Predicting abnormal behavior screening method, system, device and medium

Abstract

The present application relates to the technical field of abnormal behavior detection, and particularly relates to a method, system, device and medium for screening abnormal behavior of personnel in an enterprise. In the present application, the working behavior of the employees is taken as the original data for feature extraction in the case that the employees use personal computers a lot, and the frequency / time length feature data and the text feature data are extracted as complete original features, and the factor decomposition time and the channel mixing are adopted for multivariate time series prediction. Finally, the difference between the comparison prediction and the actual situation is taken as the preliminary screening of whether there is abnormal behavior in the work, for analysis by the security analyst, without the security analyst needing to perform overall data screening, so that the analysis work of the security analyst is greatly reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of abnormal behavior detection, in particular to a method and system for predicting abnormal behavior of personnel in an enterprise, a device and a medium. BACKGROUND

[0002] With the variety and large number of business types of current Internet enterprises, the employees' awareness of confidentiality and risk specification is weak, and occasional prohibited abnormal behavior may cause great loss to the company, posing a great risk to the company's business and operation. If these behaviors are not found, the enterprise will generally request a large number of security analysts to audit the data to find out the rule-breaking personnel, which is time-consuming and laborious and inefficient. However, it is necessary to analyze and label a large number of employees and data in the enterprise, which seriously hinders the development of the enterprise. The existing technology can only statically check the discovered or existing risk behaviors, and a large number of security analysts are still needed to analyze and label the risk behaviors that have never occurred. SUMMARY

[0003] The main purpose of the present application is to provide a method and system for predicting abnormal behavior of personnel in an enterprise, a device and a medium, which aims to perform preliminary screening and reduce the analysis and labeling work of security analysts.

[0004] To achieve the above purpose, the first aspect of the present application provides a method for predicting abnormal behavior of personnel in an enterprise, comprising the following steps:

[0005] Obtaining original data associated with employee abnormal behavior;

[0006] Performing feature extraction on the original data by using time decay mean spectrum and a pre-trained text feature extraction model to obtain frequency / time length feature data and text feature data, splicing the frequency / time length feature data and the text feature data to obtain complete original features;

[0007] Using factorization time and channel mixing to extract time-dependent features from the complete original features to obtain multivariate time features;

[0008] Performing time series prediction based on Transformer according to the multivariate time features to obtain a prediction target;

[0009] Performing difference analysis on the prediction target and the features in the actual situation to obtain a risk score;

[0010] Taking the top K largest risk scores as risk features with large deviation between prediction and actual situation, and mapping them back to specific behaviors, and outputting the specific behaviors.

[0011] Furthermore, the raw data includes: the duration of use of various types of software, the duration of access to various types of web pages, the number of times the printer is used, the content of printed documents, the operation logs of documents, email content, and chat logs from real-time communication software.

[0012] Furthermore, the duration / quantity data in the original data are preprocessed and extracted using the time-decayed mean spectrum to obtain frequency / duration feature data; this includes the following steps:

[0013] Perform time-weighted and Fourier transform on the frequency / duration data according to formula (1);

[0014]

[0015] Where X'(f) is the time-decay mean spectrum, x(t) is the number of times / duration data, α is the decay factor, and e -(α+j2πf)t Let f represent a complex exponential function that simultaneously exhibits decay and oscillation characteristics, where j represents the imaginary unit and f represents the frequency;

[0016] The characteristics of signal energy change over time are calculated according to formula (2);

[0017]

[0018] Wherein, E(T) represents the characteristic of change;

[0019] The spectral mean characteristics are calculated according to formula (3);

[0020]

[0021] Among them, f mean The characteristic of the spectral mean;

[0022] The quantitative characteristics are obtained by calculating the peak value of the mean spectrum of time decay;

[0023] Calculate the frequency band energy characteristics according to formula (4);

[0024]

[0025] Among them, E band (f1,f2) represents the frequency band energy characteristics;

[0026] The feature matrix is ​​extracted, and the combined feature vector is shown in formula (5):

[0027] F digdit =[E(T),f mean N peaks E band (f1,f2),…] (5);

[0028] Among them, Fdigdit N represents the frequency / duration feature data. peaks Indicates quantitative characteristics.

[0029] Furthermore, the pre-trained text feature extraction model BERT is used to extract features from the text. Equation (6) shows the extraction process:

[0030] F text =BERT(Embed(x)) (6);

[0031] Among them, F text represents text feature data; Embed represents the text embedding process, and x represents the text content data in the original data.

[0032] Furthermore, time-dependent feature extraction is performed on the complete original features using factorization and time-channel mixing to obtain multivariate time features, including the following steps:

[0033] The time-dependent feature extraction process is shown in formula (7):

[0034] X h,1 ,…,X h,s =sampled(norm(X) h ));

[0035]

[0036] Where sampled(...) indicates that the time series is downsampled at equal intervals into interleaved subsequences, X h Represents the complete original feature, X h,1 ,…,X h,s This represents the s sampled subsequences; norm(...) represents the normalization operation; Temporal(...) represents learning the temporal information of each subsequence using a temporal feature extractor; merge(...) represents merging the features of the s subsequences obtained from Temporal(...); Indicates time-dependent characteristics;

[0037] Formula (8) is used to perform matrix decomposition on time series data with channel redundancy to reduce noise in the channel dimension;

[0038]

[0039] in Indicates noise. It is the channel dependency after noise reduction; and For factorization, channel interaction; Indicating time-dependent features and original feature X hChannel mixing characteristics; Let represent an n×c dimension matrix, where the matrix elements are in the real number field;

[0040] Multivariate time characteristics are obtained by factoring using formula (9);

[0041]

[0042] in σ represents the weight matrix between hidden layers; b1 and b2 represent bias terms to help the model better fit the data. This indicates the channel dependency obtained after denoising.

[0043] Furthermore, Transformer-based time series prediction based on multivariate time features includes the following steps:

[0044] The self-attention method is used to capture temporal similarity at the time slice level, and the calculation formula is shown in formula (10):

[0045]

[0046] in It describes the temporal information between time segments; d is the feature dimension, i.e., the length of each vector; It is an intermediate representation calculated through a self-attention mechanism.

[0047] Applying a feedforward neural network with two linear layers and activation functions in Upper-level learning channel features;

[0048] The prediction result is generated using an initialized query matrix, and the calculation formula is shown in formula (11):

[0049]

[0050] in, It describes the relationship between the input historical time series and the output predicted series; yes transpose, For the predicted results;

[0051] right Apply a projection layer to obtain the final prediction target.

[0052] Furthermore, the risk score is obtained by performing a difference analysis between the predicted target and the characteristics under actual conditions, including the following steps:

[0053] The difference between the predicted target and the actual characteristics is calculated to obtain the difference value.

[0054] Calculate the risk score, which is the absolute value of the product of the difference and the risk coefficient. When the difference is positive, the risk coefficient is set to a first value; when the difference is negative, the risk coefficient is set to a second value.

[0055] Another aspect of the present invention discloses a screening system for predicting abnormal behavior of personnel within an enterprise, comprising:

[0056] The raw data acquisition module is used to acquire raw data related to abnormal employee behavior;

[0057] The original feature extraction module is used to extract features from the original data, obtain frequency / duration feature data and text feature data, and concatenate the frequency / duration feature data and text feature data to obtain complete original features;

[0058] The multivariate time feature extraction module is used to extract time-dependent features from the complete original features by factoring time and channel mixing, thus obtaining multivariate time features;

[0059] The prediction module is used to perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target;

[0060] The risk analysis module is used to perform a difference analysis between the predicted target and the characteristics under the actual situation to obtain a risk score;

[0061] The filtering module is used to extract the top N largest risk scores as risk features with large deviations between prediction and reality, and map them back to specific behaviors, outputting the specific behaviors.

[0062] Another aspect of the present invention discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the methods described above.

[0063] In another aspect, the present invention discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described above.

[0064] The technical solution provided by this invention may include the following beneficial effects:

[0065] This invention addresses the issue of extensive personal computer use among employees within enterprises. It extracts features from employee work behavior as raw data, extracting frequency / duration features and textual features as complete raw features. A multivariate time series prediction method is then employed, using factorization and a hybrid time-channel approach. Ultimately, the discrepancy between the predicted and actual data serves as a preliminary screening tool to determine the presence of abnormal behavior, providing data for security analysts. This eliminates the need for comprehensive data screening by security analysts, significantly reducing their workload. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0067] Figure 1 This is a flowchart illustrating a method for predicting and screening abnormal behaviors of employees within an enterprise, according to an embodiment of the present invention.

[0068] Figure 2 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0069] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0070] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0071] In this invention, unless otherwise explicitly specified and limited, the terms "connection," "fixed," etc., should be interpreted broadly. For example, "fixed" can mean a fixed connection, a detachable connection, or an integral part; it can mean a mechanical connection or an electrical connection; it can mean a direct connection or an indirect connection through an intermediate medium; it can mean the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0072] Furthermore, in this invention, descriptions involving "first," "second," etc., are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the word "and / or" throughout the text means including three parallel solutions; taking "A and / or B" as an example, it includes solution A, solution B, or a solution that simultaneously satisfies A and B. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0073] The following is combined Figure 1 The present invention describes a method for predicting and screening abnormal behavior of personnel within an enterprise, comprising the following steps:

[0074] Step S1: Obtain raw data related to abnormal employee behavior; specifically, in some optional embodiments, obtain data on the employee's daily work over three months, including: the duration of using various types of software, the duration of accessing various types of web pages, the number of times the printer is used, the content of printed documents, the operation logs of documents, email content, and chat logs from real-time communication software.

[0075] Step S2: Extract features from the raw data to obtain frequency / duration feature data and text feature data. Concatenate the frequency / duration feature data and text feature data to obtain complete raw features; specifically, using days as segments, obtain the complete raw features for each employee's day.

[0076] Step S3: Extract time-dependent features from the complete original features by factoring time and channel mixing using the time decay mean spectrum and the pre-trained text feature extraction model, and obtain multivariate time features; specifically, based on the complete original features of the employee on day N, obtain the multivariate time features of day N, where N is a positive integer.

[0077] Step S4: Perform Transformer-based time series forecasting based on multivariate time features to obtain the forecast target; specifically, based on the multivariate time features of employees on day N, predict the forecast target for day N+1.

[0078] Step S5: Perform a difference analysis between the predicted target and the actual characteristics to obtain a risk score; specifically, perform a difference analysis between the predicted target for day N+1 and the actual characteristics for day N+1.

[0079] Step S6: Extract the top K largest risk scores as risk features with significant deviations between prediction and reality, map them back to specific behaviors, and output the specific behaviors for security analysts to analyze. Here, K is a parameter value that can be adjusted as needed. In some preferred embodiments, K is set to 5. More preferably, the behaviors or features identified as anomalous by the security analyst are corrected, and these features are added as new historical data to the original data associated with the anomalous behaviors to remodel and update the model.

[0080] This invention addresses the issue of extensive personal computer use among employees within enterprises. It extracts features from employee work behavior as raw data, extracting frequency / duration features and textual features as complete raw features. A multivariate time series prediction method is then employed, using factorization and a hybrid time-channel approach. Ultimately, the discrepancy between the predicted and actual data serves as a preliminary screening tool to determine the presence of abnormal behavior, providing data for security analysts. This eliminates the need for comprehensive data screening by security analysts, significantly reducing their workload.

[0081] As an optional embodiment, the present invention preprocesses and extracts duration / quantity data from the original data using the time-decayed mean spectrum to obtain frequency / duration feature data; specifically, it includes the following steps:

[0082] Perform time-weighted and Fourier transform on the frequency / duration data according to formula (1);

[0083]

[0084] Where X'(f) is the time-decay mean spectrum, x(t) is the number of times / duration data, α is the decay factor, and e -(α+j2πf)t It represents a complex exponential function that simultaneously exhibits decay and oscillation characteristics, where j represents the imaginary unit and f represents the frequency; in the frequency domain, the signal is characterized by characteristics related to duration and quantity.

[0085] The characteristics of signal energy change over time are calculated according to formula (2);

[0086]

[0087] Wherein, E(T) represents the characteristic of change;

[0088] The spectral mean characteristics are calculated according to formula (3);

[0089]

[0090] Among them, f mean The characteristic of the spectral mean;

[0091] The quantitative characteristics are obtained by calculating the peak value of the mean spectrum of time decay;

[0092] Calculate the frequency band energy characteristics according to formula (4);

[0093]

[0094] Among them, E band (f1,f2) represents the frequency band energy characteristics;

[0095] The feature matrix is ​​extracted, and the combined feature vector is shown in formula (5):

[0096] F digdit =[E(T),f mean N peaks E band (f1,f2),…] (5);

[0097] Among them, F digdit N represents the frequency / duration feature data. peaks Indicates quantitative characteristics.

[0098] Furthermore, this invention uses the pre-trained text feature extraction model BERT to extract features from the text, and formula (6) shows the extraction process:

[0099] F text =BERT(Embed(x)) (6);

[0100] Among them, F text The text feature data is represented by "x"; "Embed" represents the text embedding process, and "x" represents the text content data in the original data. Of course, in other embodiments, other machine learning models can also be used for text feature extraction. This invention does not impose specific limitations.

[0101] Further, optionally, the present invention performs time-dependent feature extraction on the complete original features using factorization and time-channel mixing to obtain multivariate time features, including the following steps:

[0102] The time-dependent feature extraction process is shown in formula (7):

[0103] X h,1 ,…,X h,s =sampled(norm(X) h ));

[0104]

[0105] Where sampled(...) indicates that the time series is downsampled at equal intervals into interleaved subsequences, X h Represents the complete original feature, X h,1 ,…,X h,sThis represents the s sampled subsequences; norm(...) represents the normalization operation; Temporal(...) represents learning the temporal information of each subsequence using a temporal feature extractor; merge(...) represents merging the features of the s subsequences obtained from Temporal(...); The time-dependent features are represented; the time feature extractor can use different machine learning models for extraction, such as fully connected neural networks or self-attention mechanisms, and this invention does not limit them.

[0106] Formula (8) is used to perform matrix decomposition on time series data with channel redundancy to reduce noise in the channel dimension;

[0107]

[0108] in Indicates noise. It is the channel dependency after noise reduction; and For factorization, channel interaction; Indicating time-dependent features and original feature X h Channel mixing characteristics; Let represent an n×c dimension matrix, where the matrix elements are in the real number field;

[0109] Multivariate time characteristics are obtained by factoring using formula (9);

[0110]

[0111] in σ represents the weight matrix between hidden layers; b1 and b2 represent bias terms to help the model better fit the data. This indicates the channel dependency obtained after denoising.

[0112] Specifically, Transformer-based time series prediction based on multivariate time features includes the following steps:

[0113] At the encoder end, self-attention or other related modes are used to capture temporal similarity at the time slice level, and the calculation formula is shown in formula (10):

[0114]

[0115] in It describes the temporal information between time segments; d is the feature dimension, i.e., the length of each vector; It is an intermediate representation calculated through a self-attention mechanism.

[0116] Applying a feedforward neural network with two linear layers and activation functions in Upper-level learning channel features;

[0117] At the decoder end, an initial query matrix is ​​used to generate the prediction result, and the calculation formula is shown in formula (11):

[0118]

[0119] in, It describes the relationship between the input historical time series and the output predicted series; yes transpose, For the predicted results;

[0120] right Apply a projection layer to obtain the final prediction target.

[0121] Specifically, the target x will be predicted f To obtain a risk score by performing a difference analysis between the characteristics and those in the actual situation, the following steps are involved:

[0122] Calculate the predicted target x f The difference is obtained by subtracting the feature from the actual feature;

[0123] A risk score is calculated, which is the absolute value of the product of the difference and the risk coefficient. When the difference is positive, the risk coefficient is a first set value; when the difference is negative, the risk coefficient is a second set value. Generally, in a specific embodiment, the first set value is 0.7, and the second set value is 0.3.

[0124] A second aspect of this invention discloses a screening system for predicting abnormal behavior of employees within an enterprise, comprising:

[0125] The raw data acquisition module is used to acquire raw data related to abnormal employee behavior;

[0126] The original feature extraction module is used to extract features from the original data, obtain frequency / duration feature data and text feature data, and concatenate the frequency / duration feature data and text feature data to obtain complete original features;

[0127] The multivariate time feature extraction module is used to extract time-dependent features from the complete original features by factoring time and channel mixing, thus obtaining multivariate time features;

[0128] The prediction module is used to perform Transformer-based time series prediction based on multivariate time features to obtain the prediction target;

[0129] The risk analysis module is used to perform a difference analysis between the predicted target and the characteristics under the actual situation to obtain a risk score;

[0130] The filtering module is used to extract the top N largest risk scores as risk features with large deviations between prediction and reality, and map them back to specific behaviors, outputting the specific behaviors.

[0131] It should be noted that the method for predicting and screening abnormal employee behavior provided in this embodiment of the invention can be built on a server used for centralized management of office computers, and the various units and modules mentioned above can refer to program modules or units. Furthermore, more details and corresponding technical effects of the system in this embodiment of the invention can be found in the description of the method embodiments above, and will not be repeated here.

[0132] The system described in the above embodiments of the present invention can be used to execute the corresponding method embodiments of the present invention and achieve the technical effects achieved by the above method embodiments of the present invention, which will not be repeated here.

[0133] In this embodiment of the invention, the relevant functional modules can be implemented using a hardware processor.

[0134] like Figure 2 As shown, another aspect of the present invention discloses an electronic device 200, including a processor 201 and a memory 202. The processor 201 and the memory 202 are connected, for example, via a bus 203. Further, the electronic device 200 may also include a transceiver 204. It should be noted that in practical applications, the transceiver 204 is not limited to one, and the structure of the electronic device 200 does not constitute a limitation on the embodiments of this application. The processor 201 is used in the embodiments of this application to implement the functions of various units and modules of the system for predicting abnormal behavior of personnel within an enterprise. The processor 201 can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 201 can also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc. The bus 203 may include a path for transmitting information between the above components. The bus 203 may be a PCI bus or an EISA bus, etc. Bus 203 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 2The bus is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. The memory 202 can be ROM or other types of static storage devices capable of storing static information and instructions, RAM or other types of dynamic storage devices capable of storing information and instructions, or it can be EEPROM, CD-ROM or other optical disc storage, optical disk storage (including compressed optical disks, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 202 is used to store application code that executes the scheme of this application, and its execution is controlled by the processor 201. The processor 201 is used to execute the application code stored in the memory 202 to implement the method for predicting and screening abnormal behavior of personnel within an enterprise provided by this invention.

[0135] On the other hand, embodiments of the present invention provide a storage medium on which a computer program is stored, the program being executed by a processor as described above in the steps of the method for predicting and screening abnormal behavior of personnel within an enterprise.

[0136] The above-described product can perform the methods provided in the embodiments of this application, and has the corresponding functional modules and beneficial effects for performing the methods. Technical details not described in detail in this embodiment can be found in the methods provided in the embodiments of this application.

[0137] The optional embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the scope of the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical solutions of the embodiments of the present invention, and these simple modifications all fall within the protection scope of the embodiments of the present invention.

[0138] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the embodiments of the present invention will not describe the various possible combinations separately.

[0139] Furthermore, various different implementations of the present invention can be combined arbitrarily, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed in the present invention.

Claims

1. A method for predicting anomalous behavior screening of personnel within an enterprise, the method comprising: The method comprises the following steps: ​ obtaining original data associated with abnormal behavior of employees; extracting features from the original data by using time-decaying mean spectrum and a pre-trained text feature extraction model to obtain time / length feature data and text feature data, splicing the time / length feature data and the text feature data to obtain complete original features, wherein the time / length feature data comprises signal energy change characteristics over time, spectral mean characteristics, quantity characteristics, and frequency band energy characteristics; extracting time-dependent features from the complete original features by using factorization time and channel mixing to obtain multivariate time features; performing a time series prediction based on a Transformer according to the multivariate time features to obtain a prediction target; performing difference analysis on the prediction target and the features in the actual situation to obtain a risk score; taking the top K largest risk scores as risk features with large prediction and actual deviation, and mapping them back to specific behaviors to output the specific behaviors; wherein the time / length feature data is obtained by preprocessing and extracting time / length / quantity data in the original data by using time-decaying mean spectrum, comprising the following steps: performing time weighting and Fourier transform on the time / length data according to formula (1); （1）； wherein, is a time-decaying mean spectrum, is a number / time duration data, is a decay factor, represents a complex exponential function with both decay and oscillation characteristics, represents an imaginary unit, represents a frequency; calculating the signal energy change characteristics over time according to formula (2); （2）； wherein is a varying feature; calculating the spectral mean characteristics according to formula (3); （3）； wherein is a spectral mean feature; obtaining the quantity characteristics by calculating the peak value of the time-decaying mean spectrum; calculating the frequency band energy characteristics according to formula (4); （4）； wherein, is a band energy feature; extracting the feature matrix and the comprehensive feature vector as shown in formula (5): （5）； wherein, denotes a number of times / duration characteristic data, denotes a number characteristic.

2. The method of claim 1, wherein: The original data comprises the length of time using various types of software, the length of time accessing various types of web pages, the number of times of using printers, the content of printed files, the operation logs of files, the content of emails, and the chat records of real-time communication software.

3. The method of claim 1, wherein: Using a pre-trained text feature extraction model Feature extraction is performed on the text, and formula (6) shows the extraction process: （6）； wherein, represents text feature data; represents a text embedding process, is raw data text content data.

4. The method of claim 1, wherein: The multivariate time features are obtained by extracting time-dependent features from the complete original features by using factorization time and channel mixing, comprising the following steps: The time-dependent feature extraction process is formula (7): ； ； （7）； wherein, denotes the equidistant down-sampling of the time series into interleaved subsequences, denotes the complete original feature, denotes the sampled-out subsequences, denotes the normalization operation; denotes the learning of the temporal information of each subsequence with a temporal feature extractor; denotes the feature merging of the resulting subsequences, denotes the temporal dependency feature; performing matrix decomposition on the time series data with channel redundancy to reduce the noise of the channel dimension according to formula (8); ； （8）； wherein denotes the noise, is the denoised channel dependency; and is a factorized channel interaction, wherein, ; denotes a time-dependent feature and a channel mixed feature of the original feature ; denotes a dimensional matrix, wherein the matrix elements are in the field of real numbers; obtaining the multivariate time features by factorization according to formula (9); （9）； wherein , represents the weight matrix between hidden layers; is an activation function; , represents the bias term to help the model fit the data better; represents the resulting channel dependency after denoising.

5. The method of claim 4, wherein: The time series prediction based on the Transformer according to the multivariate time features comprises the following steps: The self-attention is used to capture the time similarity at the time segment level, and a calculation formula is shown as formula (10): ; （10）； wherein time information between time segments is described; is the feature dimension, i.e. the length of each vector; is an intermediate representation computed by a self-attention mechanism; A feedforward neural network with two linear layers and an activation function is applied to learn channel-level features on the input image. generating a prediction result using an initialized query matrix, and the calculation formula is shown in formula (11): ； （11）； wherein, The relationship between the input history time series and the output prediction sequence is described; is the transpose of is the prediction result; To Applying the projection layer to obtain a final predicted target .

6. The method of claim 1, wherein: The risk score is obtained by performing difference analysis on the prediction target and the features in the actual situation, comprising the following steps: calculating the difference between the prediction target and the features in the actual situation to obtain a difference value; calculating the risk score, which is the absolute value of the product of the difference value and a risk coefficient, wherein when the difference value is positive, the value of the risk coefficient is a first set value; and when the difference value is negative, the value of the risk coefficient is a second set value.

7. A system for screening for anomalous behavior of personnel within an enterprise, characterized by: The system is applied to the method for predicting abnormal behavior of employees in an enterprise according to any one of claims 1-6, and comprises: an original data acquisition module configured to acquire original data associated with abnormal behavior of employees; An original feature extraction module is configured to perform feature extraction on the original data to obtain time / length feature data and text feature data, and concatenate the time / length feature data and the text feature data to obtain complete original features; A multi-element time feature extraction module is configured to perform time-dependent feature extraction on the complete original features using factorization time and channel mixing to obtain multi-element time features; A prediction module is configured to perform a Transformer-based time series prediction based on the multi-element time features to obtain a prediction target; A risk analysis module is configured to perform difference analysis on the prediction target and features in an actual situation to obtain a risk score; A screening module is configured to take out the top N largest risk scores as risk features with large prediction and actual deviation, and map them back to specific behaviors, and output the specific behaviors.

8. An electronic device, comprising: A computer program product is provided, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method of any one of claims 1-6 when executing the program.

9. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium, and the program is executed by the processor to implement the method of any one of claims 1-6.

Images