User abnormal behavior monitoring method and device, equipment, medium and product

Abstract

The invention discloses a user abnormal behavior monitoring method and device, equipment, a medium and a product. Relates to the technical field of deep learning, network security and financial science and technology, and comprises the following steps: obtaining logs generated by a user within a set time, dividing and clustering according to a target time period to obtain a clustering log set, analyzing the clustering log set to obtain a corresponding behavior event label set, and combining and inputting the two into a pre-trained long and short-term memory model to obtain a behavior event label set; and obtaining at least one target behavior operation predicted for each piece of target mark data and a corresponding target behavior occurrence probability, and carrying out abnormal behavior monitoring on the target user according to a matched abnormal monitoring rule based on the target behavior operation and the occurrence probability thereof. Through fusion of the deep learning model and clustering analysis, the monitoring accuracy is improved, the manpower and time cost is reduced through an automatic data processing mode, the monitoring efficiency and the real-time performance are improved, and thus the reliability of user abnormal behavior recognition and safety evaluation is improved.

Description

Technical Field

[0001] The present invention relates to the fields of deep learning, network security and financial technology, and in particular to a method, device, equipment, medium and product for monitoring abnormal behavior of users. Background Art

[0002] With the development of information technology and the increasing complexity of the network environment, network security is facing unprecedented challenges. Identifying abnormal user behavior, accurately monitoring and effectively preventing various malicious behaviors are crucial to ensuring the security and stability of the network environment.

[0003] In the existing technology, users' abnormal behaviors are usually monitored by technologies such as rule engines, machine learning or deep learning. However, the rule engine-based method requires frequent maintenance and updates, which makes it difficult to cope with ever-changing threats, increasing the manpower and time costs of behavior monitoring. The generalization ability of traditional machine learning models is limited, resulting in frequent false alarms and missed alarms, which reduces the accuracy of behavior monitoring. The deep learning model's dependence on large amounts of data and computing resources, as well as the difficulty of tuning and deployment in practical applications, reduce the efficiency and real-time performance of behavior monitoring, thereby reducing the reliability of user abnormal behavior identification and security assessment. Summary of the invention

[0004] The present invention provides a method, device, equipment, medium and product for monitoring abnormal user behavior to solve the problems of low accuracy, high manpower and time cost, low efficiency and poor reliability when identifying and monitoring abnormal user behavior.

[0005] According to one aspect of an embodiment of the present invention, a method for monitoring abnormal behavior of a user is provided, comprising:

[0006] Obtain each user behavior log generated by the target user within a set time interval, and divide each user behavior log into behavior segments according to the target time period to obtain each behavior segment log;

[0007] Clustering each behavior fragment log to obtain multiple cluster log sets, and parsing each cluster log set to obtain a behavior event label set corresponding to each cluster log set;

[0008] Combine the clustered log set with the matching behavior event label set to obtain each target label data;

[0009] Inputting each target tag data into a pre-trained long short-term memory model, respectively, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and a target behavior occurrence probability corresponding to each target behavior operation;

[0010] According to the abnormal monitoring rules matching the target user, the target user is monitored for abnormal behavior based on the target behavior operation and the matching target behavior occurrence probability.

[0011] According to another aspect of an embodiment of the present invention, a device for monitoring abnormal behavior of a user is provided, comprising:

[0012] The behavior segmentation module is used to obtain each user behavior log generated by the target user within a set time interval, and divide each user behavior log into behavior segments according to the target time period to obtain each behavior segment log;

[0013] A cluster processing module is used to perform cluster processing on each behavior segment log to obtain multiple cluster log sets, and parse each cluster log set to obtain a behavior event label set corresponding to each cluster log set;

[0014] A data combination module is used to combine the cluster log set with the matching behavior event label set to obtain each target label data;

[0015] A model prediction module, used to input each target tag data into a pre-trained long short-term memory model, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and a target behavior occurrence probability corresponding to each target behavior operation;

[0016] The anomaly monitoring module is used to monitor the abnormal behavior of the target user according to the anomaly monitoring rules matched with the target user, based on the target behavior operation and the probability of occurrence of the matched target behavior.

[0017] According to another aspect of an embodiment of the present invention, an electronic device is provided, the electronic device comprising:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for monitoring abnormal user behavior described in any embodiment of the present invention.

[0021] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for monitoring abnormal user behavior described in any embodiment of the present invention when executed.

[0022] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps of the method described in any embodiment of the present invention are implemented.

[0023] The technical solution of the embodiment of the present invention obtains the logs generated by the user within the set time, divides and clusters them according to the target time period to obtain a cluster log set, parses the cluster log set to obtain the corresponding behavior event label set, and inputs the combination of the two into the pre-trained long-term and short-term memory model to obtain at least one target behavior operation predicted for each target label data, and the corresponding probability of occurrence of the target behavior, and based on the target behavior operation and its probability of occurrence, according to the matched abnormal monitoring rules, monitors the target user for abnormal behavior. By integrating the deep learning model with cluster analysis, the accuracy of monitoring is improved, and the automated data processing method reduces the manpower and time costs, improves the monitoring efficiency and real-time performance, and thus improves the reliability of user abnormal behavior identification and security assessment.

[0024] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 is a flow chart of a method for monitoring abnormal behavior of a user provided according to Embodiment 1 of the present invention;

[0027] Figure 2 is a flow chart of another method for monitoring abnormal user behavior provided according to Embodiment 2 of the present invention;

[0028] Figure 3 is a schematic diagram of the structure of a device for monitoring abnormal behavior of a user provided according to Embodiment 3 of the present invention;

[0029] Figure 4 It is a structural schematic diagram of an electronic device for implementing the method for monitoring abnormal behavior of a user according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] Embodiment 1

[0033] Figure 1 This is a flow chart of a method for monitoring abnormal user behavior provided in the first embodiment of the present invention. This embodiment can be applied to the situation where abnormal user behavior is identified and monitored, and abnormal warning is issued when abnormality is detected. This method can be executed by a monitoring device for abnormal user behavior. The monitoring device for abnormal user behavior can be implemented in the form of hardware and / or software, and can generally be configured in an electronic device. Figure 1 As shown, the method includes:

[0034] S110 , obtaining each user behavior log generated by the target user within a set time interval, and dividing each user behavior log into behavior segments according to the target time period to obtain each behavior segment log.

[0035] In the embodiments of the present invention, the target user can be specifically understood as: the object that is particularly concerned about during the process of obtaining or analyzing logs, which can be a single user or a group of users. The set time interval can be specifically understood as: a specific time period determined according to the analysis purpose, such as one hour, one day, or one week, etc. During this time interval, all user behavior logs will be collected and analyzed. The user behavior log can be specifically understood as: the detailed information recording the interaction and behavior operations between the user and the system, which can include the operation time, operation type, operation content, etc. The target time period can be specifically understood as: further dividing the set time interval into smaller time units to more finely analyze and identify the behavior patterns within a specific time period. For example, the target time period can be dynamically selected according to the specific duration of different user operations to ensure the integrity and accuracy of the division of behavior segments. The behavior segment can be specifically understood as: the continuous sequence of user behaviors within the target time period. Each behavior segment contains a series of closely related user behaviors. The behavior segment log can be specifically understood as: the log recorded for the behavior segment, which contains all user behaviors within the behavior segment.

[0036] S120. Perform clustering processing on each behavior segment log to obtain multiple clustering log sets, and respectively perform parsing processing on each clustering log set to obtain a set of behavior event labels corresponding to each clustering log set.

[0037] Clustering is an unsupervised learning method used to group data points into multiple clusters, such that the data points within the same cluster have high similarity, while the data points between different clusters have low similarity. In the embodiments of the present invention, the clustering log set can be specifically understood as: the log set (equivalent to a cluster) obtained through clustering algorithm processing. The logs in these log sets represent similar user behavior patterns or events (equivalent to the data points within the cluster).

[0038] The set of behavior event labels can be specifically understood as: a set of labels or features corresponding to each clustering log set, and these labels describe the common features of the logs in the clustering log set or the behavior events represented.

[0039] Specifically, preprocess the text of each behavior segment log to clean and standardize the original text data. The preprocessing can include word segmentation (dividing the text data into words or phrases), removing stop words (removing common words that have little impact on the meaning of the text, such as "of" and "is", etc.), and stemming (reducing words to their stem forms to reduce the impact of word form changes on the analysis results). Structure the vocabulary through stemming, reduce the variants of the vocabulary, and simplify the text processing and analysis. For example, unify "walk", "walk to", and "walk home" into "walk". The preprocessed text data is represented as D = {d1, d2,..., d n}, where d iRepresents the i-th text data, that is, a behavior fragment containing at least one stem.

[0040] Then, the preprocessed text data is converted into a numerical feature vector through a text vectorization algorithm. For example, through the bag-of-words model, each document is converted into a vector, where each dimension of the vector corresponds to a word in the vocabulary and represents the frequency of occurrence of the word in the document, or, through TF-IDF (Term Frequency-Inverse Document Frequency), each document can be represented as a vector, where each component of the vector corresponds to a word in the vocabulary and reflects the TF-IDF value of the word, which is used to measure the importance of the word in the document. After text vectorization, an n×V matrix corresponding to the text data set is obtained, where n is the number of vocabularies contained in the text data set and V is the size of the vocabulary.

[0041] After the text is vectorized, a clustering algorithm is used to cluster the text data. In a specific example, the K-means algorithm (K-means clustering algorithm) can be used to cluster the text data, randomly select K text vectors as the initial cluster centers, and assign them to the cluster represented by the nearest cluster center based on the distance between each text vector and each cluster center. Based on the average characteristics of the existing text vectors in each cluster, the position of the cluster center is recalculated and updated.

[0042] Assume that the text dataset D is divided into K clusters, denoted by C = {c1, c2, ..., c k}, where each cluster c i Contains m i text data, the goal of the K-means algorithm is to minimize the intra-cluster squared error (SSE):

[0043]

[0044] Among them, x i Represents cluster c i The i-th text vector in i Represents cluster c i The cluster center of .

[0045] This process is repeated until the location of the cluster center no longer changes significantly or the preset number of iterations is reached. In this way, a large number of behavior fragment logs can be divided into multiple cluster log sets with similar characteristics.

[0046] In addition, the clustering results may be evaluated to determine the clustering effect, and the parameters of the clustering algorithm may be adjusted to achieve a better text clustering effect, such as using the silhouette coefficient or the DB index (Davies-Bouldin Index).

[0047] In a specific example, the silhouette coefficient of text clustering can be used to evaluate the clustering results. The silhouette coefficient measures the similarity of each text data point with other text data points in its cluster, as well as the dissimilarity of the data point with the text data points in the nearest cluster. First, for each text data point i, the average similarity a between it and other text data points in the same cluster is calculated. i , you can use cosine similarity or other text similarity metrics:

[0048]

[0049] Among them, C i is the set of text data points in cluster i, d i is the text data point i, d j is the text data point j. Then, for each text data point i, calculate its average dissimilarity b with other text data points in the nearest cluster i :

[0050]

[0051] Among them, C k are clusters different from cluster i, d i is the text data point i, d j is the text data point j. For each text data point i, calculate the silhouette coefficient s i :

[0052]

[0053] Calculate the average of the silhouette coefficients of all text data points as the overall text clustering silhouette coefficient TextSilhouetteCoefficient:

[0054]

[0055] Where n is the total number of text data points. The value range of the text clustering silhouette coefficient is [-1,1]. The closer the silhouette coefficient is to 1, the better the clustering effect. If the silhouette coefficient of a text data point is negative, it means that the data point is more likely to be assigned to the wrong cluster. For the overall clustering result, the higher the silhouette coefficient, the higher the similarity within the cluster and the lower the similarity between clusters, and the better the clustering effect.

[0056] After obtaining each cluster log set, parse and process each cluster log set separately. For example, regular expressions can be used to match specific patterns in the log to identify and classify log entries; pre-trained classifiers (such as support vector machines, random forests, or gradient boosting trees, etc.) are used to automatically identify and classify log entries; natural language processing techniques, such as named entity recognition, sentiment analysis, or topic modeling, are used to extract semantic information from the log, and features are extracted and assigned labels based on the extracted features. The acquired features or labels are combined to obtain the behavior event label sets corresponding to each cluster log set.

[0057] S130: Combine the cluster log set with the matching behavior event tag set to obtain target tag data.

[0058] Specifically, the operation data within T-1 consecutive time points in the clustered log set, that is, T-1 logs in the clustered log set, are used to connect the data points in chronological order to form a data stream or data sequence with time continuity, and the serialized data is converted into a specific numerical form so that the model can process it, for example, by feature normalization or standardization, the feature is scaled to a specific range, such as 0 to 1 or a range with a mean of 0 and a standard deviation of 1. Finally, the target labeled data with a dimension of (T-1, L) is formed. Among them, T-1 represents the number of time points, which means that the value of the Tth data point is predicted by the previous T-1 historical data points, and the value of T does not exceed the total number of data points n. L represents the number of feature dimensions at each time point, corresponding to the number of behavioral event label features corresponding to each T-1 log in the matching behavioral event label set. In the case of a large amount of data, a larger T value can be selected so that the model can capture longer-term dependencies. In the case of a small amount of data, the T value should be appropriately reduced. In addition, if the data has obvious periodicity, the selection of T should match the periodicity. For example, if user behavior varies significantly at certain times of day, T could be set to 24 hours.

[0059] S140, inputting each target tag data into a pre-trained long short-term memory model, respectively, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and a target behavior occurrence probability corresponding to each target behavior operation.

[0060] In the embodiment of the present invention, Long Short-Term Memory (LSTM) is a deep learning model commonly used to process sequence data, which is characterized by being able to capture long-term dependencies and is suitable for modeling and predicting time series data. The LSTM model is composed of multiple LSTM units, each of which includes an input gate, a forget gate, an output gate, and a memory unit. Among them, the input gate controls the input of new information, the forget gate controls the forgetting of old information, and the output gate controls the output information. The memory unit is responsible for memorizing and transmitting information to capture long-term dependencies in sequence data.

[0061] Each target label data is input into the pre-trained long short-term memory model. The output of the model is the target behavior operation at the current time point and its corresponding target behavior occurrence probability. The output result can be expressed as a probability vector with a dimension of (Λ, 1), where Λ represents the number of target behavior operations. The softmax function is used to convert the original output of the model into a probability distribution. The formula is as follows:

[0062]

[0063] in, Represents a given target label data In the case of , output the target behavior operation y i The probability of h i Represents the raw output of the model.

[0064] S150 , monitoring the target user for abnormal behavior according to an abnormal monitoring rule matched with the target user, based on the target behavior operation and the occurrence probability of the matched target behavior.

[0065] In an embodiment of the present invention, the anomaly monitoring rules for target user matching can be specifically understood as: a set of criteria customized according to the behavior patterns, historical data and business logic of a specific user group or individual, which are used to identify and mark behaviors that do not conform to normal behavior patterns. By collecting user behavior data, such as login time, operation type and frequency, etc., key features can be extracted from these data, and a baseline behavior model can be established as an anomaly monitoring rule that describes the normal behavior of the target user.

[0066] Specifically, the target behavior operation and the probability of the matched target behavior are obtained in real time, the real-time data is compared with the anomaly monitoring rules matched with the target user, the deviation between them is calculated (such as cosine similarity or Euclidean distance, etc.), and the weighted sum of the deviation and the probability of the target behavior is converted into an anomaly score or probability (by standardizing the result to make the score conform to a specific distribution, such as Gaussian distribution or uniform distribution, etc.), and a threshold is set in advance. When the anomaly score exceeds this threshold, the system will automatically trigger an anomaly alarm.

[0067] The technical solution of the embodiment of the present invention obtains the logs generated by the user within the set time, divides and clusters them according to the target time period to obtain a cluster log set, parses the cluster log set to obtain the corresponding behavior event label set, and inputs the combination of the two into the pre-trained long-term and short-term memory model to obtain at least one target behavior operation predicted for each target label data, and the corresponding probability of occurrence of the target behavior, and based on the target behavior operation and its probability of occurrence, according to the matched abnormal monitoring rules, monitors the target user for abnormal behavior. By integrating the deep learning model with cluster analysis, the accuracy of monitoring is improved, and the automated data processing method reduces the manpower and time costs, improves the monitoring efficiency and real-time performance, and thus improves the reliability of user abnormal behavior identification and security assessment.

[0068] Optionally, based on the above embodiments, parsing each cluster log set to obtain a behavior event tag set corresponding to each cluster log set may include:

[0069] The behavior fragment logs in each target cluster log set are parsed through a pre-configured large-scale deep learning model to generate text data events of each behavior corresponding to each target cluster log set;

[0070] According to the behavior event label corresponding to each behavior text data event, a behavior event label set corresponding to each target cluster log set is organized.

[0071] In the embodiments of the present invention, large-scale deep learning models refer to deep learning models with large-scale parameters and complex network structures, which can process and understand large amounts of data. When analyzing behavioral fragments, large-scale deep learning models can not only understand the operation behavior of a single user, but also combine global data and contextual information to better understand the semantics and purpose of user behavior.

[0072] Specifically, the preprocessed and vectorized behavior fragment logs in each target cluster log set are input into a large deep learning model, which understands the semantics and contextual relationships of the text globally. By analyzing the text data, the model can capture the complex patterns of user behavior, while taking into account the correlation between different texts, and output the interpretation corresponding to each target cluster log set, that is, each behavior text data event, which includes the semantic understanding of user behavior and the analysis of contextual relationships.

[0073] When processing the target cluster log set, since multiple behavior events contained therein may correspond to the same label, deduplication is required to avoid duplication and ensure the accuracy and uniqueness of the behavior event label set corresponding to each cluster log set. For example, based on the specific behavior event label associated with each behavior text data event, a behavior event label set that corresponds to each target cluster log set and does not contain duplicates can be sorted and constructed, ensuring the accuracy and efficiency of the behavior event label set.

[0074] In addition, during the model analysis process, transfer learning and incremental learning methods can also be used to adjust model parameters online through fine-tuning using each cluster log set to reflect the latest data trends. When the model receives a new cluster log set, it can gradually integrate new information instead of completely retraining. It retains previously learned knowledge while absorbing new knowledge. It can adapt to the ever-changing data distribution and behavior patterns, thereby improving the model's adaptability and generalization capabilities.

[0075] Optionally, based on the above embodiments, according to the abnormal monitoring rules matched with the target user, based on the target behavior operation and the occurrence probability of the matched target behavior, monitoring the abnormal behavior of the target user may include:

[0076] Monitor whether the target behavior operation of the target user complies with the anomaly monitoring rule matching the target user, and whether the probability of occurrence of the matched target behavior is less than the threshold value set in the anomaly monitoring rule matching the target user;

[0077] If so, monitor each user behavior log generated within the next set time interval;

[0078] If not, an exception warning is issued.

[0079] Specifically, the system first monitors the user's target behavior operations and compares these operations with the abnormal monitoring rules set for the user. The rules may include specific behavior patterns, operation frequencies, and operation sequence processes. For each user group or user group after clustering, their operations are actually similar.

[0080] In a specific example, a user group or user group under the financial business cannot perform operations under the assembly line business. If a user in the user group or user group under the financial business performs an operation that can only be performed by the assembly line business user group, that is, a specific behavior pattern is violated, and the corresponding behavior probability is greater than or equal to the threshold set in the anomaly monitoring rule matching the target user, it indicates that the behavior is highly abnormal and an abnormal warning is issued.

[0081] In a specific example, the business processing flow is usually a series of fixed and continuous operations that need to be performed in a predetermined order. If in this process, a certain executed operation is not followed by a predetermined specific step, violating the sequential flow of the operation, and the corresponding behavior probability is greater than or equal to the threshold set in the anomaly monitoring rule matching the target user, it indicates that the behavior has a high degree of abnormality. The system will identify this situation as an anomaly and issue a corresponding abnormal warning.

[0082] Monitor the target user's target behavior operations and the probability of the matching target behavior in real time. If the target user's matching anomaly monitoring rules are met and the probability of the behavior is less than the threshold, it means that the user behavior is normal within the current set time interval. Continue to obtain the user behavior logs generated within the next set time interval to monitor abnormal user behavior.

[0083] When the target behavior operation violates the abnormal monitoring rules and the probability of the target behavior reaches or exceeds the threshold, an abnormal warning is issued, which can timely discover and handle possible risk events and maintain the stability and security of the system. The automated monitoring method reduces manpower and time costs, improves monitoring efficiency and real-time performance, and thus improves the reliability of user abnormal behavior identification and security assessment.

[0084] Embodiment 2

[0085] Figure 2 A flow chart of another method for monitoring abnormal user behavior provided in Example 2 of the present invention. This embodiment is a refinement of the operation of dividing each user behavior log into behavior segments according to a target time period in the above-mentioned embodiment to obtain each behavior segment log, specifically including: determining the target time period according to the behavior time of each unit user in each user behavior log; dividing the target behavior log into behavior segments according to the target time period according to the time and space generated by each unit user behavior to obtain a behavior segment log.

[0086] Correspondingly, such as Figure 2 As shown, the method includes:

[0087] S210: Obtain each user behavior log generated by the target user within a set time interval.

[0088] S220: Determine a target time period according to the user behavior time of each unit in each user behavior log.

[0089] In the embodiment of the present invention, the unit user behavior time can be specifically understood as: the user behavior recorded in the user behavior log, and the time spent by a single user on a specific behavior can be recorded through the timestamp or duration field of the action in the log.

[0090] Specifically, the selection of the target time period needs to be determined according to the actual situation and data characteristics. In general, the selection of the target time period should ensure that each segment contains enough information to support subsequent analysis and prediction, while also avoiding being too long to avoid unnecessary computational complexity. In general, the selection of the target time period should be as short as possible while ensuring that the temporal patterns and regularities of user behavior can be captured. In general, the target time period usually needs to rely on empirical judgment, but a value between the maximum and minimum time units of user behavior should be selected. For example, if the unit user behavior time is 1, 2, 3, 4, and 5 time units, then it is reasonable to select 3 time units as the target time period. However, when faced with extreme values, such as 1, 2, 3, 4, and 999 time units, the strategy for selecting the target time period can adopt the judges' scoring strategy, that is, removing the highest and lowest scores to reduce the impact of abnormal data. Next, perform statistical analysis on the remaining data, such as calculating statistics such as the mean and median, and determine a reasonable time period range based on these results. Within this range, select a typical time interval that can represent most user behaviors as the target time period. If there are too many extreme values, or there are very few active users who may log in once in a long period of time (such as a year), the behavior of such users should be classified and processed separately to avoid distortion of the overall analysis.

[0091] S230 , dividing the target behavior log into behavior segments according to the time and space of each unit user behavior and the target time period to obtain a behavior segment log.

[0092] Specifically, in the process of dividing the behavior segments of each user behavior log generated by the target user within the set time interval, it is necessary not only to divide the user's operations according to the timeline, but also to consider the continuity of the user's operation behavior in time and space, as well as the possible differences in the operation behavior on different machine IPs (Internet Protocol Address, network interface protocol addresses).

[0093] During the behavior segmentation process, even if there is a gap between the user's operations, if they are continuous in time, they should still be divided into the same behavior segment to ensure the continuity of the behavior operations in time. For example, when a user is browsing a web page, he first clicks on a link, and then clicks on another link a few minutes later. Although these two operations are not continuous in time, if they are part of the user's exploration of the same topic or completion of the same task, they are continuous in behavior.

[0094] In the process of behavior segmentation, in addition to temporal continuity, the spatial continuity of operation behaviors on different machine IPs must also be considered. Even if the machine IPs are different, if the user's operations on different machines have a certain correlation or continuity, they should be divided into the same behavior segment. For example: if a user searches for a product on a computer in the office and then continues to view the detailed information of the product on a mobile phone at home, the two behavior operations are considered to be spatially continuous.

[0095] In the process of dividing the behavior segments, we may encounter situations where the user operation records in certain time periods are less than the target time period length. Special markers can be used to fill these parts that are less than the target time period, such as zero filling or front and back data filling. In subsequent processing, these special markers can be identified and separated, thereby maintaining the continuity and integrity of the behavior segments and avoiding analysis deviations caused by missing data.

[0096] S240: Clustering the behavior fragment logs to obtain a plurality of cluster log sets, and parsing each cluster log set to obtain a behavior event tag set corresponding to each cluster log set.

[0097] S250: Combine the cluster log set with the matching behavior event tag set to obtain target tag data.

[0098] S260, inputting each target tag data into a pre-trained long short-term memory model, respectively, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and the probability of occurrence of the target behavior corresponding to each target behavior operation.

[0099] S270: Monitor the target user for abnormal behavior according to the abnormal monitoring rules matched with the target user and based on the target behavior operation and the occurrence probability of the matched target behavior.

[0100] The technical solution of the embodiment of the present invention obtains the logs generated by the user within the set time, determines the target time period according to the time of each unit user behavior in each user behavior log, divides the target behavior log into behavior segments according to the time and space of each unit user behavior according to the target time period, and clusters to obtain a cluster log set, parses the cluster log set to obtain a corresponding behavior event label set, and inputs the combination of the two into a pre-trained long-term and short-term memory model to obtain at least one target behavior operation predicted for each target label data, and the probability of occurrence of the corresponding target behavior, based on the target behavior operation and its probability of occurrence, according to the matched abnormal monitoring rules, monitors the target user for abnormal behavior. By determining the target time period and dividing the user behavior log into behavior segments according to time and space continuity, the accuracy of the analysis can be improved, and the temporal pattern and trend of the user behavior can be captured more accurately. By integrating the deep learning model with cluster analysis, the accuracy of monitoring is improved, and the automated data processing method reduces the manpower and time costs, improves the monitoring efficiency and real-time performance, and thus improves the reliability of user abnormal behavior identification and security assessment.

[0101] Further, based on the above embodiments, before dividing each user behavior log into behavior segments according to the target time period to obtain each behavior segment log, the following may also be included:

[0102] Perform at least one of the following operations: deleting duplicate behavior records in the log, deleting meaningless behavior in the log, marking abnormal data in the log, unifying the data format of each data item in the log, processing missing values ​​in the log, and processing abnormal characters in the log, and perform log preprocessing on each user behavior log.

[0103] Specifically, before dividing each user behavior log into behavior segments according to the target time period and obtaining each behavior segment log, the quality and integrity of the data can be ensured through log preprocessing operations such as data cleaning and sorting. The data cleaning process may include at least one of: deleting repeated behavior records in the log, deleting meaningless behaviors in the log, marking abnormal data in the log, unifying the data format of each data item in the log, processing missing values ​​in the log, and processing abnormal characters in the log.

[0104] Deleting duplicate behavior records in the log refers to deduplicating duplicate records that have the same user ID (Identification), timestamp, machine IP, target machine IP, and behavior operation corresponding to the behavior operation. This can avoid repeated calculations of the same operation in subsequent analysis, improving data processing efficiency and analysis accuracy.

[0105] Deleting meaningless behaviors in logs means identifying and filtering out some meaningless or irrelevant behaviors, such as records automatically generated by the system, regular login operations, log records, data backups, automatic updates, automatic repairs, automatic synchronization, automatic cleanup, automatic restarts, and automatic notifications. These behaviors are not of substantial help for the purpose of analysis, and removing them can reduce data noise and improve the effect of subsequent analysis.

[0106] Marking abnormal data in logs means marking and recording some abnormalities or abnormal values, such as abnormally frequent operations, abnormally large amounts of data transmission, etc., for subsequent processing of abnormal characters in logs. These abnormal data may contain some potential security risks and require special attention and processing to improve the reliability of abnormal user behavior monitoring.

[0107] Unifying the data format of each data item in the log means unifying the format and structure of data from different sources (such as different systems, machines or users) to facilitate subsequent data integration and analysis. For example, unifying the format of timestamps, standardizing the description of user operations, etc. For example: if a user login is recorded as "login" in one system and "user_signin" in another system, these two descriptions need to be unified into a standard term, such as "user_login".

[0108] Processing missing values ​​in logs means that since the data is all text type, missing values ​​may appear as empty strings or special tags. When processing missing values, appropriate filling methods are used, such as using specific placeholders or filling the last valid operation content, to ensure the sequential continuity and integrity of the model input data. During model training, since the input window length is fixed, for example, when the input window length is 3, it means that the model can only read three sequential behaviors at a time. If the behavior data is less than 3 in a period of time due to data loss, it is necessary to fill in placeholders to maintain data continuity. For example, "work", "work 1" and "missing" can be filled with the last valid operation content, that is, "work", "work 1" and "work 1", or filled with specific placeholders, that is, "work", "work 1" and "worked, but not recorded". This ensures that the model can receive sequentially continuous and complete data, thereby avoiding prediction bias caused by incomplete data.

[0109] Processing abnormal characters in logs refers to detecting and processing abnormal characters or illegal characters that may exist in the data, such as deleting, replacing or escaping. In addition, the processing method can be set according to the usage requirements. For example, in some systems with high security requirements, incorrect command input may be regarded as a potential attack behavior and therefore recorded and processed separately. Relatively speaking, some more relaxed systems may regard these incorrect inputs as part of the operator's final correct input command. If the operator finally enters the correct command, these incorrect historical inputs will also be considered. These abnormal characters may cause errors or anomalies in the data analysis process and need to be cleaned up and repaired in time. By processing abnormal characters in logs, clearly marked normal or abnormal behavior samples can be provided for the subsequent model training process so that the model can learn to distinguish these behavioral characteristics.

[0110] Further, based on the above embodiments, before inputting each target label data into the pre-trained long short-term memory model respectively, the following steps may be further included:

[0111] Obtaining each user's historical behavior log generated within a set time interval, and dividing each user's historical behavior log into behavior segments according to a target historical time period to obtain each historical behavior segment log;

[0112] Perform clustering processing on each historical behavior segment log to obtain multiple historical cluster log sets, and perform parsing processing on each historical cluster log set to obtain a historical behavior event label set corresponding to each historical cluster log set;

[0113] Combine the historical clustering log set with the matching historical behavior event label set to obtain each target's historical label data;

[0114] The long short-term memory model is trained and optimized using the historical labeled data of each target to obtain the target long short-term memory model.

[0115] In the embodiment of the present invention, the historical behavior log can be specifically understood as: recording the detailed information of the historical interaction and historical behavior operation between the user and the system, which may include the historical operation time, historical operation type and historical operation content, etc. The target historical time period can be specifically understood as: further dividing the set time interval into smaller time units to more carefully analyze and identify the historical behavior pattern within a specific time period. The historical behavior fragment log can be specifically understood as: a log recorded for a behavior fragment, including all user historical behaviors within the behavior fragment. The historical cluster log set can be specifically understood as: a log set recording the user's historical behavior obtained after processing by a clustering algorithm, and the logs in these log sets represent similar user historical behavior patterns or events. The historical behavior event label set can be specifically understood as: a set of labels or features corresponding to each historical cluster log set, which describe the common features of the logs in the historical cluster log set or the historical behavior events represented. Target historical tag data: an input tensor obtained by combining the historical cluster log set with the matching historical behavior event label set, serializing and encoding.

[0116] Specifically, the training process of the long short-term memory model includes two stages: forward propagation and back propagation. In the forward propagation stage, the model predicts and calculates the loss function based on the historical labeled data of each target. The loss function can use the cross entropy loss function, and the formula is as follows:

[0117]

[0118] Among them, Loss represents the loss function, N represents the number of samples, Λ represents the number of categories, and y ij Indicates that sample i belongs to the true label of category j, It represents the model's predicted probability that sample i belongs to category j.

[0119] In the back propagation phase, the gradient descent algorithm is used to optimize the model parameters to minimize the loss function. The Adam optimization algorithm can be used to update the model parameters, and the formula is as follows:

[0120]

[0121] Among them, θ t represents the model parameters at the tth iteration, η represents the learning rate, and They represent the first-order moment estimate and the second-order moment estimate of the gradient, respectively, and ε is a small constant used for numerical stability. Through the above LSTM pre-training process, a model that can accurately predict the user operation sequence is constructed, ensuring the reliability and accuracy of the recognition and evaluation of user abnormal behavior.

[0122] Specific application scenarios

[0123] In the current field of network security, existing technical solutions for identifying abnormal user behavior are usually based on technologies such as rule engines, machine learning or deep learning, which aim to monitor and prevent malicious behavior. However, the rule engine-based method requires a lot of maintenance and updates, and it is difficult to cope with ever-changing threats. Traditional machine learning models have limited generalization capabilities when faced with complex user behaviors, and are prone to false positives or false negatives. Deep learning models require a large amount of data and computing resources to train, and are relatively difficult to tune and deploy in practical applications. To solve the above problems, an embodiment of the present invention proposes a method for monitoring abnormal user behavior, which may specifically include:

[0124] 1. Data cleaning and organization

[0125] The data cleaning process includes at least one of removing duplicate records, filling in missing values, and filtering out meaningless behaviors (such as automatic system operations and regular logins), while marking abnormal data for subsequent analysis. In the data sorting stage, user behavior data and operation result data are merged for subsequent feature extraction and model training.

[0126] Deduplication of records refers to the deduplication of records with the same user ID, the same timestamp, the same machine IP, the same target machine IP, and the same operation, to avoid repeated calculations of the same operation in subsequent analysis, thereby improving data processing efficiency and analysis accuracy.

[0127] Screening out meaningless behaviors means identifying and screening out some meaningless or irrelevant behaviors, such as records automatically generated by the system and routine login operations. Removing them can reduce data noise and improve the effectiveness of subsequent analysis.

[0128] Abnormal data marking refers to marking and recording some abnormalities or abnormal values, such as abnormally frequent operations and abnormally large amounts of data transmission, etc. These abnormal data may contain some potential security risks and require special attention and processing.

[0129] Data format unification refers to unifying the format and structure of data from different sources to facilitate subsequent data integration and analysis. For example, unifying the format of timestamps and standardizing the description of user operations.

[0130] Missing value processing means that since the data is all text type, there may be missing values ​​in the data in the form of empty strings or special tags. When processing missing values, it is necessary to use appropriate filling methods to fill them, such as using specific placeholders or filling in the last valid operation content.

[0131] Abnormal character processing refers to monitoring and processing abnormal characters or illegal characters that may exist in the data. These abnormal characters may cause errors or anomalies in the data analysis process and need to be cleaned up and repaired in time.

[0132] Through data cleaning and organization, we can obtain a high-quality and clearly structured data set, which lays the foundation for subsequent user behavior analysis and model training.

[0133] 2. Behavior segmentation

[0134] In the process of dividing the behavior segments, not only are the user's operations divided according to the timeline, but the operation behaviors on different machine IPs are also considered to comprehensively consider the user's behavior patterns in different environments and improve the robustness and generalization ability of the model. At the same time, when dividing the behavior segments, the time period T is set to an appropriate length to ensure that each segment contains enough information to support subsequent analysis and prediction.

[0135] In the process of dividing the behavior segments, it is necessary to consider the continuity of the user's operation behavior in time and space, as well as the possible differences in operation behavior on different machine IPs.

[0136] Considering the time continuity, it is necessary not only to divide the user's operations according to the timeline, but also to consider the continuity of the operations in time. Even if there is a gap between the user's operations, if they are continuous in time, they should still be divided into the same behavior segment. Doing so helps capture the time pattern and timing regularity of user operations.

[0137] In terms of spatial continuity, in addition to temporal continuity, the spatial continuity of operation behaviors on different machine IPs should also be considered. Even if the machine IPs are different, if the user's operations on different machines have a certain correlation or continuity, they should be classified into the same behavior segment. This helps to comprehensively consider the user's behavior patterns and habits in different environments.

[0138] The choice of time period T needs to be determined based on the actual situation and data characteristics. Generally speaking, the choice of T should ensure that each segment contains enough information to support subsequent analysis and prediction, while not being too long to cause excessive computational complexity. Generally speaking, the choice of T should be as small as possible based on being able to capture the time pattern and regularity of user behavior.

[0139] When dividing the behavior segments, you may encounter situations where the user operation records in some time periods are less than T time points. In order to maintain the continuity and integrity of the behavior segments, special markers can be used to fill in these parts that are less than T time points. This helps maintain the integrity and stability of the data and avoids interference with subsequent analysis.

[0140] Through the behavior segment division strategy, the user's operation behaviors can be effectively divided, and the continuity and integrity of the behavior segments are ensured, providing a reliable data basis for subsequent data analysis and model training.

[0141] 3. Sample Sampling Based on Clustering

[0142] The method of cluster analysis is used to sample the behavior segments to ensure the diversity and representativeness of the samples. When performing clustering, considering the complexity and diversity of user behaviors, an adaptive clustering algorithm is adopted, which can automatically adjust the number and shape of clustering clusters according to the data characteristics, improving the accuracy and stability of the clustering results. In the process of clustering sample sampling based on text data, a method based on text vectorization is adopted and combined with the K-means algorithm for cluster analysis. The specific steps can be:

[0143] (1) Text Preprocessing

[0144] Through text preprocessing, the original text data is cleaned and standardized to make it suitable for subsequent vectorization processing. The text preprocessing process can include: word segmentation, stop word removal, and stemming. Among them, word segmentation refers to splitting the text data into words or phrases; stop word removal refers to removing common words that have little impact on the meaning of the text, such as "de" (of) and "shi" (is), etc.; stemming refers to reducing words to their stem forms to reduce the impact of word form changes on the analysis results.

[0145] The processed text data is represented as: D = {d1, d2,..., d n}, where d i represents the i-th text data.

[0146] (2) Text Vectorization

[0147] Text vectorization converts the preprocessed text data into numerical feature vectors for the application of clustering algorithms. Methods such as the bag-of-words model or TF-IDF can be selected for processing. Among them, the bag-of-words model refers to representing each document as a vector, and each element of the vector represents the number of occurrences or frequency of a word in the vocabulary in the document; TF-IDF refers to representing each document as a vector, and each element of the vector represents the TF-IDF value of a word in the vocabulary, which is used to measure the importance of the word for the document.

[0148] Assuming the size of the vocabulary is V and the text data set D contains n vocabulary words, after text vectorization, the text data set D can be represented as an n×V matrix, denoted as X.

[0149] (3) Application of Clustering Algorithm

[0150] After the text is vectorized, the K-means algorithm is used to cluster the text data. The K-means algorithm divides the text data into K clusters, where each cluster is composed of the text data within it, so that the similarity of the text data within the cluster is high, while the similarity of the text data between different clusters is low. The specific process can be: randomly select K text vectors as the initial cluster center; assign each text vector to the cluster corresponding to the cluster center closest to it; recalculate the cluster center based on the text vectors in each cluster; repeat the above steps until the cluster center no longer changes or reaches the predetermined number of iterations.

[0151] Assume that the text dataset D is divided into K clusters, denoted by C = {c1, c2, ..., c k}, where each cluster c i Contains m i text data, the goal of the K-means algorithm is to minimize the intra-cluster squared error (SSE):

[0152]

[0153] Among them, x i Represents cluster c i The i-th text vector in i Represents cluster c i The cluster center of .

[0154] (4) Clustering result evaluation

[0155] Evaluation of clustering results is an important step in determining the quality of clustering results. For example, the quality of clustering results can be evaluated by using the silhouette coefficient or DB index, and clustering parameters can be adjusted as needed. The embodiment of the present invention uses the silhouette coefficient of text clustering, which measures the similarity of each text data point with other text data points in the cluster to which it belongs, as well as the dissimilarity of the data point with the text data points in the nearest cluster. The calculation method of the silhouette coefficient can be:

[0156] For each text data point i, calculate its average similarity a with other text data points in the same cluster i , you can use cosine similarity or other text similarity metrics:

[0157]

[0158] Among them, C i is the set of text data points in cluster i, d i is the text data point i, d j is the text data point j.

[0159] For each text data point i, calculate its average dissimilarity b with other text data points in the nearest clusteri :

[0160]

[0161] Among them, C k are clusters different from cluster i, d i is the text data point i, d j is the text data point j.

[0162] For each text data point i, calculate the silhouette coefficient s i :

[0163]

[0164] Calculate the average of the silhouette coefficients of all text data points as the overall text clustering silhouette coefficient:

[0165]

[0166] Where n is the total number of text data points.

[0167] The value range of the text clustering silhouette coefficient is [-1,1]. The closer the silhouette coefficient is to 1, the better the clustering effect. If the silhouette coefficient of a text data point is negative, it means that the data point is more likely to be assigned to the wrong cluster. For the overall clustering result, the higher the silhouette coefficient, the higher the similarity within the cluster and the lower the similarity between clusters, and the better the clustering effect. In addition, according to the value of the silhouette coefficient, the parameters of the clustering algorithm can be adjusted to achieve better text clustering effect.

[0168] The clustering sample sampling process based on text vectorization includes steps such as text preprocessing, text vectorization, clustering algorithm application, and clustering result evaluation. Through these steps, a representative and diverse text sample set can be obtained, providing a reliable data foundation for subsequent model training and analysis.

[0169] 4. Large Model Analysis

[0170] When analyzing behavioral fragments, large-scale deep learning models not only consider the operation behavior of individual users, but also combine global data and contextual information to better understand the semantics and purpose of user behavior. In the model analysis process, transfer learning and incremental learning methods are used to adapt to the changing data distribution and behavior patterns, improving the adaptability and generalization ability of the model. In the large model analysis stage, deep learning models are used to further parse and understand text data to capture higher-level semantics and contextual information. The specific process may include:

[0171] (1) Text data input

[0172] The preprocessed and vectorized text data is fed into a large deep learning model where the input to the model is the vector representation of the text data.

[0173] (2) Model analysis

[0174] Large deep learning models are able to understand the semantics and context of text at a global level. By analyzing text data, the model is able to capture complex patterns of user behavior while taking into account the relevance between different texts.

[0175] (3) Output interpretation

[0176] The information output by the model is an interpretation of text data, including semantic understanding of user behavior and analysis of contextual relationships. This information will help determine whether user behavior conforms to normal patterns, thereby identifying potential abnormal or suspicious behavior.

[0177] (4) Mark back data

[0178] The information output by the model will be marked back to the original data for subsequent data analysis and model training. The marking is used to build a semantic model of user behavior and further improve the accuracy of identifying abnormal behavior.

[0179] Through large-scale model analysis, we can understand text data more comprehensively and deeply, provide richer semantic information for subsequent operations, and thus enhance the ability to analyze and judge abnormal user behavior. The output of this stage will become part of the comprehensive consideration, which will help to more accurately judge the normality and abnormality of user behavior.

[0180] 5. LSTM model training

[0181] Based on the labeled data, an LSTM model was established to predict the user operation category and probability at the current time point by performing sequence modeling on the operation data of consecutive T-1 time points. During the model training process, deep neural network and sequence modeling technology were used to capture the temporal correlation and regularity of user behavior through multi-level feature extraction and abstraction, thereby improving the prediction accuracy and stability of the model.

[0182] LSTM is a deep learning model for processing sequence data, which can capture long-term dependencies and is suitable for modeling and predicting time series data. The method for monitoring abnormal user behavior proposed in the embodiment of the present invention uses the LSTM model to model the user operation sequence and predict the user operation category and probability at the current time point.

[0183] The LSTM model consists of multiple LSTM units, each of which contains an input gate, a forget gate, an output gate, and a memory unit. The input gate controls the input of new information, the forget gate controls the forgetting of old information, and the output gate controls the output information. The memory unit is responsible for memorizing and transmitting information to capture long-term dependencies in sequence data.

[0184] The input of the model is the operation data of consecutive T-1 time points. By serializing and encoding the operation data, an input tensor with a dimension of (T-1, L) is obtained, where T-1 represents the number of time points, T is less than or equal to the total number of data points n, and L represents the feature dimension of each time point.

[0185] The output of the model is the predicted probability distribution of the user operation category at the current time point, which can be expressed as a probability vector with a dimension of (Λ, 1), where Λ represents the number of operation categories. The softmax function is used to convert the original output of the model into a probability distribution, and the formula is as follows:

[0186]

[0187] in, Represents a given input In the case of i The probability of h i Represents the raw output of the model.

[0188] The model training process includes two stages: forward propagation and back propagation. In the forward propagation stage, the model makes predictions based on the input data and calculates the loss function. The loss function can be a cross entropy loss function, and the formula is as follows:

[0189]

[0190] Among them, Loss represents the loss function, N represents the number of samples, Λ represents the number of categories, and y ij Indicates that sample i belongs to the true label of category j, It represents the model's predicted probability that sample i belongs to category j.

[0191] In the back propagation phase, the gradient descent algorithm is used to optimize the model parameters to minimize the loss function. The Adam optimization algorithm can be used to update the model parameters, and the formula is as follows:

[0192]

[0193] Among them, θ t represents the model parameters at the tth iteration, η represents the learning rate, and denote the first-order moment estimate and the second-order moment estimate of the gradient respectively, and ε is a small constant for numerical stability.

[0194] Through the above LSTM model training process, a model that can accurately predict user operation sequences can be obtained, providing reliable support for subsequent user abnormal behavior identification and user behavior security assessment.

[0195] According to the preset abnormal behavior monitoring rules, the target behavior operation and the probability of target behavior occurrence are monitored, and an abnormal warning is issued when the preset abnormal behavior monitoring rules are violated.

[0196] A method for monitoring abnormal user behavior proposed in an embodiment of the present invention adopts a method combining a deep learning model and cluster analysis, which can more accurately identify abnormal user behavior, reduce false positives and false negatives, and improve accuracy; the automated data processing and model analysis process reduces labor costs and time costs; the model training and prediction process can be completed in a shorter time, realizing real-time monitoring and response to abnormal user behavior, and improving real-time performance.

[0197] Embodiment 3

[0198] Figure 3 This is a schematic diagram of the structure of a monitoring device for abnormal user behavior provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a behavior classification module 310, a clustering processing module 320, a data combination module 330, a model prediction module 340 and an abnormality monitoring module 350, wherein:

[0199] The behavior segmentation module 310 is used to obtain each user behavior log generated by the target user within a set time interval, and to divide each user behavior log into behavior segments according to the target time period to obtain each behavior segment log;

[0200] The cluster processing module 320 is used to perform cluster processing on each behavior segment log to obtain multiple cluster log sets, and parse each cluster log set to obtain a behavior event tag set corresponding to each cluster log set;

[0201] The data combination module 330 is used to combine the cluster log set with the matching behavior event tag set to obtain each target tag data;

[0202] The model prediction module 340 is used to input each target tag data into the pre-trained long short-term memory model, and obtain at least one target behavior operation matched with the target user predicted for each target tag data, and the probability of occurrence of the target behavior corresponding to each target behavior operation;

[0203] The abnormality monitoring module 350 is used to monitor the abnormal behavior of the target user according to the abnormality monitoring rules matched with the target user, based on the target behavior operation and the probability of occurrence of the matched target behavior.

[0204] The technical solution of the embodiment of the present invention obtains the logs generated by the user within the set time, divides and clusters them according to the target time period to obtain a cluster log set, parses the cluster log set to obtain the corresponding behavior event label set, and inputs the combination of the two into the pre-trained long-term and short-term memory model to obtain at least one target behavior operation predicted for each target label data, and the probability of occurrence of the corresponding target behavior, and based on the target behavior operation and its probability of occurrence, according to the matched abnormal monitoring rules, monitors the target user for abnormal behavior. By integrating the deep learning model with cluster analysis, the accuracy of monitoring is improved, and the automated data processing method reduces the manpower and time costs, improves the monitoring efficiency and real-time performance, and thus improves the reliability of user abnormal behavior identification and user behavior security assessment.

[0205] Based on the above embodiments, the clustering processing module 320 is specifically used for:

[0206] The behavior fragment logs in each target cluster log set are parsed through a pre-configured large-scale deep learning model to generate text data events of each behavior corresponding to each target cluster log set;

[0207] According to the behavior event label corresponding to each behavior text data event, a behavior event label set corresponding to each target cluster log set is organized.

[0208] Based on the above embodiments, the abnormality monitoring module 350 is specifically used for:

[0209] Monitor whether the target behavior operation of the target user complies with the anomaly monitoring rule matching the target user, and whether the probability of occurrence of the matched target behavior is less than the threshold value set in the anomaly monitoring rule matching the target user;

[0210] If so, monitor each user behavior log generated within the next set time interval;

[0211] If not, an exception warning is issued.

[0212] Based on the above embodiments, the behavior classification module 310 is specifically used for:

[0213] Determine the target time period based on the user behavior time of each unit in each user behavior log;

[0214] According to the time and space of user behavior of each unit, the target behavior log is divided into behavior segments according to the target time period to obtain the behavior segment log.

[0215] Further, based on the above embodiments, the user behavior monitoring device may further include: a log preprocessing module, wherein:

[0216] The log preprocessing module is used to divide each user behavior log into behavior segments according to the target time period, and before obtaining each behavior segment log, perform at least one of the operations of deleting repeated behavior records in the log, deleting meaningless behaviors in the log, marking abnormal data in the log, unifying the data format of each data item in the log, processing missing values ​​in the log, and processing abnormal characters in the log, so as to perform log preprocessing on each user behavior log.

[0217] Further, based on the above embodiments, the monitoring device for abnormal user behavior may further include: a historical behavior classification module, a historical behavior clustering module, a historical data combination module and a model training module, wherein:

[0218] A historical behavior segmentation module is used to obtain each user's historical behavior log generated within a set time interval before inputting each target label data into a pre-trained long short-term memory model, and to segment each user's historical behavior log into behavior segments according to a target historical time period to obtain each historical behavior segment log;

[0219] The historical behavior clustering module is used to cluster each historical behavior segment log to obtain multiple historical cluster log sets, and parse each historical cluster log set to obtain the historical behavior event label set corresponding to each historical cluster log set;

[0220] A historical data combination module is used to combine the historical cluster log set with the matching historical behavior event tag set to obtain each target historical tag data;

[0221] The model training module is used to train and optimize the long short-term memory model using the historical labeled data of each target to obtain the target long short-term memory model.

[0222] The device for monitoring abnormal user behavior provided in the embodiment of the present invention can execute the method for monitoring abnormal user behavior provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0223] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0224] Embodiment 4

[0225] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0226] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0227] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0228] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the monitoring method of abnormal user behavior, that is:

[0229] Obtain each user behavior log generated by the target user within a set time interval, and divide each user behavior log into behavior segments according to the target time period to obtain each behavior segment log;

[0230] Clustering each behavior fragment log to obtain multiple cluster log sets, and parsing each cluster log set to obtain a behavior event label set corresponding to each cluster log set;

[0231] Combine the clustered log set with the matching behavior event label set to obtain each target label data;

[0232] Inputting each target tag data into a pre-trained long short-term memory model, respectively, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and a target behavior occurrence probability corresponding to each target behavior operation;

[0233] According to the abnormal monitoring rules matching the target user, the target user is monitored for abnormal behavior based on the target behavior operation and the matching target behavior occurrence probability.

[0234] In some embodiments, the method for monitoring abnormal user behavior may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for monitoring abnormal user behavior described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method for monitoring abnormal user behavior in any other appropriate manner (e.g., by means of firmware).

[0235] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0236] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0237] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0238] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0239] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0240] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0241] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0242] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for monitoring abnormal behavior of a user, characterized in that: include: Obtain each user behavior log generated by the target user within a set time interval, and divide each user behavior log into behavior segments according to the target time period to obtain each behavior segment log; Clustering each behavior fragment log to obtain multiple cluster log sets, and parsing each cluster log set to obtain a behavior event label set corresponding to each cluster log set; Combine the clustered log set with the matching behavior event label set to obtain each target label data; Inputting each target tag data into a pre-trained long short-term memory model, respectively, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and a target behavior occurrence probability corresponding to each target behavior operation; According to the abnormal monitoring rules matching the target user, the target user is monitored for abnormal behavior based on the target behavior operation and the matching target behavior occurrence probability.

2. The method according to claim 1, characterized in that: Each cluster log set is parsed and processed respectively to obtain the behavior event label set corresponding to each cluster log set, including: The behavior fragment logs in each target cluster log set are parsed through a pre-configured large-scale deep learning model to generate text data events of each behavior corresponding to each target cluster log set; According to the behavior event label corresponding to each behavior text data event, a behavior event label set corresponding to each target cluster log set is organized.

3. The method according to claim 1, characterized in that According to the abnormal monitoring rules matching the target user, based on the target behavior operation and the probability of the matching target behavior, the target user's abnormal behavior is monitored, including: Monitor whether the target behavior operation of the target user complies with the anomaly monitoring rule matching the target user, and whether the probability of occurrence of the matched target behavior is less than the threshold value set in the anomaly monitoring rule matching the target user; If so, monitor each user behavior log generated within the next set time interval; If not, an exception warning is issued.

4. The method according to any one of claims 1 to 3, characterized in that: Divide each user's behavior log into behavior segments according to the target time period to obtain each behavior segment log, including: Determine the target time period based on the user behavior time of each unit in each user behavior log; According to the time and space of user behavior of each unit, the target behavior log is divided into behavior segments according to the target time period to obtain the behavior segment log.

5. The method according to any one of claims 1 to 3, characterized in that: Before dividing each user behavior log into behavior segments according to the target time period to obtain each behavior segment log, the following is also included: Perform at least one of the following operations: deleting duplicate behavior records in the log, deleting meaningless behavior in the log, marking abnormal data in the log, unifying the data format of each data item in the log, processing missing values ​​in the log, and processing abnormal characters in the log, and perform log preprocessing on each user behavior log.

6. The method according to any one of claims 1 to 3, characterized in that: Before each target labeled data is input into the pre-trained long short-term memory model, it also includes: Obtaining each user's historical behavior log generated within a set time interval, and dividing each user's historical behavior log into behavior segments according to a target historical time period to obtain each historical behavior segment log; Perform clustering processing on each historical behavior segment log to obtain multiple historical cluster log sets, and perform parsing processing on each historical cluster log set to obtain a historical behavior event label set corresponding to each historical cluster log set; Combine the historical clustering log set with the matching historical behavior event label set to obtain each target's historical label data; The long short-term memory model is trained and optimized using the historical labeled data of each target to obtain the target long short-term memory model.

7. A monitoring device for abnormal user behavior, characterized in that: include: The behavior segmentation module is used to obtain each user behavior log generated by the target user within a set time interval, and divide each user behavior log into behavior segments according to the target time period to obtain each behavior segment log; A cluster processing module is used to perform cluster processing on each behavior segment log to obtain multiple cluster log sets, and parse each cluster log set to obtain a behavior event label set corresponding to each cluster log set; A data combination module is used to combine the cluster log set with the matching behavior event label set to obtain each target label data; A model prediction module, used to input each target tag data into a pre-trained long short-term memory model, to obtain at least one target behavior operation matched with the target user predicted for each target tag data, and a target behavior occurrence probability corresponding to each target behavior operation; The anomaly monitoring module is used to monitor the abnormal behavior of the target user according to the anomaly monitoring rules matched with the target user, based on the target behavior operation and the probability of occurrence of the matched target behavior.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for monitoring abnormal user behavior according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for monitoring abnormal user behavior according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the method for monitoring abnormal behavior of a user according to any one of claims 1 to 6.

Images