Data processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a data processing method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a user session, constructing a user operation graph according to the operation contained in the user session, calculating the centrality score of each node in the user operation graph, screening out N target nodes from all nodes according to the centrality score, and storing the N target nodes in the user operation graph; and extracting node-level features of the N target nodes, forming a feature set for training an anomaly detection model by the node-level features and the global features, and training the anomaly detection model through the feature set. Through the method, the characteristics of each operation of the user can be accurately and comprehensively used, so that the performance and the accuracy of the detection model are greatly enhanced.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a data processing method, device, electronic device and storage medium. Background Art

[0002] With the development of information technology and the popularization of the Internet, the behavior data of users on various online platforms has exploded. Analyzing and detecting abnormal activities in user behavior data is of great significance for ensuring system security, maintaining user privacy, and providing personalized services. However, traditional anomaly detection methods have problems of low computational efficiency and low detection accuracy when facing large-scale, complex, and diverse user behavior data. Summary of the invention

[0003] The present application provides a data processing method, device, electronic device and storage medium for comprehensively using the characteristics of various operations of the user to perform abnormal behavior detection, which greatly enhances the performance and accuracy of the detection model.

[0004] In a first aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0005] Acquire a user session, and construct a user operation graph according to the operations included in the user session, wherein the user session at least includes the operations of the user in the system, the user operation graph includes a plurality of nodes, one of the nodes represents an operation of the user in the system, and the plurality of nodes are connected based on the order of the operations;

[0006] Calculating a centrality score for each node in the user operation graph, wherein the centrality score represents a positional relationship between the current node and other nodes;

[0007] According to the centrality scores, N target nodes are selected from all nodes, and node-level features of the N target nodes are extracted;

[0008] The node-level features and the global features are combined into a feature set for training anomaly detection model, and the anomaly detection model is trained by the feature set.

[0009] Based on the above method, in the embodiment of the present application, the user operation graph is divided into multiple operation subgraphs, and then the centrality score corresponding to each operation subgraph is calculated respectively, thereby avoiding the problem that the direct calculation of the centrality score leads to high calculation cost and requires more computing resources. This significantly reduces the overall calculation cost and calculation time, and helps to improve the accuracy of the calculation of the centrality score.

[0010] In an optional embodiment, N target nodes are screened out from all nodes according to the centrality scores, including:

[0011] Divide the user operation graph into M operation subgraphs, where M is an integer greater than or equal to 2;

[0012] Calculate the centrality vector corresponding to each of the M operation subgraphs, wherein the centrality vector includes the centrality score of each node in the subgraph;

[0013] Based on the centrality score in the centrality vector of each operation subgraph, the target nodes are screened out in each subgraph to obtain the N target nodes.

[0014] Through the above method, the user operation graph is divided into multiple operation sub-graphs. The failure of a node in a distributed computing environment will not affect the entire computing task, thus ensuring the stability of the results.

[0015] In an optional embodiment, the user operation graph is divided into M operation sub-graphs, including:

[0016] Determine the out-degree and in-degree of all nodes in the user operation graph;

[0017] Determine isolated points in the user operation graph according to the out-degree and in-degree of all nodes;

[0018] The isolated points are deleted from the user operation graph, and the graph is divided into M operation sub-graphs.

[0019] The above method can be used to delete some isolated points with reference value, thereby simplifying the graph structure of the operation subgraph and reducing the computational complexity.

[0020] In an optional embodiment, calculating the centrality vector corresponding to each of the M operation subgraphs includes:

[0021] Determining a boundary node with no out-degree in the user operation graph;

[0022] Calculating the weight value of the boundary node in each operation subgraph;

[0023] Performing weighted summation on the weight values ​​and centrality scores of the boundary nodes in each operation subgraph to obtain a target centrality score of the boundary node;

[0024] Based on the target centrality score of the boundary node, a centrality vector corresponding to each of the M operation subgraphs is calculated.

[0025] By calculating the centrality scores of the boundary nodes separately, we can avoid the problem of repeated calculation of boundary nodes in each operation subgraph, which leads to inconsistent calculation results. This ensures the accuracy and consistency of the final centrality scores.

[0026] In an optional embodiment, calculating the weight value of the boundary point in each operation subgraph includes:

[0027] Obtaining the degree value of the boundary node in each operation subgraph, wherein the degree value is the sum of the out-degree and the in-degree;

[0028] The ratio of each degree value to the sum of all degree values ​​is respectively used as the weight value of the boundary point in each operation subgraph.

[0029] In an optional embodiment, the node-level features are specifically: the degree, clustering coefficient and node proximity centrality of the target node, wherein the degree represents the connection between the node and other nodes, the clustering coefficient represents the degree of connection between the node and neighboring nodes, and the node proximity centrality represents the average distance from a node to all other nodes in the operation subgraph.

[0030] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0031] An acquisition module, configured to acquire a user session and construct a user operation graph according to the operations contained in the user session, wherein the user session at least includes the operations of the user in the system, the user operation graph includes a plurality of nodes, each of the nodes represents an operation of the user in the system, and the plurality of nodes are connected based on the order of the operations;

[0032] A calculation module, used to calculate the centrality score of each node in the user operation graph, wherein the centrality score represents the positional relationship between the current node and other nodes;

[0033] An extraction module, used to screen out N target nodes from all nodes according to the centrality scores, and extract node-level features of the N target nodes;

[0034] The training module is used to combine the node-level features and the global features into a feature set for training anomaly detection model, and train the anomaly detection model through the feature set.

[0035] In an optional embodiment, the extraction module is specifically used to divide the user operation graph into M operation subgraphs, where M is an integer greater than or equal to 2;

[0036] Calculate the centrality vector corresponding to each of the M operation subgraphs, wherein the centrality vector includes the centrality score of each node in the subgraph;

[0037] Based on the centrality score in the centrality vector of each operation subgraph, the target nodes are screened out in each subgraph to obtain the N target nodes.

[0038] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0039] Memory, used to store computer programs;

[0040] The processor is used to implement the steps of the above-mentioned data processing method when executing the computer program stored in the memory.

[0041] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned data processing method are implemented.

[0042] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart of a data processing method provided for this application;

[0044] Figure 2 A schematic diagram of the user operation diagram provided for this application;

[0045] Figure 3 A schematic diagram of the structure of a data processing device provided in this application;

[0046] Figure 4 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0048] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0049] With the development of information technology and the popularization of the Internet, user behavior data on various online platforms has shown explosive growth. Analyzing and detecting abnormal activities in user behavior data is of great significance for ensuring system security, maintaining user privacy, and providing personalized services.

[0050] At present, traditional user anomaly detection methods are mainly divided into three categories: one is a statistical-based detection method, one is a machine learning-based detection method, and one is a graph model-based detection method. Statistical-based detection methods usually rely on predefined rules and thresholds to detect abnormal behaviors by analyzing the statistical characteristics of data. This type of method is simple to implement and easy to understand, but its biggest limitation is that it relies heavily on the setting of rules and thresholds, and it is difficult to cope with complex and dynamically changing user behavior patterns. In addition, this type of method shows obvious shortcomings when dealing with high-dimensional data and diverse behavior patterns.

[0051] Detection methods based on machine learning have been widely used in recent years. Such methods include supervised learning and unsupervised learning, which identify abnormal behaviors by learning patterns from large amounts of data. Supervised learning methods rely on well-labeled training data and train classification models to detect abnormal behaviors. However, obtaining high-quality labeled data is often costly and time-consuming. Unsupervised learning methods use clustering, dimensionality reduction and other techniques to identify anomalies in data. Although they reduce the dependence on labeled data to a certain extent, they are often less effective than supervised learning methods when processing high-dimensional and sparse data. In addition, many machine learning methods have high computational complexity when processing large-scale data, making it difficult to meet the needs of real-time detection.

[0052] The detection method based on the graph model constructs a graph structure of user behavior data and uses the topological characteristics of the graph and the relationship between nodes to detect abnormal behavior. The graph model method is intuitive, easy to understand and analyze, and is good at capturing global and local relationships in the data. However, as the scale of user behavior data continues to grow, the complexity of graph construction and feature calculation has increased dramatically, and the traditional single-machine computing model is difficult to cope with such a large amount of data.

[0053] Therefore, traditional user anomaly detection methods will have problems of low computational efficiency and low detection accuracy when faced with large-scale, complex, and diverse user behavior data.

[0054] In order to solve the above technical problems, a data processing method is provided in an embodiment of the present application, which includes: obtaining a user session, and constructing a user operation graph according to the operations contained in the user session, calculating the centrality score of each node in the user operation graph, and screening N target nodes from all nodes according to the centrality score, and extracting the node-level features of the N target nodes, and forming the node-level features and the global features into a feature set for training anomaly detection model, and training the anomaly detection model through the feature set. This method can accurately and comprehensively use the features of each user's operation, thereby greatly enhancing the performance and accuracy of the detection model.

[0055] Reference Figure 1 The flowchart of a data processing method provided by an embodiment of the present application is shown. The method can integrate the characteristics of various operations of the user, thereby increasing the performance and accuracy of the detection model. The method includes:

[0056] S1, obtain the user session and build a user operation graph based on the operations contained in the user session;

[0057] First of all, after a user logs in to the system, any operation performed by the user in the system will be saved and stored in the log database. Each operation of the user is recorded as a single operation log, and all single operation logs of the user within a set time are called user sessions. For example, the single operation logs corresponding to each operation of the user from logging in to logging out of the system constitute a user session.

[0058] It should be noted here that a single operation log not only indicates the user's operation in the system, but also contains timestamp information in the single operation log. The timestamp information can be used to determine the order of the user's operations in the system. For example, if a user performs a click operation, a query operation, and a download operation in the system, these operations will correspond to a single operation log, and the timestamp information of the click operation is 2024.10.11.13:01, the timestamp information of the query operation is 2024.10.11.13:05, and the timestamp information of the download operation is 2024.10.11.13:15. The order of each operation can be determined by the timestamp information in each single operation log.

[0059] After the user session is acquired, each operation is extracted from the user session. Here, each operation may be extracted from each single operation log.

[0060] After extracting each operation, a user operation graph is constructed based on each extracted operation. In the embodiment of the present application, the user operation graph can be constructed by the following method:

[0061] First, each operation extracted from the user session is taken as a node, and then each node is connected in the chronological order of the operation.

[0062] For example, reference Figure 2 As shown, in Figure 2 It includes node A (click operation), node B (query operation), node C (download operation), node D (input operation), node E (export operation), and node F (delete operation). Since each operation corresponds to a timestamp information, each operation can be connected based on the timestamp information corresponding to each operation. Figure 2 In the example, the click operation is followed by the input operation, so node A is connected to node D. It should be noted here that node A and node D are connected via a directed edge, which means that the click operation is performed first and then the input operation is performed. In this way, the connection between each node is completed.

[0063] After completing the connection between each node, the directed edge connecting each node will be configured with a corresponding weight. The weight of this directed edge is calculated based on the time interval between two operations. The smaller the time interval, the greater the weight.

[0064] After completing the configuration of the weights, the construction of the user operation graph is completed. Figure 3 Shown is a completed user operation diagram provided in an embodiment of the present application.

[0065] The above method can accurately construct a user operation graph, which ensures the subsequent feature extraction of nodes.

[0066] S2, calculates the centrality score of each node in the user operation graph;

[0067] Before calculating the centrality score of each node in the user operation graph, the first step is to delete the isolated points in the user operation graph. In the embodiment of the present application, the isolated points can be determined by the following method:

[0068] Determine the out-degree and in-degree of all nodes in the user operation graph. It should be noted here that the out-degree represents the number of arcs starting from a vertex in a directed graph with a vertex as the arc tail, which is called the out-degree of the vertex. The in-degree represents the number of arcs terminating at a vertex in a directed graph with a vertex as the arc head, which is called the in-degree of the vertex.

[0069] Based on the determined out-degree and in-degree of all nodes, nodes with only in-degree but no out-degree are determined among all nodes, and these determined nodes are determined as isolated points. Then, these isolated points are deleted from the user operation graph, thereby obtaining a user operation graph with isolated points deleted.

[0070] After deleting isolated points in the user operation graph, the user operation graph is divided into M operation sub-graphs. In the embodiment of the present application, M is an integer greater than or equal to 2.

[0071] It should be noted here that, in the embodiment of the present application, the user operation graph can be divided into M operation sub-graphs through a segmentation algorithm (multi-level partitioning, Metis).

[0072] After dividing the M operation subgraphs, an adjacency matrix is ​​constructed for each operation subgraph, and in the process of constructing the adjacency matrix, a corresponding attenuation factor is assigned to each adjacency matrix. Then the adjacency matrix is ​​calculated using the power square, and the centrality vector is obtained through multiple matrix multiplication operations.

[0073] The centrality vector is composed of the centrality scores of each node in the operation subgraph. In other words, the centrality vector is composed of the centrality scores of each node.

[0074] It should be noted here that the centrality score represents the positional relationship between a node and other nodes. In other words, the higher the centrality score of a node, the closer the node is to the center of the operation subgraph. It can also mean that the average distance between the node and other nodes is the shortest.

[0075] In an optional embodiment, in the embodiment of the present application, in order to ensure that the differences between the centrality scores are small, the obtained centrality scores are standardized, that is, the centrality scores corresponding to different operation subgraphs are converted to a unified scale. In this way, the comparability between the centrality scores can be ensured.

[0076] Furthermore, in the embodiment of the present application, after the user operation graph is divided into multiple operation subgraphs, there will be boundary nodes in each operation subgraph, and the same boundary node will also exist in different operation subgraphs. The same boundary node will have different centrality scores in different operation subgraphs, so it is necessary to calculate the consistency of the centrality scores of the boundary nodes. The specific method is as follows:

[0077] First, the boundary nodes in the operation subgraph are obtained. In the embodiment of the present application, the out-degree and in-degree of each node are determined in the user operation graph, and then the nodes without out-degree are determined among all the nodes, and these nodes without out-degree are determined as boundary nodes.

[0078] Then, the weight values ​​of the boundary nodes in each subgraph are calculated. In the embodiment of the present application, the weight values ​​of the boundary nodes in each operation subgraph can be calculated by the following formula:

[0079] Assume that the degree of node v in subgraph Gi is d(v, Gi), and the calculation formula is:

[0080]

[0081] in, W i is the weight value, n is the number of all operation subgraphs containing node v, ensuring that the contribution of each operation subgraph to the centrality score of the boundary node is proportional to the importance of the node in the operation subgraph.

[0082] Then, the weight values ​​and centrality scores of the boundary nodes in each operation subgraph are weighted and summed to obtain the target centrality score of the boundary node. For example, the centrality score of the node v in the operation subgraph Gi is C(v, Gi):

[0083]

[0084] The centrality score of node v in the operation subgraph can be obtained through the above calculation formula.

[0085] After completing the calculation of the centrality scores of the boundary nodes, the centrality vector corresponding to each of the M operation subgraphs is calculated.

[0086] The centrality vector includes the centrality scores corresponding to each node in the operation subgraph, and the centrality scores include the unique centrality scores of each boundary node.

[0087] Based on the above method, in the embodiment of the present application, the user operation graph is divided into multiple operation subgraphs, and then the centrality score corresponding to each operation subgraph is calculated respectively, thereby avoiding the problem that the direct calculation of the centrality score leads to high calculation cost and requires more computing resources. This significantly reduces the overall calculation cost and calculation time, helps to improve the accuracy of the calculation of the centrality score, and the failure of a node in a distributed computing environment will not affect the entire computing task, ensuring the stability of the results.

[0088] S3, based on the centrality scores, select N target nodes from all nodes and extract node-level features of the N target nodes;

[0089] After obtaining the centrality vector of the operation subgraph, perform the following operations on the centrality vector corresponding to each operation subgraph:

[0090] First, each centrality score in the operation subgraph is determined, and then the centrality scores are sorted in descending order to obtain a ranking result of the centrality scores. In the ranking result, the first 10% of the nodes in the ranking result are selected as the target nodes.

[0091] Of course, in addition to selecting the top 10% of nodes as target nodes based on the sorting results, you can also set a threshold and then select nodes with a centrality score greater than the threshold as target nodes.

[0092] The above method can be used to determine the target node in each operation subgraph, and finally N target nodes can be screened out from all nodes.

[0093] After N target nodes are screened out, node-level features of the N target nodes are extracted. The node-level features include: the degree of the target node, the clustering coefficient of the target node, and the node proximity centrality of the target node.

[0094] It should be noted here that the degree represents the connection between the node and other nodes. In other words, the degree reflects the local connection of the node. The higher the degree, the more other nodes the node is connected to in the network, that is, the greater the impact on the entire network in the operation subgraph.

[0095] The clustering coefficient represents the degree of connection between a node and its neighboring nodes. The clustering coefficient can be calculated by the following formula:

[0096]

[0097] Among them, E(v) represents the actual number of edges between node v and its neighbor nodes, and k(v) represents the degree of node v.

[0098] The value range of the clustering coefficient is between 0 and 1. The higher the clustering coefficient, the closer the connection between the node and its neighboring nodes.

[0099] Node proximity centrality, which represents the average distance between a node and all other nodes in the graph, can be calculated using the following formula:

[0100]

[0101] Among them, d(v,u) represents the shortest path distance from node v to node u.

[0102] The higher the proximity centrality of the node, the closer the node is to the center in the network corresponding to the operation subgraph.

[0103] For each operation subgraph, the node-level features of the top 10% of the nodes in terms of centrality scores are extracted. Then, according to the above method, the node-level features of the corresponding nodes can be extracted in each operation subgraph, that is, the node-level features of N target nodes, and finally the node-level features corresponding to the user operation graph are obtained.

[0104] S4, node-level features and global features are combined into a feature set for training anomaly detection model, and the anomaly detection model is trained through the feature set.

[0105] After obtaining the centrality vector corresponding to each operation subgraph and extracting the node-level features of each target node based on the centrality vector, the global features of the user operation graph will be directly extracted. The global features include: graph density, graph diameter, average path length, maximum / minimum degree, number of subgraphs, and subgraph size.

[0106] Specifically, graph density represents the ratio of the actual number of edges in the user operation graph to the number of all possible edges, where an edge is the connection line between two nodes.

[0107] Graph diameter, which represents the maximum value of the shortest path in the user operation graph;

[0108] Average path length, which represents the average value of the shortest path length between all node pairs in the user operation graph;

[0109] Maximum / minimum degree, which represents the degree of the node with the largest or smallest degree in the user operation graph;

[0110] The number of subgraphs,represents the number of operation subgraphs in the user operation graph, which can be connected components or subgraphs based on specific conditions.

[0111] Subgraph size, which represents the number of nodes in the operation subgraph.

[0112] After obtaining the above global features, the obtained node-level features are integrated with the global features. That is, the node-level features, global features and other graph attributes in the user operation graph are integrated to form a feature set of the user Gaussian Bayes classifier algorithm. The feature set is then normalized.

[0113] The obtained feature set is labeled with a corresponding label, which is "normal" or "abnormal". Combining the label with the feature set can reflect whether the user behavior corresponding to the feature set is normal or abnormal.

[0114] The feature set containing labels is divided into a training set and a test set. The training set is used to train the Gaussian Bayesian classifier, and the test set is used to evaluate the performance of the Gaussian Bayesian classifier. The training set is used to train the Gaussian Bayesian classifier. During the training process, the Gaussian Bayesian classifier calculates the conditional probability of each feature under a given label according to the Bayesian theorem, and calculates the posterior probability that the sample belongs to each category based on these conditional probabilities and the independence assumption of the features. For each feature, the Gaussian Bayesian classifier assumes that it conforms to the normal distribution and determines the probability distribution parameters of the feature by estimating its mean and variance. The performance of the Gaussian Bayesian classifier is evaluated using the test set. The evaluation indicators include accuracy, precision, recall, etc. These parameters can fully reflect the performance of the Gaussian Bayesian classifier in detecting abnormal behavior. In this way, the anomaly detection model that is ultimately used to detect abnormal user behavior can be obtained.

[0115] After the above anomaly detection model is obtained, the user behavior will be detected through the anomaly detection model, so as to determine whether the user behavior is abnormal behavior according to the output result of the anomaly detection model.

[0116] Through the above method, not only the node-level features in the user operation graph are extracted, but also the global features in the user operation graph are extracted, thereby providing rich feature parameters for training the anomaly detection model, which can significantly improve the detection efficiency and detection accuracy of the anomaly detection model.

[0117] Based on the same inventive concept, a data processing device is also provided in the embodiment of the present application, referring to Figure 3 As shown, the data processing device includes:

[0118] The acquisition module 301 is used to acquire a user session and construct a user operation graph according to the operations contained in the user session, wherein the user session at least includes the operations of the user in the system, the user operation graph includes a plurality of nodes, each of the nodes represents an operation of the user in the system, and the plurality of nodes are connected based on the order of the operations;

[0119] A calculation module 302 is used to calculate the centrality score of each node in the user operation graph, wherein the centrality score represents the positional relationship between the current node and other nodes;

[0120] An extraction module 303 is used to screen out N target nodes from all nodes according to the centrality scores, and extract node-level features of the N target nodes;

[0121] The training module 304 is used to combine the node-level features and the global features into a feature set for training anomaly detection model, and train the anomaly detection model through the feature set.

[0122] In an optional embodiment, the extraction module 303 is specifically configured to divide the user operation graph into M operation subgraphs, where M is an integer greater than or equal to 2;

[0123] Calculate the centrality vector corresponding to each of the M operation subgraphs, wherein the centrality vector includes the centrality score of each node in the subgraph;

[0124] Based on the centrality score in the centrality vector of each operation subgraph, the target nodes are screened out in each subgraph to obtain the N target nodes.

[0125] In an optional embodiment, the extraction module 303 is specifically configured to determine the out-degree and in-degree of all nodes in the user operation graph;

[0126] Determine isolated points in the user operation graph according to the out-degree and in-degree of all nodes;

[0127] The isolated points are deleted from the user operation graph, and the graph is divided into M operation sub-graphs.

[0128] In an optional embodiment, the extraction module 303 is specifically configured to determine a boundary node with no out-degree in the user operation graph;

[0129] Calculating the weight value of the boundary node in each operation subgraph;

[0130] Performing weighted summation on the weight values ​​and centrality scores of the boundary nodes in each operation subgraph to obtain a target centrality score of the boundary node;

[0131] Based on the target centrality score of the boundary node, a centrality vector corresponding to each of the M operation subgraphs is calculated.

[0132] In an optional embodiment, the extraction module 303 is specifically used to obtain the degree value of the boundary node in each operation subgraph, wherein the degree value is the sum of the out-degree and the in-degree;

[0133] The ratio of each degree value to the sum of all degree values ​​is respectively used as the weight value of the boundary point in each operation subgraph.

[0134] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned data processing device, referring to Figure 4 , the electronic device comprises:

[0135] At least one processor 401, and a memory 402 connected to the at least one processor 401. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present application. Figure 4 In the example, the processor 401 and the memory 402 are connected via the bus 400. The bus 400 is Figure 4 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 400 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 401 can also be called a controller, and there is no limitation on the name.

[0136] In the embodiment of the present application, the memory 402 stores instructions that can be executed by at least one processor 401. The at least one processor 401 can execute a data processing method discussed above by executing the instructions stored in the memory 402. The processor 401 can implement Figure 3 The functions of each module in the device shown.

[0137] Among them, the processor 401 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 402 and calling the data stored in the memory 402, the various functions of the device and process data, the device can be monitored as a whole.

[0138] In one possible design, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 401. In some embodiments, the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0139] Processor 401 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of a data processing method disclosed in the embodiments of the present application can be directly embodied as a hardware processor to be executed, or a combination of hardware and software modules in the processor can be executed.

[0140] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0141] By designing and programming the processor 401, the code corresponding to a data processing method introduced in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The steps of a data processing method in the embodiment shown are as follows: How to design and program the processor 401 is a technique known to those skilled in the art and will not be described in detail here.

[0142] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a data processing method discussed above.

[0143] In some possible implementations, various aspects of a data processing method provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a data processing method according to various exemplary implementations of the present application described above in this specification.

[0144] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0145] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0146] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0147] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0148] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data processing method, characterized in that: The method comprises: Acquire a user session, and construct a user operation graph according to the operations contained in the user session, wherein the user session at least includes the operations of the user in the system, the user operation graph includes a plurality of nodes, each of the nodes represents an operation of the user in the system, and the plurality of nodes are connected based on the order of the operations; Calculating a centrality score for each node in the user operation graph, wherein the centrality score represents a positional relationship between the current node and other nodes; According to the centrality scores, N target nodes are selected from all nodes, and node-level features of the N target nodes are extracted; The node-level features and the global features are combined into a feature set for training anomaly detection model, and the anomaly detection model is trained by the feature set.

2. The method according to claim 1, characterized in that: According to the centrality scores, N target nodes are selected from all nodes, including: Divide the user operation graph into M operation subgraphs, where M is an integer greater than or equal to 2; Calculate the centrality vector corresponding to each of the M operation subgraphs, wherein the centrality vector includes the centrality score of each node in the subgraph; Based on the centrality score in the centrality vector of each operation subgraph, the target nodes are screened out in each subgraph to obtain the N target nodes.

3. The method according to claim 2, characterized in that The user operation graph is divided into M operation sub-graphs, including: Determine the out-degree and in-degree of all nodes in the user operation graph; Determine isolated points in the user operation graph according to the out-degree and in-degree of all nodes; The isolated points are deleted from the user operation graph, and the graph is divided into M operation sub-graphs.

4. The method according to claim 2, characterized in that Calculating the centrality vector corresponding to each of the M operation subgraphs, including: Determining a boundary node with no out-degree in the user operation graph; Calculating the weight value of the boundary node in each operation subgraph; Performing weighted summation on the weight values ​​and centrality scores of the boundary nodes in each operation subgraph to obtain a target centrality score of the boundary node; Based on the target centrality score of the boundary node, a centrality vector corresponding to each of the M operation subgraphs is calculated.

5. The method according to claim 4, characterized in that The calculating the weight value of the boundary point in each operation subgraph includes: Obtaining the degree value of the boundary node in each operation subgraph, wherein the degree value is the sum of the out-degree and the in-degree; The ratio of each degree value to the sum of all degree values ​​is respectively used as the weight value of the boundary point in each operation subgraph.

6. The method according to claim 1, characterized in that The node-level features are specifically: the degree, clustering coefficient and node proximity centrality of the target node, wherein the degree represents the connection between the node and other nodes, the clustering coefficient represents the degree of connection between the node and neighboring nodes, and the node proximity centrality represents the average distance from a node to all other nodes in the operation subgraph.

7. A data processing device, characterized in that: include: An acquisition module, configured to acquire a user session and construct a user operation graph according to the operations contained in the user session, wherein the user session at least includes the operations of the user in the system, the user operation graph includes a plurality of nodes, each of the nodes represents an operation of the user in the system, and the plurality of nodes are connected based on the order of the operations; A calculation module, used to calculate the centrality score of each node in the user operation graph, wherein the centrality score represents the positional relationship between the current node and other nodes; An extraction module, used to screen out N target nodes from all nodes according to the centrality scores, and extract node-level features of the N target nodes; The training module is used to combine the node-level features and the global features into a feature set for training anomaly detection model, and train the anomaly detection model through the feature set.

8. The device according to claim 7, characterized in that The extraction module is specifically used to divide the user operation graph into M operation subgraphs, where M is an integer greater than or equal to 2; Calculate the centrality vector corresponding to each of the M operation subgraphs, wherein the centrality vector includes the centrality score of each node in the subgraph; Based on the centrality score in the centrality vector of each operation subgraph, the target nodes are screened out in each subgraph to obtain the N target nodes.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 6 when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

Images