User abnormal behavior detection method and device, equipment and medium

Abstract

The invention discloses a user abnormal behavior detection method and device, equipment and a medium. The method comprises the following steps: acquiring first context information uploaded by a plurality of first data sources in a previous data acquisition period, and dividing the first context information according to users; according to the second context information of the target user, calculating a basic trust distribution value of each second data source; when the second context information is determined to be reliable information according to the basic trust distribution value of each second data source, fusing the second context information with the behavior data of the target user to obtain fusion information corresponding to the target user; and according to the fusion information and the current baseline of the target user, identifying the abnormal behavior of the target user in the previous data acquisition period. By adopting the technical scheme, the context data of different data sources can be associated and integrated, credible analysis can be performed on user behaviors, and newly generated security threats can be quickly responded.

Description

Technical Field

[0001] The present invention relates to the field of enterprise information security protection technology, and in particular to a user abnormal behavior detection method, device, equipment and medium. Background Art

[0002] With the development of digital technology, corporate offices are gradually transforming towards digitalization. A large amount of data interacts between cloud platforms and local systems. This has led to increasingly complex information security threats faced by enterprises. If internal personnel of the enterprise engage in malicious behavior, it may lead to data loss, theft of commercial secrets, etc., causing immeasurable losses to the enterprise.

[0003] Traditional user and entity behavior analysis technologies are mostly based on rule engines or single-dimensional data analysis, and usually respond to specific events. Although they can detect some significant abnormal behaviors, they cannot effectively identify complex, multi-level attack patterns. Summary of the invention

[0004] The present invention provides a method, device, equipment and medium for detecting abnormal user behavior, which can associate and integrate context data from different data sources, perform reliable analysis on user behavior, and quickly respond to new security threats.

[0005] According to one aspect of the present invention, a method for detecting abnormal user behavior is provided, comprising:

[0006] Acquire first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user;

[0007] Calculating basic trust allocation values ​​of each second data source respectively according to the second context information of the target user;

[0008] When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain fused information corresponding to the target user;

[0009] According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified.

[0010] According to another aspect of the present invention, there is provided a device for detecting abnormal user behavior, comprising:

[0011] A context information division module, used to obtain first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user;

[0012] A basic trust allocation value calculation module, used to calculate the basic trust allocation value of each second data source according to the second context information of the target user;

[0013] a fusion information acquisition module, configured to, when the second context information is determined to be reliable information according to the basic trust allocation values ​​of each second data source, fuse the second context information with the behavior data of the target user to obtain fusion information corresponding to the target user;

[0014] The abnormal behavior identification module is used to identify the abnormal behavior of the target user in the previous data collection cycle according to the fusion information and the current baseline of the target user.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the user abnormal behavior detection method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the user abnormal behavior detection method described in any embodiment of the present invention when executed.

[0020] The technical solution of the embodiment of the present invention obtains the first context information uploaded by multiple first data sources in the last data collection cycle, divides the first context information by user, and calculates the basic trust allocation value of each second data source according to the second context information of the target user. When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain the fused information corresponding to the target user. According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified. The user context information collected in the last data collection cycle can be analyzed, and the context information is fused with the user behavior when it is determined that the context information is reliable, and then the abnormal behavior of the user is detected based on the current baseline of the user. It can not only screen out occasional interference events, but also perform serial analysis on the abnormal behavior of the user, effectively predict, and thus improve the accuracy of the abnormal behavior analysis of the user.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a method for detecting abnormal user behavior provided according to Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of another method for detecting abnormal user behavior provided according to Embodiment 2 of the present invention;

[0025] Figure 3 is a structural schematic diagram of a user abnormal behavior detection device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing the user abnormal behavior detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 This is a flowchart of a method for detecting abnormal user behavior provided in the first embodiment of the present invention. This embodiment can be applied to the situation where abnormal behavior of enterprise employees is identified in combination with context information. The method can be executed by a user abnormal behavior detection device, which can be implemented in the form of hardware and / or software and can generally be configured in a computer or processor with data processing capabilities. Figure 1 As shown, the method includes:

[0031] S110: Acquire first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user.

[0032] Optionally, in the present invention, the behavior of each employee in the enterprise can be monitored and analyzed. Generally, the information at a single time node is difficult to reflect the complete behavior of the employee. Therefore, in the present invention, a smaller time period can be divided into a data collection cycle, such as 2 minutes, 5 minutes, 10 minutes, etc. The data source can send the context information occurring in the data source during each data collection cycle to a computer or processor used to detect abnormal user behavior, so as to be used in the abnormal user behavior detection method of the present invention.

[0033] Optionally, the first data source may refer to various channels or systems that are connected to the enterprise intranet and can provide data related to employee behavior. It should be noted that the data collection behavior of the first data source is a trusted behavior authorized by employees within the enterprise.

[0034] Optionally, the first data source may be an office software system accessed through the enterprise intranet, a network device data source, and a hardware device data source, etc. The office software system may refer to an office automation system, an email system, an enterprise communication tool, etc. The network device data source may refer to the enterprise's VPN equipment, network equipment, etc. The hardware device data source may refer to attendance equipment, etc.

[0035] It is understandable that perceiving various contextual information related to employee behavior and using this information to understand, analyze, and predict employee behavior is not just about simply recording employee behavior events, but about being able to make a comprehensive judgment on the behavior based on many factors such as the time and place of the behavior, the business processes involved, and the people involved.

[0036] Optionally, contextual information may include various details of employee behavior and related environmental factors. Contextual information may include but is not limited to the following categories: user information, such as user role, function, access rights, work habits, etc.; time information, such as the time, frequency, and periodicity of the behavior; geographic information, such as user login location, device type, network environment, etc.; business process information, such as business processes within the organization, task allocation, team collaboration patterns, etc.

[0037] Optionally, the first context information may refer to context information provided by each first data source. In a data collection cycle, if no data is generated in a first data source, it may not be sent. The first context information is generally sent in the form of a log.

[0038] Optionally, after acquiring the first context information, the first context information may be preprocessed, such as word segmentation, stop word removal, part-of-speech tagging, and other preprocessing operations, and the preprocessed first context information may be divided according to users.

[0039] Optionally, the user can refer to a certain enterprise employee, or a certain group or group within the enterprise.

[0040] Optionally, dividing the first context information according to user behavior may include: dividing the first context information according to user entities.

[0041] Optionally, a user entity may refer to a specific object related to a user that can be identified and monitored, and may summarize various matters that can represent the existence and activities of employees in an enterprise environment, such as an employee's name, work number, position, etc. This information is used to uniquely identify an individual employee. Another example is an employee's office computer, laptop, mobile device (such as a mobile phone, tablet computer), etc. Their hardware information (such as device model, MAC address) and software information (such as operating system version, installed applications) can all be used as attributes of the entity. Another example is an employee's account information in various enterprise systems, including user name, password, permission level, etc. These accounts are the entry points for employees to operate in the system.

[0042] S120: Calculate basic trust allocation values ​​of each second data source according to the second context information of the target user.

[0043] Optionally, the target user may refer to any employee or group involved in the first context information.

[0044] Optionally, the second context information may refer to context information associated with the target user that has been determined after the first context information is divided by user.

[0045] Optionally, the second data source may refer to a data source that provides second context information. For example, after 10 first data sources provide first context information, after division, it is determined that 3 of the data sources provide context information related to the target user, then these 3 data sources are the second data sources.

[0046] Optionally, after determining the second data source, the initial basic trust allocation value of each second data source can be obtained. The method for obtaining the initial basic trust allocation value may include: parsing each second context information, and determining the effective information ratio of each second data source according to the parsing result; and determining the initial basic trust allocation value of each second data source according to the effective information ratio of each second data source.

[0047] It is understandable that each time the basic trust allocation value is calculated in the present application, it is necessary to ensure that the following conditions are met: the sum of the basic trust values ​​is 1, and each basic trust value is a non-negative value.

[0048] Furthermore, the basic trust allocation value of each second context information in each second data source may be calculated respectively according to the initial basic trust allocation value of each second data source.

[0049] Optionally, for each second data source, user behaviors in the previous data collection cycle can be classified to determine the second context information belonging to each user behavior, and the basic trust allocation value of the second data source can be calculated based on the second context information of each user behavior and the basic trust allocation value of the second context information.

[0050] S130: When the second context information is determined to be reliable information according to the basic trust allocation values ​​of each second data source, the second context information is fused with the behavior data of the target user to obtain fused information corresponding to the target user.

[0051] It is understandable that in order to ensure that the collected user behaviors are reasonable behaviors and there are no occasional interference behaviors, it is necessary to determine whether there are conflicts between the second data sources based on the basic trust allocation values ​​of each second data source. If so, it is impossible to perform the next data fusion operation. At this time, all second context information related to the target user collected in the previous data collection cycle is regarded as invalid information and data fusion is not performed; if there is no conflict, the second context information is merged with the behavior data of the target user.

[0052] Optionally, the behavior data of the target user may refer to the behavior data of the user entity, including the historical behavior of the user entity. By fusing the behavior data with the second context information of the previous data collection cycle, the user's behavior trend can be judged based on the target user's historical behavior, and the user's behavior pattern can be analyzed to identify potential security risks.

[0053] S140: Identify abnormal behaviors of the target user in the previous data collection cycle based on the fused information and the current baseline of the target user.

[0054] Optionally, the current baseline of the target user can represent the current behavioral benchmark of the target user. It can be determined by statistics and analysis of the behavioral data of the target user in a normal period in the past, and can reflect the user's usual behavioral performance level, regularity, etc. For example, the range of the number of logins per day, the frequency of operating a certain type of function, etc. under normal circumstances, and this can be used as a basis for measuring whether the behavior is abnormal in the future.

[0055] Optionally, the user's baseline can be updated regularly. After each baseline update, the mean and standard deviation of the behavior data in the baseline are obtained, and the anomaly detection threshold for the user to use the current baseline for anomaly detection is calculated based on the pre-set sensitivity parameter, mean and standard deviation. The anomaly detection threshold can be expressed by T = μ + kσ, where T is the anomaly detection threshold, μ is the mean of the behavior data, σ is the standard deviation of the behavior data, and k is an adjustable sensitivity parameter.

[0056] Optionally, based on the fused information, the current behavior parameters of the target user can be calculated, and the historical baseline behavior parameters can be determined based on the current baseline. Based on the current behavior parameters, the historical baseline behavior parameters and the anomaly detection threshold, it can be determined whether the user has abnormal behavior.

[0057] In a specific implementation, the behavior deviation of the target user can be calculated according to the formula D=|BN|, where B is the historical baseline behavior parameter, N is the current baseline behavior parameter, and D is the behavior deviation; determine whether the behavior deviation D of the target user is greater than the anomaly detection threshold T. If so, it is determined that the current user has abnormal behavior; if not, it is determined that the current user has no abnormal behavior.

[0058] The technical solution of the embodiment of the present invention obtains the first context information uploaded by multiple first data sources in the last data collection cycle, divides the first context information by user, and calculates the basic trust allocation value of each second data source according to the second context information of the target user. When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain the fused information corresponding to the target user. According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified. The user context information collected in the last data collection cycle can be analyzed, and the context information is fused with the user behavior when it is determined that the context information is reliable, and then the abnormal behavior of the user is detected based on the current baseline of the user. It can not only screen out occasional interference events, but also perform serial analysis on the abnormal behavior of the user, effectively predict, and thus improve the accuracy of the abnormal behavior analysis of the user.

[0059] Embodiment 2

[0060] Figure 2 This is a flowchart of a method for detecting abnormal user behavior provided by Embodiment 2 of the present invention. Based on the above embodiments, this embodiment specifically describes a method for calculating a basic trust allocation value of a second data source and a method for detecting abnormal behavior. Figure 2 As shown, the method includes:

[0061] S210: Obtain first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user.

[0062] S220: Classify the target second context information belonging to the target second data source according to user behaviors, and obtain context information sets corresponding to each user behavior.

[0063] Optionally, the target second data source is any second data source, and the target second context information may refer to the second context information corresponding to the target user provided by the target second data source. In different second data sources, users may have different behaviors. When the second context information is a log, these logs may be divided according to different user behaviors.

[0064] In an optional example, when the target second data source is enterprise WeChat, the user behavior of the target user in the previous data collection cycle may be logging in and sending information. At this time, logging in can be regarded as the first user behavior, and sending information can be regarded as the second user behavior, and then the target second context information is divided into the first context information set corresponding to the first user behavior, and the second context information set corresponding to the second user behavior.

[0065] S230: Obtain a basic trust allocation value for each piece of target second context information, and determine a basic trust allocation value set for each user behavior based on each context information set.

[0066] Optionally, obtaining the basic trust allocation value of each target second context information may include: obtaining the threat classification of the target second data source, and parsing each target second context information to obtain the trust value of the target second context information for each threat classification; calculating the basic trust allocation value of the target second context information according to the initial basic trust allocation value of the target second data source, the number of threat classifications, and the trust value of the target second context information for each threat classification.

[0067] In an optional implementation, the threat classification may include normal, potential threat, and high-risk threat. By analyzing the fields in the target second context, the trust value of the target second context for each threat classification may be determined.

[0068] Optionally, after determining the second context information set corresponding to each user behavior and the basic trust allocation value of each second context, the basic trust allocation value set corresponding to each user behavior can be determined.

[0069] S240: Calculate a basic trust allocation value of the target second data source according to a basic trust allocation value set of each user behavior of the target second data source.

[0070] Calculating the basic trust allocation value of the target second data source according to the basic trust allocation value set of each user behavior of the target second data source may include:

[0071] Calculate the conflict degree between each user behavior in the target second data source according to the basic trust allocation value set of each user behavior in the target second data source;

[0072] The basic trust allocation value of the target second data source is calculated according to the conflict degree between each user behavior and the basic trust allocation value set of each user behavior.

[0073] In an optional embodiment, the formula Calculate the conflict degree K between each user behavior. Wherein, m1(B) and m2(C) are the basic trust allocation value set corresponding to the first user behavior and the basic trust allocation value set corresponding to the second user behavior, respectively. Of course, only two different user behaviors are used as an example here, and multiple user behaviors can also be used, and similar calculations can be performed according to this formula.

[0074] In another optional embodiment, the formula Calculate the basic trust allocation value m(A) of the target second data source.

[0075] S250 , respectively calculating the trust or distrust of each user behavior of the target second data source according to each context set and the basic trust allocation value of each target second context information.

[0076] Optionally, the target second context information provided in the target second data source can be divided into second context information in multiple time periods according to time, and the trust or distrust of the user behavior in each time period can be calculated based on the second context information in each time period. The time period can be divided according to the start of the user's behavior. For example, in 0-1 minutes, the user performs the first user behavior, and in 1-4 minutes, the user performs the second user behavior. At this time, the trust or distrust of the first user behavior in 0-1 minutes can be calculated separately, and then the trust or distrust of the second user behavior in 1-4 minutes can be calculated.

[0077] Optionally, when the amount of second context information belonging to the target user behavior exceeds a first amount threshold, the trustworthiness of the target user behavior is calculated; otherwise, the distrustworthiness of the target user behavior is calculated.

[0078] Optionally, you can use the formula Calculate the trust level Bel(A) of user behavior B, or use the formula Calculate the distrust degree Pl(A) of user behavior B. Wherein, m(B) is a basic trust allocation value set of each second context information belonging to user behavior B.

[0079] S260: When it is determined that the basic trust allocation values ​​of each second data source are greater than a preset target threshold, the second context information is determined to be reliable information.

[0080] Alternatively, the target threshold may be determined according to a pre-specified normal distribution.

[0081] S270. Determine the support level of each user behavior in the fusion process according to the conflict level between each user behavior in the target second data source and the trust or distrust level of each user behavior, and fuse the second context information with the behavior data of the target user according to the support level of each user behavior and the context set corresponding to each user behavior.

[0082] S280: Calculate the behavior deviation of the target user in the last data collection cycle based on the current baseline of the target user and the fusion information.

[0083] S290: Obtain an abnormality detection threshold corresponding to the current baseline of the target user, and identify abnormal behavior of the target user in the previous data collection cycle according to the behavior deviation and the abnormality detection threshold.

[0084] Optionally, the method may further include:

[0085] Whenever the update time point of the baseline is reached, the baseline of the target user is updated according to the fusion information of the target user in the target time period.

[0086] Optionally, in addition to real-time abnormal user behavior detection, the fused information can also be stored. When the next baseline update time arrives, the baseline of the target user is updated using the fused information stored between two baseline update times.

[0087] The technical solution of the embodiment of the present invention obtains the first context information uploaded by multiple first data sources in the last data collection cycle, divides the first context information by user, and calculates the basic trust allocation value of each second data source according to the second context information of the target user. When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain the fused information corresponding to the target user. According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified. The user context information collected in the last data collection cycle can be analyzed, and the context information is fused with the user behavior when it is determined that the context information is reliable, and then the abnormal behavior of the user is detected based on the current baseline of the user. It can not only screen out occasional interference events, but also perform serial analysis on the abnormal behavior of the user, effectively predict, and thus improve the accuracy of the abnormal behavior analysis of the user.

[0088] Embodiment 3

[0089] Figure 3This is a schematic diagram of the structure of a user abnormal behavior detection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a context information division module 310, a basic trust allocation value calculation module 320, a fusion information acquisition module 330 and an abnormal behavior identification module 340.

[0090] The context information classification module 310 is used to obtain first context information uploaded by multiple first data sources in a previous data collection cycle, and classify the first context information by user.

[0091] The basic trust allocation value calculation module 320 is used to calculate the basic trust allocation value of each second data source according to the second context information of the target user.

[0092] The fusion information acquisition module 330 is used to fuse the second context information with the behavior data of the target user to obtain fusion information corresponding to the target user when the second context information is determined to be reliable information according to the basic trust allocation value of each second data source.

[0093] The abnormal behavior identification module 340 is used to identify the abnormal behavior of the target user in the previous data collection cycle according to the fusion information and the current baseline of the target user.

[0094] The technical solution of the embodiment of the present invention obtains the first context information uploaded by multiple first data sources in the last data collection cycle, divides the first context information by user, and calculates the basic trust allocation value of each second data source according to the second context information of the target user. When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain the fused information corresponding to the target user. According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified. The user context information collected in the last data collection cycle can be analyzed, and the context information is fused with the user behavior when it is determined that the context information is reliable, and then the abnormal behavior of the user is detected based on the current baseline of the user. It can not only screen out occasional interference events, but also perform serial analysis on the abnormal behavior of the user, effectively predict, and thus improve the accuracy of the abnormal behavior analysis of the user.

[0095] Based on the above embodiments, the basic trust allocation value calculation module 320 may include:

[0096] a context information set classification unit, configured to classify target second context information belonging to a target second data source according to user behaviors, and obtain context information sets corresponding to respective user behaviors;

[0097] A basic trust allocation value set division unit, used to obtain a basic trust allocation value of each target second context information, and determine a basic trust allocation value set of each user behavior according to each context information set;

[0098] The data source basic trust allocation value calculation unit is used to calculate the basic trust allocation value of the target second data source according to the basic trust allocation value set of each user behavior of the target second data source.

[0099] Based on the above embodiments, the data source basic trust allocation value calculation unit can be specifically used to:

[0100] Calculate the conflict degree between each user behavior in the target second data source according to the basic trust allocation value set of each user behavior in the target second data source;

[0101] The basic trust allocation value of the target second data source is calculated according to the conflict degree between each user behavior and the basic trust allocation value set of each user behavior.

[0102] Based on the above embodiments, the fusion information acquisition module 330 can be specifically used for:

[0103] When it is determined that the basic trust allocation values ​​of each second data source are greater than a preset target threshold, the second context information is determined to be reliable information.

[0104] On the basis of the above embodiments, a trust calculation module may be further included, which is used to:

[0105] Calculate the trust or distrust of each user behavior of the target second data source according to each context set and the basic trust allocation value of each target second context information;

[0106] The fusion information acquisition module 330 may also be specifically used for:

[0107] According to the conflict degree between each user behavior in the target second data source and the trust or distrust of each user behavior, the support degree of each user behavior in the fusion process is determined, and according to the support degree of each user behavior and the context set corresponding to each user behavior, the second context information is fused with the behavior data of the target user.

[0108] Based on the above embodiments, the abnormal behavior identification module 340 can be specifically used for:

[0109] Calculate the target user's behavior deviation in the previous data collection cycle based on the target user's current baseline and fusion information;

[0110] An abnormality detection threshold corresponding to the current baseline of the target user is obtained, and the abnormal behavior of the target user in the previous data collection cycle is identified according to the behavior deviation and the abnormality detection threshold.

[0111] Based on the above embodiments, a baseline updating module may be further included, which is used to:

[0112] Whenever the update time point of the baseline is reached, the baseline of the target user is updated according to the fusion information of the target user in the target time period.

[0113] The user abnormal behavior detection device provided in the embodiment of the present invention can execute the user abnormal behavior detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0114] Embodiment 4

[0115] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0116] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0117] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0118] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the user abnormal behavior detection method described in an embodiment of the present invention. That is:

[0119] Acquire first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user;

[0120] Calculating basic trust allocation values ​​of each second data source respectively according to the second context information of the target user;

[0121] When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain fused information corresponding to the target user;

[0122] According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified.

[0123] In some embodiments, the abnormal user behavior detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the abnormal user behavior detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the abnormal user behavior detection method in any other appropriate manner (e.g., by means of firmware).

[0124] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0125] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0126] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0127] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0128] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0129] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0130] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0131] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal user behavior, characterized in that: include: Acquire first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user; Calculating basic trust allocation values ​​of each second data source respectively according to the second context information of the target user; When the second context information is determined to be reliable information according to the basic trust allocation value of each second data source, the second context information is fused with the behavior data of the target user to obtain fused information corresponding to the target user; According to the fused information and the current baseline of the target user, the abnormal behavior of the target user in the last data collection cycle is identified.

2. The method according to claim 1, characterized in that According to the second context information of the target user, basic trust allocation values ​​of each second data source are calculated respectively, including: Classifying the target second context information belonging to the target second data source according to user behaviors, and obtaining context information sets corresponding to each user behavior; Obtaining a basic trust allocation value for each target second context information, and determining a basic trust allocation value set for each user behavior based on each context information set; The basic trust allocation value of the target second data source is calculated according to the basic trust allocation value set of each user behavior of the target second data source.

3. The method according to claim 2, characterized in that Calculating a basic trust allocation value of the target second data source according to a basic trust allocation value set of each user behavior of the target second data source includes: Calculate the conflict degree between each user behavior in the target second data source according to the basic trust allocation value set of each user behavior in the target second data source; The basic trust allocation value of the target second data source is calculated according to the conflict degree between each user behavior and the basic trust allocation value set of each user behavior.

4. The method according to claim 3, characterized in that Determining that the second context information is reliable information according to the basic trust allocation value of each second data source includes: When it is determined that the basic trust allocation values ​​of each second data source are greater than a preset target threshold, the second context information is determined to be reliable information.

5. The method according to claim 4, characterized in that After obtaining the basic trust allocation value of each target second context information, the method further includes: Calculate the trust or distrust of each user behavior of the target second data source according to each context set and the basic trust allocation value of each target second context information; The second context information is integrated with the behavior data of the target user, including: According to the conflict degree between each user behavior in the target second data source and the trust or distrust of each user behavior, the support degree of each user behavior in the fusion process is determined, and according to the support degree of each user behavior and the context set corresponding to each user behavior, the second context information is fused with the behavior data of the target user.

6. The method according to claim 1, characterized in that Based on the fused information and the current baseline of the target user, the abnormal behavior of the target user in the previous data collection cycle is identified, including: Calculate the target user's behavior deviation in the previous data collection cycle based on the target user's current baseline and fusion information; An abnormality detection threshold corresponding to the current baseline of the target user is obtained, and the abnormal behavior of the target user in the previous data collection cycle is identified according to the behavior deviation and the abnormality detection threshold.

7. The method according to claim 6, characterized in that Also includes: Whenever the update time point of the baseline is reached, the baseline of the target user is updated according to the fusion information of the target user in the target time period.

8. A user abnormal behavior detection device, characterized in that: include: A context information division module, used to obtain first context information uploaded by multiple first data sources in a previous data collection cycle, and divide the first context information by user; A basic trust allocation value calculation module, used to calculate the basic trust allocation value of each second data source according to the second context information of the target user; a fusion information acquisition module, configured to, when the second context information is determined to be reliable information according to the basic trust allocation values ​​of each second data source, fuse the second context information with the behavior data of the target user to obtain fusion information corresponding to the target user; The abnormal behavior identification module is used to identify the abnormal behavior of the target user in the previous data collection cycle according to the fusion information and the current baseline of the target user.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the user abnormal behavior detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the user abnormal behavior detection method according to any one of claims 1 to 7 when executed.

Images