User internet behavior identification method based on flow data analysis

Abstract

The invention relates to the field of user behavior analysis, and discloses a user internet behavior identification method based on flow data analysis, which comprises the following steps of: data acquisition and preprocessing: acquiring internet flow data of a user through multiple sensors and network equipment, the data comprising an accessed website, a data packet size and sending time; extracting flow data characteristics: extracting internet behavior characteristics of the user from the collected flow data, wherein the internet behavior characteristics comprise an access type, an access frequency and data packet size distribution; and data fusion and denoising: fusing the multi-source data by using a Kalman filtering algorithm. By applying multi-sensor data fusion, Kalman filtering, a Markov decision process, reinforcement learning, Bayesian reasoning, a machine learning algorithm and the like, data islands are effectively avoided, data accuracy and precision are improved, user behaviors are identified, analyzed and classified, real-time dynamic adjustment is achieved, and system adaptability and flexibility are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of user behavior analysis, and in particular to a method for identifying user online behavior based on flow data analysis. Background Art

[0002] With the popularization of the Internet and smart devices, users' online behaviors are becoming increasingly diversified and complex. Users' activities on the Internet include browsing web pages, watching videos, online shopping, social interaction, etc. Different behaviors have different demands and usage methods for network resources. Therefore, how to accurately and real-time identify and predict users' online behaviors and optimize network resource allocation based on behavioral patterns has become a key issue in improving network service quality and user experience.

[0003] Usually, behavior recognition relies on a single data source and lacks effective fusion of multi-source data, which makes it impossible to fully capture the complex behavior patterns of users. In addition, when processing multi-source data, existing methods find it difficult to effectively remove noise and redundant information, which affects data accuracy and the accuracy of subsequent behavior analysis. At the same time, behavior pattern recognition methods based on rules or shallow machine learning cannot handle complex user behaviors, resulting in low accuracy. Existing systems also lack the ability to effectively analyze and dynamically adjust the temporal changes in user behavior, and cannot adapt to fluctuations in user behavior in different time periods. Finally, existing technologies lack an effective feedback mechanism, cannot optimize response strategies based on real-time feedback from users, and cannot flexibly respond to changing needs. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a method for identifying user online behavior based on traffic data analysis, which solves the problems of single data source, poor data processing, low pattern recognition accuracy, and lack of timing analysis, dynamic adjustment and feedback mechanism in the behavior identification method.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for identifying user online behavior based on traffic data analysis includes the following steps: Data collection and preprocessing: Use multiple sensors and network devices to obtain users' Internet traffic data, including visited websites, data packet size, and sending time; Traffic data feature extraction: Extracting user online behavior features from collected traffic data, including access type, access frequency, and data packet size distribution; Data fusion and denoising: Use the Kalman filter algorithm to fuse data from multiple sources, and optimize the results through Bayesian reasoning to remove redundant information and noise; Behavior pattern recognition and classification: Based on the extracted features, machine learning algorithms are used to classify and identify users’ online behaviors, including social media use, video viewing, and online shopping. Time series behavior analysis and optimization: Model the user's behavior in time series, optimize the recognition strategy based on the Markov decision process or reinforcement learning algorithm, and dynamically adjust the system response according to the user's behavior; Decision response and feedback optimization: Generate real-time feedback responses based on recognition results, and continuously optimize recognition accuracy through online learning mechanisms; Behavior identification report generation: Based on the identified user behavior, a user behavior report is generated and provided to network managers or intelligent systems for further analysis and decision-making.

[0006] Preferably, the data collection and preprocessing step further includes aligning the timestamps of the flow data from multiple sensors and performing time-series synchronization on the data using a mutual information maximization method to ensure time consistency between the data.

[0007] Preferably, the data fusion and denoising step includes using an extended Kalman filter to process state estimation of a nonlinear dynamic system, and using an unscented Kalman filter to optimize the behavior recognition accuracy of the system.

[0008] Preferably, the behavior pattern recognition and classification step classifies the user's online behavior through a support vector machine or a deep neural network, wherein the classification results include social media use, online video viewing, and online shopping categories.

[0009] Preferably, the sequential behavior analysis and optimization step uses a reinforcement learning algorithm to optimize the behavior recognition strategy by interacting with the environment, and adjusts the recognition accuracy in real time.

[0010] Preferably, the sequential behavior analysis and optimization step uses a Markov decision process to dynamically model the user's behavior, predicting future behavior patterns based on current user behavior, thereby optimizing the system response strategy.

[0011] Preferably, the decision response and feedback optimization step includes real-time detection and response to abnormal behavior, and when abnormal user behavior is detected, an alarm is generated or abnormal access is automatically blocked.

[0012] Preferably, the timing behavior analysis and optimization step further comprises the following steps: The user's behavior state space is constructed through the time series of user behavior data. Each state in the state space represents the user's online behavior characteristics at a certain point in time. Based on the state space of user behavior, the Markov decision process is used to model user behavior and define the user behavior transition probability matrix, where each element in the matrix represents the probability of transitioning from one behavior state to another. The user behavior prediction model is optimized through reinforcement learning algorithm, which includes the following steps: Define the reward function for behavior prediction. The reward function is adjusted according to the difference between recognition accuracy and real-time response. The formula is expressed as: ;in, is the reward value at the current moment, is the discount factor, For the current state Next select action The estimated value of is the adjustment factor of the reward, Identify errors for behavior; The Q-value function is continuously updated through the Q-learning algorithm to optimize the behavior recognition strategy, so that the system can adapt to changing user behaviors; Based on the optimized behavior recognition strategy, the system generates and executes the optimal response decision, adjusts the accuracy of behavior prediction and system response speed to improve the overall system performance.

[0013] Preferably, the behavior identification report generating step further includes generating a report containing detailed information on the types of websites visited by users, the frequency of visits, and the size distribution of data packets, and providing it to management personnel through data visualization technology for further behavior analysis and decision support.

[0014] A user online behavior identification system based on traffic data analysis, the system comprising: A data collection module is used to obtain the user's Internet traffic data from multiple sensors; Feature extraction module, used to extract the user's online behavior characteristics, including access type, access frequency, and data packet size; Data fusion module, used to fuse multi-source data and remove noise through Kalman filtering and Bayesian reasoning method; Behavior recognition module, which is used to classify and identify online behaviors using machine learning algorithms; A time series analysis module for optimizing identification strategies via Markov decision processes or reinforcement learning; A response module, used for generating a feedback response according to the recognition result; The report generation module is used to generate user behavior identification reports and provide them to managers for further analysis.

[0015] The present invention provides a method for identifying user online behavior based on traffic data analysis. It has the following beneficial effects: 1. The present invention adopts a technical solution based on multi-sensor data fusion and Kalman filtering to achieve accurate user behavior recognition. Compared with the behavior recognition method in the prior art that only relies on a single data source or simple rules, the present invention effectively avoids the data island problem through comprehensive analysis of multiple data sources, improves recognition accuracy and robustness, and can more comprehensively reflect the user's real behavior pattern.

[0016] 2. The present invention achieves the technical effect of real-time response and dynamic adjustment by introducing Markov decision process (MDP) and reinforcement learning (RL) algorithm to analyze and optimize time series behavior. Compared with the traditional static rule-setting system, the present invention can optimize and adjust according to the real-time changes of user behavior, so that the system can respond to network needs in different time periods more intelligently, thereby improving the adaptability and flexibility of the system.

[0017] 3. The present invention adopts a combination of Kalman filtering and Bayesian reasoning technology to fuse and remove noise from multi-source data, thereby achieving the optimization effect of data accuracy and precision. Compared with the technical solutions that use a single filtering algorithm or lack data fusion in the prior art, the present invention can more efficiently remove redundant information, reduce the impact of noise, ensure the accurate fusion of multi-sensor data, and improve the reliability of subsequent behavior analysis.

[0018] 4. The present invention uses machine learning algorithms, such as support vector machines (SVMs) and decision trees, to perform multi-dimensional pattern recognition on user behaviors, thereby achieving the technical effect of accurate classification and in-depth analysis of user online behaviors. Compared with traditional behavior recognition methods based on simple rules or shallow analysis, the present invention uses a high-precision machine learning model to distinguish more diverse behavior patterns, achieve more detailed behavior classification, and support personalized service optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 Schematic diagram of the system architecture of the present invention. DETAILED DESCRIPTION

[0020] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Please see attached Figure 1 The embodiment of the present invention provides a method for identifying user online behavior based on traffic data analysis, comprising the following steps: S1. Data collection and preprocessing: Obtain users’ Internet traffic data through multiple sensors and network devices. The data includes visited websites, data packet size, and sending time. First of all, data collection and preprocessing are the first steps in the present invention, which aims to provide high-quality data support for subsequent feature extraction and behavior recognition. The core goal of this step is to obtain users' Internet traffic data through multiple sensors and network devices, and clean, integrate and format these data to ensure the timeliness and effectiveness of the data. Specifically, the collected data not only includes information on various websites visited by users, but also covers details of network communications such as data packet size, sending time, and protocol type.

[0022] During the data collection process, multiple sensors and network devices can be deployed to capture users' network behaviors. By fusing data from multiple sources, users' behavior in the network environment can be fully captured. For example, routers, DNS servers, proxy servers, and deep packet inspection systems (DPI) can record users' online behavior data from different angles. The collected data is of various types, so preprocessing steps must be performed to ensure that the data can be used for subsequent analysis.

[0023] In this embodiment, the first step of data collection is to obtain the user's traffic data through multiple devices in the network. Specifically, network devices such as routers can obtain data packets flowing through them, including basic information such as IP addresses, port numbers, data packet sizes, and protocol types. DNS servers are used to record domain name information accessed by users and provide detailed information on the user's Internet destination. Proxy servers can also obtain application layer information such as HTTP requests to further understand the user's access intentions. In addition, the deep packet inspection system (DPI) can parse the content of data packets and identify specific web pages, video streams, file downloads, and other activities visited by users.

[0024] During the data collection process, the following types of data are usually collected: Website visit information: including the domain name visited by the user, the pages visited, and related URL requests; Packet size: The size of a packet directly reflects the amount of data a user transfers and is often used to determine the type of activity a user is doing (e.g., video streaming or file downloading). Sending time: The sending timestamp of each data packet, which provides support for timing analysis; Protocol type: including HTTP, HTTPS, FTP and other protocol types, which helps to further identify user behavior patterns.

[0025] As an option, data collection can be adjusted according to different collection frequencies. For example, if you need to analyze the long-term behavior of users, you can set a lower collection frequency to save storage space; if you need to perform real-time analysis of specific events, you can increase the collection frequency to improve the timeliness of the data.

[0026] Specifically, the collected raw data undergoes the following preprocessing steps: denoising, traffic reassembly, time synchronization, and protocol parsing. These steps can ensure the integrity and consistency of the data and provide an accurate basis for subsequent feature extraction and behavior analysis.

[0027] In one possible implementation, the first task of data preprocessing is denoising. Since there are often invalid or erroneous data packets in the network environment (such as packet loss, duplicate packets, abnormal requests, etc.), these invalid data will interfere with subsequent analysis. Therefore, data denoising is a key link in ensuring data quality.

[0028] Traffic reassembly is another important task in data preprocessing, especially when data packets in the network are often split into multiple small pieces. Traffic reassembly technology reassembles multiple fragmented data packets into a complete data stream to ensure data integrity.

[0029] Time synchronization means that when multiple data sources (such as different sensors) provide data, the timestamps of these data must be aligned. Since each device and sensor in the network may have different time bases, the data may be deviated in time. Therefore, time synchronization technology can ensure the consistency of data timing by correcting the timestamp of the data.

[0030] Protocol parsing is to conduct in-depth analysis of network protocols and extract important information from them. Different types of network protocols (such as HTTP, FTP, DNS, SMTP, etc.) have different data structures and behavior patterns, so parsing the data at the protocol layer helps to better understand the user's network behavior. For example, the HTTP request contains the URL information of the web page that the user visits, while the FTP protocol reflects the user's file transfer behavior.

[0031] In this step, all preprocessing operations must be completed efficiently and accurately to ensure that subsequent behavioral analysis can be performed with high accuracy. It should be noted that data preprocessing is not just a simple cleaning of raw data, but also involves how to optimize data quality through algorithms and improve the accuracy of analysis.

[0032] In addition, in some embodiments, the data collection and preprocessing process can be automatically optimized by introducing intelligent algorithms. For example, a deep learning-based algorithm can be used to automatically identify and remove invalid data, or a machine learning algorithm can be used to predict and repair lost packets and timing errors, thereby further improving the automation and intelligence level of data processing.

[0033] Through the above steps, the user's online behavior data can be effectively collected and processed, and provide high-quality data support for subsequent behavior analysis. The quality of data collection and preprocessing directly affects the accuracy of subsequent feature extraction, pattern recognition and behavior analysis, so the accuracy and efficiency of this process are crucial.

[0034] S2, flow data feature extraction: extracting the user's online behavior characteristics from the collected flow data, including access type, access frequency, and data packet size distribution; The core goal of this step is to extract the user's online behavior characteristics from the collected network traffic data. This process is not just a simple analysis of the original traffic data, but through a series of technical means, it extracts multi-dimensional features that can reflect user behavior from the data as the basis for subsequent behavior identification and classification. The extracted features can include access type, access frequency, data packet size distribution, etc. These features can help the system accurately identify user behavior and conduct effective behavior analysis and prediction.

[0035] In this embodiment, the collected data is first preprocessed to remove irrelevant noise and redundant information. Then, the key features of the user's online behavior are extracted through multi-dimensional statistical analysis and machine learning algorithms. Feature extraction is not only to obtain the user's behavior pattern, but also to provide strong data support for subsequent behavior classification, optimization decision-making and other links.

[0036] In this embodiment, traffic data feature extraction mainly involves the following dimensions, and corresponding parameters and models need to be defined for easy implementation.

[0037] Access type characteristics refer to identifying the user's online behavior category by analyzing the data packets, protocols, domain names, etc. that the user accesses. Common access types include social media, video viewing, file downloads, online shopping, etc. This process is achieved by parsing protocol layer data.

[0038] Access type analysis formula: Assume that the characteristics of each access request in the network traffic data can be expressed as a vector: ;in, Represents the size of the data packet. Represents the type of URL requested. Other elements may include protocol type, requested file type, etc. By performing statistical analysis on these features, the user's behavior category can be identified. For example, when When the URL contains "youtube.com", it can be determined that the access behavior belongs to the video viewing category.

[0039] Parameter definition: : Packet size (unit: bytes); :URL domain name type (such as "youtube.com", "facebook.com"); : Protocol type (such as HTTP, HTTPS); The access frequency feature refers to the number of times a user visits a certain type of website or performs a certain activity within a specific period of time. By analyzing the access frequency, we can further infer the user's behavior pattern. For example, high frequency of visiting social networking sites may reflect the behavior of social media use.

[0040] Visit frequency analysis formula: Assume that the frequency of a user visiting a website within a period of time is , and its calculation formula is: .

[0041] By calculating the access frequency within a specific time period, we can identify the user's behavior pattern and provide reference data for behavior prediction. times / hour, it can be determined that the user has high network activity during this period.

[0042] Parameter definition: :Users in time period Frequency of visits within Length of time period: (Unit: hours); Packet size distribution characteristics are used to distinguish different types of network traffic. Different types of traffic (such as web browsing, video watching, file downloading, etc.) will present different packet size distributions. For example, video streaming usually contains larger packets, while web browsing is usually accompanied by smaller and more frequent packets.

[0043] Packet size distribution analysis formula: Assume that the size of the packet is , the probability distribution of packet size can be expressed by the following formula: ;in, represents the mean value of the packet size, By analyzing the packet size statistics, we can infer the type of network traffic. For example, video streams usually have larger Value and larger .

[0044] Parameter definition: :No. The size of the data packet (in bytes); : Mean value of packet size; : Standard deviation of packet size; Traffic time pattern feature extraction: Time pattern features reflect the user's behavior activities in different time periods. For example, users may frequently visit work-related websites during the day, and more frequently visit social media or video websites at night. By analyzing time series data, the time pattern of user behavior can be extracted to provide a basis for subsequent time series analysis and optimization decisions.

[0045] Time pattern analysis formula: Assume that the time series data is ,in Indicates the timestamp of each access behavior. By clustering or periodic analysis of this data, it is possible to identify the user's active period. By clustering the time points in the graph, we can identify the peak hours of users: .

[0046] Parameter definition: :No. The timestamp of each access behavior (unit: seconds); Clustering results: (represents activity patterns over a specific time period); In some embodiments, deep learning methods (such as convolutional neural networks (CNNs), long short-term memory networks (LSTMs), etc.) can be further introduced to automate the feature extraction process and improve recognition accuracy. Specifically, convolutional neural networks can automatically extract high-dimensional features from raw traffic data, while LSTMs can effectively capture the temporal dependencies of data and help identify complex user behavior patterns.

[0047] CNN feature extraction example: In this case, each feature of the data packet (such as size, protocol type, access time, etc.) can be regarded as a pixel, and the feature map is automatically extracted through the convolutional layer, and finally classified or behavior recognized through the fully connected layer.

[0048] LSTM time series analysis example: Using the LSTM model to model time series data can effectively capture the long-term dependencies of user behaviors and thus optimize the prediction of user behavior patterns.

[0049] S3, data fusion and denoising: Use the Kalman filter algorithm to fuse data from multiple sources, and optimize the results through Bayesian reasoning to remove redundant information and noise; In the previous steps, traffic data has been collected and preprocessed to obtain characteristic information including access type, frequency, packet size, etc. The key goal of this step is to improve the accuracy and reliability of data by fusing data from multiple sources. Data fusion and denoising can not only eliminate redundant information, but also integrate information between different data sources to ensure that the final characteristic data can more accurately reflect the user's online behavior. The effect of data fusion and denoising directly affects the accuracy of subsequent behavior pattern recognition and decision optimization, so this step is a crucial part of the behavior recognition process.

[0050] In this embodiment, the Kalman filter algorithm is used to fuse the traffic data from multiple sources, and the results of Bayesian reasoning optimization are combined to remove redundant information and noise. Kalman filtering is a recursive algorithm widely used to process noisy data, which can optimize and estimate data in dynamic systems. Bayesian reasoning further improves the accuracy and credibility of the results through the joint analysis of prior information and observed data.

[0051] In this embodiment, the Kalman filter algorithm is used to fuse the traffic data from different data sources. Kalman filtering can obtain an optimal state estimate by weighted averaging each observation value based on a dynamic system model and an observation model. This method can effectively reduce the impact of noise on the data, fuse data from multiple sources and provide a reliable estimation result.

[0052] Kalman filter principle: Set the system status to , Kalman filter estimates the state at each moment through two steps of prediction and correction.

[0053] Prediction step: Based on the previous state estimate and the control input, predict the current state: ;in, is the predicted state at the current moment, is the state transfer matrix, is the state estimate at the previous moment, is the control matrix, For control input.

[0054] Update step: When new observations When arriving, use the Kalman gain Correct the predicted value to get the optimal estimate at the current moment: ; ; ;in, is the Kalman gain, is the predicted covariance matrix, is the observation matrix, is the covariance matrix of the observation noise, is the identity matrix.

[0055] Through this prediction and correction approach, Kalman filtering can effectively extract true signals from noise and fuse data from different sources.

[0056] Although Kalman filtering can effectively reduce noise and fuse data, in some cases, Kalman filtering alone may not be able to completely eliminate redundant information. Therefore, Bayesian reasoning is introduced in this embodiment to further optimize the results of Kalman filtering.

[0057] Bayesian reasoning combines the likelihood function of observed data with prior information, providing a more comprehensive way of inference. Specifically, the basic idea of ​​Bayesian reasoning is to maximize the posterior probability of observed data by updating the probability distribution of the state.

[0058] Bayesian inference formula: ;in, is the posterior probability, which means that after observing the data After, status probability; is the likelihood function, which means that in a given state The data observed below probability; is the prior probability, indicating the state Prior information of is the marginal probability of observing the data.

[0059] By using the output of Kalman filtering as the prior information for Bayesian reasoning and combining it with new observation data, the accuracy of data fusion can be further improved and redundant information can be removed.

[0060] In data from multiple sources, there is often redundant information and noisy data, which will affect the final behavior pattern recognition effect. Therefore, denoising and redundant information removal are key parts of the data fusion process. Kalman filtering and Bayesian reasoning can effectively remove redundant information and noise through recursive estimation of data.

[0061] In one possible implementation, the Kalman filter automatically adjusts the processing of noise and redundant information at each iteration through its prediction and update mechanism. Bayesian reasoning further optimizes the results through the joint analysis of prior and observed data, ensuring that the final fused data can retain valid information to the greatest extent and remove unnecessary interference.

[0062] In some embodiments, in addition to using Kalman filtering and Bayesian reasoning, other data fusion techniques may be combined, such as particle filtering or weighted averaging methods, which can further improve the effect of multi-source data fusion. For example, particle filtering can better handle nonlinear and non-Gaussian noise data, so in a complex network environment, particle filtering may have more advantages than Kalman filtering.

[0063] Specifically, in some application scenarios, particle filtering constructs multiple particles (i.e., hypothetical states) to represent the probability distribution of the state, and continuously optimizes the weights of the particles through importance sampling methods to achieve more accurate state estimation.

[0064] S4. Behavior pattern recognition and classification: Based on the extracted features, a machine learning algorithm is used to classify and identify the user's online behavior. The identified behaviors include social media use, video viewing, and online shopping. The main goal of this step is to use the traffic features extracted in the previous step to perform pattern recognition and classification of users' online behaviors. Behavioral pattern recognition is to analyze the extracted features through machine learning algorithms to identify user behavior categories, such as social media use, video viewing, online shopping, etc. The accuracy of behavior classification is crucial for subsequent decision-making responses and system optimization. Therefore, the recognition and classification methods in this step should be able to handle multiple types of behavior patterns and have high recognition accuracy.

[0065] In this embodiment, a machine learning algorithm is used to classify user online behaviors. Specifically, common supervised learning algorithms such as support vector machines (SVMs) and decision trees are used to learn the model through training samples, and finally the automatic classification of user behaviors is realized. Through these algorithms, the system can extract rules from a large amount of user behavior data and classify and identify user behavior patterns based on specific features.

[0066] In this embodiment, the process of behavior pattern recognition and classification is divided into two main steps: feature training and behavior classification.

[0067] In the feature training phase, the model needs to be trained using labeled training data. The training data includes the user's network behavior data over a period of time (such as the websites visited, data packet size, frequency, and other features) and corresponding labels (such as "social media", "video watching", or "online shopping"). This training data will be used to train the machine learning model so that it can learn how to distinguish different types of behavior through the extracted features.

[0068] SVM model training: Assume that the feature vector of network traffic data is , where each Represents a feature extracted from the data. The goal of SVM is to find an optimal hyperplane to distinguish different categories. Given a training sample set in , SVM finds the optimal hyperplane through the following optimization problem: ;in, is the normal vector of the hyperplane, is the bias term. The constraints are: .

[0069] SVM finds the optimal segmentation hyperplane by maximizing the classification interval (that is, maximizing the support vector distance), thereby achieving accurate classification of behavior.

[0070] Decision tree training: The decision tree model recursively divides samples according to features until all data can be accurately classified. Each node represents the judgment of a feature, and the branch represents the different values ​​of the feature. When building a decision tree, the features of each node are usually selected using information gain or Gini coefficient to measure the importance of the feature: ;in, is the entropy of the data set, which indicates the uncertainty of the data; It is based on The entropy of the subsets after the eigenvalues ​​are divided.

[0071] After feature training is completed, the model will be used to classify the behavior patterns of new data. By using the trained SVM or decision tree model, the system can classify the user's behavior into different patterns based on the extracted traffic features, such as social media use, video viewing, online shopping, etc.

[0072] SVM classification process: For new input features , SVM calculates the probability that the feature belongs to a certain category by the following formula: ;if , it means that the user behavior belongs to the target category (such as "social media"), if , the behavior belongs to the Other category.

[0073] Decision tree classification process: When using a decision tree for classification, new data will start from the root node of the tree and traverse down layer by layer according to the feature value until it reaches a leaf node, which corresponds to a behavior category label. Specifically, the decision tree will use the feature value to perform a series of divisions on the user's online behavior until the user's behavior type is finally determined.

[0074] In order to improve classification accuracy, cross-validation and other techniques may be used to tune the model during model training. In the cross-validation process, the data set is divided into multiple subsets, and the model is trained and validated on multiple subsets to ensure the generalization ability of the model on different data sets. In addition, the classification effect can be further optimized by adjusting the model's hyperparameters (such as the kernel function in SVM, the maximum depth in the decision tree, etc.).

[0075] In some embodiments, in addition to using traditional machine learning algorithms such as SVM and decision trees, more complex algorithms can be introduced, such as convolutional neural networks (CNN) or long short-term memory networks (LSTM) in deep learning. These models can automatically learn more complex and higher-level feature representations from raw traffic data, further improving the accuracy of behavioral pattern recognition.

[0076] CNN extension: When processing traffic data, CNN can automatically extract local features and capture the spatial feature information of the data through multi-layer convolution operations. This is particularly effective for identifying user behavior patterns from complex traffic data.

[0077] LSTM extension: LSTM can capture long-term dependencies in time series data, which makes LSTM perform well when processing network traffic data with time series characteristics and can accurately identify user behavior patterns in different time periods.

[0078] S5. Time series behavior analysis and optimization: Perform time series modeling on user behaviors, optimize recognition strategies based on Markov decision processes or reinforcement learning algorithms, and dynamically adjust system responses based on user behaviors; In the above steps, the user's behavior characteristics have been obtained through data collection, feature extraction, data fusion and denoising, and pattern recognition and classification. On this basis, time series behavior analysis and optimization further optimizes the recognition strategy by analyzing the law of user behavior changes over time, so that the system can make real-time adjustments based on the user's dynamic behavior. This step is of great significance in improving the accuracy of user behavior prediction, responding to user needs in a timely manner, and optimizing resource allocation.

[0079] In this embodiment, Markov decision process (MDP) and reinforcement learning (RL) algorithms are used to model the user's behavior in time series, and based on the feedback information of the model, the recognition strategy and system response are optimized in real time. Through these methods, the system can learn and predict the user's future behavior patterns, thereby dynamically adjusting the system's response strategy to improve service quality and user experience.

[0080] In this embodiment, the core goal of temporal behavior analysis and optimization is to model the temporal characteristics of user behavior, thereby optimizing the system's recognition and response to user behavior. This process builds a dynamic model that adapts to changes in user behavior and can dynamically adjust system strategies based on user behavior data and real-time feedback.

[0081] Markov decision process (MDP) is a mathematical model that describes the decision-making process. The MDP model describes the behavior choices of the system through a series of states, actions, and rewards. Specifically, the MDP model consists of the following elements: State Space S: represents all possible states of the system. For example, the system may be in different user behavior states, such as "social media browsing", "video watching", or "online shopping".

[0082] Action Space A: represents all actions that the system can take, such as adjusting bandwidth allocation based on user behavior, recommending certain content, etc.

[0083] Transition Probability : Indicates that after executing action a in the current state s, it will transfer to the state probability.

[0084] RewardFunction : represents the immediate reward obtained by the system when executing action a in state s. The reward is usually related to factors such as user satisfaction with behavior and the response efficiency of the system.

[0085] In the specific implementation, the system first selects appropriate actions (such as increasing bandwidth, prioritizing loading social media content, etc.) based on the current user's behavior status (such as "social media browsing"), and obtains rewards based on the actions performed, and then optimizes the decision-making process through continuous experiments and feedback.

[0086] MDP optimization goal: The goal of the system is to maximize the long-term cumulative reward, which is specifically expressed by the following optimal value function: ;in, is the optimal value of state s, is the discount factor, controlling for the importance of future rewards, is the state transition probability, It’s an instant reward.

[0087] In some embodiments, in addition to using the traditional MDP model, the reinforcement learning (RL) method can be combined to further optimize the temporal behavior analysis and system response strategy. Reinforcement learning adjusts the strategy to maximize long-term rewards by continuously interacting with the environment, so it is very suitable for solving complex behavior optimization problems.

[0088] In reinforcement learning, the system learns the optimal strategy through two processes: "exploration" and "exploitation". Exploration refers to trying different behavioral strategies to obtain more information, while exploitation refers to choosing the currently known optimal strategy to obtain the maximum benefit.

[0089] Q-Learning: Q-Learning is a common reinforcement learning algorithm that learns an action-value function To indicate the status Next action The expected return after. The update formula of Q value is: ;in, is the learning rate, It’s an instant reward. is the discount factor, is the maximum Q value of the future state.

[0090] By continuously updating the Q value, the system can find the optimal behavior strategy and dynamically adjust the system response strategy based on the user's behavior.

[0091] Based on the MDP and RL models, the system can dynamically adjust service strategies according to the user's behavior patterns. For example, if the system recognizes that the user frequently visits social media and the user shows high activity in this behavior pattern, the system can increase network bandwidth and reduce the priority of other traffic, thereby improving the loading speed of social media content and user experience.

[0092] Timing feedback mechanism: Specifically, the system analyzes user behavior in real time, identifies the periodicity or trend of user behavior, and optimizes the allocation of network resources based on this information. For example, if a user frequently browses news websites during working hours and watches videos at night, the system can predict and adjust the bandwidth configuration in advance to cope with the traffic demand in different time periods.

[0093] In some embodiments, in order to better adapt to the diversity and complexity of user behaviors, the system can also introduce deep reinforcement learning (DRL). Deep reinforcement learning combines the advantages of deep learning and reinforcement learning, can handle more complex state space and action space, and is particularly suitable for tasks with high-dimensional data and complex temporal relationships.

[0094] For example, the Deep Q Network (DQN) introduces a neural network to approximate the Q-value function, enabling the system to make efficient decisions in complex environments. Through the Deep Q Network, the system can more accurately predict future behavior based on historical data of user behavior and adjust service strategies accordingly.

[0095] S6, Decision response and feedback optimization: Generate real-time feedback response based on recognition results, and continuously optimize recognition accuracy through online learning mechanism; In the above steps, the system has formed a detailed understanding of the user's online behavior through accurate identification, timing analysis and optimization of user behavior. The goal of decision response and feedback optimization is to dynamically generate appropriate feedback responses based on the identification results, according to the current network status and user needs, and continuously optimize the identification accuracy and service strategy through online learning mechanisms. This step plays a vital role in improving the system's adaptive capabilities, optimizing user experience and improving system performance.

[0096] In this embodiment, the system establishes a real-time feedback mechanism between user behavior recognition and system response by utilizing the aforementioned recognition and optimization algorithms. Specifically, based on the behavior recognition results, the system can dynamically adjust the response strategy (such as bandwidth allocation, recommended content, etc.) and continuously optimize the strategy through online learning. The online learning mechanism can enable the system to continuously improve recognition accuracy over time and adapt to changing user behaviors.

[0097] In this embodiment, the key to decision response and feedback optimization is how to respond quickly and accurately based on real-time identified user behavior and ensure that the system can continuously improve through feedback. This process usually includes three core links: response generation, feedback mechanism, and online learning.

[0098] Response generation is to generate appropriate system responses based on the recognition results of user behavior. Specifically, the system determines the response measures to be taken based on the current behavior recognition results. Common response measures include: Bandwidth allocation optimization: If the system recognizes that the user is watching a video stream or downloading a large file, the system can dynamically adjust the allocation of network bandwidth to prioritize the smoothness of the video or download task; Content recommendation: When a user’s behavior pattern is identified as “social media usage”, the system can recommend relevant social media content or push notifications; Traffic management: When the system detects that a user is performing a certain activity (such as frequently visiting an e-commerce website), the system can adjust the traffic routing strategy based on priority.

[0099] Response generation formula: Assume that the behavior pattern recognition is (such as social media), the current bandwidth status is , then the response generation can be expressed as: ;in, Represents the generated response, function Based on behavior and current bandwidth to calculate the best response.

[0100] The feedback mechanism is a key link after decision-making response. The system adjusts the strategy based on the actual feedback from users (such as service experience, network quality, etc.). The feedback mechanism helps the system optimize the response strategy by monitoring the user's response to the system in real time. Feedback can be collected in the following ways: User feedback collection: By monitoring changes in user behavior (e.g., whether users continue to watch videos after receiving optimized bandwidth allocation), the system can evaluate the effectiveness of response measures; Network performance feedback: The system can obtain feedback through real-time monitoring of network performance, for example, whether network latency is reduced after traffic management optimization.

[0101] Through real-time feedback, the system can determine whether the current response strategy meets user needs, and thus adjust the response to improve user experience.

[0102] Feedback mechanism model: Assume that after the response is generated, the system obtains the user's feedback value (For example, the loading speed and download speed of the video stream), the system adjusts the parameters To optimize the response: ;in, is the adjustment factor, is the expected feedback value, This is actual user feedback received.

[0103] Online learning is an important part of this embodiment. The system learns and adjusts real-time data through the online learning mechanism, thereby gradually improving the accuracy and efficiency of the response strategy. Online learning has the following characteristics: Incremental learning: The system continuously receives new user behavior data and feedback information, and can optimize the existing model in real time without retraining the model. Incremental learning can make the system more flexible in adapting to user behavior.

[0104] Adaptive adjustment: By analyzing historical data, the system can identify which strategies are more effective in specific scenarios and dynamically adjust the optimization direction accordingly.

[0105] Online learning model: Assume that the system updates model parameters through online learning , the model can be updated in real time through the following formula: ;in, are the updated model parameters, is the learning rate, is the loss function, For newly acquired data.

[0106] During the online learning process, the system adjusts its strategies based on the latest data (such as user behavior data, feedback data, etc.) so that the response can better meet user needs.

[0107] In some embodiments, the system can further introduce advanced algorithms such as deep learning for optimization. In this process, algorithms such as deep neural networks (DNN) can be used to model user behavior patterns and feedback data, thereby achieving more accurate strategy adjustment and optimization.

[0108] Deep reinforcement learning (DRL) extension: By introducing deep reinforcement learning, the system can better explore the optimal strategy in a complex network environment. Deep reinforcement learning combines the advantages of deep learning and reinforcement learning, can process high-dimensional input data, and optimize decisions between multiple complex behaviors.

[0109] Adaptive neural network: In some embodiments, the neural network can be adaptively adjusted according to different network environments and user behaviors, and a continuously optimized feedback mechanism can be implemented through algorithms such as reinforcement learning.

[0110] S7. Behavior identification report generation: Based on the identified user behavior, a user behavior report is generated and provided to network administrators or intelligent systems for further analysis and decision-making.

[0111] In the above steps, the user's behavior has been deeply analyzed through data collection, feature extraction, data fusion, pattern recognition and optimization. The goal of generating a behavior recognition report is to form a detailed and easy-to-understand report based on the identified user behavior, providing valuable decision-making basis for network managers or intelligent systems. The report will include user behavior patterns, behavior trends, network usage and suggestions, etc., which can help relevant personnel to grasp the user's network behavior in a timely manner and perform reasonable resource allocation, strategy optimization and other operations.

[0112] In this embodiment, the behavior recognition report includes not only the user's current behavior recognition results, but also the prediction information obtained based on the time series analysis, and the optimized behavior response strategy. The report content can not only be presented in a visual form, but also include detailed analysis data, which is convenient for decision makers to analyze and adjust according to actual needs.

[0113] In this embodiment, the process of generating a behavior recognition report includes key links such as data aggregation, report structure design, visualization and report generation. Through these steps, the system can present complex user behavior recognition and analysis results to users or network administrators in an easy-to-understand and easy-to-operate manner.

[0114] The first step of the behavior identification report is to summarize and integrate the identified user behavior data. The goal of this step is to integrate the behavior characteristics, optimization strategies, user feedback and other information extracted from each link into visual data. The data aggregation process usually includes: User behavior patterns: Based on the identified behavior types, such as “social media usage,” “video watching,” “online shopping,” etc., generate statistics for each behavior pattern; Time series analysis results: Combined with the time series pattern of user behavior, a trend chart of user behavior is generated to show the distribution of behavior in different time periods; Feedback and response strategy: Collect system feedback data, integrate optimized response strategies, and display the effect comparison before and after strategy adjustment.

[0115] This information will be collated and structured into sections of the report.

[0116] The structure of the report is designed to provide intuitive and easy-to-analyze information. Specifically, the content of the report usually includes the following parts: User profile: briefly describes the user's basic information (such as user name, device type, access time period, etc.), as well as overall network behavior trends; Behavior pattern analysis: Lists the user's behavior pattern recognition results in detail, such as the user's access type, behavior frequency, active time period, etc. in the past period of time; Time series analysis and trend prediction: Through time series analysis, we can show the changing trend of user behavior and predict the user's future behavior pattern (for example, users may visit social media more in the next period of time); Optimization response strategy and effect: Demonstrate the optimization response made by the system based on behavior recognition and timing analysis, including the adjustment of strategies such as bandwidth allocation and traffic management, as well as the effect evaluation of these adjustments.

[0117] Report generation formula: Assuming the user behavior pattern is The timing analysis results are: , the optimal response strategy is , then the generation of the report can be expressed as: ;in, It is a function that integrates behavioral data, time series trends, and response strategies into reports.

[0118] When generating reports, data visualization is an indispensable part. The data in the report is presented in the form of charts, pie charts, line graphs, etc., making the complex behavior analysis results more intuitive and easy to understand. Specifically, the visualization content in the behavior recognition report includes: Behavior pattern chart: Use pie charts or bar charts to show the proportion of different types of behaviors (for example, the proportion of social media use, the proportion of video viewing, etc.); Time series analysis curve chart: Use a line chart to show the changes in user behavior frequency in different time periods and the predicted future behavior patterns; Strategy optimization effect chart: Use a bar chart or line chart to show the effect comparison before and after the optimized response strategy (such as bandwidth allocation adjustment), for example, whether the loading speed of video viewing has been improved.

[0119] Visualization technology implementation: In some embodiments, visualization tools such as D3.js, Matplotlib, etc. can be used to automatically draw charts and embed them in reports in combination with the generated data.

[0120] After completing data aggregation, structure design and visualization, the system generates the final behavior recognition report and outputs it in a format that is easy to read and share, such as PDF or HTML. When outputting the report, users can choose the level of detail of the report according to their needs, and generate standard reports or customized reports. The report content can be generated regularly or triggered by certain specific events (for example, when there is a significant change in user behavior).

[0121] Report generation algorithm: Assume that the recognition result of user behavior pattern is The timing analysis results are: , the response strategy is , the final report generated It can be expressed by the following formula: ;in, It is a function that combines the analysis results with the report format to generate the final report.

[0122] In some embodiments, report generation can be combined with artificial intelligence technology so that the report is not limited to static data display, but can also include dynamic analysis and suggestions. For example, natural language generation (NLG) technology can be used to generate the text part of the report, making the report content more readable, automatically explaining the reasons for changes in behavior patterns, and providing data-based decision-making suggestions.

[0123] Natural Language Generation (NLG) Technology Extension: By introducing NLG technology, the system can automatically generate detailed text explanations based on the data in the report. For example, based on the data "users' social media usage frequency has increased by 20% in the past three months", the system can automatically generate an explanation text similar to "users' social media usage frequency has increased by 20% in the past three months, which may be related to recent changes in users' interests or increased social interactions."

[0124] Please see attached Figure 2 , a user online behavior identification system based on traffic data analysis, the system includes: The data acquisition module is used to obtain users' Internet traffic data from multiple sensors and network devices. These sensors include routers, deep packet inspection (DPI) systems, DNS servers, etc. This module can capture network traffic information in real time, including the websites visited by users, packet size, access time, protocol type, etc. Through diversified data sources, the system can fully understand users' Internet behavior and provide high-quality raw data for subsequent data analysis and processing.

[0125] The feature extraction module extracts features related to user behavior based on the collected traffic data, mainly including access type, access frequency, and data packet size. These features help to accurately describe the user's online behavior patterns, such as distinguishing the behavioral characteristics of users when they are doing different activities such as watching videos, browsing social media, or shopping online. By extracting features from the data, the module can extract key information from a large amount of data for subsequent behavior analysis and classification.

[0126] The data fusion module uses Kalman filtering and Bayesian reasoning algorithms to comprehensively analyze data from different sources, remove redundant information and noise, and ensure the accuracy and effectiveness of the data. Kalman filtering is used to deal with time series problems of multi-source data, while Bayesian reasoning further optimizes the fusion results by considering prior knowledge and observed data. The role of this module is to improve the adaptability of the system when facing complex and changing data sources, ensuring that the contribution of each data source can be effectively integrated and avoiding noise interference.

[0127] The behavior recognition module uses machine learning algorithms (such as support vector machines (SVM), decision trees, etc.) to classify the extracted features and accurately identify the user's online behavior type. By learning from historical data, the system can continuously optimize the model and improve the accuracy of behavior recognition. For example, the system can identify users who frequently visit social media platforms and judge them as "social media use" behavior; by analyzing the access duration and data packet size, it can judge them as "video viewing" behavior. This module provides the system with a basis for accurate behavior classification and real-time feedback.

[0128] The timing analysis module uses Markov decision process (MDP) or reinforcement learning (RL) algorithm to perform timing modeling of user behavior and optimize recognition strategies. This module can capture the temporal variation patterns of user behavior and adjust system strategies based on historical data and real-time feedback. For example, when the system recognizes that the user's online behavior has periodic changes (such as frequent visits to a certain type of website during a certain period of time every day), it can dynamically adjust strategies to optimize network resource allocation and service quality. The timing analysis module effectively improves the intelligence and adaptability of the system, ensuring that the system can respond promptly to changes in user behavior.

[0129] The response module generates corresponding feedback responses based on the identified behavior patterns and timing analysis results. For example, when the system recognizes that the user is watching a video, the response module can automatically increase bandwidth to prioritize video playback smoothness; when it detects that the user is shopping online, the system can adjust the page loading priority according to demand. This module enables the system to adjust resource allocation in real time according to user behavior, optimizing user experience and network performance.

[0130] The report generation module generates a detailed user behavior identification report based on the system's identification results, time series analysis, and response strategy for user behavior. The report includes the user's online behavior pattern, access frequency, time period analysis, optimization strategy execution status, etc., and is provided to network managers for further analysis and decision-making. The report not only helps managers understand users' network behavior, but also provides a basis for future behavior prediction and resource optimization, and further optimizes network service strategies.

[0131] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for identifying user online behavior based on traffic data analysis, characterized in that: The following steps are involved: Data collection and preprocessing: Use multiple sensors and network devices to obtain users' Internet traffic data, including visited websites, data packet size, and sending time; Traffic data feature extraction: Extracting user online behavior features from collected traffic data, including access type, access frequency, and data packet size distribution; Data fusion and denoising: Use the Kalman filter algorithm to fuse data from multiple sources, and optimize the results through Bayesian reasoning to remove redundant information and noise; Behavior pattern recognition and classification: Based on the extracted features, machine learning algorithms are used to classify and identify users’ online behaviors, including social media use, video viewing, and online shopping. Time series behavior analysis and optimization: Model the user's behavior in time series, optimize the recognition strategy based on the Markov decision process or reinforcement learning algorithm, and dynamically adjust the system response according to the user's behavior; Decision response and feedback optimization: Generate real-time feedback responses based on recognition results, and continuously optimize recognition accuracy through online learning mechanisms; Behavior identification report generation: Based on the identified user behavior, a user behavior report is generated and provided to network managers or intelligent systems for further analysis and decision-making.

2. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The data collection and preprocessing step further includes aligning the timestamps of the flow data from multiple sensors and synchronizing the data in time series using a mutual information maximization method to ensure the time consistency between the data.

3. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The data fusion and denoising step includes using an extended Kalman filter to process the state estimation of a nonlinear dynamic system, and using an unscented Kalman filter to optimize the behavior recognition accuracy of the system.

4. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The behavior pattern recognition and classification step classifies the user's online behavior through a support vector machine or a deep neural network, wherein the classification results include social media use, online video viewing, and online shopping categories.

5. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The sequential behavior analysis and optimization step uses a reinforcement learning algorithm to optimize the behavior recognition strategy by interacting with the environment and adjusts the recognition accuracy in real time.

6. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The sequential behavior analysis and optimization step uses a Markov decision process to dynamically model the user's behavior, predicts future behavior patterns based on current user behavior, and thus optimizes the system response strategy.

7. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The decision response and feedback optimization step includes real-time detection and response to abnormal behavior. When abnormal user behavior is detected, an alarm is generated or abnormal access is automatically blocked.

8. The method for identifying user online behavior based on traffic data analysis according to claim 1 is characterized in that: The timing behavior analysis and optimization step further comprises the following steps: The user's behavior state space is constructed through the time series of user behavior data. Each state in the state space represents the user's online behavior characteristics at a certain point in time. Based on the state space of user behavior, the Markov decision process is used to model user behavior and define the user behavior transition probability matrix, where each element in the matrix represents the probability of transitioning from one behavior state to another. The user behavior prediction model is optimized through reinforcement learning algorithm, which includes the following steps: Define the reward function for behavior prediction. The reward function is adjusted according to the difference between recognition accuracy and real-time response. The formula is expressed as: ;in, is the reward value at the current moment, is the discount factor, For the current state Next select action The estimated value of is the adjustment factor of the reward, Identify errors for behavior; The Q-value function is continuously updated through the Q-learning algorithm to optimize the behavior recognition strategy, so that the system can adapt to changing user behaviors; Based on the optimized behavior recognition strategy, the system generates and executes the optimal response decision, adjusts the accuracy of behavior prediction and system response speed to improve the overall system performance.

9. The method for identifying user online behavior based on traffic data analysis according to claim 1, characterized in that: The behavior identification report generation step further includes generating a report containing detailed information on the types of websites visited by users, the frequency of visits, and the size distribution of data packets, and providing it to management personnel through data visualization technology for further behavior analysis and decision support.

10. A user online behavior identification system based on traffic data analysis, characterized in that: The system includes: A data collection module is used to obtain the user's Internet traffic data from multiple sensors; Feature extraction module, used to extract the user's online behavior characteristics, including access type, access frequency, and data packet size; Data fusion module, used to fuse multi-source data and remove noise through Kalman filtering and Bayesian reasoning method; Behavior recognition module, which is used to classify and identify online behaviors using machine learning algorithms; A time series analysis module for optimizing identification strategies via Markov decision processes or reinforcement learning; A response module, used for generating a feedback response according to the recognition result; The report generation module is used to generate user behavior identification reports and provide them to managers for further analysis.

Images