User safety behavior analysis method based on multi-data fusion

Abstract

The invention discloses a user security behavior analysis method based on multi-data fusion, relates to the field of data security, solves the problem that the user security behavior analysis method lacks accuracy, and comprises the following steps: S1, obtaining a plurality of sample analysis coefficients and a security behavior preliminary analysis coefficient to obtain user behavior monitoring data, s2, dividing users in a safety behavior monitoring time period into a first type of safety users and a second type of safety users according to the user behavior monitoring data to obtain user behavior preliminary division data, and S3, obtaining a program running duration ratio and an unconventional program quantity ratio according to the user behavior monitoring data to obtain user behavior analysis data, and S4, performing safety behavior study and judgment on the user according to the user behavior monitoring data, the user behavior preliminary division data and the user behavior analysis data. According to the method, the accuracy and the pertinence of a user safety behavior analysis process can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of data security and relates to a multi-data fusion technology, in particular to a user security behavior analysis method based on multi-data fusion. Background Art

[0002] The existing user security behavior analysis methods have the following defects when performing user behavior security analysis:

[0003] 1. Existing user security behavior analysis methods only provide security reminders through the virus prevention software built into the operating system. The antivirus software built into the operating system generally focuses on the security of files and programs, and lacks in-depth analysis of user behavior patterns, and cannot effectively identify abnormal behaviors;

[0004] 2. Existing security behavior analysis tools usually use fixed detection modes for security behavior detection and cannot perform security behavior analysis based on the user's behavior habits in the operating system, resulting in a lack of pertinence in the user's security behavior analysis method;

[0005] To this end, we propose a user security behavior analysis method based on multi-data fusion. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention aims to provide a user safety behavior analysis method based on multi-data fusion. The present invention is based on separately setting a safety behavior monitoring period and multiple sample monitoring periods, analyzing the warning frequency of the characteristic warning signal and the average warning duration of the signal in each monitoring period, and obtaining a preliminary analysis coefficient of the safety behavior and multiple sample analysis coefficients to obtain user behavior monitoring data. By analyzing the user behavior monitoring data, a preliminary analysis threshold of the safety behavior is obtained, and a numerical comparison is made between the preliminary analysis threshold of the safety behavior and the preliminary analysis coefficient of the safety behavior, and users in the safety behavior monitoring period are divided into a first type of safety user and a second type of safety user to obtain Preliminary division of user behavior data is performed. During multiple sample monitoring periods, the applications run by users in the operating system are sorted to obtain multiple common programs in a ranking order. The application programs run by the second type of security users during the security behavior monitoring period are analyzed in running order and running time with the multiple common programs in a ranking order to obtain the ratio of the number of unconventional programs and the ratio of program running time. The program running time ratio and the ratio of the number of unconventional programs are defined as user behavior analysis data. Abnormal behavior warnings are directly issued to the first type of security users. For the second type of security users, the security behavior is judged by combining the user behavior monitoring data and the user behavior analysis data, and security behavior warnings are issued based on the judgment results.

[0007] In order to achieve the above object, the present invention adopts the following technical solution: The user security behavior analysis method based on multi-data fusion includes the following specific steps:

[0008] Step S1: Set a safety behavior monitoring period and multiple sample monitoring periods, analyze the warning frequency and average warning duration of the characteristic warning signal in each monitoring period, obtain the safety behavior preliminary analysis coefficient and multiple sample analysis coefficients, and obtain user behavior monitoring data;

[0009] Step S2: Analyze the user behavior monitoring data to obtain a preliminary safety behavior analysis threshold, compare the preliminary safety behavior analysis threshold with the preliminary safety behavior analysis coefficient, divide the users in the safety behavior monitoring period into the first type of safety users and the second type of safety users, and obtain preliminary user behavior classification data;

[0010] Step S3: In multiple sample monitoring periods, the application programs run by the user in the operating system are sorted to obtain multiple common ranking programs, and the application programs run by the second type of security users in the security behavior monitoring period are analyzed in running order and running time with the multiple common ranking programs to obtain the ratio of the number of unconventional programs and the ratio of the program running time, and the ratio of the program running time and the ratio of the number of unconventional programs are defined as user behavior analysis data;

[0011] Step S4: directly issue abnormal behavior warnings to the first type of safe users, conduct safety behavior analysis on the second type of safe users by combining user behavior monitoring data and user behavior analysis data, and issue safety behavior warnings based on the analysis results.

[0012] Furthermore, the step S1 further includes the following specific steps:

[0013] Step S11: taking the time value corresponding to the current moment as the reference time point, and taking a characteristic duration before the reference time point as the safety behavior monitoring period;

[0014] Step S12: obtaining a plurality of sample monitoring periods with characteristic durations before the safety behavior monitoring period, and naming them as the first sample monitoring period to the bth sample monitoring period respectively;

[0015] Step S13: Perform a preliminary safety behavior analysis on the safety behavior monitoring period to obtain a preliminary safety behavior analysis coefficient;

[0016] Step S14: respectively obtaining the preliminary analysis coefficients of the safety behaviors corresponding to the first sample monitoring period to the b-th sample monitoring period, and obtaining the first sample analysis coefficients to the b-th sample analysis coefficients;

[0017] Step S15: define the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, the first sample analysis coefficient to the bth sample analysis coefficient, and the safety behavior preliminary analysis coefficient as user behavior monitoring data, and proceed to step S2.

[0018] Furthermore, the step S13 further includes the following specific steps:

[0019] Step S131: selecting c abnormal behavior warning signals of the operating system as characteristic warning signals during the safety behavior monitoring period, and naming them as the first characteristic warning signal to the cth characteristic warning signal respectively;

[0020] Step S132: Obtain the cumulative number of occurrences of the first characteristic warning signal in the safety behavior monitoring period, obtain the number of occurrences of the first signal, obtain the duration value corresponding to the safety behavior monitoring period, obtain the characteristic duration value, calculate the ratio of the number of occurrences of the first signal to the characteristic duration value, obtain the warning frequency value corresponding to the first characteristic warning signal, and name it as the first warning frequency value;

[0021] Step S133: respectively acquiring the warning frequency values ​​corresponding to the second characteristic warning signal to the cth characteristic warning signal to obtain the second warning frequency values ​​to the cth warning frequency values;

[0022] Step S134: Obtain the warning duration corresponding to each occurrence of the first characteristic warning signal during the safety behavior monitoring period, obtain multiple signal warning durations, and average the obtained multiple signal warning durations to obtain the average warning duration corresponding to the first characteristic warning signal, and name it as the first signal average warning duration;

[0023] Step S135: respectively obtaining the average warning durations corresponding to the second characteristic warning signal to the cth characteristic warning signal, and obtaining the average warning duration of the second signal to the cth signal;

[0024] Step S136: Calculate the safety behavior preliminary analysis coefficient by combining the first warning frequency value to the c-th warning frequency value and the first signal average warning duration to the c-th signal average warning duration;

[0025] The preliminary analysis coefficient of safety behavior is calculated, and the specific formula configuration is as follows:

[0026]

[0027] Among them, Aqf is the preliminary analysis coefficient of safety behavior, Yjp1 to Yjpc are the first warning frequency value to the cth warning frequency value respectively, Ysc1 to Yscc are the average warning duration of the first signal to the average warning duration of the cth signal respectively, and c is the type quantity value corresponding to the characteristic warning signal.

[0028] Furthermore, the step S2 further includes the following specific steps:

[0029] Step S21: Obtain user behavior monitoring data, and obtain a preliminary safety behavior analysis coefficient and a first sample analysis coefficient to a bth sample analysis coefficient according to the user behavior monitoring data;

[0030] Step S22: Obtaining a preliminary safety behavior analysis threshold according to the first sample analysis coefficient to the bth sample analysis coefficient;

[0031] The step S22 further includes the following specific steps:

[0032] Step S221: Calculate the average of the first sample analysis coefficient to the bth sample analysis coefficient to obtain the average value of the sample analysis coefficient;

[0033] Step S222: performing variance calculation on the first sample analysis coefficient to the bth sample analysis coefficient to obtain the sample average analysis variance;

[0034] Step S223: Calculate the sample analysis coefficient average and the sample average analysis variance to obtain the safety behavior preliminary analysis threshold;

[0035] Calculate the threshold for preliminary analysis of security behavior. The specific formula configuration is as follows:

[0036]

[0037] Among them, Aqy is the preliminary analysis threshold of safety behavior, Ypf is the average value of sample analysis coefficient, and Fcf is the sample average analysis variance;

[0038] Step S23: numerically comparing the safety behavior preliminary analysis coefficient with the safety behavior preliminary analysis threshold, and defining the numerical comparison result as safety behavior preliminary classification data;

[0039] The step S23 further includes the following specific steps:

[0040] Step S231: when the safety behavior preliminary analysis coefficient is greater than or equal to the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a first type of safety user;

[0041] Step S232: when the safety behavior preliminary analysis coefficient is less than the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a second type of safety user;

[0042] Step S24: define the safety behavior preliminary analysis threshold and the safety behavior preliminary classification data as user behavior preliminary classification data, and proceed to step S3.

[0043] Furthermore, the step S3 further includes the following specific steps:

[0044] Step S31: Obtain user behavior monitoring data, and obtain the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, and preliminary safety behavior classification data according to the user behavior monitoring data;

[0045] Step S32: in the first sample monitoring period to the bth sample monitoring period, sort the application programs run by the user in the operating system to obtain the first-ranked common program to the dth-ranked common program;

[0046] Step S33: obtaining the ratio of the number of unconventional programs according to the first-ranked common programs to the d-th-ranked common programs;

[0047] Step S34: obtaining a program running time ratio according to the first-ranked common program to the d-th-ranked common program;

[0048] Step S35: defining the program running time ratio and the non-conventional program quantity ratio as user behavior analysis data.

[0049] Furthermore, the step S32 further includes the following specific steps:

[0050] Step S321: in the first sample monitoring period, obtain the application that the user starts to run first in the operating system, and use it as the first-priority running program, and obtain the first-priority running programs corresponding to the second to b-th sample monitoring periods respectively, to obtain b first-priority running programs;

[0051] Step S322: performing name statistics on each first-rank running program to obtain multiple programs with different names, and performing name appearance frequency statistics on each program with different names, marking the appearance frequency with the largest value as the peak statistical frequency, and when the peak statistical frequency is greater than the effective statistical frequency, marking the first-rank running program corresponding to the peak statistical frequency as the first-rank common program;

[0052] Step S323: in the first sample monitoring period, obtain the application program that the user runs after the first-priority common program in the operating system, and use it as the second-priority running program, and respectively obtain the second-priority running programs corresponding to the second to b-th sample monitoring periods to obtain b first-priority running programs;

[0053] Step S324: performing name statistics on each second-ranked running program to obtain multiple programs with different names, and performing name appearance frequency statistics on each program with different names, marking the appearance frequency with the largest value as the peak statistical frequency, and when the peak statistical frequency is greater than the effective statistical frequency, marking the running program corresponding to the peak statistical frequency as the second-ranked common program;

[0054] Step S325: respectively obtain the third-ranked common program to the d-th-ranked common program.

[0055] Furthermore, the step S33 further includes the following specific steps:

[0056] Step S331: obtaining the application that the user first starts to run during the safety behavior monitoring period to obtain a first actually running program, obtaining the application that runs after the first actually running program to obtain a second actually running program, and respectively obtaining the third to dth actually running programs;

[0057] Step S332: performing program name character matching on the first actual running program to the dth actual running program and the first order common program to the dth order common program. If the character matching results are the same, the corresponding application is marked as a regular sequence application. If the character matching results are not the same, the corresponding application is marked as an irregular sequence application.

[0058] Step S333: Count the number of non-conventional sequential application programs to obtain a non-conventional program quantity value, calculate the ratio of the non-conventional program quantity value to d, and obtain the non-conventional program quantity ratio.

[0059] Furthermore, the step S34 further includes the following specific steps:

[0060] Step S341: obtaining the average single running time of the first-rank common program in each sample monitoring period to obtain multiple single running times of the first program, and averaging the obtained multiple single running times of the first program to obtain the single average running time of the first program;

[0061] Step S342: respectively obtaining the single average running time of the programs corresponding to the second-ranked common program to the d-th-ranked common program, and obtaining the single average running time of the second program to the d-th program;

[0062] Step S343: During the safety behavior monitoring period, the actual running time corresponding to the first common program to the dth common program is respectively obtained to obtain the actual running time of the first program to the actual running time of the dth program;

[0063] Step S345: Calculate the program running time ratio by dividing the actual running time of the first program to the actual running time of the dth program by the average single running time of the first program to the average single running time of the dth program;

[0064] Calculate the program running time ratio. The specific formula is as follows:

[0065]

[0066] Among them, Cyb is the program running time ratio, Sjs1 to Sjsd are respectively the actual running time of the first program to the actual running time of the dth program, and Pjs1 to Pjsd are respectively the single average running time of the first program to the single average running time of the dth program.

[0067] Furthermore, the step S4 further includes the following specific steps:

[0068] Step S41: obtaining preliminary classification data of user behaviors, and issuing abnormal behavior warnings to the first type of safe users in the safe behavior monitoring period;

[0069] Step S42: Conduct safety behavior analysis on the second type of safety users who are in the safety behavior monitoring period.

[0070] Furthermore, the step S42 further includes the following specific steps:

[0071] Step S421: obtaining a preliminary safety behavior analysis coefficient based on the user behavior monitoring data, and obtaining a program running time ratio and a non-conventional program quantity ratio based on the user behavior analysis data;

[0072] Step S422: Calculate the safety behavior preliminary analysis coefficient, the program running time ratio, and the number of unconventional programs to obtain the user safety behavior assessment coefficient;

[0073] The user security behavior assessment coefficient is calculated using the following formula:

[0074] Ypx=Aqf+Cyb+Fcg;

[0075] Among them, Ypx is the user safety behavior judgment coefficient, Aqf is the safety behavior preliminary analysis coefficient, Cyb is the program running time ratio, and Fcg is the number of unconventional programs ratio;

[0076] Step S423: obtaining a preliminary safety behavior analysis threshold according to the preliminary classification data of user behaviors, and obtaining a program running time ratio threshold and an unconventional program quantity ratio threshold respectively;

[0077] Step S424: Calculate the user safety behavior evaluation coefficient threshold by using the safety behavior preliminary analysis threshold, the program running time ratio threshold, and the unconventional program quantity ratio threshold;

[0078] Step S425: When the user safety behavior judgment coefficient is greater than or equal to the user safety behavior judgment coefficient threshold, a safety behavior warning is issued to the user;

[0079] Step S426: When the user safety behavior judgment coefficient is less than the user safety behavior judgment coefficient threshold, the user's safety behavior monitoring continues.

[0080] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0081] 1. While performing security analysis through traditional built-in antivirus software, the present invention collects the user's behavior in the operating system, obtains the user's security behavior judgment coefficient to further complete the security behavior judgment, and can effectively improve the accuracy of identifying abnormal user behavior;

[0082] 2. The present invention obtains the user's behavior habits during the historical monitoring period to compare with the user behavior analysis data during the monitoring period. Through the historical data, the system can identify the user's unique behavior pattern, including specific activity time, frequency and behavior type, so as to analyze its behavior during the monitoring period in a targeted manner, and can more accurately judge abnormal behavior, thereby improving the targeted nature of the user security behavior analysis method. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0084] Figure 1 It is a diagram of the implementation steps of the present invention;

[0085] Figure 2 is the overall system block diagram of the present invention;

[0086] Figure 3 Match the schematic diagram to the program name in the invention. DETAILED DESCRIPTION

[0087] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0088] Embodiment 1:

[0089] See also Figure 1 The present invention provides a technical solution: a user security behavior analysis method based on multi-data fusion, comprising the following specific steps:

[0090] Step S1: respectively obtaining a safety behavior monitoring period, multiple sample monitoring periods, multiple sample analysis coefficients, and a safety behavior preliminary analysis coefficient to obtain user behavior monitoring data;

[0091] Step S11: taking the time value corresponding to the current moment as the reference time point, and taking a characteristic duration before the reference time point as the safety behavior monitoring period;

[0092] Step S12: obtaining a plurality of sample monitoring periods with characteristic durations before the safety behavior monitoring period, and naming them as the first sample monitoring period to the bth sample monitoring period respectively;

[0093] Step S13: Perform a preliminary safety behavior analysis on the safety behavior monitoring period to obtain a preliminary safety behavior analysis coefficient;

[0094] The step S13 further includes the following specific steps:

[0095] Step S131: selecting c abnormal behavior warning signals of the operating system as characteristic warning signals during the safety behavior monitoring period, and naming them as the first characteristic warning signal to the cth characteristic warning signal respectively;

[0096] Step S132: Obtain the cumulative number of occurrences of the first characteristic warning signal in the safety behavior monitoring period, obtain the number of occurrences of the first signal, obtain the duration value corresponding to the safety behavior monitoring period, obtain the characteristic duration value, calculate the ratio of the number of occurrences of the first signal to the characteristic duration value, obtain the warning frequency value corresponding to the first characteristic warning signal, and name it as the first warning frequency value;

[0097] Step S133: respectively acquiring the warning frequency values ​​corresponding to the second characteristic warning signal to the cth characteristic warning signal to obtain the second warning frequency values ​​to the cth warning frequency values;

[0098] Step S134: Obtain the warning duration corresponding to each occurrence of the first characteristic warning signal during the safety behavior monitoring period, obtain multiple signal warning durations, and average the obtained multiple signal warning durations to obtain the average warning duration corresponding to the first characteristic warning signal, and name it as the first signal average warning duration;

[0099] Step S135: respectively obtaining the average warning durations corresponding to the second characteristic warning signal to the cth characteristic warning signal, and obtaining the average warning duration of the second signal to the cth signal;

[0100] Step S136: Calculate the safety behavior preliminary analysis coefficient by combining the first warning frequency value to the c-th warning frequency value and the first signal average warning duration to the c-th signal average warning duration;

[0101] The preliminary analysis coefficient of safety behavior is calculated, and the specific formula configuration is as follows:

[0102]

[0103] Among them, Aqf is the preliminary analysis coefficient of safety behavior, Yjp1 to Yjpc are the values ​​of the first warning frequency to the cth warning frequency, Ysc1 to Yscc are the average warning duration of the first signal to the average warning duration of the cth signal, and c is the number of types corresponding to the characteristic warning signal;

[0104] Step S14: respectively obtaining the preliminary analysis coefficients of the safety behaviors corresponding to the first sample monitoring period to the b-th sample monitoring period, and obtaining the first sample analysis coefficients to the b-th sample analysis coefficients;

[0105] Step S15: define the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, the first sample analysis coefficient to the bth sample analysis coefficient, and the safety behavior preliminary analysis coefficient as user behavior monitoring data;

[0106] Step S2: obtaining a preliminary analysis threshold of safety behavior according to the user behavior monitoring data, comparing the preliminary analysis coefficient of safety behavior with the preliminary analysis threshold of safety behavior, and obtaining preliminary classification data of user behavior;

[0107] Step S21: Obtain user behavior monitoring data, and obtain a preliminary safety behavior analysis coefficient and a first sample analysis coefficient to a bth sample analysis coefficient according to the user behavior monitoring data;

[0108] Step S22: Obtaining a preliminary safety behavior analysis threshold according to the first sample analysis coefficient to the bth sample analysis coefficient;

[0109] The step S22 further includes the following specific steps:

[0110] Step S221: Calculate the average of the first sample analysis coefficient to the bth sample analysis coefficient to obtain the average value of the sample analysis coefficient;

[0111] Step S222: performing variance calculation on the first sample analysis coefficient to the bth sample analysis coefficient to obtain the sample average analysis variance;

[0112] Step S223: Calculate the sample analysis coefficient average and the sample average analysis variance to obtain the safety behavior preliminary analysis threshold;

[0113] Calculate the threshold for preliminary analysis of security behavior. The specific formula configuration is as follows:

[0114]

[0115] Among them, Aqy is the preliminary analysis threshold of safety behavior, Ypf is the average value of sample analysis coefficient, and Fcf is the sample average analysis variance;

[0116] Step S23: numerically comparing the safety behavior preliminary analysis coefficient with the safety behavior preliminary analysis threshold, and defining the numerical comparison result as safety behavior preliminary classification data;

[0117] The step S23 further includes the following specific steps:

[0118] Step S231: when the safety behavior preliminary analysis coefficient is greater than or equal to the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a first type of safety user;

[0119] Step S232: when the safety behavior preliminary analysis coefficient is less than the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a second type of safety user;

[0120] Step S24: defining the safety behavior preliminary analysis threshold and the safety behavior preliminary classification data as user behavior preliminary classification data;

[0121] Step S3: monitoring the safety behavior of the second type of safety users according to the user behavior monitoring data, and obtaining the program running time ratio and the number ratio of unconventional programs to obtain user behavior analysis data;

[0122] Step S31: Obtain user behavior monitoring data, and obtain the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, and preliminary safety behavior classification data according to the user behavior monitoring data;

[0123] Step S32: in the first sample monitoring period to the bth sample monitoring period, sort the application programs run by the user in the operating system to obtain the first-ranked common program to the dth-ranked common program;

[0124] The step S32 further includes the following specific steps:

[0125] Step S321: in the first sample monitoring period, obtain the application that the user starts to run first in the operating system, and use it as the first-priority running program, and obtain the first-priority running programs corresponding to the second to b-th sample monitoring periods respectively, to obtain b first-priority running programs;

[0126] Step S322: performing name statistics on each first-rank running program to obtain multiple programs with different names, and performing name appearance frequency statistics on each program with different names, marking the appearance frequency with the largest value as the peak statistical frequency, and when the peak statistical frequency is greater than the effective statistical frequency, marking the first-rank running program corresponding to the peak statistical frequency as the first-rank common program;

[0127] Step S323: in the first sample monitoring period, obtain the application program that the user runs after the first-priority common program in the operating system, and use it as the second-priority running program, and respectively obtain the second-priority running programs corresponding to the second to b-th sample monitoring periods to obtain b first-priority running programs;

[0128] Step S324: performing name statistics on each second-ranked running program to obtain multiple programs with different names, and performing name appearance frequency statistics on each program with different names, marking the appearance frequency with the largest value as the peak statistical frequency, and when the peak statistical frequency is greater than the effective statistical frequency, marking the running program corresponding to the peak statistical frequency as the second-ranked common program;

[0129] Step S325: repeating steps S321 to S324 to obtain the third-ranked commonality program to the d-th-ranked commonality program respectively;

[0130] Step S33: obtaining the ratio of the number of unconventional programs according to the first-ranked common programs to the d-th-ranked common programs;

[0131] The step S33 further includes the following specific steps:

[0132] Step S331: obtaining the application that the user first starts to run during the security behavior monitoring period to obtain the first actually running program, obtaining the application that runs after the first actually running program to obtain the second actually running program, and obtaining the third to dth actually running programs respectively;

[0133] Step S332: when the first actual running program to the dth actual running program and the first-rank common program to the dth-rank common program perform program name character matching, if the character matching results are the same, the corresponding application is marked as a regular sequence application; if the character matching results are different, the corresponding application is marked as an irregular sequence application;

[0134] Step S333: Count the number of non-conventional sequential application programs to obtain a non-conventional program number value, calculate the ratio of the non-conventional program number value to d, and obtain a non-conventional program number ratio;

[0135] Step S34: obtaining a program running time ratio according to the first-ranked common program to the d-th-ranked common program;

[0136] The step S34 further includes the following specific steps:

[0137] Step S341: obtaining the average single running time of the first-rank common program in each sample monitoring period to obtain multiple single running times of the first program, and averaging the obtained multiple single running times of the first program to obtain the single average running time of the first program;

[0138] Step S342: respectively obtaining the single average running time of the programs corresponding to the second-ranked common program to the d-th-ranked common program, and obtaining the single average running time of the second program to the d-th program;

[0139] Step S343: During the safety behavior monitoring period, the actual running time corresponding to the first common program to the dth common program is respectively obtained to obtain the actual running time of the first program to the actual running time of the dth program;

[0140] Step S345: Calculate the program running time ratio by dividing the actual running time of the first program to the actual running time of the dth program by the average single running time of the first program to the average single running time of the dth program;

[0141] Calculate the program running time ratio. The specific formula is as follows:

[0142]

[0143] Wherein, Cyb is the program running time ratio, Sjs1 to Sjsd are respectively the actual running time of the first program to the actual running time of the dth program, and Pjs1 to Pjsd are respectively the single average running time of the first program to the single average running time of the dth program;

[0144] Step S35: defining the program running time ratio and the non-conventional program number ratio as user behavior analysis data;

[0145] Step S4: Conduct safety behavior analysis on users in the safety behavior monitoring period based on the user behavior monitoring data, the user behavior preliminary classification data, and the user behavior analysis data, and issue safety behavior warnings based on the analysis results;

[0146] Step S41: obtaining preliminary classification data of user behavior, and issuing abnormal behavior warnings when the user in the safety behavior monitoring period is a first type of safety user;

[0147] Step S42: when the user in the safety behavior monitoring period is a second type of safety user, the safety behavior of the user is analyzed and judged;

[0148] The step S42 further includes the following specific steps:

[0149] Step S421: obtaining a preliminary safety behavior analysis coefficient based on the user behavior monitoring data, and obtaining a program running time ratio and a non-conventional program quantity ratio based on the user behavior analysis data;

[0150] Step S422: Calculate the safety behavior preliminary analysis coefficient, the program running time ratio, and the number of unconventional programs to obtain the user safety behavior assessment coefficient;

[0151] The user security behavior assessment coefficient is calculated using the following formula:

[0152] Ypx=Aqf+Cyb+Fcg;

[0153] Among them, Ypx is the user safety behavior judgment coefficient, Aqf is the safety behavior preliminary analysis coefficient, Cyb is the program running time ratio, and Fcg is the number of unconventional programs ratio;

[0154] Step S423: obtaining a preliminary safety behavior analysis threshold according to the preliminary classification data of user behaviors, and obtaining a program running time ratio threshold and an unconventional program quantity ratio threshold respectively;

[0155] Step S424: Calculate the user safety behavior evaluation coefficient threshold by using the safety behavior preliminary analysis threshold, the program running time ratio threshold, and the unconventional program quantity ratio threshold;

[0156] Step S425: When the user safety behavior judgment coefficient is greater than or equal to the user safety behavior judgment coefficient threshold, a safety behavior warning is issued to the user;

[0157] Step S426: When the user safety behavior judgment coefficient is less than the user safety behavior judgment coefficient threshold, the user's safety behavior monitoring continues.

[0158] In this application, if corresponding calculation formulas appear, the above calculation formulas are all dimensionless and take their numerical calculations. The weight coefficients, proportional coefficients and other coefficients in the formulas are set to a result value obtained by quantifying each parameter. The size of the weight coefficient and the proportional coefficient can be determined as long as it does not affect the proportional relationship between the parameter and the result value.

[0159] Embodiment 2

[0160] See also Figure 2 Based on another concept of the same invention, a user security behavior analysis system based on multi-data fusion is now proposed, which is applicable to a user security behavior analysis method based on multi-data fusion. The user security behavior analysis system includes a data acquisition module, a primary division module, a behavior analysis module, a security assessment module and a server. The data acquisition module, the primary division module, the behavior analysis module and the security assessment module are respectively connected to the server, and the server controls the data acquisition module, the primary division module, the behavior analysis module and the security assessment module respectively.

[0161] The data acquisition module obtains the safety behavior monitoring period respectively, and performs a preliminary safety behavior analysis on the user behavior in the safety behavior monitoring period to obtain the preliminary safety behavior analysis coefficient, obtains the first sample monitoring period to the b-th sample monitoring period, performs a preliminary safety behavior analysis on the first sample monitoring period to the b-th sample monitoring period by analysis, obtains the first sample analysis coefficient to the b-th sample analysis coefficient, and defines the safety behavior monitoring period, the first sample monitoring period to the b-th sample monitoring period, the first sample analysis coefficient to the b-th sample analysis coefficient, and the preliminary safety behavior analysis coefficient as user behavior monitoring data;

[0162] The time value corresponding to the current moment is taken as the reference time point, and the characteristic duration before the reference time point is taken as the safety behavior monitoring period;

[0163] Before the safety behavior monitoring period, a plurality of sample monitoring periods with characteristic durations are obtained, and they are named as the first sample monitoring period to the bth sample monitoring period respectively;

[0164] It should be noted here that:

[0165] The b involved here is the quantity value corresponding to the sample monitoring period, and b is an integer greater than 0, and there are no security risks in the user behavior corresponding to each sample monitoring period;

[0166] It should be noted here that:

[0167] The security behavior monitoring period involved here is specifically the period when the user performs more fixed operations on the operating system, which can be the working hours in this case;

[0168] The duration corresponding to the safety behavior monitoring period can be 9 hours, and in this application, as the time value corresponding to the current moment changes, the reference time point also changes accordingly, thereby realizing the dynamic update of the safety behavior monitoring period;

[0169] Conduct a preliminary safety behavior analysis during the safety behavior monitoring period to obtain a preliminary safety behavior analysis coefficient;

[0170] The details are as follows:

[0171] In the safety behavior monitoring period, c abnormal behavior warning signals of the operating system are selected as characteristic warning signals, and they are named as the first characteristic warning signal to the cth characteristic warning signal respectively;

[0172] What is explained here is:

[0173] In the present application, the first characteristic warning signal involved here may be a Ddos abnormal warning signal, the second characteristic warning signal may be a traffic abnormal fluctuation signal, and the third characteristic warning signal may be a network connection abnormal warning signal. The c involved here is the type quantity value corresponding to the characteristic warning signal, and c is an integer greater than 0. In practical applications, the specific type corresponding to the characteristic warning signal can be specifically set according to the actual situation;

[0174] Obtain the cumulative number of occurrences of the first characteristic warning signal in the safety behavior monitoring period, obtain the number of occurrences of the first signal, obtain the duration value corresponding to the safety behavior monitoring period, obtain the characteristic duration value, calculate the ratio of the number of occurrences of the first signal to the characteristic duration value, obtain the warning frequency value corresponding to the first characteristic warning signal, and name it as the first warning frequency value;

[0175] Respectively obtain the warning frequency values ​​corresponding to the second characteristic warning signal to the cth characteristic warning signal to obtain the second warning frequency value to the cth warning frequency value;

[0176] Obtain the warning duration corresponding to each occurrence of the first characteristic warning signal during the safety behavior monitoring period, obtain multiple signal warning durations, and average the obtained multiple signal warning durations to obtain the average warning duration corresponding to the first characteristic warning signal, and name it the first signal average warning duration;

[0177] The average warning durations corresponding to the second characteristic warning signal to the cth characteristic warning signal are respectively obtained to obtain the average warning duration of the second signal to the average warning duration of the cth signal;

[0178] The preliminary analysis coefficient of safety behavior is obtained by calculating the value of the first warning frequency to the value of the cth warning frequency and the average warning time of the first signal to the average warning time of the cth signal;

[0179] The preliminary analysis coefficient of safety behavior is calculated, and the specific formula configuration is as follows:

[0180]

[0181] Among them, Aqf is the preliminary analysis coefficient of safety behavior, Yjp1 to Yjpc are the values ​​of the first warning frequency to the cth warning frequency, Ysc1 to Yscc are the average warning duration of the first signal to the average warning duration of the cth signal, and c is the number of types corresponding to the characteristic warning signal;

[0182] The preliminary analysis coefficients of the safety behaviors corresponding to the first sample monitoring period to the bth sample monitoring period are obtained respectively, and the first sample analysis coefficients to the bth sample analysis coefficients are obtained;

[0183] It should be noted here that:

[0184] The first sample analysis coefficient to the bth sample analysis coefficient involved here correspond one to one with the preliminary analysis coefficients of safety behaviors corresponding to the first sample monitoring period to the bth sample monitoring period, that is, the first sample analysis coefficient is the preliminary analysis coefficient of safety behaviors corresponding to the first sample monitoring period, and the second sample analysis coefficient is the preliminary analysis coefficient of safety behaviors corresponding to the second sample monitoring period;

[0185] The safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, the first sample analysis coefficient to the bth sample analysis coefficient, and the safety behavior preliminary analysis coefficient are defined as user behavior monitoring data;

[0186] The data acquisition module acquires the user behavior monitoring data and transmits it to the primary segmentation module;

[0187] The initial segmentation module obtains the safety behavior preliminary analysis threshold according to the user behavior monitoring data, compares the safety behavior preliminary analysis coefficient with the safety behavior preliminary analysis threshold, and obtains the user behavior preliminary segmentation data;

[0188] Calculate the average of the first sample analysis coefficient to the bth sample analysis coefficient to obtain the average value of the sample analysis coefficient;

[0189] Calculate the variance of the first sample analysis coefficient to the bth sample analysis coefficient to obtain the sample average analysis variance;

[0190] The sample analysis coefficient average and sample average analysis variance are calculated to obtain the preliminary analysis threshold of the safety behavior;

[0191] Calculate the threshold for preliminary analysis of security behavior. The specific formula configuration is as follows:

[0192]

[0193] Among them, Aqy is the preliminary analysis threshold of safety behavior, Ypf is the average value of sample analysis coefficient, and Fcf is the sample average analysis variance;

[0194] Numerical comparison is performed between the safety behavior preliminary analysis coefficient and the safety behavior preliminary analysis threshold, and the numerical comparison result is defined as the safety behavior preliminary classification data;

[0195] The numerical comparison process is as follows:

[0196] When the safety behavior preliminary analysis coefficient is greater than or equal to the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a first type of safe user;

[0197] When the safety behavior preliminary analysis coefficient is less than the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a second type of safety user;

[0198] The initial segmentation module defines the security behavior preliminary analysis threshold and the security behavior preliminary segmentation data as user behavior preliminary segmentation data;

[0199] The initial segmentation module obtains preliminary segmentation data of user behavior and transmits it to the behavior analysis module and the security assessment module;

[0200] The behavior analysis module monitors the safety behavior of the second type of safety users according to the user behavior monitoring data, and obtains the program running time ratio and the number ratio of unconventional programs to obtain user behavior analysis data;

[0201] Obtain user behavior monitoring data, and obtain the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, and preliminary safety behavior classification data according to the user behavior monitoring data;

[0202] During the first sample monitoring period to the bth sample monitoring period, the application programs run by the user in the operating system are sorted to obtain the first-ranked common program to the dth-ranked common program;

[0203] The details are as follows:

[0204] It should be noted here that:

[0205] The d involved here is the number value corresponding to the sequential running program, and d is an integer greater than 0;

[0206] In the first sample monitoring period, the application program that the user starts to run first in the operating system is obtained and used as the first-priority running program. The first-priority running programs corresponding to the second to b-th sample monitoring periods are obtained respectively to obtain b first-priority running programs;

[0207] Perform name statistics on each first-rank running program to obtain multiple programs with different names, and perform name appearance frequency statistics on each program with different names, and mark the appearance frequency with the largest value as the peak statistical frequency. When the peak statistical frequency is greater than the effective statistical frequency, mark the first-rank running program corresponding to the peak statistical frequency as the first-rank common program;

[0208] It should be noted here that:

[0209] Assume that among the three first-ranked running programs, the name WPS appears 20 times, the name WeChat appears 28 times, and the name Edge browser appears 30 times. Since 30 is greater than 28 and greater than 20, Edge browser is marked as the first-ranked common program.

[0210] In the first sample monitoring period, the application program that the user runs after the first-priority common program in the operating system is obtained, and it is used as the second-priority running program, and the second-priority running programs corresponding to the second to b-th sample monitoring periods are respectively obtained to obtain b first-priority running programs;

[0211] Perform name statistics on each second-ranked running program to obtain multiple programs with different names, and perform name appearance frequency statistics on each program with different names, and mark the appearance frequency with the largest value as the peak statistical frequency. When the peak statistical frequency is greater than the effective statistical frequency, mark the running program corresponding to the peak statistical frequency as the second-ranked common program;

[0212] Repeat the process of acquiring the first-ranked common program and the second-ranked common program, and acquire the third-ranked common program to the d-th-ranked common program respectively;

[0213] Obtain the ratio of the number of unconventional procedures according to the first-ranked common procedures to the d-ranked common procedures;

[0214] The details are as follows:

[0215] Obtain the application that the user first starts running during the security behavior monitoring period to obtain a first actually running program, obtain the application that runs after the first actually running program to obtain a second actually running program, and obtain the third to dth actual running programs respectively;

[0216] See also Figure 3 , when the first actual running program to the dth actual running program and the first-rank commonality program to the dth-rank commonality program perform program name character matching, if the character matching results are the same, the corresponding application is marked as a regular sequence application; if the character matching results are not the same, the corresponding application is marked as an irregular sequence application;

[0217] Count the number of non-conventional sequential application programs to obtain the number value of non-conventional programs, calculate the ratio of the number value of non-conventional programs to d, and obtain the number ratio of non-conventional programs;

[0218] Obtaining a program running time ratio according to the first-ranked common program to the d-th-ranked common program;

[0219] The details are as follows:

[0220] The average single running time of the first-rank common program in each sample monitoring period is obtained to obtain multiple single running times of the first program, and the average of the obtained multiple single running times of the first program is calculated to obtain the single average running time of the first program;

[0221] The single average running time of the programs corresponding to the second-ranked common program to the d-th-ranked common program is obtained respectively, and the single average running time of the second program to the single average running time of the d-th program is obtained;

[0222] During the safety behavior monitoring period, the actual running time corresponding to the first common program to the dth common program is obtained respectively, and the actual running time of the first program to the actual running time of the dth program is obtained;

[0223] The program running time ratio is obtained by calculating the actual running time of the first program to the actual running time of the dth program and the single average running time of the first program to the single average running time of the dth program;

[0224] Calculate the program running time ratio. The specific formula is as follows:

[0225]

[0226] Wherein, Cyb is the program running time ratio, Sjs1 to Sjsd are respectively the actual running time of the first program to the actual running time of the dth program, and Pjs1 to Pjsd are respectively the single average running time of the first program to the single average running time of the dth program;

[0227] The ratio of program running time to the ratio of the number of unconventional programs is defined as user behavior analysis data;

[0228] The behavior analysis module obtains user behavior analysis data and transmits it to the security analysis module;

[0229] The security assessment module assesses the security behavior of users in the security behavior monitoring period based on user behavior monitoring data, user behavior preliminary classification data, and user behavior analysis data, and issues security behavior warnings based on the assessment results;

[0230] Obtain preliminary classification data of user behavior, and issue abnormal behavior warnings when users in the safety behavior monitoring period are first-type safety users;

[0231] When a user in the safety behavior monitoring period is a second-type safety user, the user's safety behavior is analyzed and judged as follows:

[0232] Obtain the preliminary safety behavior analysis coefficient based on user behavior monitoring data, and obtain the program running time ratio and the ratio of the number of unconventional programs based on user behavior analysis data;

[0233] The user safety behavior assessment coefficient is obtained by calculating the safety behavior preliminary analysis coefficient, the program running time ratio and the ratio of the number of unconventional programs;

[0234] The user security behavior assessment coefficient is calculated using the following formula:

[0235] Ypx=Aqf+Cyb+Fcg;

[0236] Among them, Ypx is the user safety behavior judgment coefficient, Aqf is the safety behavior preliminary analysis coefficient, Cyb is the program running time ratio, and Fcg is the number of unconventional programs ratio;

[0237] Based on the preliminary division of user behavior data, the preliminary analysis threshold of security behavior is obtained, and the program running time ratio threshold and the unconventional program number ratio threshold are obtained respectively;

[0238] It should be noted here that:

[0239] The program running time ratio threshold involved here is the maximum program running time ratio of the second type of safety user in the safety behavior monitoring period, and the unconventional program quantity ratio threshold is the unconventional program quantity ratio of the second type of safety user in the safety behavior monitoring period;

[0240] The user safety behavior assessment coefficient threshold is obtained by calculating the safety behavior preliminary analysis threshold, the program running time ratio threshold, and the unconventional program quantity ratio threshold;

[0241] The user security behavior assessment coefficient threshold is calculated using the following formula:

[0242] Ypxy=Aqy+Cyy+Fcy;

[0243] Among them, Ypxy is the user security behavior judgment coefficient threshold, Aqy is the security behavior preliminary analysis threshold, Cyy is the program running time ratio threshold, and Fcy is the unconventional program quantity ratio threshold;

[0244] When the user's safety behavior judgment coefficient is greater than or equal to the user's safety behavior judgment coefficient threshold, a safety behavior warning is issued to the user;

[0245] When the user safety behavior assessment coefficient is less than the user safety behavior assessment coefficient threshold, the user's safety behavior monitoring will continue;

[0246] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A user security behavior analysis method based on multi-data fusion, characterized in that: The method comprises the following steps: Step S1: Set a safety behavior monitoring period and multiple sample monitoring periods, analyze the warning frequency and average warning duration of the characteristic warning signal in each monitoring period, obtain the safety behavior preliminary analysis coefficient and multiple sample analysis coefficients, and obtain user behavior monitoring data; Step S2: Analyze the user behavior monitoring data to obtain a preliminary safety behavior analysis threshold, compare the preliminary safety behavior analysis threshold with the preliminary safety behavior analysis coefficient, divide the users in the safety behavior monitoring period into the first type of safety users and the second type of safety users, and obtain preliminary user behavior classification data; Step S3: In multiple sample monitoring periods, the application programs run by the user in the operating system are sorted to obtain multiple common ranking programs, and the application programs run by the second type of security users in the security behavior monitoring period are analyzed in running order and running time with the multiple common ranking programs to obtain the ratio of the number of unconventional programs and the ratio of the program running time, and the ratio of the program running time and the ratio of the number of unconventional programs are defined as user behavior analysis data; Step S4: directly issue abnormal behavior warnings to the first type of safe users, conduct safety behavior analysis on the second type of safe users by combining user behavior monitoring data and user behavior analysis data, and issue safety behavior warnings based on the analysis results.

2. The user security behavior analysis method based on multi-data fusion according to claim 1 is characterized in that: The step S1 further includes the following specific steps: Step S11: taking the time value corresponding to the current moment as the reference time point, and taking a characteristic duration before the reference time point as the safety behavior monitoring period; Step S12: obtaining a plurality of sample monitoring periods with characteristic durations before the safety behavior monitoring period, and naming them as the first sample monitoring period to the bth sample monitoring period respectively; Step S13: Perform a preliminary safety behavior analysis on the safety behavior monitoring period to obtain a preliminary safety behavior analysis coefficient; Step S14: respectively obtaining the preliminary analysis coefficients of the safety behaviors corresponding to the first sample monitoring period to the b-th sample monitoring period, and obtaining the first sample analysis coefficients to the b-th sample analysis coefficients; Step S15: define the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, the first sample analysis coefficient to the bth sample analysis coefficient, and the safety behavior preliminary analysis coefficient as user behavior monitoring data, and proceed to step S2.

3. The user security behavior analysis method based on multi-data fusion according to claim 2 is characterized in that: The step S13 further includes the following specific steps: Step S131: selecting c abnormal behavior warning signals of the operating system as characteristic warning signals during the safety behavior monitoring period, and naming them as the first characteristic warning signal to the cth characteristic warning signal respectively; Step S132: Obtain the cumulative number of occurrences of the first characteristic warning signal in the safety behavior monitoring period, obtain the number of occurrences of the first signal, obtain the duration value corresponding to the safety behavior monitoring period, obtain the characteristic duration value, calculate the ratio of the number of occurrences of the first signal to the characteristic duration value, obtain the warning frequency value corresponding to the first characteristic warning signal, and name it as the first warning frequency value; Step S133: respectively acquiring the warning frequency values ​​corresponding to the second characteristic warning signal to the cth characteristic warning signal to obtain the second warning frequency values ​​to the cth warning frequency values; Step S134: Obtain the warning duration corresponding to each occurrence of the first characteristic warning signal during the safety behavior monitoring period, obtain multiple signal warning durations, and average the obtained multiple signal warning durations to obtain the average warning duration corresponding to the first characteristic warning signal, and name it as the first signal average warning duration; Step S135: respectively obtaining the average warning durations corresponding to the second characteristic warning signal to the cth characteristic warning signal, and obtaining the average warning duration of the second signal to the cth signal; Step S136: Calculate the safety behavior preliminary analysis coefficient by combining the first warning frequency value to the c-th warning frequency value and the first signal average warning duration to the c-th signal average warning duration; The preliminary analysis coefficient of safety behavior is calculated, and the specific formula configuration is as follows: Among them, Aqf is the preliminary analysis coefficient of safety behavior, Yjp1 to Yjpc are the first warning frequency value to the cth warning frequency value respectively, Ysc1 to Yscc are the average warning duration of the first signal to the average warning duration of the cth signal respectively, and c is the type quantity value corresponding to the characteristic warning signal.

4. The user security behavior analysis method based on multi-data fusion according to claim 2 is characterized in that: The step S2 further includes the following specific steps: Step S21: Obtain user behavior monitoring data, and obtain a preliminary safety behavior analysis coefficient and a first sample analysis coefficient to a bth sample analysis coefficient according to the user behavior monitoring data; Step S22: Obtaining a preliminary safety behavior analysis threshold according to the first sample analysis coefficient to the bth sample analysis coefficient; The step S22 further includes the following specific steps: Step S221: Calculate the average of the first sample analysis coefficient to the bth sample analysis coefficient to obtain the average value of the sample analysis coefficient; Step S222: performing variance calculation on the first sample analysis coefficient to the bth sample analysis coefficient to obtain the sample average analysis variance; Step S223: Calculate the sample analysis coefficient average and the sample average analysis variance to obtain the safety behavior preliminary analysis threshold; Calculate the threshold for preliminary analysis of security behavior. The specific formula configuration is as follows: Among them, Aqy is the preliminary analysis threshold of safety behavior, Ypf is the average value of sample analysis coefficient, and Fcf is the sample average analysis variance; Step S23: numerically comparing the safety behavior preliminary analysis coefficient with the safety behavior preliminary analysis threshold, and defining the numerical comparison result as safety behavior preliminary classification data; The step S23 further includes the following specific steps: Step S231: when the safety behavior preliminary analysis coefficient is greater than or equal to the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a first type of safety user; Step S232: when the safety behavior preliminary analysis coefficient is less than the safety behavior preliminary analysis threshold, the user in the safety behavior monitoring period is classified as a second type of safety user; Step S24: define the safety behavior preliminary analysis threshold and the safety behavior preliminary classification data as user behavior preliminary classification data, and proceed to step S3.

5. The user security behavior analysis method based on multi-data fusion according to claim 4 is characterized in that: The step S3 further includes the following specific steps: Step S31: Obtain user behavior monitoring data, and obtain the safety behavior monitoring period, the first sample monitoring period to the bth sample monitoring period, and preliminary safety behavior classification data according to the user behavior monitoring data; Step S32: in the first sample monitoring period to the bth sample monitoring period, sort the application programs run by the user in the operating system to obtain the first-ranked common program to the dth-ranked common program; Step S33: obtaining the ratio of the number of unconventional programs according to the first-ranked common programs to the d-th-ranked common programs; Step S34: obtaining a program running time ratio according to the first-ranked common program to the d-th-ranked common program; Step S35: defining the program running time ratio and the non-conventional program quantity ratio as user behavior analysis data.

6. The user security behavior analysis method based on multi-data fusion according to claim 5 is characterized in that: The step S32 further includes the following specific steps: Step S321: in the first sample monitoring period, obtain the application that the user starts to run first in the operating system, and use it as the first-priority running program, and obtain the first-priority running programs corresponding to the second to b-th sample monitoring periods respectively, to obtain b first-priority running programs; Step S322: performing name statistics on each first-rank running program to obtain multiple programs with different names, and performing name appearance frequency statistics on each program with different names, marking the appearance frequency with the largest value as the peak statistical frequency, and when the peak statistical frequency is greater than the effective statistical frequency, marking the first-rank running program corresponding to the peak statistical frequency as the first-rank common program; Step S323: in the first sample monitoring period, obtain the application program that the user runs after the first-priority common program in the operating system, and use it as the second-priority running program, and respectively obtain the second-priority running programs corresponding to the second to b-th sample monitoring periods to obtain b first-priority running programs; Step S324: performing name statistics on each second-ranked running program to obtain multiple programs with different names, and performing name appearance frequency statistics on each program with different names, marking the appearance frequency with the largest value as the peak statistical frequency, and when the peak statistical frequency is greater than the effective statistical frequency, marking the running program corresponding to the peak statistical frequency as the second-ranked common program; Step S325: respectively obtain the third-ranked common program to the d-th-ranked common program.

7. The user security behavior analysis method based on multi-data fusion according to claim 5 is characterized in that: The step S33 further includes the following specific steps: Step S331: obtaining the application that the user first starts to run during the safety behavior monitoring period to obtain a first actually running program, obtaining the application that runs after the first actually running program to obtain a second actually running program, and respectively obtaining the third to dth actually running programs; Step S332: performing program name character matching on the first actual running program to the dth actual running program and the first order common program to the dth order common program. If the character matching results are the same, the corresponding application is marked as a regular sequence application. If the character matching results are not the same, the corresponding application is marked as an irregular sequence application. Step S333: Count the number of non-conventional sequential application programs to obtain a non-conventional program quantity value, calculate the ratio of the non-conventional program quantity value to d, and obtain the non-conventional program quantity ratio.

8. The user security behavior analysis method based on multi-data fusion according to claim 5 is characterized in that: The step S34 further includes the following specific steps: Step S341: obtaining the average single running time of the first-rank common program in each sample monitoring period to obtain multiple single running times of the first program, and averaging the obtained multiple single running times of the first program to obtain the single average running time of the first program; Step S342: respectively obtaining the single average running time of the programs corresponding to the second-ranked common program to the d-th-ranked common program, and obtaining the single average running time of the second program to the d-th program; Step S343: During the safety behavior monitoring period, the actual running time corresponding to the first common program to the dth common program is respectively obtained to obtain the actual running time of the first program to the actual running time of the dth program; Step S345: Calculate the program running time ratio by dividing the actual running time of the first program to the actual running time of the dth program by the average single running time of the first program to the average single running time of the dth program; Calculate the program running time ratio. The specific formula is as follows: Among them, Cyb is the program running time ratio, Sjs1 to Sjsd are respectively the actual running time of the first program to the actual running time of the dth program, and Pjs1 to Pjsd are respectively the single average running time of the first program to the single average running time of the dth program.

9. The user security behavior analysis method based on multi-data fusion according to claim 1 is characterized in that: The step S4 further includes the following specific steps: Step S41: obtaining preliminary classification data of user behaviors, and issuing abnormal behavior warnings to the first type of safe users in the safe behavior monitoring period; Step S42: Conduct safety behavior analysis on the second type of safety users who are in the safety behavior monitoring period.

10. The user security behavior analysis method based on multi-data fusion according to claim 9 is characterized in that: The step S42 further includes the following specific steps: Step S421: obtaining a preliminary safety behavior analysis coefficient based on the user behavior monitoring data, and obtaining a program running time ratio and a non-conventional program quantity ratio based on the user behavior analysis data; Step S422: Calculate the safety behavior preliminary analysis coefficient, the program running time ratio, and the number of unconventional programs to obtain the user safety behavior assessment coefficient; The user security behavior assessment coefficient is calculated using the following formula: Ypx=Aqf+Cyb+Fcg; Among them, Ypx is the user safety behavior judgment coefficient, Aqf is the safety behavior preliminary analysis coefficient, Cyb is the program running time ratio, and Fcg is the number of unconventional programs ratio; Step S423: obtaining a preliminary safety behavior analysis threshold according to the preliminary classification data of user behaviors, and obtaining a program running time ratio threshold and an unconventional program quantity ratio threshold respectively; Step S424: Calculate the user safety behavior evaluation coefficient threshold by using the safety behavior preliminary analysis threshold, the program running time ratio threshold, and the unconventional program quantity ratio threshold; Step S425: When the user safety behavior judgment coefficient is greater than or equal to the user safety behavior judgment coefficient threshold, a safety behavior warning is issued to the user; Step S426: When the user safety behavior judgment coefficient is less than the user safety behavior judgment coefficient threshold, the user's safety behavior monitoring continues.

Images