Screening method, system and equipment for predicting abnormal behaviors of personnel in enterprise and medium

Abstract

The invention relates to the technical field of abnormal behavior detection, in particular to a screening method, system and device for predicting abnormal behaviors of personnel in an enterprise and a medium. According to the method, under the condition that a large number of employees in an enterprise use personal computers, feature extraction is carried out by taking working behaviors of the employees as original data, frequency / duration feature data and text feature data are extracted as complete original features, and multivariate time series prediction is carried out by adopting factorization time and channel mixing. Finally, the difference between prediction and reality is compared to serve as preliminary screening for judging whether abnormal behaviors exist in work or not, a security analyst can conduct analysis, the security analyst does not need to conduct whole data screening, and the analysis work of the security analyst is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal behavior detection, and in particular to a method, system, device and medium for predicting abnormal behavior screening of personnel in an enterprise. Background Art

[0002] With the current Internet companies’ various types and numbers of businesses, employees’ awareness of confidentiality and risk regulations is weak. Occasional abnormal behaviors that violate prohibitions may also cause huge losses to the company, creating greater risks to the company’s business and operations. If these behaviors are not discovered, the company will generally request a large number of security analysts to audit the data to find the violators, which is quite time-consuming, labor-intensive and inefficient. However, in order to meet the analysis of a large number of employees and data in the company, it seriously restricts the development of the company. At present, the existing technology can only statically check the risk behaviors that have been discovered or already exist. For risk situations that have never occurred, a large number of security analysts are still needed to analyze and mark them. Summary of the invention

[0003] The main purpose of the present invention is to provide a method, system, device and medium for predicting abnormal behavior screening of personnel within an enterprise, aiming to perform preliminary screening and reduce the analysis and marking work of security analysts.

[0004] To achieve the above-mentioned purpose, the first aspect of the present invention provides a method for predicting abnormal behavior of personnel in an enterprise, comprising the following steps:

[0005] Obtaining raw data associated with employees’ abnormal behaviors;

[0006] Extracting features from the original data using a time-decayed mean spectrum and a pre-trained text feature extraction model to obtain frequency / duration feature data and text feature data, and concatenating the frequency / duration feature data and the text feature data to obtain complete original features;

[0007] The complete original features are subjected to time-dependent feature extraction using factorized time and channel mixture to obtain multivariate time features;

[0008] Perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target;

[0009] Perform differential analysis between the predicted target and the actual characteristics to obtain the risk score;

[0010] The top K largest risk scores are taken as risk features with large deviations between prediction and reality, and mapped back to specific behaviors, and the specific behaviors are output.

[0011] Furthermore, the original data includes: the duration of using various types of software, the duration of visiting various types of web pages, the number of times the printer is used, the content of the printed file, the operation log of the file, the content of the email and the chat record of the real-time communication software.

[0012] Furthermore, the duration / quantity data in the original data is preprocessed and extracted by using the time-decayed mean spectrum to obtain the frequency / duration feature data; the method includes the following steps:

[0013] Perform time weighting and Fourier transformation on the frequency / duration data according to formula (1);

[0014]

[0015] Among them, X'(f) is the time decay mean spectrum, x(t) is the number / duration data, α is the decay factor, e -(α+j2πf)t represents a complex exponential function with both attenuation and oscillation characteristics, j represents the imaginary unit, and f represents the frequency;

[0016] According to formula (2), the characteristics of signal energy changing over time are calculated;

[0017]

[0018] Among them, E(T) is the change characteristic;

[0019] The spectrum mean characteristic is calculated according to formula (3);

[0020]

[0021] Among them, f mean is the spectrum mean feature;

[0022] The quantitative features are obtained by calculating the peak of the time-decayed mean spectrum;

[0023] Calculate the frequency band energy characteristics according to formula (4);

[0024]

[0025] Among them, E band (f1, f2) is the frequency band energy characteristic;

[0026] Extract the feature matrix and the comprehensive feature vector is shown in formula (5):

[0027] F digdit =[E(T),f mean ,N peaks ,E band (f1,f2),…] (5);

[0028] Among them, Fdigdit Indicates the number of times / duration feature data, N peaks Represents quantitative characteristics.

[0029] Furthermore, the pre-trained text feature extraction model BERT is used to extract features from the text. Formula (6) shows the extraction process:

[0030] F text =BERT(Embed(x)) (6);

[0031] Among them, F text Represents text feature data; Embed represents the text embedding process, and x is the text content data in the original data.

[0032] Furthermore, the complete original features are factorized into time and channel mixtures to extract time-dependent features, and the multivariate time features are obtained, including the following steps:

[0033] The time-dependent feature extraction process is formula (7):

[0034] X h,1 ,…,X h,s =sampled(norm(X h ));

[0035]

[0036] Among them, sampled(…) means sampling the time series into interleaved subsequences with equal spacing, X h represents the complete original feature, X h,1 ,…,X h,s represents the sampled s subsequences, norm(…) represents the normalization operation; Temporal(…) represents the use of the temporal feature extractor to learn the temporal information of each subsequence; merge(…) represents the feature merging of the s subsequences obtained by Temporal(…); Represents time-dependent features;

[0037] Formula (8) is used to perform matrix decomposition on time series data with channel redundancy to reduce the noise in the channel dimension;

[0038]

[0039] in represents noise, is the channel dependency after denoising; and is the factorized channel interaction; Representing time-dependent features and the original feature X hChannel mixing characteristics; represents a matrix of dimension n×c, where the matrix elements are in the real number domain;

[0040] The multivariate time features are obtained by factoring formula (9);

[0041]

[0042] in represents the weight matrix between hidden layers; σ is the activation function; b1 and b2 represent bias terms to help the model better fit the data; Represents the channel dependence after denoising.

[0043] Furthermore, Transformer-based time series prediction based on multivariate time features includes the following steps:

[0044] Self-attention is used to capture the temporal similarity at the time segment level. The calculation formula is shown in formula (10):

[0045]

[0046] in Describes the time information between time segments; d is the feature dimension, that is, the length of each vector; It is an intermediate representation calculated by the self-attention mechanism.

[0047] Apply a feed-forward neural network with two linear layers and activation function Learning channel-level features;

[0048] The prediction results are generated using an initialized query matrix. The calculation formula is shown in formula (11):

[0049]

[0050] in, Describes the relationship between the input historical time series and the output forecast series; yes The transpose of To predict the results;

[0051] right Apply a projection layer to get the final prediction target

[0052] Furthermore, the difference analysis between the predicted target and the actual characteristics is performed to obtain the risk score, which includes the following steps:

[0053] Calculate the difference between the predicted target and the actual features to get the difference;

[0054] The risk score is calculated, and the risk score is the absolute value of the product of the difference and the risk coefficient. When the difference is a positive number, the value of the risk coefficient is a first set value; when the difference is a negative number, the value of the risk coefficient is a second set value.

[0055] Another aspect of the present invention discloses a system for predicting abnormal behavior of personnel in an enterprise, comprising:

[0056] The original data acquisition module is used to obtain the original data associated with the abnormal behavior of employees;

[0057] An original feature extraction module is used to extract features from the original data, obtain frequency / duration feature data and text feature data, and concatenate the frequency / duration feature data and the text feature data to obtain complete original features;

[0058] A multivariate time feature extraction module is used to extract time-dependent features from the complete original features using factorized time and channel mixture to obtain multivariate time features;

[0059] The prediction module is used to perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target;

[0060] The risk analysis module is used to perform differential analysis between the predicted target and the actual characteristics to obtain the risk score;

[0061] The screening module is used to extract the top N largest risk scores as risk features with large deviations between prediction and actual situation, map them back to specific behaviors, and output the specific behaviors.

[0062] Another aspect of the present invention discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any one of the above methods when executing the program.

[0063] Another aspect of the present invention discloses a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, any of the above methods is implemented.

[0064] The technical solution provided by the present invention may include the following beneficial effects:

[0065] In the case where employees in an enterprise use personal computers in large quantities, the present invention extracts features from the employees' work behaviors as raw data, extracts the frequency / duration feature data and text feature data as complete raw features, and uses factorized time and channel mixing to perform multivariate time series prediction. Finally, the gap between the comparison prediction and the actual situation is used as a preliminary screening for whether there is abnormal behavior in the work, which is provided for analysis by security analysts. There is no need for security analysts to conduct a comprehensive data screening, which greatly reduces the analysis work of security analysts. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0067] Figure 1 A schematic diagram of a flow chart of a method for predicting abnormal behavior of personnel in an enterprise according to an embodiment of the present invention;

[0068] Figure 2 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0069] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0070] It should be noted that all directional indications in the embodiments of the present invention (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0071] In the present invention, unless otherwise clearly specified and limited, the terms "connection", "fixation", etc. should be understood in a broad sense. For example, "fixation" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0072] In addition, in the present invention, descriptions such as "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing in the full text is to include three parallel solutions. Taking "A and / or B as an example", it includes solution A, or solution B, or solutions that satisfy both A and B. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0073] Combine the following Figure 1 , describing a method for predicting abnormal behavior screening of personnel in an enterprise according to an embodiment of the present invention, comprising the following steps:

[0074] Step S1: Obtaining original data associated with abnormal behavior of employees; specifically, in some optional embodiments, obtaining data on employees' daily work for three months, including: duration of use of various types of software, duration of visits to various types of web pages, number of times the printer is used, content of printed files, file operation logs, email content, and chat records of real-time communication software.

[0075] Step S2: extracting features from the original data to obtain frequency / duration feature data and text feature data, and concatenating the frequency / duration feature data and text feature data to obtain complete original features; specifically, taking days as segments, obtaining complete original features of employees every day.

[0076] Step S3: extract time-dependent features from the complete original features using factorized time and channel mixing through the time-attenuated mean spectrum and the pre-trained text feature extraction model to obtain multivariate time features; specifically, obtain the multivariate time features of the Nth day based on the complete original features of the employee, where N is a positive integer.

[0077] Step S4: Perform Transformer-based time series prediction according to the multivariate time features to obtain a prediction target; specifically, based on the multivariate time features of the employee on the Nth day, predict the prediction target for the N+1th day.

[0078] Step S5: Perform a difference analysis between the predicted target and the characteristics of the actual situation to obtain a risk score; specifically, perform a difference analysis between the predicted target for the N+1th day and the characteristics of the actual situation on the N+1th day.

[0079] Step S6: Take the top K risk scores as risk features with large deviations between prediction and reality, and map them back to specific behaviors, and output the specific behaviors for analysis by security analysts. K is a parameter value that can be adjusted according to needs. In some preferred embodiments, the value of K is 5. More preferably, the abnormal behaviors or features judged by the security analyst are corrected in the end, and the features are added as new historical data to the original data associated with the abnormal behaviors to re-model and update the model.

[0080] In the case where employees in an enterprise use personal computers in large quantities, the present invention extracts features from the employees' work behaviors as raw data, extracts the frequency / duration feature data and text feature data as complete raw features, and uses factorized time and channel mixing to perform multivariate time series prediction. Finally, the gap between the comparison prediction and the actual situation is used as a preliminary screening for whether there is abnormal behavior in the work, which is provided for analysis by security analysts. There is no need for security analysts to conduct a comprehensive data screening, which greatly reduces the analysis work of security analysts.

[0081] As an optional embodiment, the present invention preprocesses and extracts the duration / quantity data in the original data through the time-attenuated mean spectrum to obtain the frequency / duration feature data; specifically, the steps include:

[0082] Perform time weighting and Fourier transformation on the frequency / duration data according to formula (1);

[0083]

[0084] Among them, X'(f) is the time decay mean spectrum, x(t) is the number / duration data, α is the decay factor, e -(α+j2πf)t It represents a complex exponential function with both attenuation and oscillation characteristics. j represents the imaginary unit and f represents the frequency. In the frequency domain, the signal is characterized by characteristic quantities related to duration and quantity.

[0085] According to formula (2), the characteristics of signal energy changing over time are calculated;

[0086]

[0087] Among them, E(T) is the change characteristic;

[0088] The spectrum mean characteristic is calculated according to formula (3);

[0089]

[0090] Among them, f mean is the spectrum mean feature;

[0091] The quantitative features are obtained by calculating the peak of the time-decayed mean spectrum;

[0092] Calculate the frequency band energy characteristics according to formula (4);

[0093]

[0094] Among them, E band (f1, f2) is the frequency band energy characteristic;

[0095] Extract the feature matrix and the comprehensive feature vector is shown in formula (5):

[0096] F digdit =[E(T),f mean ,N peaks ,E band (f1,f2),…] (5);

[0097] Among them, F digdit Indicates the number of times / duration feature data, N peaks Represents quantitative characteristics.

[0098] Furthermore, the present invention uses the pre-trained text feature extraction model BERT to extract features from the text, and formula (6) shows the extraction process:

[0099] F text =BERT(Embed(x)) (6);

[0100] Among them, F text represents text feature data; Embed represents the text embedding process, and x is the text content data in the original data. Of course, in other embodiments, other machine learning models can also be used to extract text features. The present invention is not specifically limited.

[0101] Further optionally, the present invention uses factorized time and channel mixing to extract time-dependent features from the complete original features to obtain multivariate time features, including the following steps:

[0102] The time-dependent feature extraction process is formula (7):

[0103] X h,1 ,…,X h,s =sampled(norm(X h ));

[0104]

[0105] Among them, sampled(…) means sampling the time series into interleaved subsequences with equal spacing, X h represents the complete original feature, X h,1 ,…,X h,srepresents the sampled s subsequences, norm(…) represents the normalization operation; Temporal(…) represents the use of the temporal feature extractor to learn the temporal information of each subsequence; merge(…) represents the feature merging of the s subsequences obtained by Temporal(…); Represents time-dependent features; wherein, the time feature extractor can use different machine learning models for extraction, such as a fully connected neural network or a self-attention mechanism, which is not limited by the present invention.

[0106] Formula (8) is used to perform matrix decomposition on time series data with channel redundancy to reduce the noise in the channel dimension;

[0107]

[0108] in represents noise, is the channel dependency after denoising; and is the factorized channel interaction; Representing time-dependent features and the original feature X h Channel mixing characteristics; represents a matrix of dimension n×c, where the matrix elements are in the real number domain;

[0109] The multivariate time features are obtained by factoring formula (9);

[0110]

[0111] in represents the weight matrix between hidden layers; σ is the activation function; b1 and b2 represent bias terms to help the model better fit the data; Represents the channel dependence after denoising.

[0112] Specifically, Transformer-based time series prediction based on multivariate time features includes the following steps:

[0113] On the encoder side, self-attention or other related modes are used to capture the temporal similarity at the temporal segment level. The calculation formula is shown in formula (10):

[0114]

[0115] in Describes the time information between time segments; d is the feature dimension, that is, the length of each vector; It is an intermediate representation calculated by the self-attention mechanism.

[0116] Apply a feed-forward neural network with two linear layers and activation function Learning channel-level features;

[0117] At the decoder side, an initialized query matrix is ​​used to generate the prediction result. The calculation formula is shown in formula (11):

[0118]

[0119] in, Describes the relationship between the input historical time series and the output forecast series; yes The transpose of To predict the results;

[0120] right Apply a projection layer to get the final prediction target

[0121] Specifically, the predicted target x f The difference analysis with the actual characteristics and the risk score include the following steps:

[0122] Calculate the predicted target x f Subtract the features from the actual situation to get the difference;

[0123] The risk score is calculated, and the risk score is the absolute value of the product of the difference and the risk coefficient, wherein when the difference is a positive number, the value of the risk coefficient is a first set value; when the difference is a negative number, the value of the risk coefficient is a second set value. Generally speaking, in a specific embodiment, the first set value is 0.7 and the second set value is 0.3.

[0124] The second aspect of the present invention discloses a system for predicting abnormal behavior of personnel in an enterprise, comprising:

[0125] The original data acquisition module is used to obtain the original data associated with the abnormal behavior of employees;

[0126] An original feature extraction module is used to extract features from the original data, obtain frequency / duration feature data and text feature data, and concatenate the frequency / duration feature data and the text feature data to obtain complete original features;

[0127] A multivariate time feature extraction module is used to extract time-dependent features from the complete original features using factorized time and channel mixture to obtain multivariate time features;

[0128] The prediction module is used to perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target;

[0129] The risk analysis module is used to perform differential analysis between the predicted target and the actual characteristics to obtain the risk score;

[0130] The screening module is used to extract the top N largest risk scores as risk features with large deviations between prediction and actual situation, map them back to specific behaviors, and output the specific behaviors.

[0131] It should be noted that the method for predicting abnormal behavior of personnel in an enterprise provided by the embodiment of the present invention can be built on a server for centralized management of office computers, and the various units and modules described above can refer to program modules or units. Also, more details and corresponding technical effects of the system of the embodiment of the present invention can be referred to the description of the method embodiment above, which will not be repeated here.

[0132] The system of the above-mentioned embodiment of the present invention can be used to execute the corresponding method embodiment of the present invention, and accordingly achieve the technical effects achieved by the above-mentioned method embodiment of the present invention, which will not be repeated here.

[0133] In the embodiment of the present invention, relevant functional modules can be implemented by a hardware processor.

[0134] like Figure 2 As shown, on the other hand, the present invention discloses an electronic device 200, including: a processor 201 and a memory 202. Among them, the processor 201 and the memory 202 are connected, such as connected through a bus 203. Further, the electronic device 200 may also include a transceiver 204. It should be noted that in actual applications, the transceiver 204 is not limited to one, and the structure of the electronic device 200 does not constitute a limitation on the embodiment of the present application. Among them, the processor 201 is applied to the embodiment of the present application to realize the functions of each unit and module of the abnormal behavior screening system for predicting personnel in the enterprise. The processor 201 can be a CPU, a general processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present application. The processor 201 can also be a combination that realizes a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The bus 203 may include a path to transmit information between the above components. The bus 203 may be a PCI bus or an EISA bus, etc. The bus 203 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2Only one thick line is used to represent it, but it does not mean that there is only one bus or one type of bus. The memory 202 can be a ROM or other types of static storage devices that can store static information and instructions, a RAM or other types of dynamic storage devices that can store information and instructions, or an EEPROM, CD-ROM or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this. The memory 202 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 201. The processor 201 is used to execute the application code stored in the memory 202 to implement the method for predicting abnormal behavior screening of personnel in an enterprise provided by the present invention.

[0135] On the other hand, an embodiment of the present invention provides a storage medium having a computer program stored thereon, wherein the program is executed by a processor to perform the steps of the method for predicting abnormal behavior screening of personnel in an enterprise as performed by the above server.

[0136] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0137] The optional implementation modes of the embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above implementation modes. Within the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical scheme of the embodiments of the present invention, and these simple modifications all belong to the protection scope of the embodiments of the present invention.

[0138] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the embodiments of the present invention will not further describe various possible combinations.

[0139] In addition, various implementation modes of the embodiments of the present invention may be arbitrarily combined, and as long as they do not violate the concept of the embodiments of the present invention, they should also be regarded as the contents disclosed by the embodiments of the present invention.

Claims

1. A method for predicting abnormal behavior of personnel in an enterprise, characterized by: The steps include: Obtaining raw data associated with employees’ abnormal behaviors; Extracting features from the original data using a time-decayed mean spectrum and a pre-trained text feature extraction model to obtain frequency / duration feature data and text feature data, and concatenating the frequency / duration feature data and the text feature data to obtain complete original features; The complete original features are subjected to time-dependent feature extraction using factorized time and channel mixture to obtain multivariate time features; Perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target; Perform differential analysis between the predicted target and the actual characteristics to obtain the risk score; The top K largest risk scores are taken as risk features with large deviations between prediction and reality, and mapped back to specific behaviors, and the specific behaviors are output.

2. The method for predicting abnormal behavior of personnel in an enterprise according to claim 1, characterized in that: The raw data includes: the duration of using various types of software, the duration of visiting various types of web pages, the number of times the printer is used, the content of the printed file, the operation log of the file, the content of the email and the chat record of the real-time communication software.

3. The method for predicting abnormal behavior of personnel in an enterprise according to claim 1, characterized in that: Preprocess and extract the duration / quantity data in the original data through the time decay mean spectrum to obtain the frequency / duration feature data; The steps include: Perform time weighting and Fourier transformation on the frequency / duration data according to formula (1); Among them, X'(f) is the time decay mean spectrum, x(t) is the number / duration data, α is the decay factor, e -(α+j2πf)t represents a complex exponential function with both attenuation and oscillation characteristics, j represents the imaginary unit, and f represents the frequency; According to formula (2), the characteristics of signal energy changing over time are calculated; Among them, E(T) is the change characteristic; The spectrum mean characteristic is calculated according to formula (3); Among them, f mean is the spectrum mean feature; The quantitative features are obtained by calculating the peak of the time-decayed mean spectrum; Calculate the frequency band energy characteristics according to formula (4); Among them, E band (f1, f2) is the frequency band energy characteristic; Extract the feature matrix and the comprehensive feature vector is shown in formula (5): F digdit =[E(T),f mean ,N peaks ,E band (f1,f2),…] (5); Among them, F digdit Indicates the number of times / duration feature data, N peaks Represents quantitative characteristics.

4. The method for predicting abnormal behavior of personnel in an enterprise according to claim 1, characterized in that: The pre-trained text feature extraction model BERT is used to extract features from the text. Formula (6) shows the extraction process: F text =BERT(Embed(x)) (6); Among them, F text Represents text feature data; Embed represents the text embedding process, and x is the text content data in the original data.

5. The method for predicting abnormal behavior of personnel in an enterprise according to claim 1, characterized in that: The complete original features are factorized into time and channel mixtures to extract time-dependent features, and the multivariate time features are obtained, which include the following steps: The time-dependent feature extraction process is formula (7): X h,1 ,…,X h,s =sampled(norm(X h )); Among them, sampled(…) means sampling the time series into interleaved subsequences with equal spacing, X h represents the complete original feature, X h,1 ,…,X h,s represents the sampled s subsequences, norm(…) represents the normalization operation; Temporal(…) represents the use of the temporal feature extractor to learn the temporal information of each subsequence; merge(…) represents the feature merging of the s subsequences obtained by Temporal(…); Represents time-dependent features; Formula (8) is used to perform matrix decomposition on time series data with channel redundancy to reduce the noise in the channel dimension; in represents noise, is the channel dependency after denoising; and is the factorized channel interaction; Representing time-dependent features and the original feature X h Channel mixing characteristics; represents a matrix of dimension n×c, where the matrix elements are in the real number domain; The multivariate time features are obtained by factoring formula (9); in represents the weight matrix between hidden layers; σ is the activation function; b1 and b2 represent bias terms to help the model better fit the data; Represents the channel dependence after denoising.

6. The method for predicting abnormal behavior of personnel in an enterprise according to claim 5, characterized in that: Transformer-based time series prediction based on multivariate time features includes the following steps: Self-attention is used to capture the temporal similarity at the time segment level. The calculation formula is shown in formula (10): in Describes the time information between time segments; d is the feature dimension, that is, the length of each vector; It is an intermediate representation calculated by the self-attention mechanism; Apply a feed-forward neural network with two linear layers and activation function Learning channel-level features; The prediction results are generated using an initialized query matrix. The calculation formula is shown in formula (11): in, Describes the relationship between the input historical time series and the output forecast series; yes The transpose of To predict the results; right Apply a projection layer to obtain the final prediction target 7. The method for predicting abnormal behavior of personnel in an enterprise according to claim 1, characterized in that: The difference analysis between the predicted target and the actual characteristics to obtain the risk score includes the following steps: Calculate the difference between the predicted target and the actual features to get the difference; The risk score is calculated, and the risk score is the absolute value of the product of the difference and the risk coefficient. When the difference is a positive number, the value of the risk coefficient is a first set value; when the difference is a negative number, the value of the risk coefficient is a second set value.

8. Predict abnormal behavior screening system for personnel within the enterprise, including: The original data acquisition module is used to obtain the original data associated with the abnormal behavior of employees; An original feature extraction module is used to extract features from the original data, obtain frequency / duration feature data and text feature data, and concatenate the frequency / duration feature data and the text feature data to obtain complete original features; A multivariate time feature extraction module is used to extract time-dependent features from the complete original features using factorized time and channel mixture to obtain multivariate time features; The prediction module is used to perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target; The risk analysis module is used to perform differential analysis between the predicted target and the actual characteristics to obtain the risk score; The screening module is used to extract the top N largest risk scores as risk features with large deviations between prediction and actual situation, map them back to specific behaviors, and output the specific behaviors.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images