Abnormal behavior assessment method and system based on data drive

Abstract

The present invention discloses a method and system for abnormal behavior assessment based on data-driven, and the method includes data collection, data preprocessing, establishing a user behavior detection model, model parameter optimization and abnormal behavior assessment. The present invention belongs to the field of data processing, and specifically refers to a method and system for abnormal behavior assessment based on data-driven. This scheme reduces information loss in data feature restoration and enhances the accuracy of abnormal behavior detection through enhanced noise suppression and discretization processing, as well as high-fidelity data restoration; provides accurate abnormal behavior recognition capabilities based on probability model design; improves the responsiveness to complex user behavior data based on the dynamic adaptability of the designed activation function, thereby ensuring the accuracy of abnormal behavior assessment; initializes individual positions based on dynamic offsets, and conducts fine search by designing adversarial learning strategies to improve the effect of user abnormal behavior assessment.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data-driven abnormal behavior assessment method and system. Background Art

[0002] The data-driven abnormal behavior assessment method is a method that combines data analysis and modeling technology to discover behaviors that deviate from normal behavior patterns. It plays a core role in user behavior management, and helps identify potential security threats or abnormal behaviors by modeling multi-dimensional features such as user operations, access patterns, time characteristics, and session data. However, general abnormal behavior assessment methods are severely affected by noise interference, cannot adapt to changes in user's diverse scenarios, and have weak ability to capture user behavior patterns, which leads to poor accuracy in abnormal behavior assessment; general abnormal behavior assessment methods are unable to adapt to the dynamic changes of complex user behavior scenarios, resulting in poor results in user abnormal behavior assessment. Summary of the invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a data-driven abnormal behavior assessment method and system. In view of the problem that the general abnormal behavior assessment method is seriously interfered by noise, cannot adapt to the changes in the diversified scenarios of users, and has a weak ability to capture user behavior patterns, which leads to poor accuracy of abnormal behavior assessment, this solution reduces the information loss in data feature restoration and enhances the accuracy of abnormal behavior detection through enhanced noise suppression and discretization processing, as well as high-fidelity data restoration; provides accurate abnormal behavior recognition capability based on probability model design; improves the response capability to complex user behavior data based on the dynamic adaptability of the designed activation function, thereby ensuring the accuracy of abnormal behavior assessment; in view of the problem that the general abnormal behavior assessment method cannot adapt to the dynamic changes of complex user behavior scenarios, resulting in poor effect of user abnormal behavior assessment, this solution initializes individual positions based on dynamic offsets, and conducts fine search by designing an adversarial learning strategy to improve the effect of user abnormal behavior assessment.

[0004] The technical solution adopted by the present invention is as follows: The data-driven abnormal behavior assessment method provided by the present invention comprises the following steps:

[0005] Step S1: data collection;

[0006] Step S2: data preprocessing;

[0007] Step S3: Establishing a user behavior detection model;

[0008] Step S4: model parameter optimization;

[0009] Step S5: Abnormal behavior assessment.

[0010] Furthermore, in step S1, the data collection is to collect historical behavior data; the historical user behavior data includes user operation behavior data, user access behavior data, time feature data, user session behavior data and user behavior status; the user behavior status is used as a data label.

[0011] Furthermore, in step S2, the data preprocessing is to perform data cleaning, data conversion and data set division on the collected data; the data cleaning is to process missing values, duplicate values ​​and outliers; the data conversion is to convert the cleaned data into vector form and perform standardization processing; the data set division is to divide the converted data set into a test set and a training set.

[0012] Further, in step S3, the establishment of the user behavior detection model is to build the user behavior detection model based on the preprocessed historical behavior data, specifically including:

[0013] Encoder Design:

[0014] Map the input user behavior data x to the potential representation z, expressed as: ; The encoder uses a fully connected layer to reduce the dimension, expressed as: ; Where E(·) is the encoder function; is the activation function; W m1 is the weight matrix of the encoder; b is the bias term of the encoder; is the ith element of the potential representation; x i+m is the i+mth element in the vector corresponding to the input user behavior data x; m is the offset; M is the total offset;

[0015] Quantizer Design:

[0016] Quantize the potential representation z and get ; Map each element in z to the nearest center, expressed as: ; ; Where Q(·) is the quantizer function; c l is the quantization center, C is the set of quantization centers; is the i-th element of the quantized potential representation; t is the current number of training times; is the learning rate; Nl is the total number of users; is the operating frequency of the il-th user; is the operating frequency of the quantization center;

[0017] Generator Decoder Design:

[0018] The quantized potential representation Remap back to the original data space to get the reconstructed data ; The decoder uses deconvolution operation to perform dimension expansion as: ; In the formula, is the reconstruction data; G(·) is the generator function; and They are the weight matrix and bias term of the generator respectively; is the i-th element in the reconstructed data;

[0019] Discriminator design:

[0020] The input data is judged, expressed as: output = D(x); the convolutional network processes the input data, expressed as: ; Where output is the discriminator output; D(·) is the discriminator function; and They are the weight and bias of the discriminator respectively;

[0021] Probabilistic model design:

[0022] Calculate the joint probability distribution of the potential representation, and set a joint threshold in advance. If the joint probability distribution of the data is lower than the threshold, it is judged as abnormal user behavior data; it is expressed as: ; Output the predicted user behavior state based on the maximum conditional probability; The conditional probability calculation is expressed as: ; In the formula, is the joint probability distribution; n is the total number of samples; and are the i-1th and 1st elements of the quantized potential representation respectively; is the approximate calculated value of the conditional probability, i.e., the probability that the i-th element belongs to the l-th class label, i.e., the user behavior state; p(·|·) is the conditional probability;

[0023] Activation function design:

[0024] The user behavior detection model includes an encoder, a quantizer, a generator decoder, a discriminator and a probability model; the discriminator determines the user behavior state of the input data, and also designs a probability model for identifying potential abnormal user behavior states in combination with changes in user behavior scenarios, and finally generates a prediction result; wherein the activation functions in the encoder, the generator decoder and the discriminator are specifically designed as follows: the activation function improved by soft segmentation is designed, which is expressed as: ; ; Where tx is the activation function input; T0 is the scale parameter used to adjust the scalability of the input; α is the fractional order, which controls the nonlinearity of the activation function; is the segmentation threshold; and are the maximum fractional order and the minimum fractional order respectively; is the order index; is the activation function;

[0025] Loss function definition:

[0026] Define the adaptive loss function, expressed as: ; Where L is the adaptive loss function used by the model; γ is the attenuation factor; is the mean square error loss function; is the cross entropy loss function;

[0027] Model judgment:

[0028] The model is trained based on the training set. When the model loss converges, the user behavior detection model training is completed. If the maximum number of training times is reached, the model parameters are optimized. An accuracy threshold is set in advance. When the prediction accuracy of the trained user behavior detection model for the test set is higher than the accuracy threshold, the user behavior detection model is established. Otherwise, the data set is re-divided to train the user behavior detection model.

[0029] Further, in step S4, the model parameter optimization is to adjust the parameters of the user behavior detection model based on the user behavior data under different conditions, which specifically includes the following steps:

[0030] Step S41: Initialization; establish a parameter search space based on the network structure parameters, scale parameters, fractional order and attenuation factor in the user behavior detection model; initialize the individual position in the search population, and use the prediction accuracy of the user behavior detection model trained based on the individual position for the test set as the individual fitness value; the formula used to initialize the individual position in the search population is as follows:

[0031] ;

[0032] ;

[0033] In the formula, x i1+1,j1 and x i1,j1 are the positions of the i1+1th individual and the i1th individual in the j1th dimension respectively; is the dynamic offset; is the initial offset; i1 is the individual index; N1 is the number of individuals in the population;

[0034] Step S42: Design of adversarial learning strategy; for each individual, calculate the inverse solution, expressed as ; The final solution is selected based on the fitness value, expressed as: ;

[0035] In the formula, x j1is the inverse solution of the i1th individual; is a random number between 0 and 1; lb and ub are the lower and upper bounds of the search space respectively; and These are the individual positions after and before opponent learning, respectively; (·) is the individual fitness value;

[0036] Step S43: Dynamic random movement design; applying the particle swarm search algorithm to move the individual position, and then performing individual dynamic fine-tuning. The formula used for dynamic fine-tuning is as follows:

[0037] ;

[0038] ;

[0039] ;

[0040] ;

[0041] In the formula, is the individual position after dynamic fine-tuning; is the position of the individual after it is moved by the particle swarm search algorithm in the j1th dimension at the t1th iteration; is the distance moved by the individual particle swarm search algorithm; a is the dynamic adjustment factor; maxt1 is the maximum number of iterations; L(s) is the fine-tuning step size; s is the step size factor; u is the normal distribution A random number, where ; v is subject to normal distribution A random number; is the gamma function; α1 is the scale parameter used to determine the step size; β is the stability index;

[0042] Step S44: Optimization judgment; a fitness threshold is set in advance; when there is an individual fitness value higher than the fitness threshold, the model parameter optimization is completed, and a user behavior detection model is established based on the individual position; if the maximum number of iterations is reached, it is reinitialized; otherwise, the adversarial learning strategy is returned to continue iteration.

[0043] Furthermore, in step S5, the abnormal behavior assessment is based on the established user behavior detection model, and user behavior data is collected in real time; after preprocessing, it is input into the user behavior detection model, and abnormal behavior assessment is performed based on the output of the user behavior detection model.

[0044] The data-driven abnormal behavior assessment system provided by the present invention includes a data acquisition module, a data preprocessing module, a user behavior detection model establishment module, a model parameter optimization module and an abnormal behavior assessment module;

[0045] The data collection module collects user behavior data and sends the data to the data preprocessing module;

[0046] The data preprocessing module performs data cleaning, data conversion and standardization on the collected data; and sends the preprocessed data to the user behavior detection model building module;

[0047] The user behavior detection model module includes an encoder, a quantizer, a generator decoder, a discriminator and a probability model; the encoder uses a deep neural network to represent the characteristics of the user behavior data and maps it to a latent space; the discriminator determines the user behavior state of the input data based on a convolutional network, and also designs a probability model for identifying potential abnormal user behavior states in combination with changes in user behavior scenarios, and finally generates a prediction result; and sends the data to the model parameter optimization module;

[0048] The model parameter optimization module dynamically adjusts the model parameters based on user behavior data under different conditions; and sends the data to the abnormal behavior assessment module;

[0049] The abnormal behavior assessment module implements abnormal behavior assessment based on the established and optimized user behavior detection model.

[0050] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0051] (1) In view of the problem that general abnormal behavior assessment methods are seriously affected by noise interference, cannot adapt to the changes in user's diverse scenarios, and have weak ability to capture user behavior patterns, which leads to poor accuracy in abnormal behavior assessment, this solution reduces information loss in data feature restoration and enhances the accuracy of abnormal behavior detection through enhanced noise suppression and discretization processing, as well as high-fidelity data restoration; provides accurate abnormal behavior recognition capabilities based on probabilistic model design; and improves the response capability to complex user behavior data based on the dynamic adaptability of the designed activation function, thereby ensuring the accuracy of abnormal behavior assessment.

[0052] (2) In view of the problem that general abnormal behavior assessment methods are unable to adapt to the dynamic changes of complex user behavior scenarios, resulting in poor results in user abnormal behavior assessment, this scheme initializes individual positions based on dynamic offsets and conducts fine search by designing an adversarial learning strategy to improve the effect of user abnormal behavior assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of a process flow of a data-driven abnormal behavior assessment method provided by the present invention;

[0054] Figure 2 A schematic diagram of a data-driven abnormal behavior assessment system provided by the present invention;

[0055] Figure 3 is a schematic flow chart of step S3;

[0056] Figure 4 It is a schematic diagram of the process of step S4.

[0057] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0059] In the description of the present invention, it is necessary to understand that terms such as “upper”, “lower”, “front”, “back”, “left”, “right”, “top”, “bottom”, “inside” and “outside” indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred system or element must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention.

[0060] Example 1, see Figure 1 The present invention provides a data-driven abnormal behavior assessment method, which comprises the following steps:

[0061] Step S1: Data collection, collecting historical user behavior data;

[0062] Step S2: Data preprocessing, data cleaning, data conversion and data set division of the collected data;

[0063] Step S3: Establish a user behavior detection model. The encoder uses a deep neural network to efficiently represent the user behavior data and maps it to the latent space to achieve dimensionality reduction of complex user behavior data. The discriminator uses a convolutional network to determine the user behavior state of the input data. Combined with the changes in user behavior scenarios, a state prediction model based on conditional probability is designed to identify potential abnormal user behavior states and generate prediction results.

[0064] Step S4: Model parameter optimization, dynamically adjusting model parameters based on user behavior data under different conditions;

[0065] Step S5: abnormal behavior assessment, abnormal behavior assessment is implemented based on the established user behavior detection model.

[0066] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, historical user behavior data includes user operation behavior data, user access behavior data, time feature data, user session behavior data and user behavior status; user behavior status is used as a data label; user operation behavior data includes operation type, operation frequency, operation sequence and operation preference; user access behavior data includes access resources, access content and access location; time feature data includes time regularity, operation interval and operation suddenness; user session behavior data includes login behavior, session duration and operation scope; user behavior status includes normal behavior, mild abnormal behavior and severe abnormal behavior.

[0067] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, data cleaning is to process missing values, duplicate values ​​and outliers; data conversion is to convert the cleaned data into vector form and perform standardization; data set division is to divide the converted data set into a test set and a training set.

[0068] Example 4, see Figure 1 and Figure 3 This embodiment is based on the above embodiment. In step S3, establishing a user behavior detection model is to build a user behavior detection model based on the preprocessed historical behavior data, specifically including:

[0069] Encoder Design:

[0070] Map the input user behavior data x to the potential representation z, expressed as: ; The encoder uses a fully connected layer to reduce the dimension, expressed as: ; Where E(·) is the encoder function; is the activation function; W m1 is the weight matrix of the encoder; b is the bias term of the encoder; is the ith element of the potential representation; x i+m is the i+mth element in the vector corresponding to the input user behavior data x; m is the offset; M is the total offset; through the design of the encoder, the user behavior detection model can efficiently extract the core features of the server user behavior data, while reducing redundant information, thereby enhancing the ability to identify abnormal behaviors;

[0071] Quantizer Design:

[0072] Quantize the potential representation z and get ; Map each element in z to the nearest center, expressed as: ; ; Where Q(·) is the quantizer function; c l is the quantization center, C is the set of quantization centers; is the i-th element of the quantized potential representation; t is the current number of training times; is the learning rate; Nl is the total number of users; is the operating frequency of the il-th user; is the operating frequency of the quantization center; through this process, the data of the potential representation is mapped to the discretized quantization center, thereby reducing the interference of noise and improving the ability of the user behavior detection model to process discrete behavior features;

[0073] Generator Decoder Design:

[0074] The quantized potential representation Remap back to the original data space to get the reconstructed data ; The decoder uses deconvolution operation to perform dimension expansion as: ; In the formula, is the reconstruction data; G(·) is the generator function; and They are the weight matrix and bias term of the generator respectively; is the i-th element in the reconstructed data; through this reverse mapping, the generator can restore the user behavior data with high fidelity, which helps to reduce the loss between the potential representation and the original data, and can also improve the user behavior detection model's ability to understand and predict behavior characteristics, and further enhance the accuracy of identifying abnormal behaviors;

[0075] Discriminator design:

[0076] The input data is judged, expressed as: output = D(x); the convolutional network processes the input data, expressed as: ; Where output is the discriminator output; D(·) is the discriminator function; and They are the weight and bias of the discriminator respectively; the discriminator combines convolution operation and activation function to quickly determine the validity of input user behavior data; through the anomaly detection mechanism, the discriminator can screen out potential abnormal behavior data, ensuring the reliability and accuracy of user behavior data analysis, while improving the real-time detection capability of abnormal behavior;

[0077] Probabilistic model design:

[0078] Calculate the joint probability distribution of the potential representation, and set a joint threshold in advance. If the joint probability distribution of the data is lower than the threshold, it is judged as abnormal user behavior data; it is expressed as: ; Output the predicted user behavior state based on the maximum conditional probability; The conditional probability calculation is expressed as: ; In the formula, is the joint probability distribution; n is the total number of samples; and are the i-1th and 1st elements of the quantized potential representation respectively; is the approximate calculated value of the conditional probability, i.e., the probability that the i-th element belongs to the l-th class label, i.e., the user behavior state; p(·|·) is the conditional probability; through the probability model, the user behavior detection model can accurately identify abnormal user behavior and accurately predict the user behavior state; significantly improve the ability to perceive abnormal behavior and the efficiency of user behavior management;

[0079] Activation function design:

[0080] In order to adapt to complex user behavior scenarios, a soft segmentation improved activation function is designed to improve the responsiveness to diversified user behavior data; the user behavior detection model includes an encoder, a quantizer, a generator decoder, a discriminator and a probability model; the discriminator determines the user behavior state of the input data, and also designs a probability model for identifying potential abnormal user behavior states in combination with changes in user behavior scenarios, and finally generates a prediction result; among them, the activation functions in the encoder, generator decoder and discriminator are specifically designed as follows: the soft segmentation improved activation function is designed, which is expressed as: ; ; Where tx is the activation function input; T0 is the scale parameter used to adjust the scalability of the input; α is the fractional order, which controls the nonlinearity of the activation function; is the segmentation threshold; and are the maximum fractional order and the minimum fractional order respectively; is the order index; is the activation function;

[0081] Loss function definition:

[0082] Define the adaptive loss function, expressed as: ; Where L is the adaptive loss function used by the model; γ is the attenuation factor; is the mean square error loss function; is the cross entropy loss function;

[0083] Model judgment:

[0084] The model is trained based on the training set. When the model loss converges, the user behavior detection model training is completed. If the maximum number of training times is reached, the model parameters are optimized. An accuracy threshold is set in advance. When the prediction accuracy of the trained user behavior detection model for the test set is higher than the accuracy threshold, the user behavior detection model is established. Otherwise, the data set is re-divided to train the user behavior detection model, further ensuring the accuracy of user behavior detection.

[0085] By performing the above operations, the general abnormal behavior assessment method is seriously affected by noise interference, cannot adapt to the changes in user's diverse scenarios, and has a weak ability to capture user behavior patterns, which leads to poor accuracy in abnormal behavior assessment. This solution reduces information loss in data feature restoration and enhances the accuracy of abnormal behavior detection through enhanced noise suppression and discretization processing, as well as high-fidelity data restoration; provides accurate abnormal behavior recognition capabilities based on probabilistic model design; and improves the responsiveness to complex user behavior data based on the dynamic adaptability of the designed activation function, thereby ensuring the accuracy of abnormal behavior assessment.

[0086] Example 5, see Figure 1 and Figure 4 This embodiment is based on the above embodiment. In step S4, the model parameter optimization is to adjust the parameters of the user behavior detection model based on the user behavior data under different conditions, and specifically includes the following steps:

[0087] Step S41: Initialization; establish a parameter search space based on the network structure parameters, scale parameters, fractional order and attenuation factor in the user behavior detection model; initialize the individual position in the search population, and use the prediction accuracy of the user behavior detection model trained based on the individual position for the test set as the individual fitness value; the formula used to initialize the individual position in the search population is as follows:

[0088] ;

[0089] ;

[0090] In the formula, x i1+1,j1 and x i1,j1 are the positions of the i1+1th individual and the i1th individual in the j1th dimension respectively; is the dynamic offset; is the initial offset; i1 is the individual index; N1 is the number of individuals in the population;

[0091] Step S42: For each individual, calculate the inverse solution, expressed as ; The final solution is selected based on the fitness value, expressed as: ;Therefore, it can adapt to the complex and diverse environmental requirements in user behavior management;

[0092] In the formula, x j1 is the inverse solution of the i1th individual; is a random number between 0 and 1; lb and ub are the lower and upper bounds of the search space respectively; and These are the individual positions after and before opponent learning, respectively; (·) is the individual fitness value

[0093] Step S43: Dynamic random movement design; combining the changes in user behavior management requirements and the interference of abnormal environment, dynamic random movement design; applying particle swarm search algorithm to move individual positions, and then performing individual dynamic fine-tuning, the formula used for dynamic fine-tuning is as follows:

[0094] ;

[0095] ;

[0096] ;

[0097] ;

[0098] In the formula, is the individual position after dynamic fine-tuning; is the position of the individual after it is moved by the particle swarm search algorithm in the j1th dimension at the t1th iteration; is the distance moved by the individual particle swarm search algorithm; a is the dynamic adjustment factor; maxt1 is the maximum number of iterations; L(s) is the fine-tuning step size; s is the step size factor; u is the normal distribution A random number, where ; v is subject to normal distribution A random number; is the gamma function; α1 is the scale parameter used to determine the step size; β is the stability index;

[0099] Step S44: Optimization judgment; a fitness threshold is set in advance; when there is an individual fitness value higher than the fitness threshold, the model parameter optimization is completed, and a user behavior detection model is established based on the individual position; if the maximum number of iterations is reached, it is reinitialized; otherwise, the adversarial learning strategy is returned to continue iteration.

[0100] By performing the above operations, the general abnormal behavior assessment method cannot adapt to the dynamic changes of complex user behavior scenarios, resulting in poor effect of user abnormal behavior assessment. This scheme initializes individual positions based on dynamic offsets, and performs fine search by designing an adversarial learning strategy to improve the effect of user abnormal behavior assessment.

[0101] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, abnormal behavior assessment is based on the established user behavior detection model, and user behavior data is collected in real time; after pre-processing, it is input into the user behavior detection model, and abnormal behavior assessment is performed based on the output of the user behavior detection model; if the output of the user behavior detection model is serious abnormal behavior, early warning processing is performed.

[0102] Embodiment 7, see Figure 2 , this embodiment is based on the above embodiment, and the data-driven abnormal behavior assessment system provided by the present invention includes a data acquisition module, a data preprocessing module, a user behavior detection model establishment module, a model parameter optimization module and an abnormal behavior assessment module;

[0103] The data collection module collects user behavior data and sends the data to the data preprocessing module;

[0104] The data preprocessing module performs data cleaning, data conversion and standardization on the collected data; and sends the preprocessed data to the user behavior detection model establishment module;

[0105] The user behavior detection model module includes an encoder, a quantizer, a generator decoder, a discriminator and a probability model; the encoder features the user behavior data through a deep neural network and maps it to a latent space; the discriminator determines the user behavior state of the input data based on a convolutional network, and also designs a probability model for identifying potential abnormal user behavior states in combination with changes in user behavior scenarios, and finally generates a prediction result; and sends the data to a model parameter optimization module; and sends the data to a model parameter optimization module;

[0106] The model parameter optimization module dynamically adjusts the model parameters based on user behavior data under different conditions; and sends the data to the abnormal behavior assessment module;

[0107] The abnormal behavior assessment module implements abnormal behavior assessment based on the established and optimized user behavior detection model.

[0108] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0109] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.

[0110] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A data-driven abnormal behavior assessment method, characterized by: The method comprises the following steps: Step S1: Data collection, collecting historical user behavior data; Step S2: data preprocessing; Step S3: Establish a user behavior detection model; the user behavior detection model includes an encoder, a quantizer, a generator decoder, a discriminator and a probability model; the discriminator determines the user behavior state of the input data, and also designs a probability model for identifying potential abnormal user behavior states in combination with changes in user behavior scenarios, and finally generates a prediction result; wherein, the activation functions in the encoder, generator decoder and discriminator are specifically designed as follows: the activation function improved by soft segmentation is designed, which is expressed as: ; ; Where tx is the activation function input; T0 is the scale parameter used to adjust the scalability of the input; α is the fractional order, which controls the nonlinearity of the activation function; is the segmentation threshold; and are the maximum fractional order and the minimum fractional order respectively; is the order index; is the activation function; Step S4: model parameter optimization; Step S5: abnormal behavior assessment, which is based on the established and optimized user behavior detection model to implement abnormal behavior assessment.

2. The data-driven abnormal behavior assessment method according to claim 1, characterized in that: In step S3, establishing a user behavior detection model further includes: Encoder Design: Map the input user behavior data x to the potential representation z, expressed as: ; The encoder uses a fully connected layer to reduce the dimension, expressed as: ; Where E(·) is the encoder function; is the activation function; W m1 is the weight matrix of the encoder; b is the bias term of the encoder; is the ith element of the potential representation; x i+m is the i+mth element in the vector corresponding to the input user behavior data x; m is the offset; M is the total offset; Quantizer Design: Quantize the potential representation z and get ; Map each element in z to the nearest center, expressed as: ; ; Where Q(·) is the quantizer function; c l is the quantization center, C is the set of quantization centers; is the i-th element of the quantized potential representation; t is the current number of training times; is the learning rate; Yl is the total number of users; is the operation frequency of the yth user; is the operating frequency of the quantization center; Generator decoder design: The quantized potential representation Remap back to the original data space to get the reconstructed data ; The decoder uses deconvolution operation to perform dimension expansion as: ; In the formula, is the reconstruction data; G(·) is the generator function; and They are the weight matrix and bias term of the generator respectively; is the i-th element in the reconstructed data; Discriminator design: The input data is judged, expressed as: output = D(x); the convolutional network processes the input data, expressed as: ; Where output is the discriminator output; D(·) is the discriminator function; and They are the weight and bias of the discriminator respectively; Probabilistic model design: Calculate the joint probability distribution of the potential representation, and set a joint threshold in advance. If the joint probability distribution of the data is lower than the threshold, it is judged as abnormal user behavior data; it is expressed as: ; Output the predicted user behavior state based on the maximum conditional probability; The conditional probability calculation is expressed as: ; In the formula, is the joint probability distribution; n is the total number of samples; and are the i-1th and 1st elements of the quantized potential representation respectively; is the approximate calculated value of the conditional probability, i.e., the probability that the i-th element belongs to the l-th class label, i.e., the user behavior state; p(·|·) is the conditional probability; Loss function definition: Define the adaptive loss function, expressed as: ; Where L is the adaptive loss function used by the model; γ is the attenuation factor; is the mean square error loss function; is the cross entropy loss function; Model judgment: The model is trained based on the training set. When the model loss converges, the user behavior detection model training is completed. If the maximum number of training times is reached, the model parameters are optimized. An accuracy threshold is set in advance. When the prediction accuracy of the trained user behavior detection model for the test set is higher than the accuracy threshold, the user behavior detection model is established. Otherwise, the data set is re-divided to train the user behavior detection model.

3. The data-driven abnormal behavior assessment method according to claim 2, characterized in that: In step S4, the model parameter optimization specifically includes the following steps: Step S41: Initialization; establish a parameter search space based on the network structure parameters, scale parameters, fractional order and attenuation factor in the user behavior detection model; initialize the individual position in the search population, and use the prediction accuracy of the user behavior detection model trained based on the individual position for the test set as the individual fitness value; the formula used to initialize the individual position in the search population is as follows: ； ； In the formula, x i1+1,j1 and x i1,j1 are the positions of the i1+1th individual and the i1th individual in the j1th dimension respectively; is the dynamic offset; is the initial offset; i1 is the individual index; N1 is the number of individuals in the population; Step S42: Design of adversarial learning strategy; for each individual, calculate the inverse solution, expressed as ; The final solution is selected based on the fitness value, expressed as: ; In the formula, x j1 is the inverse solution of the i1th individual; is a random number between 0 and 1; lb and ub are the lower and upper bounds of the search space respectively; and are the positions of the i1th individual after and before opponent learning, respectively; (·) is the individual fitness value; Step S43: Dynamic random movement design; applying the particle swarm search algorithm to move the individual position, and then performing individual dynamic fine-tuning. The formula used for dynamic fine-tuning is as follows: ； ； ； ； In the formula, is the individual position after dynamic fine-tuning; is the position of the individual after it is moved by the particle swarm search algorithm in the j1th dimension at the t1th iteration; is the distance moved by the individual particle swarm search algorithm; a is the dynamic adjustment factor; maxt1 is the maximum number of iterations; L(s) is the fine-tuning step size; s is the step size factor; u is the normal distribution A random number, where ; v is subject to normal distribution A random number; is the gamma function; α1 is the scale parameter used to determine the step size; β is the stability index; Step S44: Optimization judgment; a fitness threshold is set in advance; when there is an individual fitness value higher than the fitness threshold, the model parameter optimization is completed, and a user behavior detection model is established based on the individual position; if the maximum number of iterations is reached, it is reinitialized; otherwise, the adversarial learning strategy is returned to continue iteration.

4. The data-driven abnormal behavior assessment method according to claim 3, characterized in that: In step S1, the historical user behavior data includes user operation behavior data, user access behavior data, time feature data, user session behavior data and user behavior status; the user behavior status is used as a data label.

5. The data-driven abnormal behavior assessment method according to claim 1, characterized in that: In step S5, the abnormal behavior assessment is based on the established user behavior detection model, and user behavior data is collected in real time; After preprocessing, it is input into the user behavior detection model, and abnormal behavior evaluation is performed based on the output of the user behavior detection model.

6. The data-driven abnormal behavior assessment method according to claim 1, characterized in that: In step S2, the data preprocessing is to clean the collected data, convert the data and divide the data set; the data cleaning is to process missing values, duplicate values ​​and abnormal values; The data conversion is to convert the cleaned data into vector form and perform standardization processing; the data set division is to divide the converted data set into a test set and a training set.

7. A data-driven abnormal behavior assessment system, used to implement the data-driven abnormal behavior assessment method according to any one of claims 1 to 6, characterized in that: It includes data collection module, data preprocessing module, user behavior detection model building module, model parameter optimization module and abnormal behavior assessment module; The data collection module collects user behavior data and sends the data to the data preprocessing module; The data preprocessing module performs data cleaning, data conversion and standardization on the collected data; And send the preprocessed data to the module for establishing user behavior detection model; The user behavior detection model module includes an encoder, a quantizer, a generator decoder, a discriminator and a probability model; the encoder uses a deep neural network to represent the user behavior data and maps it to a latent space; The discriminator determines the user behavior status of the input data based on the convolutional network. It also designs a probability model for identifying potential abnormal user behavior status based on changes in user behavior scenarios, and finally generates a prediction result. The data is then sent to the model parameter optimization module. The model parameter optimization module dynamically adjusts the model parameters based on user behavior data under different conditions; and sends the data to the abnormal behavior assessment module; The abnormal behavior assessment module implements abnormal behavior assessment based on the established and optimized user behavior detection model.

Images