an abnormal operation behavior is 40%, the probability that operation behavior D4 is an abnormal operation behavior is 90%, and the probability that operation behavior D5 is an abnormal operation behavior is 80%. The probability that operation behavior D1 is an abnormal operation behavior, the probability that operation behavior D4 is an abnormal operation behavior, and the probability that operation behavior D5 is an abnormal operation behavior are all between 60% and 100%, so operation behavior D1, operation behavior D4, and operation behavior D5 can be determined as historical abnormal behaviors.

[0120] Step 706: Create an abnormal behavior node for each historical abnormal behavior and generate an abnormal behavior path.

[0121] Specifically, the server creates abnormal behavior nodes for each historical abnormal behavior and generates abnormal behavior paths. That is, the server creates abnormal behavior nodes for each historical abnormal behavior and then considers the operational association relationship between the operational behaviors corresponding to each historical abnormal behavior to generate the abnormal behavior path.

[0122] For example, further introducing the above example, the operation behavior D1, the operation behavior D4 and the operation behavior D5 are determined as historical abnormal behaviors, and the server can create an abnormal behavior node B1 corresponding to the operation behavior D1, an abnormal behavior node B2 corresponding to the operation behavior D4, and an abnormal behavior node B3 corresponding to the operation behavior D5. Considering the corresponding relationship in the example in the embodiment, the operation behavior D1 is the historical abnormal behavior A1 in the above example, the operation behavior D4 is the historical abnormal behavior A2 in the above example, and the operation behavior D5 is the historical abnormal behavior A3 in the above example. At this time, the server specifically generates an abnormal behavior path through the abnormal behavior node B1, the abnormal behavior node B2 and the abnormal behavior node B3.

[0123] It can be understood that all the examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0124] In this embodiment, the historical abnormal behavior is determined by the probability that each operation behavior is an abnormal operation behavior, which can ensure the accuracy of the determined historical abnormal behavior being an abnormal operation behavior, thereby ensuring that the generated abnormal behavior path specifically describes the behavior path between each abnormal operation behavior, so as to improve the accuracy of abnormal behavior path construction.

[0125] In one embodiment, Figure 8 As shown, the method for abnormal behavior analysis also includes:

[0126] Step 802, determining a target application scenario for abnormal behavior analysis, and determining an operation association relationship between various operation behaviors in the target application scenario, and a behavior execution order exists between the operation behaviors with an operation association relationship.

[0127] Among them, the target application scenario is used to describe the scenario for abnormal behavior analysis, such as the shopping transaction scenario, social information transmission scenario or other analysis scenarios with behavioral periodicity, as exemplified in the above embodiments. Based on this, the operation association relationship is used to describe the behavior execution order between the operation behaviors. For example, taking the specific application in the shopping transaction scenario as an example, it is necessary to first perform the transaction account registration operation, then perform the product browsing operation, then perform the product selection operation, and finally perform the product order transaction operation. Therefore, the behavior execution order between the above operation behaviors is: transaction account registration operation, product browsing operation, product selection operation, and product order transaction operation. It can be understood that since there may be a repeated behavior execution order of multiple operation behaviors in actual applications, such as: product browsing operation, product selection operation, product browsing operation, product selection operation, product browsing operation, and product selection operation, the operation association relationship can also describe: there is a repeated behavior execution order between the operation behaviors.

[0128] Secondly, taking the specific application in social information transmission as an example, it is still necessary to first perform the social account registration operation, and then enter the virtual social area, and exchange information with other virtual social users in the virtual social area, or you can perform the friend addition operation between virtual social users, and then specifically interact with virtual social users who become friends. Therefore, the behavior execution order between the aforementioned operation behaviors is: social account registration operation, virtual social area entry operation, information interaction operation. Or: social account registration operation, virtual social area entry operation, friend addition operation, information interaction operation. At this time, it is also considered that the repeated behavior execution order includes: friend addition operation, information interaction operation, friend addition operation, information interaction operation, friend addition operation, information interaction operation, friend addition operation, information interaction operation, and repeated operation behaviors.

[0129] Specifically, when the server needs to perform abnormal behavior analysis, it first determines the target application scenario that needs to perform abnormal behavior analysis, and then determines the operational association relationship between various operation behaviors in the target application scenario. It can be understood that the operational association relationship between various operation behaviors in the target application scenario can be determined based on historical operation behaviors in the target application scenario, or the operational association relationship of the target application scenario is preset by an expert. The method for determining the operational association relationship is not specifically limited here.

[0130] Based on this, create an abnormal behavior node for each historical abnormal behavior and generate an abnormal behavior path, including:

[0131] Step 804: Create an abnormal behavior node for each historical abnormal behavior.

[0132] Specifically, the server creates an abnormal behavior node for each historical abnormal behavior. For example, if operation behaviors D1, D4, and D5 are determined as historical abnormal behaviors, the server can create an abnormal behavior node B1 corresponding to operation behavior D1, an abnormal behavior node B2 corresponding to operation behavior D4, and an abnormal behavior node B3 corresponding to operation behavior D5.

[0133] Step 806: Generate an abnormal behavior path through the operation association relationship and the abnormal behavior node of each historical abnormal behavior.

[0134] Specifically, the server generates an abnormal behavior path through the operation association relationship and the abnormal behavior nodes of each historical abnormal behavior. That is, the server further considers the operation association relationship determined in the above steps, and specifically connects the abnormal behavior nodes of each historical abnormal behavior according to the behavior execution order described by the operation association relationship through the operation association relationship used to describe the historical abnormal behaviors, thereby generating an abnormal behavior path. It can be understood that, since there may be multiple historical abnormal behaviors that are repeated in the behavior execution order in actual applications, the server specifically needs to consider the behavior execution order described in the operation association relationship and the repeated behavior execution order to connect the abnormal behavior nodes of each historical abnormal behavior, so as to ensure that the abnormal behavior path is more in line with the actual situation.

[0135] For example, a shopping transaction scenario is used as an example, and the order of behavior execution between operation behaviors is: transaction account registration operation, product browsing operation, product selection operation, product order transaction operation. In the above example, operation behavior D1 is specifically a transaction account registration operation, operation behavior D4 is specifically a product order transaction operation, and operation behavior D5 is specifically a product browsing operation. Then, according to the above behavior execution order, it can be known that the execution order between operation behavior D1, operation behavior D4 and operation behavior D5 is: operation behavior D1, operation behavior D5, operation behavior D4. Therefore, the abnormal behavior path obtained is: abnormal behavior node B1-abnormal behavior node B3-abnormal behavior node B2.

[0136] It can be understood that all the examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0137] In this embodiment, the target application scenario for abnormal behavior analysis is taken into consideration, and the specific behavior execution order between each operation behavior in the target application scenario is taken into consideration to ensure that the obtained abnormal behavior path is more in line with the actual situation, so that the abnormal behavior path that fits the actual situation is used in the subsequent process for data analysis, thereby improving the accuracy and authenticity of the abnormal behavior analysis.

[0138] In one embodiment, Fig. 9 As shown, the information features of each historical abnormal behavior are extracted based on the historical behavior data, including:

[0139] Step 902: Determine a plurality of data information to be analyzed from the data information of each historical abnormal behavior.

[0140] Specifically, the server screens the data information of each historical abnormal behavior to obtain multiple data information to be analyzed. The aforementioned multiple data information to be analyzed may be completely consistent with the data information of each historical abnormal behavior, or may be obtained by sampling part of the data information of each historical abnormal behavior, or may be obtained by performing multiple rounds of sampling on the data information of each historical abnormal behavior, which is not specifically limited here.

[0141] Step 904: extract information features of each piece of data information to be analyzed, where the information features at least include basic features and behavioral features.

[0142] The information features include at least basic features and behavioral features. The basic features are used to characterize the operator information that triggers the operation behavior, while the behavioral features are used to characterize the behavior description information of the operation behavior. Specifically, feature extraction is performed on the behavior description information and operator information included in each data information to be analyzed to obtain the information features of each data information to be analyzed.

[0143] In this embodiment, the amount of data processing can be reduced by screening the data information to be analyzed, and the data processing efficiency can be further improved on the basis of step decoupling.

[0144] Based on this, the following will introduce how to perform multiple rounds of sampling to obtain multiple data information to be analyzed, and the method for performing subsequent steps based on this: In one embodiment, Fig.10 As shown, from the data information of each historical abnormal behavior, multiple data information to be analyzed are determined, including:

[0145] Step 1002 , sampling the data information of each historical abnormal behavior in multiple batches to obtain multiple data information to be analyzed; wherein the data information to be analyzed is the data information of each historical abnormal behavior obtained by the corresponding batch sampling.

[0146] Specifically, the server performs multiple batches of sampling on the data information of each historical abnormal behavior, and the historical behavior data obtained by each batch of sampling can be obtained, that is, the multiple data information to be analyzed respectively correspond to the data information of each historical abnormal behavior obtained by batch sampling. For example, five rounds of sampling are performed on the data information of each historical abnormal behavior, and the multiple data information to be analyzed are respectively data information to be analyzed E1, data information to be analyzed E2, data information to be analyzed E3, data information to be analyzed E4, and data information to be analyzed E5. At this time, it can be determined that the data information to be analyzed E1 can be the data information of each historical abnormal behavior obtained by the first batch of sampling. The data information to be analyzed E2 can be the data information of each historical abnormal behavior obtained by the second batch of sampling. The data information to be analyzed E3 can be the data information of each historical abnormal behavior obtained by the third batch of sampling. The data information to be analyzed E4 can be the data information of each historical abnormal behavior obtained by the fourth batch of sampling. And the data information to be analyzed E5 can be the data information of each historical abnormal behavior obtained by the fifth batch of sampling.

[0147] Based on this, common features are determined from the information sub-features of the information features of each historical abnormal behavior, including:

[0148] Step 1004, determining the common features of each batch of samples from the information sub-features of the information features of each batch of samples.

[0149] Specifically, the server determines the common features of each batch of samples from the information sub-features of the information features of each batch of samples by a method similar to that described in the foregoing embodiments.

[0150] Based on this, a mapping relationship between each common feature and each abnormal behavior node is created, and an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report, including:

[0151] Step 1006, create a mapping relationship between the common features of each batch of samples and each abnormal behavior node, perform abnormal analysis on the data information to be analyzed of each batch of samples through the mapping relationship and the abnormal behavior path, obtain a batch analysis report for each batch of samples, and generate an abnormal behavior analysis report through the batch analysis report for each batch of samples.

[0152] Specifically, the server creates a mapping relationship between the common features of each batch of samples and each abnormal behavior node through a similar method as described in the aforementioned embodiment. Furthermore, the server performs a specific abnormal analysis on the data information to be analyzed under each batch of samples through the mapping relationship between the common features under each batch of samples and each abnormal behavior node, and can obtain a batch behavior analysis report corresponding to each batch of samples, and then an abnormal behavior analysis report can be generated by summarizing the batch behavior analysis reports corresponding to each batch of samples. The method for obtaining the batch behavior analysis report corresponding to each batch of samples is similar to the method for obtaining the abnormal behavior analysis report in the aforementioned embodiment, and will not be repeated here. It can be understood that all the examples in this embodiment are only used to understand this solution, and should not be understood as specific limitations of this solution.

[0153] In this embodiment, the data information to be analyzed obtained through multiple batches of sampling can be batch analyzed for different data information to be analyzed, and then the efficiency of batch analysis can be improved by combining the step decoupling method. Thus, the conclusions of batch analysis of multiple rounds of sampling are synthesized, so that the obtained abnormal behavior analysis report is more accurate and comprehensive.

[0154] Based on the detailed description of the above embodiments, the complete process of the abnormal behavior analysis method in the embodiments of the present application will be described below. In one embodiment, Fig.11 As shown, a method for abnormal behavior analysis is provided, and the method is applied to Figure 1 The server 104 in the example is used for explanation. It is understandable that the method can also be applied to the terminal 102, and can also be applied to a system including the terminal 102 and the server 104, and is implemented through the interaction between the terminal 102 and the server 104. In this embodiment, the method includes the following steps:

[0155] Step 1101, collect statistics on the data information of each operation behavior in the historical time period.

[0156] Specifically, the server firstly passes through the data information of each operation behavior in the historical time period, and at this time, the data information of each operation behavior is the original data which has not been processed by the operation.

[0157] Step 1102, perform data desensitization processing on the data information of each operation behavior to obtain historical behavior data.

[0158] Specifically, the data information of each operation behavior is desensitized to obtain historical behavior data. At this time, the historical behavior data specifically includes: the data information of each operation behavior after the data is desensitized to ensure that the historical behavior data does not include data involving user sensitive information.

[0159] Step 1103: Based on the historical behavior data, determine the probability that each operation behavior is an abnormal operation behavior.

[0160] Specifically, the server determines the probability that each operation behavior is an abnormal operation behavior based on the historical behavior data. Since the historical behavior data includes the data information of each operation behavior, the server can determine the probability that each operation behavior is an abnormal operation behavior based on the data information of each operation behavior through the abnormal behavior analysis model.

[0161] Step 1104: determine historical abnormal behaviors based on the probability that each operation behavior is an abnormal operation behavior.

[0162] The historical abnormal behavior may be a single operation or multiple operation behaviors. Specifically, the operation behavior of the server whose probability of abnormal operation behavior is within the abnormal probability range is determined as the historical abnormal behavior, and the aforementioned abnormal probability range may be 60% to 100%, or 80% to 100%, or 50% to 100%, etc.

[0163] Step 1105 , determining a target application scenario for abnormal behavior analysis, and determining an operation association relationship between various operation behaviors in the target application scenario, and a behavior execution sequence exists between the operation behaviors with an operation association relationship.

[0164] Among them, the target application scenario is used to describe the scenario for abnormal behavior analysis, such as the shopping transaction scenario, social information transmission scenario or other analysis scenarios with behavioral periodicity as exemplified in the aforementioned embodiments. Specifically, when the server needs to perform abnormal behavior analysis, it first determines the target application scenario that needs to perform abnormal behavior analysis, and then determines the operational association relationship between each operation behavior in the target application scenario. And it can be understood that the operational association relationship between each operation behavior in the target application scenario can be determined based on the historical operation behavior in the target application scenario, or, through the expert preset operation association relationship of the target application scenario. The method for determining the operational association relationship is not specifically limited here.

[0165] Step 1106: Create an abnormal behavior node for each historical abnormal behavior.

[0166] Specifically, the server creates an abnormal behavior node for each historical abnormal behavior. For example, if operation behaviors D1, D4, and D5 are determined as historical abnormal behaviors, the server can create an abnormal behavior node B1 corresponding to operation behavior D1, an abnormal behavior node B2 corresponding to operation behavior D4, and an abnormal behavior node B3 corresponding to operation behavior D5.

[0167] Step 1107, generating an abnormal behavior path through the operation association relationship and the abnormal behavior nodes of each historical abnormal behavior.

[0168] Step 806: Generate an abnormal behavior path through the operation association relationship and the abnormal behavior node of each historical abnormal behavior.

[0169] Specifically, the server generates an abnormal behavior path through the operation association relationship and the abnormal behavior nodes of each historical abnormal behavior. That is, the server further considers the operation association relationship determined in the above steps, and specifically connects the abnormal behavior nodes of each historical abnormal behavior according to the behavior execution order described by the operation association relationship through the operation association relationship used to describe the historical abnormal behaviors, thereby generating an abnormal behavior path.

[0170] It is understandable that since there may be multiple historical abnormal behaviors repeated in actual applications, the server specifically needs to consider the behavior execution order described in the operation association relationship and the repeated behavior execution order to connect the abnormal behavior nodes of each historical abnormal behavior to ensure that the abnormal behavior path is more in line with the actual situation.

[0171] Step 1108: perform multiple batches of sampling on the data information of each historical abnormal behavior to obtain multiple data information to be analyzed.

[0172] The data information to be analyzed is the data information of each historical abnormal behavior obtained by the corresponding batch sampling. Specifically, the server performs multiple batches of sampling on the data information of each historical abnormal behavior to obtain the historical behavior data obtained by each batch sampling, that is, the multiple data information to be analyzed correspond to the data information of each historical abnormal behavior obtained by the batch sampling.

[0173] Step 1109: extract information features of each piece of data information to be analyzed, where the information features at least include basic features and behavioral features.

[0174] The information features include at least basic features and behavioral features. The basic features are used to characterize the operator information that triggers the operation behavior, while the behavioral features are used to characterize the behavior description information of the operation behavior. Specifically, feature extraction is performed on the behavior description information and operator information included in each data information to be analyzed to obtain the information features of each data information to be analyzed.

[0175] Step 1110, determining the common features of each batch of samples from the information sub-features of the information features of each batch of samples.

[0176] Specifically, the server determines the common features of each batch of samples from the information sub-features of the information features of each batch of samples by a similar method as described in the above-mentioned embodiment.

[0177] Step 1111 , determining the historical abnormal behaviors corresponding to the information features belonging to the common features of each batch of samples as the associated historical abnormal behaviors associated with the common features of each batch of samples.

[0178] The associated historical abnormal behavior specifically refers to the historical abnormal behavior corresponding to the information feature to which the common feature belongs. Specifically, the server determines the historical abnormal behavior corresponding to the information feature to which the common feature belongs for each batch of samples as the associated historical abnormal behavior associated with the common feature for each batch of samples.

[0179] Step 1112: Create a mapping relationship between an abnormal behavior node associated with the historical abnormal behavior and the common features associated with each batch of samples.

[0180] Specifically, the server creates a mapping relationship between the abnormal behavior nodes associated with the historical abnormal behaviors and the common features associated with each batch of samples. That is, the server specifically establishes a one-to-one association relationship between the abnormal behavior nodes corresponding to the associated historical abnormal behaviors and the common features of each batch of samples associated with the associated historical abnormal behaviors.

[0181] Step 1113, determining the common features in each batch of samples that have a mapping relationship with each abnormal behavior node through the mapping relationship and the abnormal behavior nodes included in the abnormal behavior path.

[0182] Specifically, the server first determines the abnormal behavior nodes included in the abnormal behavior path, and for each abnormal behavior node, determines the association relationship between the abnormal behavior nodes described by the mapping relationship and the common features in each batch of samples to determine the common features of the mapping relationship between the abnormal behavior nodes in each batch of samples.

[0183] Step 1114 , performing feature text processing on the common features in each batch of samples that have a mapping relationship with each abnormal behavior node, so as to extract data information represented by the common features of each abnormal behavior node in each batch of samples.

[0184] Specifically, common features can represent data information. Therefore, in order to extract the specific text information of the data information represented by the common features, the server needs to perform feature text processing on the common features that have a mapping relationship with each abnormal behavior node in each batch of samples, so as to extract the data information represented by the common features of each abnormal behavior node in each batch of samples.

[0185] Step 1115 , analyzing the data information represented by the common features of the abnormal behavior nodes in each batch of samples to obtain the node analysis results of the abnormal behavior nodes in each batch of samples.

[0186] Specifically, the server performs feature textualization on the common features of each abnormal behavior node in each batch of samples to obtain data information represented by the common features of each abnormal behavior node in each batch of samples, and then analyzes and derives the data information in each batch of samples to obtain the node analysis results of each abnormal behavior node in each batch of samples.

[0187] Step 1116, obtaining a batch analysis report for each batch of samples through the node analysis results of each abnormal behavior node in each batch of samples, and generating an abnormal behavior analysis report through the batch analysis report for each batch of samples.

[0188] Specifically, a batch analysis report for each batch of samples is obtained through the node analysis results of each abnormal behavior node in each batch of samples, and an abnormal behavior analysis report is generated through the batch analysis report of each batch of samples. Since the actual abnormal behavior scenario is usually carried out through the interaction of multiple operation behaviors, the server can also consider the operation association relationship between each abnormal behavior node in the abnormal behavior path during the abnormal analysis process. Therefore, the server can also analyze the data information represented by the common characteristics of each abnormal behavior node in each batch of samples according to the operation association relationship between each abnormal behavior node in the abnormal behavior path, so as to obtain the operation relationship analysis results between each abnormal behavior node in the abnormal behavior path in each batch of samples, so as to obtain the batch analysis report for each batch of samples through the node analysis results and the operation relationship analysis results of each abnormal behavior node in each batch of samples, and then the abnormal behavior analysis report can also be generated by summarizing the batch behavior analysis report corresponding to each batch of samples.

[0189] It should be understood that the specific implementations of steps 1101 to 1116 are similar to those of the aforementioned embodiments and will not be repeated here.

[0190] It should be understood that, although the steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0191] Based on the same inventive concept, the embodiment of the present application also provides an abnormal behavior analysis device for implementing the abnormal behavior analysis method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormal behavior analysis device embodiments provided below can refer to the limitations of the abnormal behavior analysis method above, and will not be repeated here.

[0192] In one embodiment, Fig.12 As shown, an abnormal behavior analysis device is provided, including: a behavior data acquisition module 1202, a feature extraction module 1204, a common feature determination module 1206 and a behavior analysis module 1208, wherein:

[0193] The behavior data acquisition module 1202 is used to acquire historical behavior data within a historical time period, and the historical behavior data includes data information of each operation behavior;

[0194] The feature extraction module 1204 is used to create an abnormal behavior path through the historical behavior data, and extract information features of each historical abnormal behavior based on the historical behavior data. The abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior.

[0195] A common feature determination module 1206 is used to determine a common feature from the information sub-features of the information features of each historical abnormal behavior, where the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors;

[0196] The behavior analysis module 1208 is used to create a mapping relationship between each common feature and each abnormal behavior node, and perform an abnormal analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

[0197] In one embodiment, the behavior analysis module 1208 is specifically used to determine the historical abnormal behaviors corresponding to the information features belonging to each common feature as associated historical abnormal behaviors associated with the common features; and create a mapping relationship between the abnormal behavior nodes of the associated historical abnormal behaviors and the associated common features.

[0198] In one embodiment, the behavior analysis module 1208 is specifically used to determine the common features having a mapping relationship with each abnormal behavior node through the mapping relationship and the abnormal behavior nodes included in the abnormal behavior path; based on the common features having a mapping relationship with each abnormal behavior node, analyze and generate an abnormal behavior analysis report.

[0199] In one embodiment, the behavior analysis module 1208 is specifically used to perform feature text processing on the common features that have a mapping relationship with each abnormal behavior node to extract the data information represented by the common features of each abnormal behavior node; analyze the data information represented by the common features of each abnormal behavior node to obtain the node analysis results of each abnormal behavior node; and generate an abnormal behavior analysis report based on the node analysis results of each abnormal behavior node.

[0200] In one embodiment, the feature extraction module 1204 is specifically used to determine the probability that each operation behavior is an abnormal operation behavior based on historical behavior data; determine historical abnormal behaviors based on the probability that each operation behavior is an abnormal operation behavior; create an abnormal behavior node for each historical abnormal behavior, and generate an abnormal behavior path.

[0201] In one embodiment, Fig.13 As shown, the abnormal behavior analysis device also includes an operation association relationship determination module 1302;

[0202] The operation association determination module 1302 is used to determine the target application scenario for abnormal behavior analysis, and determine the operation association between various operation behaviors in the target application scenario. There is a behavior execution order between the operation behaviors with operation association relationships.

[0203] The feature extraction module 1204 is specifically used to create an abnormal behavior node for each historical abnormal behavior; and generate an abnormal behavior path by operating the association relationship and the abnormal behavior node for each historical abnormal behavior.

[0204] In one embodiment, the feature extraction module 1204 is specifically used to determine a plurality of data information to be analyzed from the data information of each historical abnormal behavior; and extract information features of each data information to be analyzed, where the information features at least include basic features and behavior features.

[0205] In one embodiment, the feature extraction module 1204 is specifically used to perform multiple batches of sampling on the data information of each historical abnormal behavior to obtain multiple data information to be analyzed; wherein the data information to be analyzed is the data information of each historical abnormal behavior obtained by the corresponding batch sampling;

[0206] The common feature determination module 1206 is specifically used to determine the common features of each batch of samples from the information sub-features of the information features of each batch of samples;

[0207] The behavior analysis module 1208 is specifically used to create a mapping relationship between the common features of each batch of samples and each abnormal behavior node, perform abnormal analysis on the data information to be analyzed of each batch of samples through the mapping relationship and the abnormal behavior path, obtain a batch analysis report for each batch of samples, and generate an abnormal behavior analysis report through the batch analysis report for each batch of samples.

[0208] In one embodiment, the behavior data acquisition module 1202 is specifically used to collect data information of each operation behavior in a historical time period; perform data desensitization processing on the data information of each operation behavior, and obtain historical behavior data.

[0209] Each module in the abnormal behavior analysis device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0210] In one embodiment, a computer device is provided. The computer device may be a server or a terminal. In this embodiment, the computer device is described as a server as an example. The internal structure diagram thereof may be as follows: Fig.14 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store historical behavior data, data information of each operation behavior, and other data related to the embodiment of the present application. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for abnormal behavior analysis is implemented.

[0211] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0212] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0213] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0214] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0215] It should be noted that the object information (including but not limited to object device information, object personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0216] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0217] The technical feature information of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical feature information in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical feature information, they should be considered to be within the scope of this specification.

[0218] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for abnormal behavior analysis, characterized in that: include: Acquire historical behavior data within a historical time period, wherein the historical behavior data includes data information of each operation behavior; Creating an abnormal behavior path through the historical behavior data, and extracting information features of each historical abnormal behavior based on the historical behavior data, wherein the abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior; Determine a common feature from the information sub-features of the information features of each of the historical abnormal behaviors, wherein the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors; A mapping relationship between each of the common features and each of the abnormal behavior nodes is created, and an abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

2. The method according to claim 1, characterized in that The creating a mapping relationship between each of the common features and each of the abnormal behavior nodes includes: Determining the historical abnormal behaviors corresponding to the information features belonging to each of the common features as associated historical abnormal behaviors associated with the common features; A mapping relationship between the abnormal behavior node associated with the historical abnormal behavior and the associated common features is created.

3. The method according to claim 1, characterized in that The abnormal analysis is performed through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report, including: Determine, through the mapping relationship and the abnormal behavior nodes included in the abnormal behavior path, common features having the mapping relationship with each of the abnormal behavior nodes; Based on the common features having the mapping relationship with each of the abnormal behavior nodes, the abnormal behavior analysis report is analyzed and generated.

4. The method according to claim 3, characterized in that The analyzing and generating the abnormal behavior analysis report based on the data information represented by the common features having the mapping relationship with each of the abnormal behavior nodes includes: Performing feature text processing on the common features having the mapping relationship with each of the abnormal behavior nodes to extract data information represented by the common features of each of the abnormal behavior nodes; Analyzing the data information represented by the common characteristics of each of the abnormal behavior nodes to obtain the node analysis results of each of the abnormal behavior nodes; The abnormal behavior analysis report is generated based on the node analysis results of each abnormal behavior node.

5. The method according to claim 1, characterized in that The creating an abnormal behavior path through the historical behavior data includes: Based on the historical behavior data, determining the probability that each of the operation behaviors is an abnormal operation behavior; Determining historical abnormal behaviors based on the probability that each of the operating behaviors is an abnormal operating behavior; An abnormal behavior node is created for each of the historical abnormal behaviors, and the abnormal behavior path is generated.

6. The method according to claim 5, characterized in that The method further comprises: Determine a target application scenario for abnormal behavior analysis, and determine an operation association relationship between various operation behaviors in the target application scenario, and a behavior execution order exists between the operation behaviors with the operation association relationship; The step of creating an abnormal behavior node for each of the historical abnormal behaviors and generating the abnormal behavior path includes: Creating an abnormal behavior node for each of the historical abnormal behaviors; The abnormal behavior path is generated through the operation association relationship and the abnormal behavior nodes of each of the historical abnormal behaviors.

7. The method according to claim 1, characterized in that The extracting information features of each historical abnormal behavior based on the historical behavior data includes: Determining a plurality of data information to be analyzed from the data information of each of the historical abnormal behaviors; Extract information features of each of the data information to be analyzed, wherein the information features at least include basic features and behavior features.

8. The method according to claim 7, characterized in that Determining a plurality of data information to be analyzed from the data information of each of the historical abnormal behaviors includes: Performing multiple batches of sampling on the data information of each of the historical abnormal behaviors to obtain multiple data information to be analyzed; wherein the data information to be analyzed is the data information of each of the historical abnormal behaviors obtained by the corresponding batch sampling; Determining common features from the information sub-features of the information features of each of the historical abnormal behaviors includes: Determine the common features of each batch of samples from the information sub-features of the information features of each batch of samples; Creating a mapping relationship between each of the common features and each of the abnormal behavior nodes, and performing an abnormal analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report, including: A mapping relationship is created between the common features of each batch of samples and each of the abnormal behavior nodes, and an abnormal analysis is performed on the data information to be analyzed of each batch of samples through the mapping relationship and the abnormal behavior path to obtain a batch analysis report for each batch of samples, and an abnormal behavior analysis report is generated through the batch analysis report for each batch of samples.

9. The method according to claim 1, characterized in that: The obtaining of historical behavior data within a historical time period includes: Collecting statistics on the data of each operation behavior within the historical time period; The data information of each of the operation behaviors is desensitized to obtain the historical behavior data.

10. An abnormal behavior analysis device, characterized in that: The device comprises: A behavior data acquisition module is used to acquire historical behavior data within a historical time period, wherein the historical behavior data includes data information of each operation behavior; A feature extraction module, configured to create an abnormal behavior path through the historical behavior data, and extract information features of each historical abnormal behavior based on the historical behavior data, wherein the abnormal behavior path includes abnormal behavior nodes corresponding to each historical abnormal behavior; A common feature determination module, used to determine a common feature from the information sub-features of the information features of each of the historical abnormal behaviors, wherein the common feature is: the same information sub-feature in the information features of at least two historical abnormal behaviors; The behavior analysis module is used to create a mapping relationship between each of the common features and each of the abnormal behavior nodes, and perform an abnormal analysis through the mapping relationship and the abnormal behavior path to obtain an abnormal behavior analysis report.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images