User behavior analysis method and system based on database session clustering

Abstract

According to the user behavior analysis method and system based on database session clustering, database sessions are analyzed by adopting a fuzzy clustering algorithm, the similarity between the sessions is automatically found, and the similar sessions are classified into one class, so that a potential data distribution mode can be revealed; and meanwhile, a predefined rule is not needed, and variable session behaviors can be flexibly adapted. According to the method, different sessions are grouped through database session clustering analysis, a database administrator can very easily obtain different practical meanings represented by the sessions according to the grouped session information, and the meanings represent behavior modes of users or occurrence of abnormal situations. No matter what situation, a database administrator can be helped to quickly analyze the database session, and the operation and maintenance efficiency is improved.

Description

Technical Field

[0001] The invention relates to a user behavior analysis method and system based on database session clustering, and belongs to the field of database management. Background Art

[0002] Database is the main way to store data. Considering the importance of data, the importance of database is self-evident. In order to ensure the healthy operation of the database, database management cannot be ignored. Among the many aspects of database management, the management of database sessions is very critical.

[0003] A database session is a connection established between a user and a database. Simply put, whenever a user needs to perform operations such as adding, deleting, modifying, and querying in a database, a connection is established with the database through a session. Database sessions are not only the basic unit of database resource allocation, but also the basis of security control because the database system uses sessions to identify user identities for access control. It can be seen that session management is directly related to the performance and security of the database.

[0004] In terms of database performance, on the one hand, the number and time of sessions must be properly controlled to avoid too many sessions accessing the database at the same time. On the other hand, idle sessions must be closed in a timely manner to reduce resource usage and waste. If there are too many sessions accessing the database at the same time, database performance will decline and even cause lock conflicts, which will directly affect the availability of the database.

[0005] In terms of database security, database sessions are the basis of security control. If the monitoring system detects abnormal session activity, it can immediately prevent possible illegal access. Once an abnormal operation is found in a session, the database administrator can immediately disconnect the session to maximize the security of the database.

[0006] The database session record stores important information such as user identity, operation content, and duration. For example, the V$SESSION view of the Oracle database provides detailed information about the current session, including the session's unique identifier, user name, session status, program that started the session, and SQL statement information being executed. Analyzing this data can help ensure system security and prevent unauthorized access and data leakage, and can also help optimize and improve services and enhance user experience.

[0007] At present, the analysis methods for database sessions mainly include the following categories:

[0008] (1) Log file-based methods: Database log files are the best data source for conversation analysis because they record every interaction between users and the database in detail. However, the amount of log data is often large, resulting in low analysis efficiency, and generally requires manual participation and is more dependent on manual experience.

[0009] (2) Statistical methods: Statistical methods can summarize basic information such as session duration, frequency, and operation type, which helps to understand the overall situation of database sessions, but lack in-depth analysis of sessions. If there is abnormal data, the statistical results cannot be identified, and the accuracy of the statistical figures will be affected.

[0010] (3) Rule-based method: This method can identify abnormal conversations in specific scenarios. The formulation of rules requires rich experience and expertise, and the rules are relatively static and difficult to cope with complex and changing conversation behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a system structure diagram of the present invention.

[0012] Figure 2 This is a clustering process diagram of the FC4DBS algorithm of the present invention. Summary of the invention

[0013] In order to solve the technical problems existing in the prior art, the present invention proposes a user behavior analysis method based on database session clustering. The method adopts a fuzzy clustering algorithm to analyze database sessions, automatically discovers the similarity between sessions, and classifies similar sessions into one category. The method comprises the following steps:

[0014] 1.1 Data collection: Collect user original session data from the database;

[0015] 1.2 Data preprocessing: standardize the collected raw session data;

[0016] 1.3 Cluster analysis: Use clustering algorithm to perform fuzzy cluster analysis on the preprocessed session data; divide user sessions into different clusters based on the similarity relationship of the sessions, and each cluster represents a user behavior pattern;

[0017] 1.4 Result display: The results of cluster analysis are displayed to users in a visual way.

[0018] Furthermore, the fuzzy clustering algorithm is used in cluster analysis. The specific steps of the fuzzy clustering algorithm are as follows:

[0019] (1) Processing mixed attribute data, using one-hot encoding to convert categorical attributes into numerical attributes;

[0020] (2) Initialize parameters, including the number of clusters C and other parameters m, α, β, and λ; randomly initialize matrices U, V, and W, and initialize the cluster center matrix P;

[0021] (3) Calculate the distance D from database session sample i to cluster c and attribute j cij =(x ij -p cj ) 2 , x ij is the jth attribute value of database session sample i, p cj is the jth attribute value of the center of the cth cluster; c = 1, 2, ..., C, i = 1, 2, ..., N, j = 1, 2, ..., K, c, i and j are the cth cluster, the ith database session sample, and the jth attribute respectively; C is the number of clusters, indicating how many clusters the database session is divided into; N is the number of samples, that is, the total number of database sessions; K is the number of attributes;

[0022] (4) First calculate Where k is an integer ranging from 1 to C; then calculate Among them, q is an integer ranging from 1 to K; finally calculate U is the database session sample membership matrix, whose element u ci represents the membership of database session sample i to cluster c; V is the attribute membership matrix, whose element v cj represents the membership of attribute j to cluster c; W is the attribute weight matrix, whose element w j represents the weight of attribute j; m is the fuzzy index;

[0023] (5) Update the cluster center matrix P, whose elements are p cj The calculation method is

[0024] (6) Calculate the objective function α and β are parameters that control the fuzziness of sample and attribute membership, respectively; λ is the weight coefficient of the sparsity constraint; if the objective function J FC4DBS If the change of is less than the preset threshold ε or reaches the maximum number of iterations τ, the iterative process of the clustering algorithm is completed; otherwise, go to step (3) to enter the next iteration.

[0025] Based on the above method, the present invention further proposes a user behavior analysis system based on database session clustering, which includes the following modules:

[0026] 1.1 Data collection module: This module collects user original session data from the database.

[0027] 1.2 Data preprocessing module: This module performs standardization on the collected raw session data.

[0028] 1.3 Cluster analysis module: This module applies clustering algorithm to perform fuzzy cluster analysis on preprocessed session data. User sessions are divided into different clusters according to the similarity relationship of the sessions, and each cluster represents a user behavior pattern.

[0029] 1.4 Result display module: This module displays the results of cluster analysis to users in a visual way.

[0030] Furthermore, the cluster analysis module uses a fuzzy clustering algorithm to analyze database conversations, automatically discover similarities between conversations, and classify similar conversations into one category.

[0031] Furthermore, the fuzzy joint clustering algorithm steps include:

[0032] (1) Processing mixed attribute data, using one-hot encoding to convert categorical attributes into numerical attributes;

[0033] (2) Initialize parameters, including the number of clusters C and other parameters m, α, β, and λ; randomly initialize matrices U, V, and W, and initialize the cluster center matrix P;

[0034] (3) Calculate the distance D from database session sample i to cluster c and attribute j cij =(x ij -p cj ) 2 , x ij is the jth attribute value of database session sample i, p cj is the jth attribute value of the center of the cth cluster; c = 1, 2, ..., C, i = 1, 2, ..., N, j = 1, 2, ..., K, c, i and j are the cth cluster, the ith database session sample, and the jth attribute respectively; C is the number of clusters, indicating how many clusters the database session is divided into; N is the number of samples, that is, the total number of database sessions; K is the number of attributes;

[0035] (4) First calculate Where k is an integer ranging from 1 to C; then calculate Among them, q is an integer ranging from 1 to K; finally calculate U is the database session sample membership matrix, whose element u ci represents the membership of database session sample i to cluster c; V is the attribute membership matrix, whose element v cj represents the membership of attribute j to cluster c; W is the attribute weight matrix, whose element w j represents the weight of attribute j; m is the fuzzy index;

[0036] (5) Update the cluster center matrix P, whose elements are p cj The calculation method is

[0037] (6) Calculate the objective function α and β are parameters that control the fuzziness of sample and attribute membership, respectively; λ is the weight coefficient of the sparsity constraint; if the objective function J FC4DBS If the change of is less than the preset threshold ε or reaches the maximum number of iterations τ, the iterative process of the clustering algorithm is completed; otherwise, go to step (3) to enter the next iteration.

[0038] The present invention uses a fuzzy clustering algorithm to analyze database conversations, automatically discovers similarities between conversations, and groups similar conversations into one category, which helps to reveal potential data distribution patterns; at the same time, it does not require predefined rules and can flexibly adapt to changing conversation behaviors. The present invention groups different conversations through database conversation clustering analysis. Database administrators can easily obtain the different practical meanings represented by each conversation based on the grouped conversation information. These meanings represent the user's behavior pattern or the occurrence of abnormal situations. In either case, it can help database administrators quickly analyze database conversations and improve operation and maintenance efficiency. DETAILED DESCRIPTION

[0039] Example 1

[0040] The present invention proposes a database conversation analysis method based on fuzzy clustering. The method adopts a fuzzy clustering algorithm to analyze database conversations, which can automatically discover the similarities between conversations and classify similar conversations into one category, which helps to reveal potential data distribution patterns. At the same time, the method does not require predefined rules and can flexibly adapt to changeable conversation behaviors.

[0041] Based on the fuzzy clustering algorithm, the present invention designs a database conversation analysis system. The structure diagram of the system is shown in Figure 1 As shown. In the system, the functions of each module are:

[0042] (1) Data collection module: This module collects user session data from the database. The session information recorded in different types of databases is different, but common information is basically included, such as user ID, session start time, end time, executed SQL statements, resource consumption, etc.

[0043] (2) Data preprocessing module: standardizes the collected raw session data to eliminate missing values, NULL values, etc.

[0044] (3) Cluster analysis module: This module applies clustering algorithm to perform fuzzy cluster analysis on the preprocessed session data. According to the similarity relationship of the sessions, the user sessions are divided into different clusters, and each cluster represents a user behavior pattern.

[0045] (4) Result display module: displays the results of cluster analysis to users in a visual way.

[0046] In the above database session analysis system, the focus is on the fuzzy clustering algorithm in the cluster analysis module. This module adopts a fuzzy joint clustering algorithm, named FC4DBS algorithm, namely Fuzzy Clustering for DBSessions. The reason is that there are some correlations between many attributes in the user session. If you choose to ignore the existence of such correlations, it will inevitably affect the accuracy of the final clustering results. Therefore, clustering is performed simultaneously in the two dimensions of session and attribute. The fuzzy joint clustering algorithm designed in the present invention utilizes information entropy and sparsity constraints, which can make the clustering results more stable.

[0047] The objective function of the FC4DBS algorithm is:

[0048]

[0049] Where C is the number of clusters, indicating how many clusters the database session is divided into; N is the number of samples, that is, the total number of database sessions; K is the number of attributes; c = 1, 2, ..., C, i = 1, 2, ..., N, j = 1, 2, ..., K, c, i and j represent the cth cluster, the ith database session sample, and the jth attribute respectively; U is the membership matrix of the database session sample, whose element u ci represents the membership of database session sample i to cluster c; V is the attribute membership matrix, whose element v cj represents the membership of attribute j to cluster c; W is the attribute weight matrix, whose element w j represents the weight of attribute j; P is the cluster center matrix, whose elements are p cj ;D cij represents the distance from database session sample i to cluster c and attribute j, which is calculated as D cij =(x ij -p cj ) 2 , x ij represents the jth attribute value of database session sample i, p cj represents the jth attribute value of the cth cluster center; m is the fuzzy index, α and β are parameters that control the fuzziness of sample and attribute membership respectively; λ is the weight coefficient of the sparsity constraint.

[0050] In this objective function, the first term represents the weighted distance between the database session sample and the cluster center. The goal is to minimize the weighted distance so that the database session sample is as close to its cluster center as possible; the second and third terms are the entropy terms of sample membership and attribute membership, respectively; the purpose of the fourth term is mainly to encourage the sparsity of weight distribution, that is, to encourage each attribute to have a higher weight only in some clusters, avoiding uniform distribution of weights.

[0051] Based on the above objective function, the clustering process of the FC4DBS algorithm is designed as follows: Figure 2 As shown. Figure 2 It can be seen that the specific process of the FC4DBS algorithm is as follows:

[0052] (1) Data preprocessing: The attributes of database sessions are usually mixed attributes, including both numerical attributes and categorical attributes. This step processes the mixed attribute data and uses One-Hot Encoding to convert categorical attributes into numerical attributes.

[0053] (2) Algorithm initialization: Initialize the parameters in the algorithm, including the number of clusters C and other parameters m, α, β, and λ; randomly initialize the matrices U, V, and W, and initialize the cluster center matrix P.

[0054] (3) Distance calculation: This step calculates D cij .

[0055] (4) Optimize the objective function: In this step, three parts are calculated. First, the calculation of u is simplified. ci , the calculation formula is:

[0056]

[0057] Here, k represents an integer ranging from 1 to C.

[0058] Then calculate v cj , the calculation formula is:

[0059]

[0060] Here, q represents an integer ranging from 1 to K.

[0061] Finally calculate w j , the calculation formula is:

[0062]

[0063] (5) Update the cluster center matrix: This step updates the cluster center matrix P, whose elements are p cj The calculation method is:

[0064]

[0065] (6) Determine whether it converges: If the objective function J FC4DBS If the change of is less than the preset threshold ε or reaches the maximum number of iterations τ, the iterative process of the clustering algorithm is completed; otherwise, jump to step (3) to enter the next iteration.

[0066] (7) Clustering result output: The final clustering result is displayed to the user.

[0067] Because the clustering results include the grouping of database sessions, users can easily view some user behavior patterns after getting the clustering results. For example, it can be found that some users may be more inclined to perform SELECT operations, while other users are more inclined to UPDATE or INSERT operations; for another example, some abnormal situations in user sessions may also be presented in the results. This method is very flexible. As long as the user session records are given and each record contains the necessary attributes, the records can be easily grouped. This grouping has no rule restrictions and is completely unsupervised.

[0068] Example 2

[0069] The present invention proposes a database conversation analysis system based on the fuzzy clustering algorithm FC4DBS. In the system, the algorithm FC4DBS is the most critical. The calculation process of the algorithm is introduced below through a specific example.

[0070] Assume that there are 5 database sessions, each of which contains 3 attributes, namely user ID, query type and response time, where user ID and query type are categorical attributes and response time is a numerical attribute. The specific information of these 5 database sessions is as follows:

[0071]

[0072] Based on this data set, the calculation process of the algorithm FC4DBS is:

[0073] (1) Data preprocessing:

[0074] Because user ID and query type are categorical attributes, they are first converted to numeric types using one-hot encoding. User IDs include A, B, and C, and query types include SELECT, UPDATE, and INSERT, all of which require type conversion. In addition, although response time is a numeric attribute, it is best to limit the value range to the interval [0,1], which is achieved through the minimum-maximum normalization method. In summary, after data preprocessing, the session information obtained is:

[0075]

[0076] (2) Algorithm initialization:

[0077] Assume that the number of clusters C = 2, the number of attributes K = 7, m = 1.5, α = 1, β = 1, λ = 1.

[0078] Randomly initialize matrices U, V, and W, initialize cluster center matrix P, and assume that matrix U is:

[0079]

[0080] Assume the matrix V is:

[0081]

[0082] Assume the matrix W is:

[0083] W=(0.14 0.14 0.14 0.14 0.14 0.14 0.14)

[0084] Assume the matrix P is:

[0085]

[0086] (3) Distance calculation:

[0087] Based on the above data, D can be calculated cij The values ​​are as follows:

[0088]

[0089] (4) Optimize the objective function:

[0090] First, we simplify the calculation of u ci , according to the formula:

[0091]

[0092] Then calculate v cj , according to the formula:

[0093]

[0094] Finally calculate w j , the calculation formula is:

[0095]

[0096] (5) Update the cluster center matrix: This step updates the cluster center matrix P, whose elements are p cj The calculation method is:

[0097]

[0098] (6) Determine whether it converges: If the objective function J FC4DBS If the change of is less than the preset threshold ε or reaches the maximum number of iterations τ, the iterative process of the clustering algorithm is completed; otherwise, jump to step (3) to enter the next iteration.

[0099] (7) Clustering result output: After obtaining the final clustering result, the conversations are grouped according to the membership matrix U. Assume that the following U matrix is ​​finally obtained:

[0100]

[0101] By grouping the clusters with the highest membership, the final clustering result is:

[0102] Cluster 1: Session 1, Session 3, Session 5

[0103] Cluster 2: Session 2, Session 4

[0104] Specifically for database sessions, we can see that the database sessions contained in these two clusters are:

[0105] Cluster 1:

[0106]

[0107] Cluster 2:

[0108]

[0109] It can be clearly seen from the clustering results that the two clusters represent different user behavior patterns:

[0110] Cluster 1: mainly contains sessions with the query type of SELECT and a low response time. This type of session is mainly SELECT queries with a relatively short response time.

[0111] Cluster 2: Contains UPDATE and INSERT type sessions with a high response time. This type of session is mainly based on update and insert operations, and the response time is relatively long.

[0112] It can be seen that through database session clustering analysis, different sessions can be grouped. Based on the grouped session information, database administrators can easily obtain the different practical meanings represented by each session. These meanings may represent user behavior patterns or the occurrence of abnormal situations. In any case, it can help database administrators to form a quick analysis of database sessions and help improve operation and maintenance efficiency.

Claims

1. A user behavior analysis method based on database session clustering, the method comprising the following steps: 1.1 Data collection: Collect user original session data from the database; 1.2 Data preprocessing: standardize the collected raw session data; 1.3 Cluster analysis: Use clustering algorithm to perform fuzzy cluster analysis on the preprocessed session data; divide user sessions into different clusters based on the similarity relationship of the sessions, and each cluster represents a user behavior pattern; 1.4 Result display: The results of cluster analysis are displayed to users in a visual way; the features are: In cluster analysis, fuzzy clustering algorithm is used to analyze database conversations, automatically discover similarities between conversations, and classify similar conversations into one category.

2. A user behavior analysis method based on database session clustering as claimed in claim 1, characterized in that: The fuzzy clustering algorithm includes the following steps: (1) Processing mixed attribute data, using one-hot encoding to convert categorical attributes into numerical attributes; (2) Initialize parameters, including the number of clusters C and other parameters m, α, β, and λ; randomly initialize matrices U, V, and W, and initialize the cluster center matrix P; (3) Calculate the distance D from database session sample i to cluster c and attribute j cij =(x ij -p cj ) 2 , x ij is the jth attribute value of database session sample i, p cj is the jth attribute value of the center of the cth cluster; c = 1, 2, ..., C, i = 1, 2, ..., N, j = 1, 2, ..., K, c, i and j are the cth cluster, the ith database session sample, and the jth attribute respectively; C is the number of clusters, indicating how many clusters the database session is divided into; N is the number of samples, that is, the total number of database sessions; K is the number of attributes; (4) First calculate Where k is an integer ranging from 1 to C; then calculate Wherein, q is an integer ranging from 1 to K; Final calculation U is the database session sample membership matrix, whose element u ci represents the membership of database session sample i to cluster c; V is the attribute membership matrix, whose element v cj represents the membership of attribute j to cluster c; W is the attribute weight matrix, whose element w j represents the weight of attribute j; m is the fuzzy index; (5) Update the cluster center matrix P, whose elements are p cj The calculation method is (6) Calculate the objective function α and β are parameters that control the fuzziness of sample and attribute membership, respectively; λ is the weight coefficient of the sparsity constraint; if the objective function J FC4DBS If the change of is less than the preset threshold ε or reaches the maximum number of iterations τ, the iterative process of the clustering algorithm is completed; otherwise, go to step (3) to enter the next iteration. (7) Display the final clustering results to the user.

3. A user behavior analysis system based on database session clustering, the system includes the following modules: 1.1 Data collection module: This module collects user original session data from the database. 1.2 Data preprocessing module: This module performs standardization on the collected raw session data; 1.3 Cluster analysis module: This module applies clustering algorithm to perform fuzzy cluster analysis on preprocessed session data; user sessions are divided into different clusters according to the similarity relationship of the sessions, and each cluster represents a user behavior pattern; 1.4 Result display module: This module displays the results of cluster analysis to users in a visual way; its characteristics are: The cluster analysis module uses fuzzy clustering algorithm to analyze database conversations, automatically discovers similarities between conversations, and classifies similar conversations into one category.

4. A user behavior analysis system based on database session clustering as claimed in claim 3, characterized in that: The steps of fuzzy joint clustering algorithm include: (1) Processing mixed attribute data, using one-hot encoding to convert categorical attributes into numerical attributes; (2) Initialize parameters, including the number of clusters C and other parameters m, α, β, and λ; randomly initialize matrices U, V, and W, and initialize the cluster center matrix P; (3) Calculate the distance D from database session sample i to cluster c and attribute j cij =(x ij -p cj ) 2 , x ij is the jth attribute value of database session sample i, p cj is the jth attribute value of the center of the cth cluster; c = 1, 2, ..., C, i = 1, 2, ..., N, j = 1, 2, ..., K, c, i and j are the cth cluster, the ith database session sample, and the jth attribute respectively; C is the number of clusters, indicating how many clusters the database session is divided into; N is the number of samples, that is, the total number of database sessions; K is the number of attributes; (4) First calculate Where k is an integer ranging from 1 to C; then calculate Wherein, q is an integer ranging from 1 to K; Final calculation U is the database session sample membership matrix, whose element u ci represents the membership of database session sample i to cluster c; V is the attribute membership matrix, whose element v cj represents the membership of attribute j to cluster c; W is the attribute weight matrix, whose element w j represents the weight of attribute j; m is the fuzzy index; (5) Update the cluster center matrix P, whose elements are p cj The calculation method is (6) Calculate the objective function α and β are parameters that control the fuzziness of sample and attribute membership, respectively; λ is the weight coefficient of the sparsity constraint; if the objective function J FC4DBS If the change of is less than the preset threshold ε or reaches the maximum number of iterations τ, the iterative process of the clustering algorithm is completed; otherwise, go to step (3) to enter the next iteration.

Images