User behavior analysis method, system and device, medium and program product

Abstract

The invention provides a user behavior analysis method, system and device, a medium and a program product. The analysis method comprises the steps of obtaining a code mapping table of normal log operation behaviors of a user; coding the historical log operation of the user based on the coding mapping table, and constructing an original data set; extracting a regular expression of a normal log operation behavior of the user from the original data set; and checking the user behavior based on the regular expression. According to the method, the historical log operation of the user is coded based on the coding mapping table of the normal log operation behavior of the user, and the original data set is constructed; extracting a regular expression of a normal log operation behavior of the user from the original data set; the user behavior is checked based on the regular expression, the problem that the abnormal or wrong behavior of the normally logged-in user cannot be recognized due to the limitation of a permission rule-based technology is solved, and the accuracy of user behavior analysis is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security analysis, and in particular to a method, system, device, medium and program product for analyzing user behavior. Background Art

[0002] Internal threat is one of the key threats faced by each unit. Since insiders have access to internal business systems and understand their structure and security procedures, once an internal threat forms a security incident, the cost is often very high and the consequences are serious.

[0003] Traditional user abnormal behavior analysis technology often performs direct inspection and judgment based on permission rules, and can detect some basic account anomalies, such as account login from different locations, abnormal IP login, unauthorized operation, etc. This permission rule-based technology has certain limitations and cannot identify abnormal or erroneous behaviors of normal logged-in users.

[0004] The latest technical research generally uses big data and machine learning modeling and analysis methods, such as hidden Markov, support vector machine, decision tree, neural network and other algorithm technologies. This technology often requires the collection of a large amount of data, consumes a lot of CPU or GPU computing power, and is suitable for Internet cloud service scenarios. For single industrial computers and servers, it has great limitations and is difficult to implement.

[0005] For professional application software such as industrial control systems and network management systems, the types of user operation behaviors are limited, the behavior patterns are relatively fixed, and the server performance and computing power are limited. They are not suitable for using current machine learning and artificial intelligence algorithms. Simpler and more efficient algorithms should be used. Summary of the invention

[0006] The technical problem to be solved by the present disclosure is to overcome the limitations of the user abnormal behavior analysis method in the prior art, which cannot identify the abnormal or erroneous behavior of normal logged-in users, and to provide a user behavior analysis method, system, device, medium and program product.

[0007] The present invention solves the above technical problems through the following technical solutions:

[0008] A first aspect of the present disclosure provides a method for analyzing user behavior, the method comprising:

[0009] Get the encoding mapping table of the user's normal log operation behavior;

[0010] Encode the user's historical log operations based on the encoding mapping table and construct an original data set;

[0011] Extracting a regular expression of a user's normal log operation behavior from the original data set;

[0012] The user behavior is checked based on the regular expression.

[0013] Preferably, the step of obtaining a coding mapping table of a user's normal log operation behavior includes:

[0014] Classifying the normal log operation behaviors of the user according to the operation actions to obtain the operation action classification results;

[0015] Refining the operation action classification result to obtain a refined operation action classification result;

[0016] Setting encoding conditions based on the refined operation action classification results;

[0017] The encoding mapping table is created based on the encoding condition.

[0018] Preferably, the step of encoding the user's historical log operations based on the encoding mapping table and constructing an original data set includes:

[0019] Extracting session records from the historical log operation;

[0020] Querying the historical behavior code corresponding to each historical operation behavior in the session record from the code mapping table;

[0021] Generate a long string based on the historical behavior encoding;

[0022] Generate a number label for the session record based on the long character string;

[0023] The original data set is constructed based on the number annotations.

[0024] Preferably, the step of extracting a regular expression of a user's normal log operation behavior from the original data set includes:

[0025] A data model for identifying normal log operation behaviors of users based on the original data set;

[0026] Merge the states in the data model where the user operation behavior sequence numbers are the same and the abnormal impacts are the same, to obtain a simplified data model;

[0027] The simplified data model is converted into a regular expression of the user's normal log operation behavior.

[0028] Preferably, the step of verifying the user behavior based on the regular expression comprises:

[0029] Obtain the user's real-time log operation behavior;

[0030] Encode the real-time log operation behavior of the user to obtain a coding sequence number;

[0031] Selecting a target data item in a regular expression based on the encoding sequence number;

[0032] Obtaining the real-time behavior code corresponding to the real-time log operation behavior of the user;

[0033] In response to the real-time behavior code not being present in the target data item, determining that the inspection result is abnormal user behavior.

[0034] Preferably, the analysis method further comprises:

[0035] If the inspection result shows that the user's behavior is abnormal, the user's abnormal operation behavior is prevented.

[0036] A second aspect of the present disclosure provides a user behavior analysis system, the analysis system comprising:

[0037] The acquisition module is used to obtain the encoding mapping table of the user's normal log operation behavior;

[0038] An encoding module, used to encode the user's historical log operations based on the encoding mapping table and construct an original data set;

[0039] An extraction module, used to extract a regular expression of a user's normal log operation behavior from the original data set;

[0040] A verification module is used to verify user behavior based on the regular expression.

[0041] Preferably, the acquisition module includes:

[0042] A classification unit, used to classify the normal log operation behavior of the user according to the operation action, and obtain the operation action classification result;

[0043] A refinement processing unit, used for performing refinement processing on the operation action classification result to obtain a refined operation action classification result;

[0044] A setting unit, used for setting encoding conditions based on the refined operation action classification result;

[0045] A creating unit is used to create the encoding mapping table based on the encoding condition.

[0046] Preferably, the encoding module includes:

[0047] An extraction unit, used to extract the session records in the historical log operation;

[0048] A query unit, used to query the historical behavior code corresponding to each historical operation behavior in the session record from the code mapping table;

[0049] A first generating unit, configured to generate a long character string based on the historical behavior code;

[0050] A second generating unit, configured to generate a number label for the conversation record based on the long character string;

[0051] A construction unit is used to construct the original data set based on the number annotation.

[0052] Preferably, the extraction module comprises:

[0053] An identification unit, used to identify a data model of a user's normal log operation behavior based on the original data set;

[0054] A merging unit, used to merge the states of user operation behaviors with the same sequence number and the same abnormal impact in the data model to obtain a simplified data model;

[0055] The conversion unit is used to convert the simplified data model into a regular expression of the user's normal log operation behavior.

[0056] Preferably, the inspection module comprises:

[0057] The first acquisition unit is used to acquire the user's real-time log operation behavior;

[0058] An encoding unit, used for encoding the real-time log operation behavior of the user to obtain a coding sequence number;

[0059] A selection unit, used for selecting a target data item in a regular expression based on the encoding sequence number;

[0060] A second acquisition unit is used to acquire a real-time behavior code corresponding to the real-time log operation behavior of the user;

[0061] A determination unit is used to determine that the inspection result is abnormal user behavior in response to the real-time behavior code not existing in the target data item.

[0062] Preferably, the analysis system further comprises:

[0063] The blocking module is used to block the user's abnormal operation behavior when the inspection result shows that the user's behavior is abnormal.

[0064] A third aspect of the present disclosure provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and used to run on the processor, wherein the processor implements the user behavior analysis method described in the first aspect when executing the computer program.

[0065] A fourth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the user behavior analysis method described in the first aspect.

[0066] A fifth aspect of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the user behavior analysis method as described in the first aspect.

[0067] On the basis of being in accordance with the common sense in the art, the above-mentioned preferred conditions can be arbitrarily combined to obtain the preferred embodiments of the present disclosure.

[0068] The positive and progressive effects of this disclosure are:

[0069] The present invention encodes the user's historical log operations based on a coding mapping table of the user's normal log operation behavior and constructs an original data set; extracts a regular expression of the user's normal log operation behavior from the original data set; and verifies the user behavior based on the regular expression, thereby solving the limitation of the permission rule-based technology that cannot identify the abnormal or erroneous behavior of the normal logged-in user, and improving the accuracy of user behavior analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A flowchart of a method for analyzing user behavior provided in Embodiment 1 of the present disclosure;

[0071] Figure 2 A schematic diagram of modules of a user behavior analysis system provided in Embodiment 2 of the present disclosure;

[0072] Figure 3 This is a schematic diagram of the structure of an electronic device for implementing the method for analyzing user behavior according to Embodiment 3 of the present disclosure. DETAILED DESCRIPTION

[0073] The present disclosure is further described below by way of examples, but the present disclosure is not limited to the scope of the examples.

[0074] Prefixes such as "first" and "second" are used in the embodiments of the present disclosure only to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers to distinguish description objects in the embodiments of the present disclosure does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and no unnecessary limitation should be constituted due to the use of such prefixes. In addition, in the description of the present embodiment, unless otherwise specified, the meaning of "plurality" is two or more.

[0075] In the embodiments of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0076] Example 1

[0077] Figure 1 A flowchart of a method for analyzing user behavior provided in Example 1 of the present disclosure is shown in FIG. Figure 1 As shown, the analysis method includes:

[0078] S1. Obtain a coding mapping table of the user's normal log operation behavior;

[0079] In this embodiment, the normal log operation behavior of the user includes login, addition, modification, deletion, query, export, import, exit, etc. For the network management system, it generally also includes operations such as issuing policies. In order to more accurately classify and analyze, the user's log operation behavior is divided into finer granularity and then encoded, and the user's log operation behavior is encoded as operation action + object + result.

[0080] In this embodiment, encoding conditions (eg, encoding rules) are set for normal log operation behaviors of users, and an encoding mapping table is created based on the encoding conditions;

[0081] It should be noted that the encoding conditions are set according to actual conditions and are not specifically limited here.

[0082] S2, encode the user's historical log operations based on the encoding mapping table and construct the original data set;

[0083] S3, extract the regular expression of the user's normal log operation behavior from the original data set;

[0084] In this embodiment, a regular expression of a user's normal log operation behavior is extracted from the original data set based on a behavior extraction algorithm.

[0085] S4. Verify user behavior based on regular expressions.

[0086] In this embodiment, the extracted regular expression is used to check whether the user's behavior is abnormal.

[0087] This embodiment encodes the user's historical log operations based on a coding mapping table of the user's normal log operation behavior and constructs an original data set; extracts a regular expression of the user's normal log operation behavior from the original data set; and verifies the user behavior based on the regular expression, thereby solving the limitations of the permission rule-based technology and failing to identify abnormal or erroneous behaviors of normally logged-in users, thereby improving the accuracy of user behavior analysis.

[0088] In an optional embodiment, step S1 includes:

[0089] S11, classifying the user's normal log operation behavior according to the operation action, and obtaining the operation action classification result;

[0090] S12, performing refinement processing on the operation action classification result to obtain a refined operation action classification result;

[0091] In this embodiment, the data granularity under the operation action classification is refined.

[0092] S13, setting encoding conditions based on the refined operation action classification results;

[0093] S14. Create a coding mapping table based on the coding conditions.

[0094] In this embodiment, encoding conditions are set based on the refined operation action classification results, and an encoding mapping table is generated.

[0095] This embodiment models user behavior through coding conditions and regular expressions to detect abnormal operations. This method has excellent performance, simple code, easy implementation, and is suitable for resource-constrained environments.

[0096] In an optional embodiment, step S2 includes:

[0097] S21, extracting session records in historical log operations;

[0098] S22, querying the historical behavior code corresponding to each historical operation behavior in the session record from the code mapping table;

[0099] S23, generating a long string based on historical behavior coding;

[0100] In this embodiment, the historical behavior codes of a single session record are concatenated to generate a long string;

[0101] S24, generating a number label for the session record based on the long character string;

[0102] S25. Construct the original data set based on the number annotation.

[0103] In this embodiment, the long character strings generated by different session records are labeled with the user ID that generated the session and are organized into an original data set.

[0104] In an optional embodiment, step S3 includes:

[0105] S31, a data model for identifying normal log operation behaviors of users based on the original data set;

[0106] In this embodiment, the session records in the original data set are grouped using the user number as a group identifier; within the same group, the state is defined by the historical behavior code in each session record, and the flow path between the states is defined by the arrangement order of the historical behavior code, so as to generate a data model of the user's normal log operation behavior; and the data model of the user's normal log operation behavior is stored in the database;

[0107] S32, merging the states in the data model where the user operation behavior sequence numbers are the same and the abnormal impact is the same, to obtain a simplified data model;

[0108] S33. Convert the simplified data model into a regular expression of the user's normal log operation behavior.

[0109] In this embodiment, a regular expression is extracted from the original data set, the data model of the user's normal log operation behavior is identified, and the data model is converted into a regular expression. Since the regular expression method is relatively simple, it is more suitable for industrial control system scenarios with simple business scenarios and poor machine performance.

[0110] In an optional embodiment, step S4 includes:

[0111] S41, obtaining the user's real-time log operation behavior;

[0112] S42, encoding the user's real-time log operation behavior to obtain a coding sequence number;

[0113] S43, selecting a target data item in the regular expression based on the encoding sequence number;

[0114] S44, obtaining a real-time behavior code corresponding to the user's real-time log operation behavior;

[0115] S45. In response to the real-time behavior code not existing in the target data item, determining that the inspection result is abnormal user behavior.

[0116] In this embodiment, the corresponding regular expression is queried based on the user number that logs into the system; the user's real-time log operation behavior is collected, encoded, and then part of the regular expression (for example, the target data item) is selected based on the encoding sequence number (for example, the collection sequence number) to verify the user behavior.

[0117] In an optional embodiment, step S4 further includes: in response to the real-time behavior code being present in the target data item, determining that the inspection result is that the user behavior is normal.

[0118] It should be noted that part of the regular expression should be selected for verification in time when the user operates. After the user completes the operation and the session ends, the complete regular expression can be used for verification.

[0119] In an optional embodiment, the analysis method further comprises:

[0120] If the inspection result shows that the user's behavior is abnormal, the user's abnormal operation behavior is prevented.

[0121] In this embodiment, when the inspection result is abnormal, blocking measures are enabled to prevent abnormal operation behavior of the user.

[0122] This embodiment builds a data model of user behavior based on the user's log operation behavior, and extracts regular expressions to verify the user operation behavior. It has excellent performance, simple code, and is easy to implement. Compared with verification based purely on fixed rules, the present disclosure can combine the data model of user behavior to identify abnormal behavior. Compared with models based on machine learning artificial intelligence algorithms, the present disclosure can greatly reduce computing power requirements and can run easily even on computers with very poor performance. It is especially suitable for industrial control system scenarios with simple business scenarios and poor machine performance.

[0123] Example 2

[0124] Corresponding to the aforementioned embodiment of a method for analyzing user behavior, the present disclosure also provides an embodiment of a system for analyzing user behavior.

[0125] Figure 2 A schematic diagram of a module of a user behavior analysis system provided in Embodiment 2 of the present disclosure, such as Figure 2 As shown, the analysis system includes: an acquisition module 21, an encoding module 22, an extraction module 23, and a verification module 24;

[0126] The acquisition module 21 is used to obtain a coding mapping table of a user's normal log operation behavior;

[0127] In this embodiment, the normal log operation behavior of the user includes login, addition, modification, deletion, query, export, import, exit, etc. For the network management system, it generally also includes operations such as issuing policies. In order to more accurately classify and analyze, the user's log operation behavior is divided into finer granularity and then encoded, and the user's log operation behavior is encoded as operation action + object + result.

[0128] In this embodiment, encoding conditions (eg, encoding rules) are set for normal log operation behaviors of users, and an encoding mapping table is created based on the encoding conditions;

[0129] It should be noted that the encoding conditions are set according to actual conditions and are not specifically limited here.

[0130] The encoding module 22 is used to encode the user's historical log operations based on the encoding mapping table and construct an original data set;

[0131] An extraction module 23 is used to extract a regular expression of a user's normal log operation behavior from the original data set;

[0132] In this embodiment, a regular expression of a user's normal log operation behavior is extracted from the original data set based on a behavior extraction algorithm.

[0133] The verification module 24 is used to verify the user behavior based on regular expressions.

[0134] In this embodiment, the extracted regular expression is used to check whether the user's behavior is abnormal.

[0135] This embodiment encodes the user's historical log operations based on a coding mapping table of the user's normal log operation behavior and constructs an original data set; extracts a regular expression of the user's normal log operation behavior from the original data set; and verifies the user behavior based on the regular expression, thereby solving the limitations of the permission rule-based technology and failing to identify abnormal or erroneous behaviors of normally logged-in users, thereby improving the accuracy of user behavior analysis.

[0136] In an optional embodiment, the acquisition module includes:

[0137] A classification unit, used to classify the user's normal log operation behavior according to the operation action, and obtain the operation action classification result;

[0138] A refinement processing unit, used to refine the operation action classification result to obtain a refined operation action classification result;

[0139] In this embodiment, the data granularity under the operation action classification is refined.

[0140] A setting unit, used for setting encoding conditions based on the refined operation action classification results;

[0141] A creating unit is used to create a coding mapping table based on a coding condition.

[0142] In this embodiment, encoding conditions are set based on the refined operation action classification results, and an encoding mapping table is generated.

[0143] This embodiment models user behavior through coding conditions and regular expressions to detect abnormal operations. This method has excellent performance, simple code, easy implementation, and is suitable for resource-constrained environments.

[0144] In an optional embodiment, the encoding module includes:

[0145] An extraction unit, used for extracting session records in historical log operations;

[0146] A query unit, used to query the historical behavior code corresponding to each historical operation behavior in the session record from the code mapping table;

[0147] A first generating unit, used for generating a long character string based on the historical behavior code;

[0148] In this embodiment, the historical behavior codes of a single session record are concatenated to generate a long string;

[0149] A second generating unit, used for generating a number label of the session record based on the long character string;

[0150] The construction unit is used to construct the original data set based on the number annotation.

[0151] In this embodiment, the long character strings generated by different session records are labeled with the user ID that generated the session and are organized into an original data set.

[0152] In an optional embodiment, the extraction module includes:

[0153] An identification unit, used to identify a data model of a user's normal log operation behavior based on an original data set;

[0154] In this embodiment, the session records in the original data set are grouped using the user number as a group identifier; within the same group, the state is defined by the historical behavior code in each session record, and the flow path between the states is defined by the arrangement order of the historical behavior code, so as to generate a data model of the user's normal log operation behavior; and the data model of the user's normal log operation behavior is stored in the database;

[0155] A merging unit, used to merge the states of user operation behaviors with the same sequence number and the same abnormal impact in the data model to obtain a simplified data model;

[0156] The conversion unit is used to convert the simplified data model into a regular expression of the user's normal log operation behavior.

[0157] In this embodiment, a regular expression is extracted from the original data set, the data model of the user's normal log operation behavior is identified, and the data model is converted into a regular expression. Since the regular expression method is relatively simple, it is more suitable for industrial control system scenarios with simple business scenarios and poor machine performance.

[0158] In an optional embodiment, the inspection module includes:

[0159] The first acquisition unit is used to acquire the user's real-time log operation behavior;

[0160] The encoding unit is used to encode the user's real-time log operation behavior to obtain a coding sequence number;

[0161] A selection unit, used for selecting a target data item in a regular expression based on a coding sequence number;

[0162] The second acquisition unit is used to acquire the real-time behavior code corresponding to the real-time log operation behavior of the user;

[0163] The determination unit is used to determine that the inspection result is abnormal user behavior in response to the real-time behavior code not existing in the target data item.

[0164] In this embodiment, the corresponding regular expression is queried based on the user number that logs into the system; the user's real-time log operation behavior is collected, encoded, and then part of the regular expression (for example, the target data item) is selected based on the encoding sequence number (for example, the collection sequence number) to verify the user behavior.

[0165] In an optional embodiment, the determination unit is further configured to determine, in response to the real-time behavior code being present in the target data item, that the inspection result is that the user behavior is normal.

[0166] It should be noted that part of the regular expression should be selected for verification in time when the user operates. After the user completes the operation and the session ends, the complete regular expression can be used for verification.

[0167] In an optional embodiment, the analysis system further comprises:

[0168] The blocking module is used to block the user's abnormal operation behavior when the inspection result shows that the user's behavior is abnormal.

[0169] In this embodiment, when the inspection result is abnormal, blocking measures are enabled to prevent abnormal operation behavior of the user.

[0170] This embodiment builds a data model of user behavior based on the user's log operation behavior, and extracts regular expressions to verify the user operation behavior. It has excellent performance, simple code, and is easy to implement. Compared with verification based purely on fixed rules, the present disclosure can combine the data model of user behavior to identify abnormal behavior. Compared with models based on machine learning artificial intelligence algorithms, the present disclosure can greatly reduce computing power requirements and can run easily even on computers with very poor performance. It is especially suitable for industrial control system scenarios with simple business scenarios and poor machine performance.

[0171] As for the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The system embodiment described above is only illustrative, wherein the units described as separate components may or may not be physically separated, and the components as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution.

[0172] Example 3

[0173] Figure 3 This is a schematic diagram of the structure of an electronic device shown in Embodiment 3 of the present disclosure, wherein the electronic device includes a memory, a processor, and a computer program stored in the memory and used to run on the processor, and when the processor executes the computer program, the method for analyzing user behavior described in any of the above embodiments is implemented. Figure 3 The electronic device 90 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0174] like Figure 3 As shown, the electronic device 90 may be in the form of a general-purpose computing device, for example, it may be a server device. The components of the electronic device 90 may include, but are not limited to: at least one processor 91, at least one memory 92, and a bus 93 connecting different system components (including the memory 92 and the processor 91).

[0175] The bus 93 includes a data bus, an address bus, and a control bus.

[0176] The memory 92 may include a volatile memory, such as a random access memory (RAM) 921 and / or a cache memory 922 , and may further include a read only memory (ROM) 923 .

[0177] The memory 92 may also include a program tool 925 (or utility) having a set (at least one) of program modules 924, such program modules 924 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0178] The processor 91 executes various functional applications and data processing by running the computer programs stored in the memory 92, such as the user behavior analysis method provided in any of the above embodiments.

[0179] The electronic device 90 may also communicate with one or more external devices 94 (e.g., keyboards, pointing devices, etc.). Such communication may be performed via an input / output (I / O) interface 95. Furthermore, the electronic device 90 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 96. Figure 3 As shown, the network adapter 96 communicates with other modules of the electronic device 90 via the bus 93. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 90, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID (disk array) systems, tape drives, and data backup storage systems, etc.

[0180] It should be noted that although several units / modules or sub-units / modules of the electronic device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be embodied.

[0181] Example 4

[0182] Embodiment 4 of the present disclosure further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method for analyzing user behavior provided in any of the above embodiments is implemented.

[0183] The readable storage medium may include but is not limited to: a portable disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical storage device, a magnetic storage device or any suitable combination of the above.

[0184] Example 5

[0185] Embodiment 5 of the present disclosure further provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned methods for analyzing user behavior.

[0186] Among them, the program code for executing the computer program product of the present disclosure can be written in any combination of one or more programming languages, and the program code can be executed completely on the user device, partially on the user device, as an independent software package, partially on the user device and partially on a remote device, or completely on the remote device.

[0187] Among them, the program code for executing the computer program product of the present disclosure can be written in any combination of one or more programming languages, and the program code can be executed completely on the user device, partially on the user device, as an independent software package, partially on the user device and partially on a remote device, or completely on the remote device.

[0188] Although the specific embodiments of the present disclosure are described above, those skilled in the art should understand that this is only an example, and the protection scope of the present disclosure is defined by the appended claims. Those skilled in the art may make various changes or modifications to these embodiments without departing from the principles and essence of the present disclosure, but these changes and modifications all fall within the protection scope of the present disclosure.

Claims

1. A method for analyzing user behavior, characterized in that: The analysis method comprises: Get the encoding mapping table of the user's normal log operation behavior; Encode the user's historical log operations based on the encoding mapping table and construct an original data set; Extracting a regular expression of a user's normal log operation behavior from the original data set; The user behavior is checked based on the regular expression.

2. The method for analyzing user behavior according to claim 1, characterized in that: The step of obtaining the coding mapping table of the user's normal log operation behavior includes: Classifying the normal log operation behaviors of the user according to the operation actions to obtain the operation action classification results; Refining the operation action classification result to obtain a refined operation action classification result; Setting encoding conditions based on the refined operation action classification results; The encoding mapping table is created based on the encoding condition.

3. The method for analyzing user behavior according to claim 1, characterized in that: The step of encoding the user's historical log operations based on the encoding mapping table and constructing an original data set includes: Extracting session records from the historical log operation; Querying the historical behavior code corresponding to each historical operation behavior in the session record from the code mapping table; Generate a long string based on the historical behavior encoding; Generate a number label for the session record based on the long character string; The original data set is constructed based on the number annotations.

4. The method for analyzing user behavior according to claim 1, characterized in that: The step of extracting a regular expression of a user's normal log operation behavior from the original data set comprises: A data model for identifying normal log operation behaviors of users based on the original data set; Merge the states in the data model where the user operation behavior sequence numbers are the same and the abnormal impacts are the same, to obtain a simplified data model; The simplified data model is converted into a regular expression of the user's normal log operation behavior.

5. The method for analyzing user behavior according to claim 1, characterized in that: The step of verifying the user behavior based on the regular expression comprises: Obtain the user's real-time log operation behavior; Encode the real-time log operation behavior of the user to obtain a coding sequence number; Selecting a target data item in a regular expression based on the encoding sequence number; Obtaining the real-time behavior code corresponding to the real-time log operation behavior of the user; In response to the real-time behavior code not being present in the target data item, determining that the inspection result is abnormal user behavior.

6. The method for analyzing user behavior according to claim 5, characterized in that: The analysis method further comprises: If the inspection result shows that the user's behavior is abnormal, the user's abnormal operation behavior is prevented.

7. A user behavior analysis system, characterized in that: The analysis system comprises: The acquisition module is used to obtain the encoding mapping table of the user's normal log operation behavior; An encoding module, used to encode the user's historical log operations based on the encoding mapping table and construct an original data set; An extraction module, used to extract a regular expression of a user's normal log operation behavior from the original data set; A verification module is used to verify user behavior based on the regular expression.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and used to run on the processor, characterized in that: When the processor executes the computer program, the method for analyzing user behavior according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for analyzing user behavior according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for analyzing user behavior according to any one of claims 1 to 6 is implemented.

Images