Abnormal user behavior detection method based on space-time behavior characteristic data analysis

Abstract

The invention relates to the technical field of big data analysis, and discloses an abnormal user behavior detection method based on spatio-temporal behavior characteristic data analysis, comprising the following steps: S1, data acquisition: acquiring spatio-temporal behavior characteristic data of a user; s2, data preprocessing: preprocessing the data, and extracting spatio-temporal behavior characteristics; s3, feature dimension reduction: performing dimension reduction on the multi-modal feature matrix, and constructing a low-dimensional manifold space; s4, dynamic modeling: describing a local dynamic change mode of user behaviors; s5, distribution analysis: calculating a deviation degree; and S6, abnormity judgment: judging whether the user behavior is an abnormal user behavior or not. Non-linear dimension reduction of high-dimensional space-time behavior characteristic data is realized through a manifold learning technology, and manifold regularization constraint is adopted to ensure that a local geometric structure of the data is reserved in the dimension reduction process. Compared with a traditional method, the method has the advantages that the calculation complexity is effectively reduced, the accuracy of feature expression is remarkably improved, and high-quality input is provided for subsequent analysis.

Description

Technical Field

[0001] The present invention relates to the technical field of big data analysis, and in particular to an abnormal user behavior detection method based on spatiotemporal behavior feature data analysis. Background Art

[0002] With the rapid development of big data and artificial intelligence technologies, abnormal user behavior detection has become a core research direction in the fields of network security, intelligent transportation, financial risk control, etc. In the existing technology, methods based on statistical analysis, machine learning or rule models are usually used to achieve abnormal behavior detection. For example, traditional principal component analysis technology can reduce the dimension of data and extract main features to a certain extent, and methods based on clustering and classification algorithms are also widely used in the detection of abnormal behavior. In addition, for the modeling of dynamic behavior data, some technologies use time series analysis methods to characterize the changing trend of behavior and have achieved preliminary application results. These methods have shown good performance in specific scenarios and laid the foundation for anomaly detection.

[0003] However, with the increasing complexity and diversity of user behavior data, existing technologies have gradually exposed their limitations when facing spatiotemporal behavior feature data. Specifically, user behavior data usually presents high-dimensional nonlinear distribution characteristics, and traditional methods have difficulty capturing nonlinear correlations between features; the correlation analysis and dynamic fusion of multimodal data is still a technical difficulty, and conventional technologies often fail to fully explore the information interaction between modalities; in addition, dynamic behavior modeling is mostly limited to the analysis of short-term data, and its ability to describe long-term evolution trends is insufficient; in terms of measuring distribution differences, existing technologies mostly use simple distance calculation methods, which are difficult to adapt to the requirements of complex data distribution. Therefore, how to improve the accuracy and efficiency of detection when processing complex, multimodal, and dynamic spatiotemporal behavior feature data has become an urgent problem to be solved. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a method for detecting abnormal user behavior based on the analysis of spatiotemporal behavior feature data, which solves the problem of difficulty in detecting abnormal user behavior caused by nonlinear distribution, high-dimensional characteristics, multimodal association and dynamic change complexity in spatiotemporal behavior feature data.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for detecting abnormal user behavior based on spatiotemporal behavior feature data analysis, comprising the following steps: S1. Data collection: obtaining users’ spatiotemporal behavior feature data; S2, data preprocessing: preprocessing the spatiotemporal behavior feature data, extracting spatiotemporal behavior features, and forming a multimodal feature matrix; S3, feature dimensionality reduction: Based on the manifold learning method, the multimodal feature matrix is ​​reduced in dimension, a low-dimensional manifold space is constructed, and the local geometric relationship of the original data is maintained; S4, dynamic modeling: in the low-dimensional manifold space, the local dynamic change pattern of user behavior is characterized by Riemannian geometry analysis; S5. Distribution analysis: Based on the optimal transmission theory, calculate the deviation between the normal user behavior distribution and the current user behavior distribution; S6. Abnormality determination: Compare the degree of deviation with a preset threshold to determine whether it is abnormal user behavior.

[0006] Preferably, in step S1, the spatiotemporal behavior feature number includes: Temporal characteristics: the time point, time interval, and periodicity of the behavior; Spatial features: user’s geographical location, movement trajectory, and time spent at the location; Behavioral characteristics: the user's access resource types and device usage.

[0007] Preferably, the step S2 further comprises the following steps: S21, completing missing values ​​in spatiotemporal behavior feature data; S22, removing outliers in time and space characteristics; S23. Normalize the numerical range of the behavioral features to ensure that the features are within the same scale.

[0008] Preferably, in step S3, the manifold learning dimensionality reduction includes the following steps: S31, calculate the similarity of sample points in the spatiotemporal behavior feature data, build a neighborhood structure, and represent the local relationship between samples; S32, constructing a feature matrix related to the neighborhood structure to characterize geometric characteristics between samples; S33. Based on the constructed feature matrix, the data is subjected to dimensionality reduction processing to obtain a low-dimensional embedding representation that maintains geometric relationships.

[0009] Preferably, in the step S3, the dimensionality reduction process maintains the geometric relationship of the sample points in the neighborhood by introducing manifold regularization constraints, wherein the constraints include constructing a similarity matrix of local sample points and minimizing the relative error after projection of the sample points.

[0010] Preferably, in step S4, the local dynamic change mode includes: S41. Construct a local metric on a low-dimensional manifold space to characterize the changing characteristics of user behavior in a local area. S42. Calculate the degree of change of user behavior data in the low-dimensional manifold space to describe the dynamic evolution of the behavior; S43. Based on the abnormality judgment index of the degree of change, mark the potential abnormal points in the user behavior.

[0011] Preferably, in step S4, dynamic modeling is combined with time sliding window technology to segment user behavior data to capture short-term and long-term characteristics of behavior changes over time, and abnormal feature points are analyzed by calculating geometric deviation measures of behavior changes.

[0012] Preferably, the step S5 further comprises the following steps: S51, modeling normal user behavior data to form a distribution pattern of normal behavior; S52, modeling the current user behavior data to form a distribution pattern of the current behavior; S53. Measure the degree of deviation between the normal behavior distribution and the current behavior distribution to obtain a distribution difference result.

[0013] Preferably, in step S5, the distribution analysis is based on the joint distribution of multimodal features, and the importance weights of different modal features are adjusted by weighted adjustment to optimize the contribution of different modalities to the distribution deviation calculation, thereby improving the accuracy of the distribution difference.

[0014] Preferably, the step S6 further comprises the following steps: S61, comparing and analyzing the normal behavior distribution on different time scales with the current behavior distribution, and obtaining the distribution deviation degree on each time scale; S62, comparing and analyzing the normal behavior distribution at different spatial scales with the current behavior distribution, and obtaining the distribution deviation degree at each spatial scale; S63. Determine whether it is abnormal behavior by comprehensively considering the degree of deviation at multiple time and space scales.

[0015] The present invention provides a method for detecting abnormal user behavior based on spatiotemporal behavior feature data analysis. It has the following beneficial effects: 1. This invention uses manifold learning technology to achieve nonlinear dimensionality reduction of high-dimensional spatiotemporal behavior feature data, and uses manifold regularization constraints to ensure that the local geometric structure of the data is preserved during the dimensionality reduction process. Compared with traditional methods, it effectively reduces the computational complexity and significantly improves the accuracy of feature expression, providing high-quality input for subsequent analysis.

[0016] 2. The present invention builds a dynamic evolution model of user behavior by combining the multi-scale characteristics of time and space. It uses sliding window technology to capture short-term dynamic changes, and extracts the dynamic characteristics of user trajectories through multi-level spatial analysis. At the same time, it uses Riemannian geometry curvature analysis to enhance the ability to describe complex behavior patterns.

[0017] 3. The present invention introduces the optimal transmission theory and uses the Wasserstein distance to accurately measure the degree of deviation between normal behavior and current behavior distribution. At the same time, it combines multi-scale distribution analysis and dynamic threshold adjustment mechanism to effectively adapt to the long-term changes in user behavior and significantly improve the robustness and accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a flow chart of the method steps of the present invention; Figure 2 It is a flow chart of the manifold learning dimensionality reduction steps of the present invention; Figure 3 It is a schematic diagram of the local dynamic change mode of the present invention; Figure 4 The step flow chart of expanding step S5 of the present invention; Figure 5 The step flow chart of expanding step S6 of the present invention; Figure 6 The step flow of step S2 of the present invention is expanded. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the specification of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Please see attached Figure 1 The embodiment of the present invention provides a method for detecting abnormal user behavior based on spatiotemporal behavior feature data analysis, comprising the following steps: S1. Data collection: obtaining users’ spatiotemporal behavior feature data; S2, data preprocessing: preprocess the spatiotemporal behavior feature data, extract the spatiotemporal behavior features, and form a multimodal feature matrix; S3, feature dimensionality reduction: Based on the manifold learning method, the multimodal feature matrix is ​​reduced in dimension, a low-dimensional manifold space is constructed, and the local geometric relationship of the original data is maintained; S4. Dynamic modeling: In low-dimensional manifold space, the local dynamic change pattern of user behavior is characterized through Riemannian geometry analysis; S5. Distribution analysis: Based on the optimal transmission theory, calculate the deviation between the normal user behavior distribution and the current user behavior distribution; S6. Abnormality judgment: Compare the degree of deviation with the preset threshold to determine whether it is abnormal user behavior.

[0021] Specifically, the present invention provides an abnormal user behavior detection method based on spatiotemporal behavior feature data analysis, which obtains the user's spatiotemporal behavior feature data and combines manifold learning, Riemann geometry analysis and optimal transmission theory to achieve accurate detection of abnormal user behavior. Specifically, it includes the following steps: First, obtain the user's spatiotemporal behavior feature data, which consists of time features, spatial features, and user behavior features. Time features include the time point, time interval, and periodicity of the behavior; spatial features include the user's geographic location, movement trajectory, and location dwell time; and user behavior features include the type of accessed resources and device usage. Data is collected in real time through user devices or system logs and then enters the data preprocessing module. The preprocessing process includes missing value completion, outlier removal, and feature normalization to ensure the integrity and consistency of the features. Feature normalization can use the Min-Max standardization method to map feature values ​​to a unified numerical range, laying the foundation for subsequent analysis.

[0022] After completing data preprocessing, the feature dimensionality reduction step is entered. The present invention adopts a manifold learning method to reduce the dimensionality of the multimodal feature matrix and construct a low-dimensional manifold space to maintain the local geometric relationship of the data. Specifically, a neighborhood relationship matrix is ​​constructed by calculating the similarity between sample points, and a Laplace matrix is ​​generated based on the matrix to describe the local connectivity of the sample points on the manifold. In the process of dimensionality reduction, a manifold regularization constraint is introduced to ensure that the geometric relationship of the sample points in the neighborhood remains unchanged, thereby eliminating redundant and noise features in high-dimensional data and generating a low-dimensional feature representation.

[0023] The low-dimensional manifold space after dimensionality reduction is used for dynamic modeling and analyzing the changing patterns of user behavior over time and space. This step defines the local distance on the manifold by constructing the Riemann metric to characterize the changing characteristics of user behavior. At the same time, the local deviation of user behavior is described by calculating the geometric change measure (such as Gaussian curvature) of user behavior on the embedded manifold. The sliding time window technology is used to segment user behavior to capture the short-term dynamic change characteristics of behavior, and the evolution trend of behavior is predicted through the time series analysis model. In the spatial dimension, the details of dynamic modeling are further enriched by analyzing the changing characteristics of user trajectories (such as movement speed and residence time).

[0024] Next, distribution analysis is performed. The present invention establishes a distribution model of normal user behavior and a distribution model of current user behavior, and measures the degree of distribution deviation between the two based on the optimal transmission theory. Specifically, the Wasserstein distance is used to calculate the difference between the normal behavior distribution and the current behavior distribution. The distance reflects the overall deviation of the current behavior relative to the normal behavior. For multimodal features, the present invention further introduces a modal weight adjustment mechanism to improve the accuracy of distribution analysis by weighted optimization of the contribution of different modal features to distribution deviation. In addition, for multi-scale analysis of distribution, multi-level modeling of time and space dimensions is adopted to calculate the degree of distribution deviation at each time and space scale, and these deviation degrees are combined to obtain the overall distribution difference result.

[0025] After obtaining the distribution difference result, the abnormality judgment step is entered. The present invention compares the distribution deviation degree with the preset threshold. When the deviation degree exceeds the threshold, the current behavior is determined to be abnormal behavior. The threshold can be dynamically adjusted according to the actual application scenario, for example, through statistical analysis based on historical data or setting an adaptive mechanism to adapt to long-term changes in user behavior patterns. In addition, the present invention combines the multi-scale analysis results and improves the robustness and accuracy of anomaly detection by weighted fusion of the deviation degree of time and space dimensions.

[0026] In summary, the present invention realizes efficient and accurate identification of complex user behaviors by combining dimensionality reduction, dynamic modeling, distribution analysis and anomaly detection of spatiotemporal feature data. The present invention is fully disclosed, enabling those skilled in the art to reproduce the technology based on the above content, and is applicable to multiple fields such as network security, traffic management and financial risk control.

[0027] In step S1, the spatiotemporal behavior feature numbers include: Temporal characteristics: the time point, time interval, and periodicity of the behavior; Spatial features: user’s geographical location, movement trajectory, and time spent at the location; Behavioral characteristics: the user's access resource types and device usage.

[0028] Specifically, the present invention relates to an abnormal user behavior detection method based on spatiotemporal behavior feature data analysis, wherein data collection is the basic link of the entire technical process. The quality of data collection directly determines the accuracy and reliability of subsequent analysis. In order to fully reflect the user behavior characteristics, the present invention collects multimodal feature data of time, space and user behavior, and combines different data sources and collection strategies to construct a comprehensive feature data set. The collected data not only covers the time and geographic information of user behavior, but also includes the device information accessed by the user and the contextual behavior pattern. Through the fusion of multimodal data, a more accurate foundation can be provided for subsequent feature analysis and behavior analysis.

[0029] It should be noted that the data collection in this step needs to meet the timeliness and integrity requirements of high-dimensional features, so a distributed data collection framework is used to support large-scale data processing. At the same time, in view of the inconsistency of data sources, the present invention designs a unified data format specification to ensure that data collected from different data sources can be seamlessly integrated.

[0030] In this embodiment, the user's spatiotemporal behavior feature data is mainly collected through user devices, log systems and external data sources. Specifically, the time features include the time point, time interval and periodicity of the behavior; the spatial features include the user's geographical location, movement trajectory and stay area; the behavior features include the type of resources accessed by the user, device information and operation mode.

[0031] As an implementation method, the collection of time feature data is achieved by recording the timestamps of user operations to generate a series of time series data. For example, the login time, request time, and exit time of a user accessing the system can be used as basic time feature data. By calculating the time interval between adjacent operations, the time interval characteristics of user behavior can be further extracted to analyze the periodic characteristics in the behavior pattern.

[0032] In some embodiments, spatial feature data is collected through geographic location services (such as GPS) or network positioning technology. For example, the GPS data of a user's mobile device can record longitude and latitude information, and resolve the user's approximate location in combination with the network IP address. Specifically, the system continuously collects the user's geographic location, generates the user's movement trajectory, and calculates the speed and residence time of its location change. These features help describe the user's behavior distribution pattern in the spatial dimension.

[0033] It should be noted that there may be noise data in the process of spatial feature collection, such as GPS positioning errors or discontinuous trajectory points. The present invention filters out abnormal points by setting a position deviation threshold and uses interpolation to fill in missing trajectory points to ensure the accuracy and continuity of the collected data.

[0034] As an option, data collection of user behavior characteristics is based on access logs and device information. For example, behavior characteristics may include the type of resources accessed by the user (such as web pages, files, or applications), and the type of operating device (such as mobile phones, tablets, or computers). In addition, the frequency of user device switching can also be recorded to analyze the user's cross-device behavior patterns. For example, when a user frequently switches between different devices to access the system, the consistency and abnormality of their behavior can be further analyzed.

[0035] In a possible implementation, the present invention performs a unified formatting process on multimodal data. Specifically, time features are stored in timestamp format, spatial features are stored in latitude and longitude coordinates and time tags, and behavioral features are stored in structured data of user session records. Through this standardized process, the complexity of data preprocessing can be effectively reduced, providing clear data input for subsequent steps.

[0036] In order to ensure the timeliness of spatiotemporal feature data, the present invention adopts a distributed data collection architecture. As an example, the system can realize real-time transmission of data streams through message queue technologies such as Apache-Kafka, and archive historical data in combination with a distributed storage system (such as HDFS). Through this architectural design, it can support large-scale concurrent data collection needs.

[0037] In some possible implementations, the present invention designs a fault-tolerant mechanism for data collection. It should be noted that the user device may have incomplete data collection due to network interruption or device abnormality. The present invention can automatically complete the missing data collection operation after the data source is restored by introducing a retry mechanism and a cache strategy.

[0038] In the specific implementation process, the present invention also supports integrity verification of collected data. For example, by calculating whether the sampling interval of the time series data meets the preset standard, it is possible to quickly detect whether there is data loss or duplication during the collection process.

[0039] It is understandable that the collection of spatiotemporal behavior feature data is the starting point and foundation of the anomaly detection process. Ensuring the accuracy, timeliness and completeness of data collection can significantly improve the analysis efficiency and detection effect of subsequent steps. The data collection solution of the present invention has wide applicability in the fields of network security, traffic analysis and user behavior modeling, and provides a reliable data foundation for abnormal behavior detection.

[0040] Please see attached Figure 6 , step S2 further comprises the following steps: S21, completing missing values ​​in spatiotemporal behavior feature data; S22, removing outliers in time and space characteristics; S23. Normalize the numerical range of the behavioral features to ensure that the features are within the same scale.

[0041] Specifically, in the present invention, data preprocessing is an important step to normalize, structure and clean the collected spatiotemporal behavior feature data, and its purpose is to provide high-quality input data for subsequent feature analysis, dynamic modeling and anomaly detection. Through data preprocessing, the integrity and consistency of the data can be effectively improved, while reducing the interference of feature noise on the detection results. The main tasks of data preprocessing include missing value completion, outlier removal, feature normalization and data format conversion, and different processing methods are adopted for different attributes of time, space and behavior characteristics. It should be noted that this step combines contextual information when processing data to ensure that the processed data can retain the original characteristics of the spatiotemporal characteristics and meet the input requirements of subsequent algorithms.

[0042] In this embodiment, the preprocessing for time features includes normalization of timestamp data and time interval calculation. Specifically, data in timestamp format is usually recorded in milliseconds or seconds. In order to ensure the consistency of processing, this embodiment converts the timestamp into the ISO-8601 standard format, such as "YYYY-MM-DD, HH:MM:SS". This standardized format facilitates subsequent time interval calculation and periodic analysis.

[0043] As an option, the present invention generates time interval feature data of user behavior by calculating the difference between consecutive timestamps. For example, the time interval between user login and operation can be used to analyze the regularity or burstiness of user behavior. In addition, the time series data can be divided into segments of fixed length by the time window method to form short-term dynamic features of behavior.

[0044] In the preprocessing process of spatial features, this embodiment performs denoising and completion operations on geographic location data. It should be noted that GPS data may produce abnormal values ​​due to signal interference or equipment problems, such as sudden jumps in longitude and latitude coordinates or discontinuous trajectory points. Specifically, the present invention uses a threshold filtering method to remove coordinate points that exceed a preset error range. For example, when the distance between adjacent points exceeds a reasonable range (such as 500 meters), the point will be marked as an abnormal point and processed.

[0045] As a possible implementation method, the present invention uses linear interpolation to fill in the missing points of the trajectory data. For example, when the time interval between two points in the user's trajectory is too long or the position span is large, the system will insert a virtual position point based on the time difference and distance difference between the two previous and next position points, thereby generating continuous trajectory data.

[0046] In the preprocessing of behavioral features, the present invention normalizes and structures multimodal features. Exemplarily, the resource types accessed by users are stored in a discrete form, such as "webpage", "file" or "application", and converted into numerical features through the One-Hot encoding method for subsequent analysis. In addition, the user's device type (such as "mobile phone", "tablet" or "computer") is also encoded in a similar manner to enhance the computability of the features.

[0047] In order to improve the comparability between different features, the present invention performs normalization on numerical features. Specifically, the normalization operation maps the feature value to the range of [0,1], and the normalization formula is as follows:

[0048] Among them, x' is the normalized eigenvalue, x is the original eigenvalue, and x min and x max are the minimum and maximum values ​​of the eigenvalues, respectively. In this way, the influence of large differences in the eigenvalue range on subsequent models can be avoided.

[0049] As an extension, in the normalization of time features and spatial features, the present invention further considers the periodicity of features. For example, for the periodic processing of time features, time can be mapped to a two-dimensional circular coordinate system and represented as:

[0050] in, is the sinusoidal mapping value of the time feature, t is the current time point, is the cosine mapping value of the time feature, and T is the period length. This representation can preserve the periodicity of the time feature and avoid the boundary problem of simple numerical normalization.

[0051] It should be noted that, in some embodiments, data preprocessing also includes conversion of the original data format. As an implementation, the present invention uses JSON or Parquet format to store processed data, which is compatible with distributed storage systems (such as HDFS) and supports efficient transmission of large-scale data.

[0052] It is understandable that data preprocessing is a key step in subsequent analysis, and its purpose is to improve data availability and consistency while ensuring data integrity. The preprocessing process of the present invention provides high-quality input data for subsequent manifold learning dimensionality reduction and dynamic modeling through a differentiated approach for different feature types. Through the above description, those skilled in the art can reproduce the preprocessing steps of the present invention based on the disclosed content and apply them to complex spatiotemporal behavior analysis scenarios.

[0053] Please see attached Figure 2 In step S3, manifold learning dimensionality reduction includes the following steps: S31, calculate the similarity of sample points in the spatiotemporal behavior feature data, build a neighborhood structure, and represent the local relationship between samples; S32, constructing a feature matrix related to the neighborhood structure to characterize the geometric characteristics between samples; S33. Based on the constructed feature matrix, the data is subjected to dimensionality reduction processing to obtain a low-dimensional embedding representation that maintains geometric relationships.

[0054] In step S3, the dimensionality reduction process maintains the geometric relationship of sample points in the neighborhood by introducing manifold regularization constraints. The constraints include constructing a similarity matrix of local sample points and minimizing the relative error after projection of the sample points.

[0055] Specifically, the feature dimensionality reduction step of the present invention aims to map high-dimensional spatiotemporal behavior feature data to low-dimensional space through nonlinear dimensionality reduction technology while maintaining the local geometric relationship of the data. Since user behavior characteristics have complex high-dimensional distribution, directly processing high-dimensional data may lead to excessive computational complexity and introduce redundant or noisy features. Through manifold learning methods, high-dimensional data can be embedded into low-dimensional manifold space, while reducing the data dimension and retaining the core characteristics of user behavior. This step provides efficient and accurate low-dimensional data representation for subsequent dynamic modeling and anomaly detection.

[0056] It should be noted that manifold learning assumes that user behavior feature data is distributed on an implicit low-dimensional manifold, and generates a low-dimensional representation that can reflect the global data structure by constructing local similarity relationships between sample points. The present invention introduces manifold regularization constraints in the dimensionality reduction process to ensure that the reduced dimensionality data can retain the geometric structure of the neighborhood sample points.

[0057] In this embodiment, the similarity of sample points in the spatiotemporal behavior feature data is first calculated to construct a neighborhood structure to represent the local relationship between samples. Specifically, the similarity measure is calculated using a Gaussian kernel function, which is defined as follows:

[0058] Among them, N(X i ) represents the sample x i Neighborhood set, σ is the Gaussian kernel bandwidth parameter, is the Euclidean distance between sample points, x i , x j is the feature vector of the sample point. It should be noted that the neighborhood set can be determined by the k-nearest neighbor algorithm, and the number of neighborhood sample points k is a preset parameter used to control the local range of the neighborhood.

[0059] As an option, the similarity matrix W can be further standardized to eliminate the unevenness of data distribution. Specifically, the similarity value of each sample point can be normalized so that:

[0060] Among them, W ij ’ is the standardized similarity weight value, W ij is the original similarity weight value, is the sample point x i The sum of the similarity weights of all adjacent sample points. This standardization operation can improve the robustness of the dimensionality reduction process.

[0061] After constructing the similarity matrix, the present invention further generates a Laplace matrix L to describe the local connectivity of the sample points on the manifold. Specifically, the Laplace matrix is ​​defined as: L=DW, where D is the degree matrix and W is the similarity matrix. The eigenvalues ​​and eigenvectors of the Laplace matrix can reflect the global distribution characteristics of the sample points in the low-dimensional space.

[0062] As an implementation method, the present invention obtains the feature representation after dimensionality reduction by minimizing the following objective function:

[0063] in, is the dimension reduction objective function value, F represents the feature matrix after dimension reduction, tr is the matrix trace operator, is the transpose of the feature matrix F. By performing eigendecomposition on the Laplacian matrix, the eigenvectors corresponding to the smallest d eigenvalues ​​are taken as the low-dimensional embedding result F, where d is the target dimension of the low-dimensional space.

[0064] In some embodiments, the present invention introduces manifold regularization constraints in the dimensionality reduction process to enhance the ability to preserve neighborhood geometric relationships. Specifically, the regularization objective function is as follows:

[0065] Among them, f represents the mapping function of the data point, λ is the regularization strength parameter, is the Hilbert space where the function f is located, is the norm of function f in Hilbert space, λ is the regularization strength parameter, W ij is the similarity weight between sample points, x i , x j is the feature vector of the sample point.

[0066] By optimizing this objective function, data deformation in the dimensionality reduction process can be effectively reduced while enhancing the retention of local geometric structures.

[0067] It should be noted that the present invention supports nonlinear mapping of high-dimensional features and improves the flexibility of dimensionality reduction by introducing the kernel function method. Exemplarily, the kernel principal component analysis (KPCA) method is used to map the original feature space to a high-dimensional kernel space, and then the manifold learning operation is performed in the kernel space. The kernel function can be a Gaussian kernel, a polynomial kernel, or a Sigmoid kernel to adapt to different types of feature distributions.

[0068] In one possible implementation, the low-dimensional manifold representation after dimensionality reduction contains the main structural information of user behavior characteristics and significantly reduces the dimensionality of the original data. The dimensionality reduction result can be used as input for subsequent dynamic modeling and anomaly detection. For example, the trajectory data after dimensionality reduction can be used to analyze the user's movement patterns, while the low-dimensional representation of the time feature data can reveal the periodic pattern of behavior.

[0069] It is understandable that feature dimensionality reduction is an important part of the present invention to achieve efficient anomaly detection. By reducing the data dimension and retaining the core characteristics, a simplified and accurate data representation is provided for subsequent steps. The dimensionality reduction method combines the Laplace eigenmap and manifold regularization, which not only ensures the geometric relationship of the local neighborhood, but also enhances the adaptability to complex behavioral characteristics. The disclosure of the above technical details enables those skilled in the art to perform a complete technical reproduction based on the content of the present invention and apply it to the processing scenarios of large-scale spatiotemporal behavioral data.

[0070] Please see attached Figure 3 ,In step S4, the local dynamic change modes include: S41. Construct a local metric on a low-dimensional manifold space to characterize the changing characteristics of user behavior in a local area. S42. Calculate the degree of change of user behavior data in the low-dimensional manifold space to describe the dynamic evolution of the behavior; S43. Based on the abnormality judgment index of the degree of change, mark the potential abnormal points in the user behavior.

[0071] In step S4, dynamic modeling is combined with time sliding window technology to segment user behavior data to capture the short-term and long-term characteristics of behavior changes over time, and analyze abnormal feature points by calculating the geometric deviation measure of behavior changes.

[0072] Specifically, in the present invention, dynamic modeling is a key step in modeling the spatiotemporal behavior of low-dimensional manifold feature data after dimensionality reduction. By constructing the dynamic change pattern of user behavior, the evolution characteristics of behavior over time and space are analyzed. This step uses Riemann geometry theory and sliding window technology to extract dynamic change characteristics from the local geometric relationship of user behavior and characterize the potential trend of abnormal behavior. Through segmented modeling of the time dimension and the space dimension, the present invention can capture short-term anomalies in user behavior, while using the global characteristics of behavior to improve the robustness of modeling. It should be noted that the results of dynamic modeling not only provide input for subsequent distribution analysis, but can also be directly used for auxiliary judgment of anomaly detection.

[0073] In this embodiment, a local metric of user behavior is first constructed on a low-dimensional manifold space to characterize the changing characteristics of the behavior data. Specifically, the Riemann metric g ij is defined as:

[0074] Among them, g ij is the metric tensor of the manifold, ds 2 is the local distance element on the manifold, indicating the local distance between two sample points in the low-dimensional manifold space, dx i dx j The small change in the i-th and j-th dimensions in the feature space reflects the local geometric relationship of the sample points in the low-dimensional manifold space. As an implementation method, g ij It can be derived through the inner product or similarity matrix of the sample points in the original feature space to ensure that the geometric structure in the low-dimensional space is consistent with the original space.

[0075] After constructing the metric, the present invention further describes the local dynamic characteristics of user behavior by calculating the curvature of user behavior data in the low-dimensional manifold space. It should be noted that Gaussian curvature K is an important measure for characterizing the local geometric properties of manifolds, which is defined as:

[0076] Where Hess(f) is the Hessian matrix on the embedded manifold, Represents the norm of the gradient. By calculating the Gaussian curvature value of each sample point, it is possible to identify areas where significant changes occur on the manifold, which usually correspond to potential abnormal points in user behavior.

[0077] As an option, the present invention combines the sliding time window technology to model user behavior in time segments. Specifically, user behavior data is segmented according to a fixed time length (such as 5 minutes, 1 hour or 1 day), and the curvature and change trend of each time slice are calculated independently. For example, a user's access behavior in a day can be divided into multiple time periods. By calculating the dynamic characteristics of these time periods respectively, abnormal behavior in a specific time period can be identified.

[0078] It should be noted that the present invention also takes into account the multi-scale characteristics of behavioral data in time. In some embodiments, the length of the time window can be gradually increased in a recursive manner, for example, from minutes to hours and days, to capture the long-term evolution pattern in user behavior. This multi-scale time modeling helps to take into account both short-term fluctuations and long-term trends when detecting anomalies.

[0079] In the spatial dimension, this embodiment extracts the dynamic characteristics of the trajectory data by analyzing the user's movement trajectory. For example, by calculating the user's speed and acceleration between consecutive position points, the user's behavior change pattern in space can be reflected. Specifically, for the trajectory point sequence {p1, p2…, p n}, its speed v i and acceleration a i They are defined as:

[0080] Among them, a i is the speed of the i-th trajectory, ∆t is the time interval between adjacent trajectory points, and p i+1 -p i are continuous position points in the user trajectory, is the distance between consecutive location points. By analyzing the distribution of speed and acceleration, we can further identify whether the user has abnormal movement patterns, such as sudden large movements or frequent location changes in a short period of time.

[0081] As a possible implementation, the present invention also combines a spatial division strategy in dynamic modeling, dividing user behavior into three spatial ranges: local, regional, and global according to the level of geographical location. For each spatial range, the geometric change characteristics of user behavior are calculated independently. For example, the local range can analyze the distribution of user's residence time in a specific location, while the global range can analyze the user's behavior pattern across multiple geographical regions in a short period of time.

[0082] It should be emphasized that the results of dynamic modeling can be directly used for the classification and judgment of behavior. For example, when the Gaussian curvature value of user behavior in a certain time period is significantly higher than that in other time periods, the time period can be preliminarily marked as a candidate area for abnormal behavior. In addition, high acceleration points in trajectory data can also be used as trigger conditions for potential anomalies, providing further verification basis for subsequent distribution analysis.

[0083] It is understandable that dynamic modeling is an important part of the present invention for detecting complex user behaviors. By extracting the dynamic change characteristics of user behaviors from the time and space dimensions, it provides rich feature inputs for subsequent distribution analysis and anomaly detection. The dynamic modeling method of the present invention combines manifold geometry analysis and multi-scale time window technology, and has strong adaptability and robustness. The disclosure of the above content enables those skilled in the art to perform complete technical reproduction based on the present invention.

[0084] Please see attached Figure 4 , step S5 further comprises the following steps: S51, modeling normal user behavior data to form a distribution pattern of normal behavior; S52, modeling the current user behavior data to form a distribution pattern of the current behavior; S53. Measure the degree of deviation between the normal behavior distribution and the current behavior distribution to obtain a distribution difference result.

[0085] In step S5, the distribution analysis is based on the joint distribution of multimodal features. By weighted adjustment of the importance weights of different modal features, the contribution of different modalities to the distribution deviation calculation is optimized, thereby improving the accuracy of distribution differences.

[0086] Specifically, the distribution analysis step of the present invention aims to quantify the degree of deviation between the normal behavior distribution and the current behavior distribution by establishing a mathematical model, thereby providing a basis for anomaly detection. Distribution analysis introduces the Optimal-Transport-Theory, uses the Wasserstein distance to accurately measure the distribution difference, and combines the characteristics of multimodal data to further optimize the accuracy and robustness of distribution modeling. It should be noted that the results of the distribution analysis directly affect the performance of subsequent anomaly judgment. Therefore, the goal of this step is to provide stable distribution deviation results through strict distribution construction and efficient difference measurement.

[0087] In this embodiment, normal user behavior data is first modeled to form a reference distribution P. Specifically, the normal user behavior distribution is obtained through historical data statistics. Assume that the data sample {x1, x2…, x N} represents the feature set of normal behavior, then P can be defined as the joint probability distribution of these samples:

[0088] Where δ represents the Dirac function, which is used to describe the position distribution of the sample points. P(x) is the probability distribution function of the sample points, which is used to describe the distribution of the sample points in the feature space. N is the total number of sample points. x is any point in the feature space. i is the position of the i-th sample point in the feature space. As a possible implementation, the distribution P can be further smoothed by kernel density estimation to obtain a continuous distribution model. The formula for kernel density estimation is:

[0089] in, is the smooth distribution function obtained by kernel density estimation, N is the total number of sample points, h is the bandwidth parameter of kernel density estimation, which is used to control the degree of smoothness, K is the kernel function, x is any point in the feature space, and x i is the position of the i-th sample point in the feature space.

[0090] In a possible implementation, in order to improve the efficiency of Wasserstein distance calculation, the present invention introduces the Sinkhorn distance algorithm. By introducing a regularization term, the Sinkhorn distance transforms the optimization problem of joint distribution into an efficient solution problem of matrix product, and its calculation formula is:

[0091] Among them, W λ (P,Q) is the Sinkhorn distance, which is used to describe the regularized Wasserstein distance between distributions P and Q. P and Q are two probability distributions, representing the normal behavior distribution and the current behavior distribution, respectively. Inf is the operator that takes the minimum value, which means finding the optimal joint distribution. γ is the joint distribution of P and Q, which is used to describe the matching relationship between the two distributions. is the set of all possible joint distributions, satisfying the marginal distributions P and Q respectively, is the square of the Euclidean distance between sample points x and y, is the Cartesian product of the feature space, representing the combined space of all sample point pairs, λ is the regularization strength parameter, which is used to control the sensitivity of the Sinkhorn distance to the regularization term, and KL(γ) is the KL divergence of the joint distribution γ, which is used to represent the regularization constraint.

[0092] It should be noted that the present invention also optimizes the multi-scale characteristics of distribution analysis. In some embodiments, distributions P and Q are decomposed into multiple sub-distributions according to the time scale and the spatial scale. For example, the time scale can be divided into minute, hour and day levels, and the spatial scale can be divided into local areas, city ranges and transnational areas. For each sub-distribution, the Wasserstein distance is calculated separately, and the overall distribution difference is obtained by weighted summation.

[0093] In some implementations, the present invention further introduces a modal weight adjustment mechanism to optimize the contribution of multimodal features to distribution analysis. For example, the modal weights can be dynamically adjusted by feature importance analysis based on historical data, thereby improving the accuracy of distribution difference calculation.

[0094] It is understandable that distribution analysis is a core step in the anomaly detection process, which provides a quantitative basis for anomaly judgment by modeling the distribution and measuring the difference between normal behavior and current behavior. The present invention combines Wasserstein distance, multi-scale modeling and modal weight adjustment technology in the distribution analysis process, with high accuracy and robustness. The above-mentioned technology is fully disclosed, which can ensure that those skilled in the art can fully implement the distribution analysis step according to the content of the present invention and apply it to complex spatiotemporal behavior detection scenarios.

[0095] Please see attached Figure 5 , step S6 further comprises the following steps: S61, comparing and analyzing the normal behavior distribution on different time scales with the current behavior distribution, and obtaining the distribution deviation degree on each time scale; S62, comparing and analyzing the normal behavior distribution at different spatial scales with the current behavior distribution, and obtaining the distribution deviation degree at each spatial scale; S63. Determine whether it is abnormal behavior by comprehensively considering the degree of deviation at multiple time and space scales.

[0096] Specifically, the abnormal judgment step of the present invention is the final decision-making link based on the distribution analysis results. Its core is to determine whether the current user behavior is abnormal by combining the degree of deviation between the normal user behavior distribution and the current user behavior distribution. By comparing the distribution deviation degree with the preset threshold, it is possible to effectively determine whether the behavior exceeds the normal range, thereby identifying potential abnormal behavior. It should be noted that the abnormal judgment process not only relies on the quantitative results of the distribution difference, but also combines multimodal features, multi-scale distribution analysis, and dynamic threshold adjustment technologies to ensure the accuracy and robustness of the judgment results.

[0097] In this embodiment, the abnormality judgment is based on the measurement result of the distribution deviation, and the difference between the normal distribution P and the current distribution Q is mainly characterized by the distribution difference W(P,Q) calculated by the Wasserstein distance. It should be noted that W(P,Q) is the core quantitative indicator of the degree of deviation of the behavior distribution. The larger its value is, the higher the degree to which the current behavior deviates from the normal behavior.

[0098] As an implementation method, when W(P,Q) exceeds a set threshold ∈, the system will determine that the current behavior is abnormal. The setting of the threshold ∈ can be based on statistical analysis of historical data. For example, by calculating the distribution of the Wasserstein distance of normal behavior and setting a certain confidence interval, a suitable threshold can be determined. Specifically, the threshold can be expressed as:

[0099] Among them, μ w and σ w are the mean and standard deviation of the Wasserstein distance, k is a parameter that controls the abnormal range, and ∈ is the threshold for abnormal behavior detection.

[0100] In a possible implementation, the present invention further combines the results of multi-scale distribution analysis to improve the robustness of anomaly judgment by integrating the distribution differences in time and space dimensions. Specifically, the distribution deviation results on the time scale and space scale are used for multi-scale anomaly judgment. When the comprehensive deviation exceeds the preset threshold ∈, the behavior is judged to be abnormal. The multi-scale anomaly judgment formula is:

[0101] Among them, W multi (P,Q) is the deviation value of multi-scale distribution, T, L is the number of time scale and space scale, α t ,β l is the weight factor of time and space scale, W(P t ,Q t ) is the Wasserstein distance on the time scale, W(P l ,Q l ) is the Wasserstein distance on the spatial scale.

[0102] As an option, for different modes of behavioral features, the present invention designs a modality weighting mechanism so that abnormal judgment can give higher weights to key modes. For example, in some application scenarios, time features may be more important than spatial features. You can increase the weight of the time mode by α t To strengthen the influence of time features. It should be noted that the modal weight can be determined by analyzing the importance of features of historical data, thereby optimizing the accuracy of anomaly judgment.

[0103] In some embodiments, the present invention adopts a dynamic threshold adjustment mechanism to adapt to the long-term changes in user behavior patterns. Specifically, the dynamic threshold adjustment is based on the statistical distribution of the Wasserstein distance in the time window, and the threshold ∈ is updated periodically. For example, at the end of each time window, the mean and standard deviation of the Wasserstein distance are recalculated, and the threshold range of the next cycle is adjusted accordingly. This dynamic adjustment mechanism can effectively cope with the gradual changes in user behavior and reduce the misjudgment rate.

[0104] It should be noted that the abnormal judgment step of the present invention also supports the hierarchical judgment of abnormal behavior. For example, when the distribution deviation degree W(P,Q) is within a lower threshold range, it can be marked as "mild abnormality" to prompt the system to conduct further observation; when the deviation degree exceeds a higher threshold, it is directly marked as "serious abnormality" to trigger the system's alarm or intervention mechanism.

[0105] In one possible implementation, the abnormal judgment result can be verified in combination with the curvature analysis result of dynamic modeling. For example, when the Gaussian curvature K and the Wasserstein distance W(P,Q) exceed the threshold at the same time, the reliability of abnormal behavior judgment can be significantly improved. In addition, the present invention can also further verify the rationality of abnormal behavior in combination with the speed and acceleration characteristics in the trajectory data. For example, if the Wasserstein distance is high but there is no obvious abnormality in the trajectory characteristics, the abnormal marking of the behavior can be postponed.

[0106] It is understandable that anomaly judgment is the final decision-making link of the present invention, and its core lies in converting the distribution deviation results into clear abnormal behavior judgments. The present invention achieves efficient and accurate judgment of complex user behaviors by combining Wasserstein distance, multi-scale analysis, modal weighting and dynamic threshold adjustment technology. The above technical content is fully disclosed to ensure that those skilled in the art can perform complete technical reproduction according to the present invention and apply it to various spatiotemporal behavior anomaly detection scenarios.

[0107] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting abnormal user behavior based on spatiotemporal behavior feature data analysis, characterized in that: The following steps are involved: S1. Data collection: obtaining users’ spatiotemporal behavior feature data; S2, data preprocessing: preprocessing the spatiotemporal behavior feature data, extracting spatiotemporal behavior features, and forming a multimodal feature matrix; S3, feature dimensionality reduction: Based on the manifold learning method, the multimodal feature matrix is ​​reduced in dimension, a low-dimensional manifold space is constructed, and the local geometric relationship of the original data is maintained; S4, dynamic modeling: in the low-dimensional manifold space, the local dynamic change pattern of user behavior is characterized by Riemannian geometry analysis; S5. Distribution analysis: Based on the optimal transmission theory, calculate the deviation between the normal user behavior distribution and the current user behavior distribution; S6. Abnormality determination: Compare the degree of deviation with a preset threshold to determine whether it is abnormal user behavior.

2. According to claim 1, the abnormal user behavior detection method based on spatiotemporal behavior feature data analysis is characterized in that: In the step S1, the spatiotemporal behavior feature numbers include: Temporal characteristics: the time point, time interval, and periodicity of the behavior; Spatial features: user’s geographical location, movement trajectory, and time spent at the location; Behavioral characteristics: the user's access resource types and device usage.

3. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: The S2 step further comprises the following steps: S21, completing missing values ​​in spatiotemporal behavior feature data; S22, removing outliers in time and space characteristics; S23. Normalize the numerical range of the behavioral features to ensure that the features are within the same scale.

4. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: In the step S3, the manifold learning dimensionality reduction includes the following steps: S31, calculate the similarity of sample points in the spatiotemporal behavior feature data, build a neighborhood structure, and represent the local relationship between samples; S32, constructing a feature matrix related to the neighborhood structure to characterize geometric characteristics between samples; S33. Based on the constructed feature matrix, the data is subjected to dimensionality reduction processing to obtain a low-dimensional embedding representation that maintains geometric relationships.

5. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: In the step S3, the dimension reduction process maintains the geometric relationship of the sample points in the neighborhood by introducing manifold regularization constraints, wherein the constraints include constructing a similarity matrix of local sample points and minimizing the relative error after the sample points are projected.

6. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: In the step S4, the local dynamic change mode includes: S41. Construct a local metric on a low-dimensional manifold space to characterize the changing characteristics of user behavior in a local area. S42. Calculate the degree of change of user behavior data in the low-dimensional manifold space to describe the dynamic evolution of the behavior; S43. Based on the abnormality judgment index of the degree of change, mark the potential abnormal points in the user behavior.

7. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: In the S4 step, dynamic modeling is combined with time sliding window technology to segment user behavior data to capture short-term and long-term characteristics of behavior changes over time, and abnormal feature points are analyzed by calculating the geometric deviation measure of behavior changes.

8. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: The step S5 further comprises the following steps: S51, modeling normal user behavior data to form a distribution pattern of normal behavior; S52, modeling the current user behavior data to form a distribution pattern of the current behavior; S53. Measure the degree of deviation between the normal behavior distribution and the current behavior distribution to obtain a distribution difference result.

9. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1 is characterized in that: In the step S5, the distribution analysis is based on the joint distribution of multimodal features. The importance weights of different modal features are adjusted by weighting to optimize the contribution of different modalities to the distribution deviation calculation, thereby improving the accuracy of the distribution difference.

10. The abnormal user behavior detection method based on spatiotemporal behavior feature data analysis according to claim 1, characterized in that: The step S6 further comprises the following steps: S61, comparing and analyzing the normal behavior distribution on different time scales with the current behavior distribution, and obtaining the distribution deviation degree on each time scale; S62, comparing and analyzing the normal behavior distribution at different spatial scales with the current behavior distribution, and obtaining the distribution deviation degree at each spatial scale; S63. Determine whether it is abnormal behavior by comprehensively considering the degree of deviation at multiple time and space scales.

Images